Qualys Pricing 2026: Ultimate Guide for Security Products

If a Qualys quote is on your desk, the quickest check is the price per asset: divide the annual total by the assets it covers and compare the result with what Qualys itself has published. Qualys pricing is quoted for most products, so this guide uses the public figures: Qualys’s own AWS Marketplace listings, its launch press releases, its TotalCloud pricing calculator and Vendr’s 2026 data, all checked in October 2026.

Key takeaways:

• Qualys sells VMDR per asset; its own AWS listing prices a 128-host package at $596 a month.
• The Qualys pricing calculator turns cloud resources into Qualys Units (QLU); your quote sets the dollar price per QLU.
• Patch Management launched at $29.95 per asset in 2019; Qualys has quoted it privately since.
• Vendr’s 2026 data puts the median Qualys contract at $36,952 a year across 108 purchases.
• Tenable and Rapid7 publish per-asset prices, the closest public benchmark for a Qualys quote.

How Much Does Qualys Cost in 2026?

A typical Qualys contract costs $36,952 a year: that is the median in Vendr’s 2026 Qualys benchmark, built on 108 purchases, with a range of $3,617 to $126,487. Where your contract lands depends on how many assets you license, which apps you add and how long you commit.

Qualys quotes most products per asset, through its sales team and partners. Qualys has published prices itself in two places: launch press releases for VMDR, Patch Management and Web Application Scanning, and host packages on AWS Marketplace. The comparison table below lists each figure with its date and source.

To test before you buy, Qualys offers no-cost 30-day trials of VMDR, Patch Management, TotalCloud and other apps on its free trials page.

Qualys shows which of your assets are exposed; the open question is whether anyone exploits one of them before the patch lands. The UnderDefense Agentic AI SOC works on top of the SIEM, EDR, cloud and identity tools you already run: AI agents triage each alert in about 2 minutes from alert to triage, and analysts make the response decision around the clock.

Qualys Pricing Comparison Table

The table lists each Qualys product with the unit it is billed by and the latest price Qualys itself has published, with the year, so you can see how old each public figure is before you compare it with a quote.

The 2017 and 2019 figures are launch prices from Qualys press releases; the 2026 figures come from Qualys’s own AWS Marketplace listings, checked on October 19, 2026. Use them as reference points and expect your quote to differ by volume and term.

Qualys Pricing Calculator: How to Sanity-Check a Quote

Qualys’s own pricing calculator sits on its TotalCloud QLU pricing page. You enter how many cloud resources each module protects (virtual machines, serverless functions, container images, SaaS users), and the calculator returns a total in Qualys Units (QLU), with a Save as PDF button for your procurement file. It stops at units: the dollar price per QLU comes from your quote.

The conversion ratios Qualys publishes on the same page decide how fast each module uses up units:

Only virtual machines and serverless functions count toward CSPM; Qualys covers S3 buckets, databases, load balancers, VPCs, subnets and other cloud resources at no additional cost. So 200 virtual machines and 1,000 serverless functions under CSPM come to 1,680 QLU (1,600 plus 80). Divide the annual quote by that total, and you have a per-QLU price to compare across partners and renewals.

Checking a VMDR Quote Against Qualys’s Own Per-Host Prices

For VMDR, no Qualys calculator returns dollars, but the Qualys VMDR (US Only) listing on AWS Marketplace, sold by Qualys, prices host packages, which gives you a per-host rate for each band:

These are 1-month contract prices, annualized; the listing says a 12-month contract saves up to 17%. Divide the annual VMDR line in your quote by your host count and set it next to the band you fall into. A higher rate can be fair when the line bundles Patch Management or Policy Audit, so ask for those as separate lines.

Qualys Products Overview: Pricing and Features

Qualys sells its products as separate apps on one platform, and each app has its own billing unit. The sections below cover the six apps buyers price most often, with the latest public figure for each and the source behind it.

Qualys VMDR Pricing and Features

Qualys VMDR (Vulnerability Management, Detection and Response) finds, assesses and prioritizes vulnerabilities across on-premises, cloud and internet-facing assets. Qualys VMDR pricing is per asset: Qualys’s 2019 launch release set it at $199 per asset with a 32-asset minimum, and Qualys has sold it by quote and in AWS host packages since.

