IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › Security operations › Vuln management › Small business › September 2026 Edition

Vulnerability management platforms for small business buyers

Asked as “vulnerability management platform”, and as “vulnerability scanning and management tool”, on behalf of a small B2B company. 44 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Intruder
Clear leader
59% of first choices, clear leader.
ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessIntruder59%Clear leaderThis pageMid-marketRapid7 InsightVM45%Clear leaderStanding →EnterpriseTenable Vulnerability Management25%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Intruder59%2%52endorsed leader
02OpenVAS11%31%35criticized challenger
03ManageEngine Vulnerability Manager Plus7%4%24accepted challenger
04Tenable Vulnerability Management7%46%24criticized challenger
05ESET Vulnerability & Patch Management2%5%19accepted challenger
06Tenable Nessus2%31%26criticized challenger
Show the six products at 0%, ordered by negative rate
11Rapid70%70%10criticized challenger
12Qualys VMDR0%67%21criticized challenger
10Qualys0%50%22criticized challenger
09Tenable0%50%18criticized challenger
08Rapid7 InsightVM0%36%25criticized challenger
07Microsoft Defender Vulnerability Management0%11%18accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Rapid7 InsightVM vs IntruderRapid7 InsightVM vs ManageEngine Vulnerability Manager PlusIntruder vs ManageEngine Vulnerability Manager Plus

One product takes 59% of first choices here, so the chart would put eleven markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Eight products carry a negative rate above 25% in this category. Jump to the standing

02What they warned about

Eight of twelve models held their first choice under the paraphrase. Gemini 3.5 Flash, Qwen 3.7 Flash, Kimi K2 and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Qualys VMDR
67%
14 of 21 labels negative · 9 of 12 models · 2 hard negative
“small businesses should be cautious about or avoid the following vulnerability management platforms due to issues like poor support, high costs” Mistral Small, negative prompt
Rapid7 InsightVM
36%
9 of 25 labels negative · 9 of 12 models · 1 hard negative
“**Verdict:** Best avoided unless you have 500+ assets and a full-time security engineer.” DeepSeek V4 Flash, negative prompt
OpenVAS
31%
11 of 35 labels negative · 8 of 12 models · 2 hard negative
“Open-source scanners alone** (OpenVAS without management) | No dedicated support, high configuration/maintenance burden” Kimi K2, negative prompt
Tenable Vulnerability Management
46%
11 of 24 labels negative · 8 of 12 models · 1 hard negative
“**avoid the full platform** for ongoing continuous monitoring unless you're comfortable with ongoing technical overhead” DeepSeek V4 Flash, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 792 links across 183 sites, every framing counted. Ranked by the number of answers carrying the site or page.

axis-intelligence.com
45 answers · 45 citations · 9 models
upguard.com
vendor site · UpGuard44 answers · 44 citations · 10 models
techrepublic.com
29 answers · 29 citations · 8 models
riskwatch.com
vendor site · RiskWatch26 answers · 26 citations · 9 models
orca.security
vendor site · Orca25 answers · 25 citations · 10 models
expertinsights.com
vendor site · Expert Insights23 answers · 24 citations · 8 models
g2.com
18 answers · 37 citations · 9 models
vicarius.io
vendor site · Vicarius17 answers · 25 citations · 7 models
beaglesecurity.com
vendor site · Beagle Security14 answers · 23 citations · 6 models
pdq.com
vendor site · PDQ14 answers · 23 citations · 7 models
blueheadline.com
14 answers · 14 citations · 9 models
reddit.com
13 answers · 28 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

