Vulnerability management pricing is hard to compare because vendors meter different things: hosts, assets, IP addresses, computers plus technicians, or one flat license. Below, published list prices for Qualys VMDR, Rapid7 InsightVM, ManageEngine Vulnerability Manager Plus and SITEY sit side by side at four fleet sizes, each sourced and dated, with what each price covers and leaves out. SITEY publishes this page and sells one of the products on it, so we also show where SITEY is the more expensive choice.
How these prices were collected
Every competitor figure in this vulnerability management software pricing comparison comes from a public vendor page or AWS Marketplace listing, accessed on 24 September 2026 and linked under Sources. List prices only; no negotiated, partner or promotional prices. Prices appear as the source displays them; we added or removed no tax and repeat any tax note. Where we multiply a monthly price by 12, the table says so. We review this page every 90 days, and sooner if a vendor changes a listed price.
Apples and oranges: who pays for the scanner?
Qualys VMDR, Rapid7 InsightVM and ManageEngine Vulnerability Manager Plus are sold by their own vendors as vulnerability management products. Rapid7’s listing, for example, states that its price includes unlimited scan engines and templates and up to three consoles. Check each vendor’s listing for exactly what detection its price covers.
SITEY works on top of the scanners you already run. It imports results from 16 scanners and launches scans directly in two of them, Nessus and OpenVAS, then runs the rest of its 8-phase pipeline on the results. A fair SITEY budget therefore has at least two lines: the SITEY license and a scanner license.
All 28 modules, the 8-phase pipeline, Windows and Linux agents, imports from 16 scanners, AI triage and AI remediation planning.
The scanner license, your AI provider’s usage charges, the Linux server and PostgreSQL database it runs on, and the engineer who operates it.
Tenable listed Nessus Professional at $4,790 for one year on 24 September 2026; tax display varies by region. Check Tenable’s license terms for how far one license covers your fleet. For OpenVAS, Greenbone designs OPENVAS FREE for private use and non-professional IT infrastructures; its Community Feed lacks checks for enterprise products such as Cisco, MS Exchange and Palo Alto, which the Enterprise Feed covers.
Vulnerability management pricing by fleet size
The table shows 12-month list cost. For Qualys, that is 12 times the monthly-contract price; the listing says a 12-month contract saves up to 17% but shows no 12-month amounts.
| SITEY | Qualys VMDR | Rapid7 InsightVM | ManageEngine VMP | |
|---|---|---|---|---|
| Pricing basis | Flat license with an IP quota | Host packages (US-only listing) | Assets | Computers plus technicians |
| 100 to 128 assets | $7,188 (12 × $599), or $5,999 once for lifetime; plus a scanner | $7,152 for 128 hosts (12 × $596) | $3,840 for up to 128 assets | $695 Professional or $1,195 Enterprise, on-prem, 100 computers, 1 technician |
| 512 assets | Same price, within the IP quota; plus a scanner | $17,868 (12 × $1,489) | Private Offer, no public price | Device-tier store price; figure not recorded on this page |
| 1,024 assets | Same price, within the IP quota; plus a scanner | $28,224 (12 × $2,352) | Private Offer | Store tier or sales |
| 2,048+ assets | Same price only if your fleet fits the license’s IP quota | $44,628 for 2,048 hosts (12 × $3,719); $81,660 for 5,120 (12 × $6,805) | Private Offer | Store tier or sales |
What the table says
At 128 assets SITEY’s monthly plan is the most expensive line in this table; from about 512 hosts, measured against Qualys list prices and within SITEY’s IP quota, its flat price starts to pay off.
At 100 to 128 assets, SITEY’s monthly plan costs more over 12 months than Rapid7, ManageEngine and Qualys, before you add a scanner. Lifetime ($5,999 once) beats the monthly plan only if you keep SITEY beyond ten months. For a small estate with no scanner yet, every other product in this table lists a lower 12-month price than SITEY does before a scanner is even added.
