License & Deployment Mix: 29 tools – 13 OSS, 10 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)

What Is Vulnerability Management?

Vulnerability Management (VM) is the continuous process of identifying, classifying, prioritizing, remediating, and mitigating security vulnerabilities in an organization’s systems, applications, and infrastructure. Unlike point-in-time penetration testing, VM is an ongoing lifecycle that discovers weaknesses before attackers exploit them.

Vulnerability scanning is the automated discovery component – tools probe networks, hosts, web applications, containers, and cloud environments for known vulnerabilities (CVEs), misconfigurations, and security weaknesses. Scanning produces findings that must be prioritized, assigned to owners, tracked through remediation, and verified as resolved.

Enterprise vulnerability management platforms provide:

• Asset discovery – identify all systems, services, and applications across on-premises, cloud, and hybrid environments; maintain an accurate asset inventory as the foundation for scanning coverage
• Vulnerability scanning – automated detection of known CVEs, misconfigurations, default credentials, exposed services, and security weaknesses using authenticated and unauthenticated scan methods across network, web, container, and cloud targets
• Risk prioritization – rank vulnerabilities using CVSS (Common Vulnerability Scoring System), EPSS (Exploit Prediction Scoring System), CISA KEV (Known Exploited Vulnerabilities catalog), asset criticality, and business context to focus remediation on what matters most
• Remediation tracking – assign vulnerabilities to owners, set SLA deadlines, track remediation progress, verify fixes through rescanning, and report on mean time to remediate (MTTR)
• Compliance reporting – generate reports aligned to regulatory frameworks (PCI-DSS, HIPAA, SOC 2, CIS benchmarks, NIST, ISO 27001) with evidence of scanning coverage and remediation timelines
• Integration with patch management – connect vulnerability findings to patching systems to automate or accelerate remediation of missing patches and outdated software
• API security scanning – test REST, GraphQL, and SOAP APIs for injection flaws, broken authentication, excessive data exposure, and OWASP API Top 10 vulnerabilities
• Container and cloud scanning – scan container images, Kubernetes manifests, Infrastructure as Code (IaC) templates, and cloud configurations for vulnerabilities and misconfigurations before and after deployment

Vulnerability management is foundational to security posture. Without it, organizations cannot answer basic questions: “What vulnerabilities exist in our environment?” and “Are we fixing them fast enough?” Every major compliance framework requires regular vulnerability scanning and documented remediation.

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

This evaluation covers the full vulnerability management landscape.

Overview Comparison

Scanning Capabilities

Broadest scanning: Nessus/Tenable, Qualys VMDR, Rapid7 InsightVM (all scan types from one platform)

Best container/cloud: Trivy (OSS leader), Wiz and Orca Security (commercial agentless leaders)

Best web app scanning: OWASP ZAP (OSS), Burp Suite Pro and Invicti (commercial)

Detection & Prioritization

Best prioritization: Tenable (VPR + EPSS + KEV), Qualys (TruRisk), CrowdStrike (ExPRT.AI), Rapid7 (Real Risk)

Best OSS prioritization: Dependency-Track (EPSS + KEV + policy engine)

Remediation & Reporting

Best remediation workflows: Qualys VMDR, Tenable, Rapid7 InsightVM (full lifecycle with SLAs and ticketing)

Best auto-remediation: Snyk (auto-fix PRs for dependencies)

SSO / OIDC Comparison

OIDC is the preferred SSO protocol. The table notes each tool’s behaviour with Authentik as the IdP.

* = requires extension, plugin, or specific configuration

Best SSO support: CrowdStrike Spotlight (OIDC, SAML, SCIM), Wiz (OIDC, SAML, SCIM), Snyk (OIDC, SAML, SCIM), Checkmarx (OIDC, SAML, SCIM)

No SSO applicable: Nuclei, Nikto, Trivy, Grype, Vuls, Lynis, OpenSCAP (CLI tools – no web UI)

Monitoring Integration

Integration with a monitoring stack of Telegraf, InfluxDB, Grafana, and AlertManager.

Easiest monitoring integration: OpenVAS (syslog + API), Dependency-Track (webhooks + API), SonarQube (webhooks + API) – all self-hosted with well- documented APIs

CLI tools (Nuclei, Trivy, Grype, Nikto, Vuls, Lynis, OpenSCAP) require parsing JSON/SARIF output via Telegraf exec or Fluent Bit pipelines

Deployment & Scale

Self-hosted OSS: OpenVAS, OWASP ZAP, Dependency-Track, SonarQube, Archery, Clair

Agentless scanning: Orca, Wiz (cloud-native SideScanning / snapshot analysis – no agents on workloads)

Agent-based VM: CrowdStrike Spotlight and Microsoft Defender VM leverage existing EDR agents for vulnerability assessment (no separate scanner)

Tools

29 tools.

Acunetix

Acunetix is a web application vulnerability scanner specializing in Dynamic Application Security Testing (DAST).

