No more typing reviews! Try our Samantha, our new voice AI agent.

ManageEngine Vulnerability Manager Plus vs Rapid7 Metasploit comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
10th
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
53
Ranking in other categories
Container Security (11th), Cloud Workload Protection Platforms (CWPP) (9th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (7th)
ManageEngine Vulnerability ...
Ranking in Vulnerability Management
40th
Average Rating
9.4
Reviews Sentiment
7.4
Number of Reviews
3
Ranking in other categories
Cyber Asset Attack Surface Management (CAASM) (8th), Attack Surface Management (ASM) (37th)
Rapid7 Metasploit
Ranking in Vulnerability Management
25th
Average Rating
8.0
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.2%, up from 1.0% compared to the previous year. The mindshare of ManageEngine Vulnerability Manager Plus is 0.7%, down from 1.0% compared to the previous year. The mindshare of Rapid7 Metasploit is 2.0%, up from 1.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Qualys TotalCloud1.2%
Rapid7 Metasploit2.0%
ManageEngine Vulnerability Manager Plus0.7%
Other96.1%
Vulnerability Management
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
MB
IT Helpdesk at a manufacturing company with 51-200 employees
Enhanced endpoint security with effective patch management and frequent scans
The most valuable feature was the patch management, which was very effective for endpoint-centric solutions requiring remediation of vulnerabilities. ManageEngine Vulnerability Manager Plus was the perfect fit for managing these requirements. We improved the number of scans and patches performed from four times per year per computer to four times per month.
reviewer1247523 - PeerSpot reviewer
Head of Sales Services Department at a comms service provider with 51-200 employees
Extensive exploit database and seamless integration enhance penetration testing capabilities
The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even the same attack you provide today will go in different ways another day. I prefer when the auditor or pen-tester provides the attack in a non-automated mode. For some, it might be a valuable option, but I'm not sure it's valuable for us, as after the attack has been provided, we should release a report detailing how it transpired and what the customer should improve to block this way of attack. If the attack was provided in an automated mode, you cannot receive sufficient information that helps with this final report for the customer. While you can check the vulnerability, and the system will tell you there is no vulnerability, usually, a human can change one, two, or three parameters and using the same technique and the same scripts can break the system. Rapid7 Metasploit could be improved in areas concerning the experience with finding particular scripts pre-installed in the solution. Customers, administrators, and pen-testers spend considerable time trying to locate the specific component they need by the name of the technique or the name of the attack, so any improvements in making it easier to find those predefined components by name or timeframe would be beneficial. Search filters could be a correct improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution."
"One of Qualys' best features is its categorization, which allows us to see the types of assets, their security postures, and the AI-powered version of the tool."
"I depend heavily on the reports that I have from this tool."
"Qualys TotalCloud's most valuable feature is its ability to link clusters of assets, providing a clear model of deployments, vulnerabilities, and statuses."
"The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility."
"My experience with using TruRisk to mitigate noise from raw CVEs has been great."
"TruRisk Insights is the most important innovation they've released this year."
"Vulnerability and threat detection and assessment of the criticality of the vulnerabilities exposed are most valuable."
"The solution helps us figure out vulnerabilities and fix them."
"The most valuable feature was the patch management, which was very effective for endpoint-centric solutions requiring remediation of vulnerabilities."
"ManageEngine is a comprehensive tool that is broad and can be customized to fit specific needs."
"I have been using it for over two years, and it is fantastic."
"Rapid7 has a significant advantage in providing a clear picture of my environment."
"Technical support has been helpful and responsive."
"Rapid7 Metasploit is a useful product."
"The solution is open source and has many small targetted penetration tests that have been written by many people that are useful. You can choose different subjects for the test, such as Oracle databases or Apache servers."
"I would definitely recommend Metasploit to others."
"The most valuable features of Metasploit include its powerful capabilities for exploitation and scanning."
"The most valuable feature for us is the support for testing Linux-based web server components."
"It contains almost all the available exploits and payloads."
 