At 256 hosts the two are close: Qualys lists $942 a month ($11,304 over 12 months), near SITEY’s monthly plan plus Nessus Professional at its listed price ($11,978, assuming one Nessus Professional license covers your fleet). At 512 hosts the gap opens: that SITEY total stays at $11,978, against $17,868 for Qualys VMDR on monthly contracts, and below the roughly $14,830 (our arithmetic) Qualys would cost if the full 17% saving applied. For Rapid7 and ManageEngine at that size we have no published list price, so we make no claim. Add AI usage, server and staff time before deciding. Vendor detail is on our Qualys alternative and Rapid7 InsightVM alternative pages.
If you also need patching
Tenable and Qualys both sell catalogue patching (Tenable Patch Management and Qualys VMDR FixIT), and Vicarius now also writes scripts for flaws with no vendor patch. SITEY writes a host-specific bash or PowerShell fix from the finding and host context. An approval gate with four autonomy levels and 18 risk-classified AI actions holds high-impact changes for a person, the agent applies the approved script, and a retest confirms closure.
| SITEY | Qualys VMDR FixIT | Tenable Patch Management | Vicarius vRx | |
|---|---|---|---|---|
| Listed price | $599 per month or $5,999 once | 128 hosts $935/month; 512 hosts $2,861/month; 2,048 hosts $7,455/month (monthly contract, US only) | No online price; quote | 10 endpoints $600 on a 12-month contract (Americas only); otherwise custom quote |
| Pricing basis | Flat, with an IP quota | Host packages | Per asset, annual subscription | Mainly managed assets, plus term, package and volume |
| Deployment | Your own Linux server | AWS Marketplace listing | On-prem or SaaS | SaaS (marketplace listing) |
| How fixes are produced | AI-written host-specific scripts; approval gate; agent applies; retest confirms | VMDR plus OS and 100+ third-party application patching | Windows (including drivers and BIOS), Mac, Linux, 20,000+ third-party apps; schedule, pause or roll back deployments | ScriptAI (announced 23 September 2026) writes Bash and PowerShell for flaws with no vendor patch, checked by Vicarius researchers before it runs |
Pricing models, explained
Packages of 128, 256, 512, 1,024, 2,048 and 5,120 hosts. Cost rises in steps as you cross each package.
Rapid7 sells up to 128 assets online, larger estates by private offer. The other two price by asset or managed asset.
Managed on-prem, annual subscription priced by IP, perpetual licensing also available. Tenable asks you to request a customized quote.
List prices are for 100 computers with one technician. Annual and perpetual options exist; Professional on-prem perpetual for 100 computers is $2,085.
$599 per month, cancel anytime, or $5,999 once for a perpetual license with one year of updates and engine feed. No per-asset fee and no scan quota, but each license has an IP quota; see the pricing page.
Hidden vulnerability management costs
- AI usage (SITEY). Not in SITEY’s price. You bring your own key for an OpenAI-compatible endpoint and your provider bills you. Finding text and host context go to that endpoint; you can use a self-hosted model endpoint or turn AI off.
- Server, database and people (SITEY). SITEY runs only on Linux (Ubuntu 22.04 or 24.04, Debian 12, RHEL or Rocky 9) with your own PostgreSQL database. There is no Windows server install, and someone technical has to install and operate it.
- Technicians (ManageEngine). Every ManageEngine price on this page is for one technician. Check the store if more people will operate it.
- Region and term. The Qualys listings are US only; the Vicarius entry is Americas only. Rapid7 lists discounts on 24- and 36-month contracts.
How to build a like-for-like budget
- Count what each vendor meters
Hosts, assets, IPs, or computers and technicians. For SITEY, check the IP quota.
- Decide on the scanner
Keep the one you own or budget a new one. For SITEY, it is always a separate line.
- Price the same term
Put every option on 12 months, then note the discounts listed for longer contracts.
- Add running costs
AI usage, server hardware, backups and staff time. Self-hosted software moves these costs to you.
- Request the quotes you still need
Security Center, Tenable Patch Management, Rapid7 above 128 assets and most vRx sizes are quote-only. SITEY is bought online and installed by you, with no sales call.
