IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › Security operations › September 2026 Edition

Vulnerability management platforms

Asked as “vulnerability management platform”, and as “vulnerability scanning and management tool”, on behalf of a mid-market B2B company. 44 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Rapid7 InsightVM
Clear leader
45% of first choices, clear leader.
ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessIntruder59%Clear leaderStanding →Mid-marketRapid7 InsightVM45%Clear leaderThis pageEnterpriseTenable Vulnerability Management25%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Rapid7 InsightVM45%8%36endorsed leader
02Intruder16%0%19accepted challenger
03ManageEngine Vulnerability Manager Plus9%0%14accepted challenger
04OpenVAS9%24%21accepted challenger
05Tenable Vulnerability Management7%0%18accepted challenger
06Microsoft Defender Vulnerability Management2%19%27accepted challenger
07Tenable Nessus2%33%12criticized challenger
Show the five products at 0%, ordered by negative rate
12Rapid70%38%13criticized challenger
11Qualys0%30%23criticized challenger
09Tenable0%24%25accepted challenger
10Wiz0%6%16accepted challenger
08Qualys VMDR0%4%24accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Rapid7 InsightVM vs IntruderRapid7 InsightVM vs ManageEngine Vulnerability Manager PlusIntruder vs ManageEngine Vulnerability Manager Plus

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative60%
Key
01Rapid7 InsightVM45%
02Intruder16%
03ManageEngine Vulnerability Manager Plus9%
04OpenVAS9%
05Tenable Vulnerability Management7%
06Microsoft Defender Vulnerability Management2%
07Tenable Nessus2%
08Qualys VMDR0%
09Tenable0%
10Wiz0%
11Qualys0%
12Rapid70%

02What they warned about

Nine of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Qualys
30%
7 of 23 labels negative · 5 of 12 models
“Enterprise tools like Qualys are notorious for charging modular add-on fees for basic things like external scanning” Gemini 3.5 Flash, direct prompt
Tenable
24%
6 of 25 labels negative · 5 of 12 models
“powerful, highly accurate, and standard for compliance, though they can sometimes feel overly complex for smaller teams” Gemini 3.5 Flash, scale prompt
Tenable Nessus
33%
4 of 12 labels negative · 4 of 12 models · 1 hard negative
“Buying a standalone scanner (like *Tenable Nessus Professional* ...) and trying to run an enterprise program with it... Why to avoid” Gemini 3.5 Flash, negative prompt
Microsoft Defender Vulnerability Management
19%
5 of 27 labels negative · 4 of 12 models
“can be attractive, but it tends to be more compelling as part of a broader Microsoft security stack than as a standalone best-of-breed VM choice” GPT-5.4 mini, direct prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

60 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 769 links across 213 sites, every framing counted. Ranked by the number of answers carrying the site or page.

axis-intelligence.com
32 answers · 32 citations · 9 models
vicarius.io
vendor site · Vicarius26 answers · 45 citations · 10 models
gartner.com
26 answers · 33 citations · 10 models
techrepublic.com
26 answers · 27 citations · 9 models
upguard.com
vendor site · UpGuard24 answers · 24 citations · 9 models
expertinsights.com
vendor site · Expert Insights20 answers · 23 citations · 9 models
riskwatch.com
vendor site · RiskWatch20 answers · 20 citations · 8 models
orca.security
vendor site · Orca17 answers · 18 citations · 8 models
cybervendorguide.com
16 answers · 16 citations · 8 models
technologymatch.com
13 answers · 13 citations · 6 models
tech-insider.org
12 answers · 23 citations · 6 models
comparitech.com
12 answers · 13 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

