If you are looking for a Qualys alternative because per-host pricing keeps climbing as your estate grows, start with one condition: SITEY does not include a scanner. You bring your own, such as Nessus Professional or OpenVAS, or you import reports from one of 16 supported tools, Qualys included. SITEY is the self-hosted layer that takes those findings through AI triage, host-specific remediation scripts, human approval and retest, for a flat $599 a month or $5,999 once. This page compares it with Qualys VMDR using sourced list prices, and says plainly where Qualys is the better buy.
Qualys VMDR pricing compared with SITEY
Qualys publishes host-tier prices for VMDR on AWS Marketplace. The figures below are month-to-month list prices from the US-only AWS Marketplace listings, next to SITEY’s monthly plan. Qualys prices by host package. SITEY charges one price with no per-asset fee, but each SITEY licence has an IP quota, so check that your estate fits on the pricing page before you compare the larger rows.
| Hosts | SITEY (monthly plan) | Qualys VMDR | Qualys VMDR FixIT |
|---|---|---|---|
| 128 | $599 | $596 | $935 |
| 256 | $599* | $942 | Not checked |
| 512 | $599* | $1,489 | $2,861 |
| 1,024 | $599* | $2,352 | Not checked |
| 2,048 | $599* | $3,719 | $7,455 |
| 5,120 | $599* | $6,805 | Not checked |
Qualys figures: AWS Marketplace list prices, US Only, 1-month contract, USD per month, accessed 24 September 2026; the VMDR listing is SaaS. The VMDR listing says a 12-month contract saves up to 17%; 12-month amounts are not shown separately. FixIT adds OS and 100+ third-party application patching to VMDR. “Not checked” means we did not capture that FixIT tier, not that it does not exist. *SITEY’s price applies only if the host count fits your licence’s IP quota. SITEY’s column excludes your scanner, server and AI usage.
How to read this table honestly
At 128 hosts, Qualys wins on price. Its month-to-month list is $3 below SITEY’s monthly plan, and the 12-month contract, which Qualys says saves up to 17%, can widen the gap. If you run around a hundred hosts and have no scanner today, Qualys VMDR is the simpler and cheaper purchase.
From 256 hosts up, SITEY’s list price is lower, and the gap grows with each tier: $343 a month at 256 hosts, $890 at 512, $1,753 at 1,024. Even the full 17% discount does not close it at 256 hosts. But the columns are not like for like, because Qualys brings its own detection and SITEY does not. Put these lines on SITEY’s side before you decide:
| Cost line | SITEY | Qualys |
|---|---|---|
| Detection | Not included. A commercial scanner licence, or OpenVAS | Qualys’s own scanning and Cloud Agent |
| Hosting | Your Linux server | SaaS on this listing; Private Cloud Platform for on-premises |
| Database | Your own PostgreSQL, which you back up and maintain | Part of the SaaS service |
| Patching | Included: host-specific scripts, applied by the SITEY agent within your approval policy | FixIT tier or Qualys Patch Management |
| AI usage | Not in the price. Your own OpenAI-compatible key and bill, or AI switched off | Not compared here |
On the scanner line, note that Greenbone positions OPENVAS FREE, which uses the Community Feed, for private use and non-professional IT infrastructures. Most businesses should budget for a commercial scanner licence and add it to SITEY’s column.
Where Qualys is the stronger choice
Qualys is a mature platform, and several things it does, SITEY does not do at all. If any of these is a hard requirement, Qualys is likely the better fit.
Qualys brings its own scanning and the Qualys Cloud Agent, and states that it is a PCI SSC Approved Scanning Vendor. SITEY has no scanner and is not an ASV.
Qualys Private Cloud Platform runs on your own premises, so “Qualys is cloud-only” is not accurate. If on-premises is your only reason to leave, compare that option first.
VMDR FixIT adds OS and third-party application patching. Qualys Patch Management can remediate Windows vulnerabilities with a job that combines missing patches and configuration scripts, on Windows Cloud Agent 5.7.0 or later.
In September 2026 Qualys described a loop in which Agent Val chooses what to validate and TruConfirm validates exploitability on live assets, TruRisk Eliminate scores patch reliability before deployment and rolls patches out in waves from least to most critical assets, and humans define the rules and thresholds and review exceptions.
TruRisk Eliminate can isolate a host through the Cloud Agent when a remediation deadline passes and the vulnerability is still open, with no EDR integration. Qualys says this is exclusive to TruRisk Eliminate customers and not part of VMDR. SITEY does not isolate hosts.
What SITEY does differently
SITEY is built for teams that already have findings and need them fixed, verified and recorded on their own server, with no per-asset fee.
One price, bought online
$599 a month, cancel anytime, or $5,999 once for a perpetual licence that includes a year of updates and the engine feed. There is no per-asset fee and no scan quota, but each licence has an IP quota. You buy online, install it yourself and never sit through a sales call.
Your server, your PostgreSQL
SITEY installs on Linux only: Ubuntu 22.04 or 24.04, Debian 12, RHEL or Rocky 9. There is no Windows server version. Findings, assets and history live in your own PostgreSQL database. Agents run on your Windows and Linux endpoints, apply approved remediation scripts and report results and inventory back.
Triage you can check
AI triage gives each finding a false-positive probability and a priority score built on CVSS, EPSS and CISA KEV. The reasoning is stored with the finding, and an analyst can reverse the verdict.
A fix written for that host
AI remediation planning writes a bash or PowerShell script for the specific host a finding was reported on, rather than a generic advisory. The SITEY agent on that host applies it once released.
