Comparison
Qualys vs. HostedScan
Qualys VMDR is an enterprise vulnerability management suite with modules for web apps, patching, and policy compliance. HostedScan covers external, internal, web, API, and TLS scanning in one product you can start in minutes.
Try the Premium plan free for 14 days. No credit card required.
At a glance
HostedScan
Qualys
Starting price
$468 / year, 5 targets
Quote per asset
Scanners
OpenVAS, Nuclei, ZAP, Nmap, SSLyze; Nessus on Professional
Qualys scanner
Internal scanning
Included from Premium
Appliances and agents
Trial
14 days, no card
30 days
Differences
What sets HostedScan apart from Qualys
Start in minutes
Sign up, add a target, and see findings before the Qualys quote arrives, with no onboarding project and no appliance to install.
Published, per-target pricing
Plans from $39 per month billed annually with per-target rates on the page. Qualys is quoted per asset and per module with no public list price.
Six scanners on one plan
OpenVAS, Nuclei, ZAP, Nmap, SSLyze, and Nessus on Professional. Qualys Web Application Scanning is a separate module from VMDR.
API included
REST API and webhooks on Premium and above with no separate API pricing.
Inside the product
What you get on day one
Every risk carries first and last seen dates, each target carries a health score, and accepting a risk is one click, without a VM analyst to run it.
Which one fits
Choose HostedScan if
- You want to start today at a published price.
- You have hundreds of assets to scan.
- You want web, API, TLS, and port scanning included in the plan.
- You need audit-ready reports without a dedicated analyst.
Choose Qualys if
- You need policy compliance, patching, and EDR in the same console.
- You run agents across a large fleet, including OT and IoT.
- Your procurement expects a multi-year contract and a named account team.
- You need FedRAMP or similar attestations on the platform.
Capability matrix
Feature by feature
Differences come first. A half circle marks a limited capability, and its note names the limit. Notes about Qualys link to their source.
Feature
Scanners
Tenable Nessus
Nessus cloud scanning, Nessus scanners for internal networks, and Nessus Agents, all on Professional.
Qualys uses its own detection content.
SourceOpen-source scanners you can audit
Greenbone OpenVAS and Nuclei CVE scanning plus Nmap TCP and UDP port scans on every plan, and Tenable Nessus on Professional.
Closed detection content.
SourceDaily definition updates
The Greenbone feed syncs daily. Nuclei templates are updated regularly.
Continuous signature updates.
SourceCoverage
Endpoint agents at scale
Nessus Agents for endpoint scanning on Professional. No agent on Basic or Premium.
SourceCloud Agent across servers and workstations.
SourceWeb application scanning
OWASP ZAP active and passive scanning for the OWASP Top 10 and beyond.
Qualys Web Application Scanning is a separate module from VMDR.
SourceAPI scanning from a spec
Import an OpenAPI or Swagger spec and ZAP tests every endpoint.
SourceAPI scanning inside the WAS module.
SourceDedicated TLS and port scanners
SSLyze certificate, protocol, and cipher checks on every plan.
TLS and port findings are detections in VMDR; Qualys SSL Labs is a free public tool outside the platform.
SourcePatch management
No patch deployment. Findings carry remediation steps and ticketing integrations hand them off.
Patch Management module deploys fixes from the same console.
SourceReporting and risk management
White-label reports
White-label PDF reports with your branding on Professional.
No white-label option published.
Import results from other scanners
Connect GitHub Dependabot and Snyk, and upload Nmap, OpenVAS, or ZAP results through the API.
SourceNo published import of third-party scanner results.
Integrations and API
Licensing, pricing, and support
Published price list
Published plans from $39 per month billed annually. Per-target rates on the pricing page.
Quoted per asset and per module. No public price list.
SourceStart without a sales call
Sign up, add a target, scan. Sales is optional at any size.
30-day trial is self-serve; buying goes through sales.
SourceHow the two products run
External scanning
Hosted scanners. Add a hostname, IP, URL, or CIDR.
Qualys cloud scanners, configured per subscription.
Internal scanning
Internal scanner on Premium; Nessus scanners and Nessus Agents on Professional.
Virtual scanner appliances and Cloud Agent deployed across the estate.
Scanner upkeep
HostedScan maintains the scanners and syncs the Greenbone feed daily.
Qualys updates detections; you maintain appliances and agent rollout.
Where data lives
HostedScan cloud with export and API.
Qualys cloud platform in your chosen region.
What your team does weekly
Triage one risk list, export a report.
Operate the platform: agents, appliances, tags, dashboards, report templates.
Migration
How to switch from Qualys to HostedScan
Leaving Qualys is mostly about the target inventory and the accepted-risk decisions. Both export cleanly.
Carries over
- Asset inventory as targets
- Accepted-risk decisions, re-applied
- Scan cadence
- Audit reports, regenerated
Stays behind
- Qualys detection history
- Policy Compliance and Patch Management data
- Custom report templates and dashboards
- 1
Export the asset inventory
Export hosts and web apps from Qualys as CSV, or pull them from your cloud accounts.
- 2
Import targets
Upload the CSV or connect AWS, Azure, or DigitalOcean so discovery keeps the list current.
- 3
Stand up internal scanning
Run the internal scanner on Premium where the Qualys appliance was.
- 4
Re-apply exceptions
Accept the risks you had exceptions for in Qualys, with the reason, so the first report matches.
- 5
Run the overlap period
Keep Qualys until the contract ends and compare the two finding lists during the trial.
Pricing example
50 external assets with web, network, and TLS scanning and SOC 2 reports
One scenario priced on both products. HostedScan totals come from the published plan and per-target rates. Qualys figures were checked in September 2026 and link to the source.
HostedScan Premium
$2,658 / year
$221.50 per month billed annually. 5 targets included, 45 added at $2.50 each per month.
Premium includes every open-source scanner, authenticated ZAP scans, the internal scanner, the API, and audit-ready reports. Unlimited scans on all 50 targets.
Qualys
Quote
Qualys VMDR is priced per asset per year and quoted by sales. Qualys Web Application Scanning is a separate module with its own price.
From our customers
What our customers say
“We utilize HostedScan to penetration test our internet presence and internet facing assets on a daily basis to guarantee our internal security and support of our businesses ISO accreditation requirements. HostedScan’s easy to use UI and excellent support services provides both our business with immeasurable value and peace of mind.”
Alex • Technical Director
“We're so glad we found HostedScan. The platform doesn't just identify security issues—it gives us the visibility and confidence we need to stay on top of them. It's become a critical part of how we maintain our SOC 2 compliance, streamlining what used to be a time-consuming process.”
Paul Reinheimer • Co-Founder
“Really pleased with the solution, we are certainly using it more now than ever, simple to use and has proved a valuable solution.”
Warren Whewell • Head of Cyber Defence and Operations
Quick Answers
Frequently asked questions
Our knowledge base contains answers to technical questions, and you can always contact us for more details on our plans, pricing, or any questions.
Speed and power,
without the complexity
The world's leading vulnerability scanners, all in one platform.