axis-intelligence.com/best-vulnerability-management-tools-tested
32 answers · 9 models
techrepublic.com/article/top-vulnerability-management-tools
26 answers · 9 models
gartner.com/reviews/market/vulnerability-assessment
23 answers · 9 models
upguard.com/blog/top-vendor-vulnerability-tools
22 answers · 8 models
riskwatch.com/vulnerability-management-software
20 answers · 8 models
expertinsights.com/security-operations/the-top-vulnerability-management-sol…
17 answers · 9 models
orca.security/resources/blog/best-vulnerability-management-tools
17 answers · 8 models
vicarius.io/articles/6-best-consolidated-vulnerability-management-platforms…
17 answers · 9 models
cybervendorguide.com/guides/vulnerability-management
16 answers · 8 models
technologymatch.com/blog/tenable-vs-qualys-vs-rapid7-vm-platform-comparison
13 answers · 6 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best vulnerability management platform for a mid-market B2B company?”Paraphrase“Which vulnerability scanning and management tool would you recommend to a mid-sized B2B company?”Comparative“What are the top vulnerability management platforms and how do they differ?”Budget-constrained“What is the best vulnerability management platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a vulnerability management platform. What should we look at?”Negative“Which vulnerability management platforms should I avoid or be cautious about?”
Claude Haiku 4.5Rapid7 InsightVM
Three alternativesAikido Security, ESET Vulnerability & Patch Management, UpGuard
against: Qualys VMDRRapid7 InsightVM, Tenable Nessus/SecurityCenterChangedTenable Vulnerability Management
Three alternativesQualys VMDR, Rapid7 InsightVM, Tanium
against: Microsoft Defender Vulnerability ManagementManageEngine Vulnerability Manager Plus
One alternativeOpenVAS
against: DefectDojono first choicenothing named
GPT-5.4 miniTenable Vulnerability Management
Two alternativesArctic Wolf, Qualys VMDR
against: Microsoft Defender Vulnerability ManagementTenable Vulnerability ManagementHeld
Two alternativesQualys, Tenable Nessus
no first choice
Four alternativesMicrosoft Defender Vulnerability Management, Qualys, Rapid7, Tenable
Tenable Nessus
Two alternativesMicrosoft Defender Vulnerability Management, OpenVAS
against: Rapid7 InsightVMno first choiceagainst: BeyondTrust Enterprise Vulnerability Management, Microsoft Defender Vulnerability Management, Rapid7 InsightVM, Trivy
Gemini 3.5 FlashVicarius vRx
Six alternativesCrowdStrike Falcon Exposure Management, Intruder, Microsoft Defender Vulnerability Management, Orca Security, Tenable Vulnerability Management, Wiz
against: QualysIntruderChanged
Four alternativesAikido Security, Orca Security, Rapid7 InsightVM, Wiz
Qualys, Tenable
Seven alternativesBrinqa, CrowdStrike Falcon Exposure Management, Microsoft Defender Vulnerability Management, Nucleus Security, Orca Security, Rapid7, Wiz
Intruder
Five alternativesDefectDojo, ManageEngine Vulnerability Manager Plus, OpenVAS, Panoptic Scans, Wazuh
no first choice
Seven alternativesAction1, Automox, CrowdStrike Falcon Spotlight, Ivanti Neurons for Vulnerability Management, Microsoft Defender Vulnerability Management, Orca Security, Wiz
against: Qualys, Rapid7, Tenableagainst: CrowdStrike Falcon Spotlight, Microsoft Defender for Endpoint, Qualys, Rapid7, Tenable, Tenable Nessus
Perplexity SonarRapid7 InsightVM
Three alternativesManageEngine Vulnerability Manager Plus, Microsoft Defender for Cloud, Vicarius vRx
Rapid7 InsightVMHeld
Four alternativesManageEngine Vulnerability Manager Plus, Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management / Nessus
Qualys VMDR, Rapid7 InsightVM, Tenable
Three alternativesCrowdStrike Falcon Spotlight / Exposure Management, Microsoft Defender Vulnerability Management, Wiz
Intruder, ManageEngine Vulnerability Manager Plus
Two alternativesOpenVAS, Trivy
no first choiceagainst: Automox, CrowdStrike, ManageEngine, Microsoft Defender Vulnerability Management, NinjaOne, Nuclei, OpenVAS, Qualys, Rapid7, SecPod SanerNow, Tenable, Trivy
Grok 4.1 FastRapid7 InsightVM
Three alternativesCrowdStrike Falcon Spotlight / Exposure Mgmt, Qualys VMDR, Tenable Vulnerability Management
Rapid7 InsightVMHeld
Three alternativesIntruder, Qualys VMDR, Tenable Vulnerability Management
against: Tenable NessusTenable
Four alternativesCrowdStrike, Qualys, Rapid7, Wiz
OpenVAS
Four alternativesIntruder, Nuclei, Qualys VMDR, Tenable Nessus
