Every category where a model named Qualys for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant
Vulnerability management platforms	Security operations	0%	18 of 80	30%	23	criticized challenger
Attack surface management	Security operations	0%	24 of 104	0%	4	under 10 labels · led by Intruder at 59%
Penetration testing as a service	Security operations	0%	28 of 76	0%	4	under 10 labels · led by Cobalt at 44%
Cloud security posture management	Cloud and infrastructure	0%	48 of 53	67%	3	under 10 labels · led by Wiz at 43%
Container and Kubernetes security	Cloud and infrastructure	0%	69 of 78	100%	1	under 10 labels · led by Aqua Security at 18%
GRC platforms	Security operations	0%	70 of 77	100%	1	under 10 labels · led by Vanta at 14%
Patch management	IT operations and endpoint	0%	41 of 87	0%	1	under 10 labels · led by Action1 at 27%

Movement

This is the first edition on this tier, so no move can be computed for Qualys yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Qualys across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.

Model	First choice	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	0	1	2	0	3
GPT-5.4 mini	0	2	1	0	3
Gemini 3.5 Flash	1	0	2	3	6
Perplexity Sonar	0	0	1	1	2
Grok 4.1 Fast	0	2	1	1	4
Mistral Small	0	0	2	1	3
DeepSeek V4 Flash	0	1	2	1	4
Llama 4 Maverick	0	0	1	0	1
Qwen 3.7 Flash	1	0	1	4	6
Kimi K2	0	0	2	0	2
GLM 4.7 FlashX	1	0	1	0	2
MiniMax M2.5	0	0	1	0	1

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct8 labels1

Paraphrase6 labelsNone

Comparative24 labels3not counted in share

Budget-constrained14 labelsNone

Scale-constrained20 labels1

Negative32 labels1not counted in share

First choiceAlternativeMentionNegative104 labels in all, every segment counted; 2 of the 6 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“For most enterprises, Tenable or Qualys are the top choices depending on your deployment preferences.” GLM 4.7 FlashX · Vuln management · comparative prompt · first choice

“Choose Tenable or Qualys if you have a massive, hybrid, or complex physical corporate network” Gemini 3.5 Flash · Vuln management · comparative prompt · first choice

“the top vulnerability management platforms are Tenable, Qualys, and Rapid7” Qwen 3.7 Flash · Vuln management · comparative prompt · first choice

“Need broad exposure management across many asset types and vendors? Look at Tenable or Qualys.” GPT-5.4 mini · Vuln management · comparative prompt · alternative

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“Many modern security vendors (like Tenable or Qualys) sell compliance add-ons... they often lack the workflows for policy management, third-party risk assessment (TPRM), or Board-level reporting” Qwen 3.7 Flash · GRC · negative prompt · soft negative

“Vendors like Qualys (specifically their VM module used as CSPM) ... are often criticized by pure-cloud shops for high resource consumption and lower accuracy” Qwen 3.7 Flash · CSPM · negative prompt · soft negative

“some niche players like AlgoSec or Qualys): Incomplete cloud coverage, high false positives, or scalability problems” Grok 4.1 Fast · CSPM · negative prompt · soft negative

“Enterprise tools like Qualys are notorious for charging modular add-on fees for basic things like external scanning” Gemini 3.5 Flash · Vuln management · direct prompt · soft negative

Named alongside

The products named in the same answers as Qualys, over the 104 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Qualys was named but was not.

ProductSame answerTook the first choice insteadHead to head

Tenable63 of 1046Not in the top three

Rapid741 of 1040Not in the top three

Wiz38 of 1044Not in the top three

Microsoft Defender Vulnerability Management28 of 1043Not in the top three

OpenVAS25 of 1042Not in the top three

Intruder22 of 10414Not in the top three

Tenable Nessus21 of 1040Not in the top three

Rapid7 InsightVM18 of 1041Not in the top three

Orca Security15 of 1041Not in the top three

Prisma Cloud15 of 1040Not in the top three

A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Qualys. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 70 of the 104 answers that named Qualys and are not a share of its labels.

Domains cited

riskwatch.com29

axis-intelligence.com28

upguard.com28

expertinsights.com24

techrepublic.com23

orca.security22

vicarius.io18

gartner.com17

g2.com14

reddit.com14

217 of the 217 domain citations in answers naming Qualys came from somebody else's page.

Pages cited

riskwatch.com/vulnerability-management-software29

axis-intelligence.com/best-vulnerability-management-tools-tested28

upguard.com/blog/top-vendor-vulnerability-tools23

orca.security/resources/blog/best-vulnerability-management-tools21

techrepublic.com/article/top-vulnerability-management-tools20

expertinsights.com/security-operations/the-top-vulnerability-management-solutions15

ciopages.com/buyer-guides/vulnerability-management12

sentinelone.com/cybersecurity-101/cybersecurity/8-vulnerability-management-tools12

Pages are listed as the models cited them.

Names read as Qualys

What the judge wrote, as written, with how often. The vendor table decides that these count as Qualys; a claim can dispute any of them.

Qualys (Cloud Platform/EASM) 1Qualys (Exposure Management) 1Qualys (Qualys Cloud Platform / VMDR) 1Qualys (VMDR / Enterprise TruRisk Platform) 1Qualys CSPM 1

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Qualys's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Qualys, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at qualysec.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.