axis-intelligence.com/best-vulnerability-management-tools-tested
45 answers · 9 models
upguard.com/blog/top-vendor-vulnerability-tools
44 answers · 10 models
techrepublic.com/article/top-vulnerability-management-tools
29 answers · 8 models
riskwatch.com/vulnerability-management-software
26 answers · 9 models
orca.security/resources/blog/best-vulnerability-management-tools
24 answers · 10 models
expertinsights.com/security-operations/the-top-vulnerability-management-sol…
21 answers · 8 models
blueheadline.com/cybersecurity/best-vulnerability-scanners-small-business
14 answers · 9 models
pdq.com/blog/best-vulnerability-management-tools
14 answers · 7 models
vicarius.io/articles/6-best-consolidated-vulnerability-management-platforms…
13 answers · 7 models
hivepro.com/blogs/vulnerability-management-tool-list
11 answers · 6 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best vulnerability management platform for a small B2B company?”Paraphrase“Which vulnerability scanning and management tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top vulnerability management platforms for a small team and how do they differ?”Budget-constrained“What is the best vulnerability management platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a vulnerability management platform. What should we look at?”Negative“Which vulnerability management platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5no first choiceno first choiceHeldIntruder
Three alternativesCyrisma, Orca, Rapid7 InsightVM
ManageEngine Vulnerability Manager Plus
Two alternativesNuclei, OpenVAS
against: DefectDojono first choiceagainst: CrowdStrike, Microsoft, Nuclei, OpenVAS, Prisma Cloud, Qualys, Rapid7, Tanium, Tenable
GPT-5.4 miniTenable Vulnerability Management
Four alternativesAikido Security, Intruder, Microsoft Defender Vulnerability Management, Qualys VMDR
Tenable Vulnerability ManagementHeld
Four alternativesMicrosoft Defender Vulnerability Management, Qualys VMDR, Rapid7 InsightVM, Tenable Nessus
against: ManageEngine Vulnerability Manager PlusTenable Vulnerability Management / Nessus
Three alternativesCrowdStrike Falcon Spotlight, Qualys Enterprise TruRisk Platform, Rapid7 InsightVM
against: OpenVASOpenVAS
One alternativeTenable Nessus
against: Qualys VMDRno first choiceagainst: Qualys VMDR, Rapid7 InsightVM / Rapid7 Command, Tenable One, Tenable Vulnerability Management
Gemini 3.5 FlashAikido Security
Three alternativesAction1, Intruder, Vicarius vRx
against: Qualys, Rapid7, TenableIntruderChanged
Four alternativesAstra Security, Detectify, Microsoft Defender Vulnerability Management, Tenable Nessus
Intruder
Three alternativesAction1, Cyrisma, DefectDojo
against: Tenable NessusIntruder, Wazuh
Three alternativesDefectDojo, ManageEngine Vulnerability Manager Plus, OpenVAS
against: Qualys, Rapid7, TenableAction1
Four alternativesAikido Security, Automox, Microsoft Defender Vulnerability Management, Vicarius
against: Qualys, Tenable Nessusagainst: OpenVAS, Orca Security, Prisma Cloud, Qualys VMDR, Rapid7 InsightVM, Tenable One, Wiz
Perplexity SonarIntruder
Four alternativesManageEngine Vulnerability Manager Plus, Qualys VMDR, Rapid7 InsightVM, Tenable Vulnerability Management
IntruderHeld
Three alternativesManageEngine Vulnerability Manager Plus, OpenVAS, Tenable Nessus
Intruder
Three alternativesMicrosoft Defender Vulnerability Management, PDQ, Vicarius vRx
against: OpenVAS, Qualys, Rapid7, TenableIntruder
Three alternativesAction1, ManageEngine Vulnerability Manager Plus, OpenVAS
no first choiceagainst: OpenVAS, Qualys, Rapid7 InsightVM, Tenable
Grok 4.1 FastIntruder
Two alternativesManageEngine Vulnerability Manager Plus, Tenable Nessus
IntruderHeld
Three alternativesESET Vulnerability & Patch Management, OpenVAS, Tenable Nessus
Intruder
Three alternativesESET Vulnerability & Patch Management, PDQ Connect/Detect, Syxsense
against: Qualys, Rapid7, TenableOpenVAS
Two alternativesIntruder, ManageEngine Vulnerability Manager Plus
against: ESET Vulnerability & Patch Management, Tenable, Tenable NessusIntruder
Four alternativesMicrosoft Defender Vulnerability Management, Qualys VMDR, Rapid7 InsightVM, Tenable
against: ConnectSecure, Cyrisma, Microsoft Defender Vulnerability Management, Qualys VMDR, Rapid7 InsightVM, Tenable Nessus, Tenable Vulnerability Management
Mistral SmallIntruder
One alternativeRapid7 InsightVM
IntruderHeld
Two alternativesMalwarebytes, ManageEngine Vulnerability Manager Plus
Intruder
Four alternativesAWS Inspector, OpenVAS, Snyk, Trivy