no first choiceagainst: Qualys VMDR/Exposure Management, Rapid7 InsightVM, Tenable Nessus / Tenable.io / Vulnerability Management
Mistral SmallRapid7 InsightVM
Two alternativesESET Vulnerability & Patch Management, UpGuard
Rapid7 InsightVMHeld
Two alternativesIntruder, ManageEngine Vulnerability Manager Plus
Tenable Vulnerability Management
Three alternativesOrca Security, Qualys VMDR, Rapid7 InsightVM
Intruder
Two alternativesGFI LanGuard, ManageEngine Vulnerability Manager Plus
against: Qualys, Tenableno first choiceagainst: CVETodo, GuardNest, RoboShadow
DeepSeek V4 FlashRapid7 InsightVM
Three alternativesMicrosoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
against: WizRapid7 InsightVMHeld
Four alternativesIntruder, ManageEngine Vulnerability Manager Plus, Qualys VMDR, Tenable
Qualys VMDR, Tenable
Five alternativesCrowdStrike Falcon Exposure Management, Microsoft Defender Vulnerability Management, Orca Security, Rapid7 InsightVM, Wiz
ManageEngine Vulnerability Manager Plus
Three alternativesIntruder, Microsoft Defender Vulnerability Management, OpenVAS
against: Qualys Community Edition, Rapid7no first choiceagainst: BeyondTrust Retina, Cisco Vulnerability Management, Microsoft Defender Vulnerability Management, OWASP ZAP, OpenVAS, Qualys, Rapid7 Nexpose, Tenable Nessus, Trivy
Llama 4 MaverickRapid7 InsightVMRapid7 InsightVMHeld
Two alternativesQualys VMDR, Tenable Vulnerability Management
no first choiceIntruder
Three alternativesDefectDojo, GFI LanGuard, ManageEngine Vulnerability Manager Plus
no first choicenothing named
Qwen 3.7 FlashRapid7 InsightVM
Three alternativesManageEngine Vulnerability Manager Plus, Qualys VMDR, Tenable Vulnerability Management
Rapid7 InsightVMHeld
Three alternativesArctic Wolf, ManageEngine Vulnerability Manager Plus, Tenable Vulnerability Management
Qualys, Rapid7, Tenable
Two alternativesIntruder, OpenVAS
Microsoft Defender Vulnerability Management
Three alternativesDeemkay, Lansweeper, ManageEngine Patch Manager Plus
against: OpenVASno first choiceagainst: Burp Suite, Iru Vulnerability Management, OWASP ZAP, Qualys, Rapid7, Tenable
Kimi K2Rapid7 InsightVM
Three alternativesMicrosoft Defender Vulnerability Management, Qualys VMDR, Tenable
Rapid7 InsightVMHeld
Two alternativesQualys VMDR, Tenable Vulnerability Management
Tenable
Five alternativesArctic Wolf, CrowdStrike Falcon Exposure Management, Qualys VMDR, Rapid7 InsightVM, Wiz
OpenVAS, Wazuh
Three alternativesIntruder, ManageEngine Vulnerability Manager Plus, Microsoft Defender Vulnerability Management
no first choiceagainst: Rapid7 Nexpose, Tenable Nessus
GLM 4.7 FlashXRapid7 InsightVM
Three alternativesMicrosoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
Rapid7 InsightVMHeld
Three alternativesESET Vulnerability & Patch Management, Qualys VMDR, Tenable Vulnerability Management
Qualys, Tenable
Three alternativesMicrosoft Defender for Cloud, Rapid7 InsightVM, Snyk
against: Palo Alto Networks Cortex XDRIntruder, ManageEngine Vulnerability Manager Plus, OWASP ZAP, OpenVAS
Three alternativesGFI LanGuard, Microsoft Defender Vulnerability Management, Semgrep
no first choicenothing named
MiniMax M2.5Rapid7 InsightVM
Four alternativesCisco Vulnerability Management, Orca Security, Tenable Vulnerability Management, Wiz
against: SentinelOneRapid7 InsightVM, Tenable Vulnerability ManagementChanged
One alternativeQualys VMDR
against: OpenVASTenable Vulnerability Management
Six alternativesCrowdStrike Falcon Exposure Management, ESET Vulnerability & Patch Management, Intruder, Microsoft Defender Vulnerability Management, Qualys VMDR, Rapid7 InsightVM
Intruder, OpenVASagainst: OpenVASno first choiceagainst: Rapid7 Nexpose, Tenable
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:22yes1411 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:34yes25 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:48yes2224 s
Direct recommendationPerplexity Sonarsonar2026-09-17 07:38yes205 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:23yes3016 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 07:43yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:38yes614 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:30yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:47yes1045 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:22yes1339 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:41yes1279 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:48no051 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:26no06 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:30yes45 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:36yes721 s