Cons

"There is room for improvement in vulnerability scanning, particularly for PaaS environments. Currently, Qualys does not have full access to these instances, which limits its effectiveness."
"Qualys TotalCloud has the potential to improve by integrating a hybrid platform for comprehensive management of both on-premises and cloud infrastructures."
"One thing that could be improved is the user experience and navigation."
"The vulnerability part is good, but the policy compliance module needs improvement because it involves a lot of manual work. Specifically, the remediation part of the controls requires enhancements."
"The cloud licensing unit system is unclear, especially since "units" aren't well-defined."
"The improvement needed in Qualys TotalCloud is mainly in the artificial intelligence automation agents, where we can customize and create what meets our needs, not necessarily having to use those provided in the tool."
"The support process is inefficient due to the excessive number of replies required when submitting tickets."
"The cost of Qualys TotalCloud is high and could be more competitive."
"One area that needs improvement is the contract management. My legal team required some partner requirements for that, and ManageEngine could not support it."
"The user interface is the only drawback of the product."
"The integration with third-party solutions such as ticketing solutions or CMDB solutions can be improved."
"The open-source version has reporting limitations. You need to develop these capabilities yourself. Built-in reporting is an excellent feature for penetration testing, but it isn't a must-have. The solution could also cover more vulnerabilities. Metasploit has around 10,000 exploits in its library, but more is always better."
"The initial setup was a bit "tweaky" for the open-source version."
"The reporting feature needs improvement."
"The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even the same attack you provide today will go in different ways another day."
"Integration with popular vulnerability scanners would be a useful feature."
"The reporting feature needs improvement. The time taken to fetch reports based on the number of events can be extensive, unlike Tenable, which is more user-friendly and faster."
"The solution is not user-friendly and has room for improvement."
"Support is another area where improvement is needed, particularly for assisting non-security users."
 

Pricing and Cost Advice

"TotalCloud's price is about right where I would expect it to be."
"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."
"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"The cost is high, but it meets our organizational needs."
"Qualys TotalCloud offers cost-effective licensing flexibility."
"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."
"The price is very reasonable."
"It is expensive. Our license expired, and our company is not thinking to renew because of our budget."
"On a scale of one to ten, where one is cheap and ten is expensive, I rate the product's pricing a six. So it's fairly priced."
"Rapid7 Metasploit is cheaper than Tenable.io Vulnerability Management."
"Rapid7 Metasploit is an open-source solution."
"It is a reasonably priced solution. I would rate it from five out of ten."
"I use the open-source version of this product. Pricing is not relevant."
"The pricing structure involves a one-time purchase cost of approximately twenty thousand dollars or euros for all customers."
"I have used the free version of Rapid7 Metasploit."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
12%
Manufacturing Company
11%
Financial Services Firm
10%
Comms Service Provider
12%
Financial Services Firm
10%
Outsourcing Company
8%
Computer Software Company
7%
Comms Service Provider
11%
Construction Company
10%
Manufacturing Company
10%
Financial Services Firm
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise10
Large Enterprise38
No data available
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise12
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, an...
What needs improvement with Qualys TotalCloud?
In terms of improvements, the features we are using in Qualys TotalCloud are working in the best optimal way, and I d...
What is your primary use case for Qualys TotalCloud?
I have been using Qualys TotalCloud for the last eight months to scan the hardware and the virtual devices in our inf...
What is your experience regarding pricing and costs for ManageEngine Vulnerability Manager Plus?
ManageEngine is considered an affordable solution, offering competitive pricing compared to similar solutions like Ut...
What needs improvement with ManageEngine Vulnerability Manager Plus?
The integration with third-party solutions such as ticketing solutions or CMDB solutions can be improved. The asset d...
What is your primary use case for ManageEngine Vulnerability Manager Plus?
I worked in an integrator solution company, and we implemented ManageEngine Vulnerability Manager Plus for different ...
What is your experience regarding pricing and costs for Rapid7 Metasploit?
The pricing of Rapid7 Metasploit is quite affordable. It has a free version that many customers start with, and after...
What needs improvement with Rapid7 Metasploit?
The automated approach in the audits or in the hacking testing with Rapid7 Metasploit could be improved because even ...
What is your primary use case for Rapid7 Metasploit?
I use Rapid7 Metasploit as a distributor, as an integrator, and as a user. I use Rapid7 Metasploit in my company inte...
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
Metasploit
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
City of Corpus Christi, Diebold, Lumenate, Nebraska Public Power District, Prairie North Regional Health, Apptio, Automation Direct, Bob's Stores, Cardinal Innovations Healthcare Solutions, Carnegie Mellon University
Find out what your peers are saying about ManageEngine Vulnerability Manager Plus vs. Rapid7 Metasploit and other solutions. Updated: September 2026.
917,433 professionals have used our research since 2012.