Intruderno first choiceagainst: ConnectSecure, Cyrisma, Nodeware, Qualys VMDR, Rapid7 InsightVM, Tenable Vulnerability Management
DeepSeek V4 FlashIntruder
Three alternativesESET Vulnerability & Patch Management, Rapid7 InsightVM, Syxsense
against: Qualys VMDR, Tenable Vulnerability ManagementIntruderHeld
Four alternativesESET Vulnerability & Patch Management, ManageEngine Vulnerability Manager Plus, Rapid7 InsightVM, Tenable
against: QualysIntruder
Four alternativesESET Vulnerability & Patch Management, NinjaOne, OpenVAS, Wazuh
against: Qualys, Tenable Vulnerability ManagementOpenVAS, Qualys Community Edition / FreeScan
Three alternativesIntruder, ManageEngine Vulnerability Manager Plus, OWASP ZAP
no first choice
Three alternativesCrowdStrike, Microsoft Defender, Wiz
against: Microsoft Defender for Cloud with Sentinel, OpenVAS, Qualys VMDR, Rapid7 InsightVM, ServiceNow Vuln Management, Tenable Vulnerability Management, Wazuh
Llama 4 MaverickIntruder
Three alternativesCrowdStrike Falcon Exposure Management, Orca Security, Rapid7 InsightVM
IntruderHeld
Three alternativesManageEngine Vulnerability Manager Plus, Rapid7 InsightVM, Tenable Nessus
Intruder
One alternativeOrca Security
Intruderno first choicenothing named
Qwen 3.7 FlashIntruder
Three alternativesQualys VMDR, Tenable Nessus, Tenable Vulnerability Management
Tenable Vulnerability ManagementChanged
Three alternativesBitSentry, Drata, Vanta
Intruder
Two alternativesESET Vulnerability & Patch Management, ManageEngine Vulnerability Manager Plus
Intruder
Two alternativesESET Vulnerability & Patch Management, OpenVAS
no first choice
Two alternativesBreachRadar, Defer.ai
against: Tenable Nessusagainst: Cyrisma, Microsoft Defender Vulnerability Management, Nikto, OpenVAS, Qualys VMDR, Rapid7 InsightVM, RiskWatch, Tenable Nessus, Tenable Vulnerability Management
Kimi K2Intruder, ManageEngine Vulnerability Manager Plus
Two alternativesESET Vulnerability & Patch Management, Syxsense
against: Qualys VMDR, Tenable Vulnerability ManagementIntruderChanged
One alternativeTenable Nessus
Intruder
Four alternativesESET Vulnerability & Patch Management, Microsoft Defender Vulnerability Management, Rapid7 InsightVM, Tenable Vulnerability Management
against: Qualys VMDRManageEngine Vulnerability Manager Plus
One alternativeOpenVAS
against: Intruder, Qualys, Rapid7Intruder
Three alternativesManageEngine, Qualys, Tenable Vulnerability Management
against: ConnectSecure, Microsoft Defender for Cloud, OpenVAS, Qualys VMDR, Rapid7 InsightVM, Splunk Enterprise Security, Tanium, Tenable
GLM 4.7 FlashXIntruder
Two alternativesESET Vulnerability & Patch Management, Microsoft Defender Vulnerability Management
against: Qualys VMDR, Tenable Vulnerability ManagementIntruderHeld
Three alternativesESET Vulnerability & Patch Management, Malwarebytes, Orca Security
against: Tenable NessusTenable
Three alternativesESET Vulnerability & Patch Management, Intruder, PDQ Deploy & Inventory
ESET Vulnerability & Patch Management, OpenVAS
Five alternativesAction1, ManageEngine Vulnerability Manager Plus, Microsoft Defender Vulnerability Management, OWASP ZAP, Trivy
Intruder
Four alternativesCrowdStrike Falcon Spotlight, ESET Vulnerability & Patch Management, Orca Security, Syxsense
against: Qualys VMDR, Rapid7 InsightVM, Tenable Vulnerability Managementagainst: OpenVAS, Qualys, Rapid7, Tenable, Tenable Nessus
MiniMax M2.5Hive Pro, Intruder
One alternativeTenable Vulnerability Management
IntruderChanged
Two alternativesMalwarebytes, ManageEngine Vulnerability Manager Plus
Intruder
Four alternativesESET Vulnerability & Patch Management, Microsoft Defender Vulnerability Management, OpenVAS, Tenable Vulnerability Management
OpenVAS, Tenable Nessus
Three alternativesManageEngine Vulnerability Manager Plus, Rapid7 InsightVM, Tenable Vulnerability Management
no first choiceagainst: Qualys VMDR, Rapid7 InsightVM, Tenable Vulnerability Management
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:22no05 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:32yes36 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:35yes1721 s
Direct recommendationPerplexity Sonarsonar2026-09-17 07:22yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:26yes4120 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 07:47yes54 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:41yes1315 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:25yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:42yes523 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:48yes846 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:42yes11213 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:41yes514 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:39no04 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:30no05 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:43yes918 s