ParaphrasePerplexity Sonarsonar2026-09-17 07:39yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:21yes1610 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 07:40yes55 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:47yes99 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:47yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:34yes542 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:39yes1022 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:31yes1840 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:41no010 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:45yes1212 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:34yes512 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:40yes1727 s
ComparativePerplexity Sonarsonar2026-09-17 07:35yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:35yes3416 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 07:25yes77 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:43yes1419 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:35yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:45yes1033 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:40yes1563 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:40no015 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:33yes927 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:35yes178 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:40no05 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:37yes1824 s
Budget constrainedPerplexity Sonarsonar2026-09-17 07:25yes204 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:26yes4116 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:28yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:37yes1814 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:34yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:35no048 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:30yes1021 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:46yes1388 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:26yes517 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:21no08 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:43no010 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:37no016 s
Scale constrainedPerplexity Sonarsonar2026-09-17 07:33yes208 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:48yes1911 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:42no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:29yes1223 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:44yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:46no048 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:48yes1275 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:48yes1361 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:30no010 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:37yes3612 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:40yes48 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:35yes1321 s
Negative framingPerplexity Sonarsonar2026-09-17 07:40yes209 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:29yes2313 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 07:37yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:35yes3021 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:46yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:34yes1081 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:24yes3037 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:43yes2947 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:25yes2256 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
ESET read as ESET Vulnerability & Patch Management
Ivanti read as Ivanti Neurons for Vulnerability Management
SecPod read as SecPod SanerNow
Unresolved, counted raw
Beacon
BeyondTrust Enterprise Vulnerability Management (Legacy)
BeyondTrust Retina (Retina CS / Retina Network Security Scanner)
CVETodo
CrowdStrike Falcon Spotlight / Exposure Management
CrowdStrike Falcon Spotlight / Exposure Mgmt
Deemkay
Edgescan
GuardNest
Iru Vulnerability Management
Panoptic Scans
Qualys VMDR/Exposure Management
RoboShadow
StorageGuard
Tenable Nessus / Tenable.io / Vulnerability Management
Tenable Nessus/SecurityCenter
Vuls
Discontinued, still offered
No shut-down product was recommended here.

Also in security operations

The other categories of this function, with the leader in each.
← Threat intelAPM →