A person releases high-impact changes
The approval gate has four autonomy levels and classifies 18 AI actions by risk. High-impact changes wait for a human approver, who sees the actual script and target, and the decision is logged with a name and a timestamp.
Closed means retested
A successful fix moves a finding to awaiting retest, not resolved. For a Nessus finding, Retest and closure launches a new Nessus scan against the original target and matches that specific finding (high and critical severities only); for other sources the verification method differs, and the module page lists each one.
SITEY is not SaaS. You install and run it, and you need someone technical to install, update and operate the server, the database and the agents. It includes no scanner. Each licence has an IP quota, see the pricing page. It is not air-gapped: it connects to siteyvm.com for licence activation and validation and for the engine feed, and neither connection carries scan data. AI features need your own OpenAI-compatible key, and that usage is billed by your provider, not included in SITEY’s price.
Moving from Qualys to SITEY
You do not have to switch in one step. SITEY imports Qualys XML exports through its scanner integrations, so you can load current findings and run both side by side while you evaluate.
- Prepare a Linux server and PostgreSQL
Use one of the supported distributions and a PostgreSQL instance you control, then install SITEY and activate the licence.
- Import your Qualys findings
Upload a Qualys XML export. Findings are normalised into the same schema as every other scanner and deduplicated. Try one export first and check that hosts, ports and CVEs arrived as expected.
- Connect the scanner you will keep
SITEY launches scans directly only for Nessus and OpenVAS. For every other tool, Qualys included, you run the scan in that tool and import the report.
- Roll out agents
Install the SITEY agent on the Windows and Linux endpoints you want remediated. Without an agent, a host still gets triage but no automated fix.
- Set autonomy and approvers
Start with a conservative autonomy level, name your approvers, and widen automation only for finding classes you trust.
One caveat: SITEY cannot launch a Qualys scan, so a Qualys-sourced finding is not retested by re-running Qualys. After a fix it falls back to agent-based verification, which looks for a completed remediation job on that exact host; if no agent matches, the finding stays open and is flagged for a manual check.
Frequently asked questions
Is SITEY cheaper than Qualys VMDR?
It depends on host count. At 128 hosts, Qualys VMDR’s month-to-month list price ($596) is slightly below SITEY’s $599, and its 12-month contract, at up to 17% off, can be cheaper still. From 256 hosts up, SITEY’s list price is lower, but you must add a scanner licence, your own server and any AI usage, and your hosts must fit the licence’s IP quota.
Does SITEY include a vulnerability scanner?
No. SITEY imports results from 16 scanners, including Qualys, Nessus, Tenable, OpenVAS, Nexpose, Nmap, Nuclei and Burp Suite, and launches scans directly only for Nessus and OpenVAS.
Is SITEY air-gapped? What data leaves my network?
SITEY is not air-gapped. It makes two connections to siteyvm.com, licence activation and validation, and the engine feed; neither carries scan data. Optional outbound calls go to the OpenAI-compatible AI endpoint you choose, which receives finding text and host context, and to NVD, CISA KEV, FIRST EPSS, MSRC and the Microsoft Update Catalog. You can point AI at a model endpoint you host yourself, or turn AI off. The security page covers the details.
Can I keep Qualys and use SITEY for remediation?
Yes. Keep scanning in Qualys and import its XML exports into SITEY for triage, remediation scripts, approval and verification. SITEY does not start Qualys scans, so Qualys-sourced findings are verified through the SITEY agent on that host, or flagged for a manual check when no agent matches.
Will SITEY change my servers without approval?
High-impact changes wait for a named human approver. You choose one of four autonomy levels per policy, and the gate classifies 18 AI actions by risk, so any unattended run stays within the policy scope you set.
Who builds SITEY?
SITEY Bilisim, based in Giresun Teknopark, Bulancak, Turkey. The founder has worked as a security researcher since 2014 and is credited with CVE-2021-40960 and CVE-2022-3792.
Sources
- Qualys VMDR (US Only), AWS Marketplace listing: aws.amazon.com/marketplace/pp/prodview-5g6ecotizcru6, accessed 24 September 2026.
- Qualys VMDR FixIT (US Only), AWS Marketplace listing: aws.amazon.com/marketplace/pp/prodview-z7o6ewmgkl6ka, accessed 24 September 2026.
- Qualys Private Cloud Platform: qualys.com/private-cloud, accessed 24 September 2026.
- Qualys PCI ASV compliance: qualys.com/apps/pci-asv-compliance, accessed 24 September 2026.
- Qualys Patch Management documentation, vulnerability remediation with configuration scripts: docs.qualys.com/en/pm/latest/patches/vuln_remediation_config_scripts.htm, accessed 24 September 2026.
- Qualys blog post on its autonomous remediation engine, 17 September 2026: blog.qualys.com/product-tech/2026/09/17/…, accessed 24 September 2026.
- Qualys blog, automated asset isolation for CISA KEV deadlines: blog.qualys.com/product-tech/2026/09/15/automate-asset-isolation-cisa-kev-deadlines, accessed 24 September 2026.
- Greenbone, OPENVAS FREE: greenbone.net/en/openvas-free/, accessed 24 September 2026.
Qualys, Qualys VMDR, TruRisk and related names are trademarks of Qualys, Inc. Nessus and Tenable are trademarks of Tenable, Inc. OpenVAS and Greenbone are trademarks of Greenbone AG. AWS Marketplace is a trademark of Amazon.com, Inc. or its affiliates. SITEY is not affiliated with or endorsed by Qualys, Tenable, Greenbone or Amazon.