# Vulnerability management platforms for enterprise buyers: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "vulnerability management platform" and as "vulnerability scanning and management tool", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://it-ai-index.com/security/vulnerability-management-platforms/enterprise/

**Standing:** Tenable Vulnerability Management leads with 25% of first choices; verdict contested. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Tenable Vulnerability Management | 25% | 0% | 18 |
| 2 | Qualys VMDR | 14% | 14% | 37 |
| 3 | Tenable | 14% | 23% | 30 |
| 4 | Rapid7 InsightVM | 10% | 11% | 38 |
| 5 | Microsoft Defender Vulnerability Management | 8% | 8% | 25 |
| 6 | Qualys | 4% | 33% | 24 |
| 7 | CrowdStrike Falcon Spotlight | 2% | 30% | 10 |
| 8 | Wiz | 0% | 11% | 28 |
| 9 | Orca Security | 0% | 8% | 13 |
| 10 | CrowdStrike | 0% | 10% | 10 |
| 11 | Rapid7 | 0% | 29% | 17 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Tenable; alternatives Qualys VMDR, Rapid7 InsightVM
- GPT-5.4 mini: Tenable Vulnerability Management; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR
- Gemini 3.5 Flash: Qualys, Tenable; alternatives Brinqa, CrowdStrike Falcon Exposure Management, Microsoft Defender Vulnerability Management, Nucleus Security
- Perplexity Sonar: Tenable Vulnerability Management; alternatives OpenVAS, Qualys VMDR / Enterprise TruRisk Platform, Rapid7 InsightVM, Wiz
- Grok 4.1 Fast: Tenable Vulnerability Management; alternatives Qualys VMDR, Rapid7 InsightVM
- Mistral Small: Rapid7 InsightVM, Tenable Vulnerability Management; alternatives CrowdStrike Falcon Exposure Management, Ivanti Neurons for Vulnerability Management, Qualys VMDR
- DeepSeek V4 Flash: Qualys VMDR, Tenable; alternatives Orca Security, Rapid7 InsightVM, Wiz
- Llama 4 Maverick: Rapid7 InsightVM, Tenable Vulnerability Management; alternatives Binarly
- Qwen 3.7 Flash: Tenable One; alternatives Qualys VMDR, Rapid7 InsightVM, Wiz
- Kimi K2: Tenable; alternatives CrowdStrike Falcon Exposure Management, Qualys VMDR, Rapid7 InsightVM
- GLM 4.7 FlashX: Tenable One; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Wiz
- MiniMax M2.5: Rapid7 InsightVM, Tenable One / Tenable Vulnerability Management; alternatives CrowdStrike Falcon Complete with Spotlight, Qualys Enterprise TruRisk Platform, Wiz

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- gartner.com: 32 answers, 46 citations
- techrepublic.com: 29 answers, 29 citations
- riskwatch.com: 26 answers, 26 citations
- orca.security: 25 answers, 29 citations
- axis-intelligence.com: 25 answers, 25 citations
- expertinsights.com: 22 answers, 24 citations
- tech-insider.org: 20 answers, 36 citations
- technologymatch.com: 20 answers, 20 citations

Pages named in the most answers:

- https://gartner.com/reviews/market/vulnerability-assessment (29 answers)
- https://techrepublic.com/article/top-vulnerability-management-tools (29 answers)
- https://riskwatch.com/vulnerability-management-software (26 answers)
- https://axis-intelligence.com/best-vulnerability-management-tools-tested (25 answers)
- https://orca.security/resources/blog/best-vulnerability-management-tools (25 answers)
- https://technologymatch.com/blog/tenable-vs-qualys-vs-rapid7-vm-platform-comparison (20 answers)
- https://worldmetrics.org/best/enterprise-vulnerability-management-software (20 answers)
- https://expertinsights.com/security-operations/the-top-vulnerability-management-solutions (19 answers)
- https://pdq.com/blog/best-vulnerability-management-tools (17 answers)
- https://cybervendorguide.com/guides/vulnerability-management (16 answers)

## Warned against

- Qualys: 8 of 24 labels negative. "the standard "pay-per-scanned-asset" model (used by leaders like Qualys and Tenable) creates significant budget volatility" (Qwen 3.7 Flash, budget prompt)
- Tenable: 7 of 30 labels negative. "⭐⭐ (Poor - Spikes with Cloud Growth) ... Only pay a dedicated premium (Qualys/Tenable) if your legal/compliance team strictly mandates a third-party scanner" (Qwen 3.7 Flash, budget prompt)
- Qualys VMDR: 5 of 37 labels negative. "Platforms to Avoid for Predictable Costs | Qualys VMDR | Per-IP pricing ... modular add-ons increase complexity" (Kimi K2, budget prompt)
- Rapid7: 5 of 17 labels negative. "Rapid7 launched Active Patching in July 2025 as a paid add-on, with script-based virtual patching templates for systems without fixes rather than runtime protection" (Claude Haiku 4.5, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.