ParaphrasePerplexity Sonarsonar2026-09-17 07:26yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:30yes179 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 07:38yes55 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:29yes1212 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:44yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:34no040 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:33yes2085 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:30yes824 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:35yes1048 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:21yes99 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:23yes410 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:46yes2627 s
ComparativePerplexity Sonarsonar2026-09-17 07:38yes2011 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:21yes3018 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 07:43yes56 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:21yes1419 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:37yes54 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:42yes1048 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:39yes1284 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:25yes25143 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:40yes820 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:47yes97 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:29yes36 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:29yes1821 s
Budget constrainedPerplexity Sonarsonar2026-09-17 07:22yes205 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:42yes4216 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:40yes53 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:33yes2017 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:21yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:26yes1040 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:23yes2555 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:22yes1230 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:24no08 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:27no07 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:45no09 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:43yes1527 s
Scale constrainedPerplexity Sonarsonar2026-09-17 07:22yes208 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:25yes1710 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:44no07 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:34yes1820 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:48yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:34no037 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:32yes1021 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:29yes13113 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:48no045 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:26yes169 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:33yes59 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:22yes727 s
Negative framingPerplexity Sonarsonar2026-09-17 07:34yes205 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:30yes3918 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 07:28yes67 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:39yes2230 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:24yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:44yes1478 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:26yes2937 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:50yes27118 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:24yes2042 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
ESET read as ESET Vulnerability & Patch Management
Unresolved, counted raw
BitSentry
BreachRadar
Defer.ai
Microsoft Defender for Cloud with Sentinel
Nikto
PDQ Connect/Detect
PDQ Inventory/Deploy
Qualys Community Edition / FreeScan
Qualys Free Scanner
Qualys Small Business
Rapid7 InsightVM / Rapid7 Command
ServiceNow Vuln Management
ShadowSecurityScanner
Xylus
Discontinued, still offered
No shut-down product was recommended here.

Also in security operations

The other categories of this function, with the leader in each.
← Threat intelAPM →