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Archery

Archery (ArcherySec) is an open-source vulnerability assessment and management platform that aggregates results from multiple security scanning tools into a centralized dashboard.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Black Duck

Black Duck (formerly Black Duck Software, now part of Synopsys / recently divested) is an enterprise Software Composition Analysis (SCA) platform specializing in open-source security, license compliance, and software supply chain risk manag…

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Burp Suite Pro

Burp Suite is the industry-standard web security testing toolkit developed by PortSwigger. It provides an intercepting proxy, automated scanner, and extensive manual testing tools for web application security professionals.

License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: none

Website

Checkmarx

Checkmarx is a leading application security testing platform providing SAST (Static Application Security Testing), SCA (Software Composition Analysis), DAST, API security testing, and supply chain security.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Clair

Clair is an open-source container image vulnerability analysis tool originally developed by CoreOS (now Red Hat). It performs static analysis of container image layers to identify known vulnerabilities in OS packages.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

CrowdStrike Falcon Spotlight

CrowdStrike Falcon Spotlight is a vulnerability assessment module within the CrowdStrike Falcon platform.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Dependency-Track

Dependency-Track is an open-source OWASP Software Composition Analysis platform that consumes SBOMs (CycloneDX, SPDX) and continuously monitors components for known vulnerabilities and license risks.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none

Website · Source

Grype

Grype is an open-source vulnerability scanner for container images and filesystems, developed by Anchore.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

HCL AppScan

HCL AppScan is an enterprise application security testing platform providing DAST (Dynamic Analysis), SAST (Static Analysis), IAST (Interactive Analysis), and SCA (Software Composition Analysis).

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Intruder

Intruder is a cloud-based automated vulnerability scanning platform designed for small to mid-size businesses (SMBs) and development teams.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Invicti

Invicti (formerly Netsparker) is an enterprise web application security platform providing automated DAST and IAST scanning with a unique Proof-Based Scanning technology.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Lynis

Lynis is an open-source security auditing and hardening tool for Unix-based systems including Linux, macOS, and BSD.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Microsoft Defender Vulnerability Management

Microsoft Defender Vulnerability Management (MDVM), formerly Threat and Vulnerability Management (TVM), is a built-in vulnerability management capability within Microsoft Defender for Endpoint.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Nessus / Tenable

Nessus is the market-leading vulnerability scanner, originally created in 1998 by Renaud Deraison and now developed by Tenable.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Nikto

Nikto is an open-source web server scanner that performs comprehensive tests against web servers for dangerous files, outdated software versions, server misconfigurations, and CGI vulnerabilities.

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Nuclei

Nuclei is a fast, open-source template-driven vulnerability scanner from ProjectDiscovery, using YAML templates across HTTP, DNS, TCP, and other protocols with a large community template library.

License: MIT (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

OpenSCAP

OpenSCAP is an open-source implementation of the Security Content Automation Protocol (SCAP) standards maintained by NIST.

License: LGPL-2.1-or-later (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

OpenVAS / Greenbone

OpenVAS (Open Vulnerability Assessment Scanner) is the open-source vulnerability scanning engine at the core of the Greenbone Vulnerability Management (GVM) framework.

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Orca Security

Orca Security is an agentless cloud security platform (CNAPP) that provides vulnerability management, misconfiguration detection, malware scanning, lateral movement risk analysis, and compliance checking across AWS, Azure, GCP, and Alibaba…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

OWASP ZAP

OWASP ZAP (Zed Attack Proxy) is the world’s most widely used open-source web application security scanner.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Qualys VMDR

Qualys VMDR (Vulnerability Management, Detection, and Response) is a cloud-based vulnerability management platform that provides asset discovery, vulnerability assessment, prioritization, and remediation tracking in a unified workflow.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Rapid7 InsightVM

Rapid7 InsightVM is a vulnerability management solution built on the Nexpose scan engine with cloud-based analytics and live dashboards via the Rapid7 Insight Platform.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Snyk

Snyk is a developer-first security platform providing Software Composition Analysis (SCA), Static Application Security Testing (SAST), container image scanning, and Infrastructure as Code (IaC) security testing.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

SonarQube Community

SonarQube Community Edition is an open-source platform for continuous code quality and security analysis.

License: LGPL-3.0-or-later (OSS) · Kind: web · Deploy: native, docker · SSO: SAML

Website · Source

Trivy

Trivy is a comprehensive open-source security scanner developed by Aqua Security. It detects vulnerabilities, misconfigurations, secrets, and license issues across container images, filesystems, Git repositories, Kubernetes clusters, and Ia…

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Veracode

Veracode is an enterprise application security testing platform providing SAST (Static Analysis), DAST (Dynamic Analysis), SCA (Software Composition Analysis), manual penetration testing, and compliance reporting.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Vuls

Vuls (VULnerability Scanner) is an open-source agentless vulnerability scanner for Linux and FreeBSD systems.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Wiz

Wiz is a cloud security platform (CNAPP) providing agentless vulnerability management, cloud security posture management (CSPM), cloud infrastructure entitlement management (CIEM), container security, Kubernetes security posture management…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website