# Vulnerability management platforms: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "vulnerability management platform" and as "vulnerability scanning and management tool", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://it-ai-index.com/security/vulnerability-management-platforms/

**Standing:** Rapid7 InsightVM leads with 45% of first choices; verdict clear leader. 44 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Rapid7 InsightVM | 45% | 8% | 36 |
| 2 | Intruder | 16% | 0% | 19 |
| 3 | ManageEngine Vulnerability Manager Plus | 9% | 0% | 14 |
| 4 | OpenVAS | 9% | 24% | 21 |
| 5 | Tenable Vulnerability Management | 7% | 0% | 18 |
| 6 | Microsoft Defender Vulnerability Management | 2% | 19% | 27 |
| 7 | Tenable Nessus | 2% | 33% | 12 |
| 8 | Qualys VMDR | 0% | 4% | 24 |
| 9 | Tenable | 0% | 24% | 25 |
| 10 | Wiz | 0% | 6% | 16 |
| 11 | Qualys | 0% | 30% | 23 |
| 12 | Rapid7 | 0% | 38% | 13 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightVM; alternatives Aikido Security, ESET Vulnerability & Patch Management, UpGuard
- GPT-5.4 mini: Tenable Vulnerability Management; alternatives Arctic Wolf, Qualys VMDR
- Gemini 3.5 Flash: Vicarius vRx; alternatives CrowdStrike Falcon Exposure Management, Intruder, Microsoft Defender Vulnerability Management, Orca Security
- Perplexity Sonar: Rapid7 InsightVM; alternatives ManageEngine Vulnerability Manager Plus, Microsoft Defender for Cloud, Vicarius vRx
- Grok 4.1 Fast: Rapid7 InsightVM; alternatives CrowdStrike Falcon Spotlight / Exposure Mgmt, Qualys VMDR, Tenable Vulnerability Management
- Mistral Small: Rapid7 InsightVM; alternatives ESET Vulnerability & Patch Management, UpGuard
- DeepSeek V4 Flash: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
- Llama 4 Maverick: Rapid7 InsightVM
- Qwen 3.7 Flash: Rapid7 InsightVM; alternatives ManageEngine Vulnerability Manager Plus, Qualys VMDR, Tenable Vulnerability Management
- Kimi K2: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable
- GLM 4.7 FlashX: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
- MiniMax M2.5: Rapid7 InsightVM; alternatives Cisco Vulnerability Management, Orca Security, Tenable Vulnerability Management, Wiz

## Sources the answers cite

60 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- axis-intelligence.com: 32 answers, 32 citations
- vicarius.io: 26 answers, 45 citations
- gartner.com: 26 answers, 33 citations
- techrepublic.com: 26 answers, 27 citations
- upguard.com: 24 answers, 24 citations
- expertinsights.com: 20 answers, 23 citations
- riskwatch.com: 20 answers, 20 citations
- orca.security: 17 answers, 18 citations

Pages named in the most answers:

- https://axis-intelligence.com/best-vulnerability-management-tools-tested (32 answers)
- https://techrepublic.com/article/top-vulnerability-management-tools (26 answers)
- https://gartner.com/reviews/market/vulnerability-assessment (23 answers)
- https://upguard.com/blog/top-vendor-vulnerability-tools (22 answers)
- https://riskwatch.com/vulnerability-management-software (20 answers)
- https://expertinsights.com/security-operations/the-top-vulnerability-management-solutions (17 answers)
- https://orca.security/resources/blog/best-vulnerability-management-tools (17 answers)
- https://vicarius.io/articles/6-best-consolidated-vulnerability-management-platforms-for-mid-market-security-and-it-teams-2026 (17 answers)
- https://cybervendorguide.com/guides/vulnerability-management (16 answers)
- https://technologymatch.com/blog/tenable-vs-qualys-vs-rapid7-vm-platform-comparison (13 answers)

## Warned against

- Qualys: 7 of 23 labels negative. "Enterprise tools like Qualys are notorious for charging modular add-on fees for basic things like external scanning" (Gemini 3.5 Flash, direct prompt)
- Tenable: 6 of 25 labels negative. "powerful, highly accurate, and standard for compliance, though they can sometimes feel overly complex for smaller teams" (Gemini 3.5 Flash, scale prompt)
- Tenable Nessus: 4 of 12 labels negative. "Buying a standalone scanner (like *Tenable Nessus Professional* ...) and trying to run an enterprise program with it... Why to avoid" (Gemini 3.5 Flash, negative prompt)
- Microsoft Defender Vulnerability Management: 5 of 27 labels negative. "can be attractive, but it tends to be more compelling as part of a broader Microsoft security stack than as a standalone best-of-breed VM choice" (GPT-5.4 mini, direct prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.