What the SITEY price covers
AI triage gives each finding a false-positive probability and a priority score using CVSS, EPSS and CISA KEV; the reasoning is stored and an analyst can overrule it. Windows and Linux agents apply approved scripts and report results and inventory. SITEY Bilisim builds SITEY at Giresun Teknopark, Bulancak, Turkey; its founder has been a security researcher since 2014 (CVE-2021-40960, CVE-2022-3792).
SITEY is not SaaS: you install and run it on your own Linux server, and you need a technical person to install and operate it. Each license has an IP quota. It is not air-gapped, because it connects to siteyvm.com for license validation and the engine feed. AI features need your own key, and your AI provider bills you for usage.
Frequently asked questions
How much does vulnerability management software cost?
List prices we found: $695 a year for ManageEngine Vulnerability Manager Plus Professional (on-prem, 100 computers, one technician), $3,840 for 12 months for Rapid7 InsightVM (up to 128 assets) and $596 a month for Qualys VMDR (128 hosts). SITEY is $599 a month or $5,999 once, plus a scanner.
Qualys vs Rapid7 pricing: which is cheaper?
At 128 assets on AWS Marketplace, Rapid7 InsightVM lists $3,840 for 12 months; Qualys VMDR lists $596 a month on a monthly contract ($7,152 over 12 months, up to 17% less on a 12-month contract). Above 128 assets Rapid7 uses private offers, so there is no public figure to compare. The Qualys listing is US only.
Does SITEY’s price include a scanner?
No. SITEY imports results from 16 scanners and launches scans directly in Nessus and OpenVAS. Budget the scanner separately or use one you already own.
Is SITEY priced per asset?
No. The price is flat, with no per-asset fee and no scan quota. Each license has an IP quota; see the pricing page.
Does SITEY run air-gapped, and what data leaves my network?
It is not air-gapped. It makes two connections to siteyvm.com, for license activation and validation and for the engine feed; neither carries scan data. Optional calls go to the OpenAI-compatible AI endpoint you choose, which receives finding text and host context (you can self-host the model endpoint or turn AI off), and to NVD, CISA KEV, FIRST EPSS, MSRC and the Microsoft Update Catalog. See our security page.
Should I buy monthly or lifetime?
Monthly is $599 and can be cancelled. Lifetime is $5,999 once: a perpetual license with one year of updates and engine feed, about ten months of the monthly plan.
Sources
- Qualys VMDR (US Only), AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-5g6ecotizcru6, accessed 24 September 2026.
- Qualys VMDR FixIT (US Only), AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-z7o6ewmgkl6ka, accessed 24 September 2026.
- Rapid7 InsightVM, AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-iytoknlkgcesm, accessed 24 September 2026.
- ManageEngine Vulnerability Manager Plus pricing: https://www.manageengine.com/vulnerability-management/pricing.html, accessed 24 September 2026.
- ManageEngine store: https://store.manageengine.com/vulnerability-management/, accessed 24 September 2026.
- Tenable buy page: https://www.tenable.com/buy, accessed 24 September 2026.
- Tenable Security Center: https://www.tenable.com/products/security-center, accessed 24 September 2026.
- Tenable Patch Management: https://www.tenable.com/products/patch-management, accessed 24 September 2026.
- Vicarius vRx, AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-pnvxqhtkzpckq, accessed 24 September 2026.
- Vicarius pricing: https://www.vicarius.io/pricing, accessed 24 September 2026.
- SiliconANGLE on Vicarius ScriptAI: https://siliconangle.com/2026/09/23/vicarius-launches-scriptai-to-write-fixes-for-flaws-with-no-vendor-patch/, accessed 24 September 2026.
- Greenbone OPENVAS FREE: https://www.greenbone.net/en/openvas-free/, accessed 24 September 2026.
- Greenbone feed comparison: https://www.greenbone.net/en/feed-comparison/, accessed 24 September 2026.
Nessus and Tenable are trademarks of Tenable, Inc. Qualys and VMDR are trademarks of Qualys, Inc. Rapid7 and InsightVM are trademarks of Rapid7, Inc. ManageEngine, Greenbone, OpenVAS, Vicarius, vRx and AWS Marketplace are trademarks of their respective owners. SITEY is not affiliated with or endorsed by any of these companies.