Key features of Qualys Vulnerability Management (VMDR): 

• Vulnerability and configuration assessment: scans on-premises, cloud and internet-facing assets from one platform.
• Patch detection and CVE correlation: shows which missing patch fixes each vulnerability.
• Risk-based prioritization: TruRisk ranks vulnerabilities by exploitation in the wild, including by ransomware.
• Sensors included: unlimited virtual scanners, Cloud Agents and passive sensors, according to Qualys.

Pros of Qualys Vulnerability Management (VMDR):

• Coverage of on-premises, cloud and remote assets
• Risk-based prioritization
• Automation for faster remediation
• Continuous Monitoring
• Compliance support

Cons of Qualys Vulnerability Management (VMDR):

• No current list price on qualys.com; quotes come through sales and partners
• Assets above the contracted count can trigger true-up charges, according to Vendr
• AWS Marketplace packages are US-only and come in fixed host steps

Best for:

• Mid-size and large organizations that want vulnerability management priced per asset
• Organizations needing automated risk prioritization and patching
• Companies with compliance requirements (SOC 2, ISO 27001, HIPAA, etc.)

Qualys Patch Management Pricing and Features

Qualys Patch Management (PM) deploys operating system and third-party patches through the same Cloud Agent that VMDR uses. When Qualys launched it, its 2019 press release set pricing at $29.95 per asset. Qualys has published no PM price since, and Vendr’s 2026 data describes it as an add-on to VMDR, priced per endpoint or server.

The one current public price includes PM in a bundle: the VMDR ProtectIT listing on AWS Marketplace, sold by Qualys to US buyers, combines VMDR, Patch Management and EDR at $1,540 a month for 128 hosts. That is $944 a month above VMDR alone for the same hosts, and it covers PM and EDR together, so treat it as an upper bound for PM.

Key features of Qualys Patch Management:

• Operating system and third-party patching: Windows, Linux and Mac, plus third-party applications, from one dashboard.
• Vulnerability-to-patch mapping: matches VMDR findings to the patches or configuration changes that fix them.
• Zero-touch patching: scheduled jobs that patch prioritized software automatically.
• Remote endpoints: patches roaming devices outside the corporate network through the Cloud Agent.

Pros of Qualys Patch Management:

• No second agent where VMDR Cloud Agents already run
• Works next to SCCM or an existing patch tool, according to Qualys
• No-cost 30-day trial

Cons of Qualys Patch Management:

• No current published price; the last public figure dates from 2019
• Vulnerability-to-patch mapping draws on VMDR findings, so it pays off most alongside a VMDR license
• The AWS bundle that includes PM also includes EDR, whether or not you need it

Best for:

• Teams already running Qualys Cloud Agents for VMDR
• IT teams patching third-party applications next to SCCM
• Organizations with remote and roaming endpoints

Qualys Web Application Scanning (WAS) Pricing and Features

Qualys WAS scans web applications and APIs for vulnerabilities such as the OWASP Top 10. Qualys last published WAS prices in a 2017 press release: annual subscriptions priced by the number of web applications, starting at $1,695 for small businesses and $2,495 for larger enterprises. Current WAS pricing comes by quote, so ask for the price per application.

Key features of Qualys Web Application Scanning (WAS):

• Web application testing: detects OWASP Top 10 vulnerabilities.
• Automated scanning: finds SQL injection, cross-site scripting and similar flaws.
• API coverage: tests SOAP and REST API services alongside browser-based apps.
• DevSecOps integration: runs scans from CI/CD pipelines.

Pros of Qualys Web Application Scanning (WAS):

• Broad web application and API coverage
• Automated scanning and remediation
• Advanced threat detection with AI and machine learning
• Detailed reporting and dashboards
• Compliance support

Cons of Qualys Web Application Scanning (WAS):

• Priced per web application, so a large app portfolio raises the bill quickly
• The last published price dates from 2017; current pricing is by quote
• Sold as its own subscription, separate from VMDR licenses

Best for:

• Businesses with multiple web applications or APIs
• Organizations implementing DevSecOps
• Enterprises needing automated vulnerability detection & compliance

Qualys Compliance Solutions (Policy Audit) Pricing and Features

Qualys offers compliance management solutions to help businesses meet regulatory requirements and ensure their security frameworks align with industry standards.

Qualys now sells its compliance product as Policy Audit, formerly Policy Compliance, and publishes no price for it. Vendr’s 2026 data describes per-asset pricing, sold as an add-on to VMDR or as a standalone app.

Key features of Qualys Compliance Solutions:

• Configuration assessment: checks system settings against CIS Benchmarks, DISA STIGs and your own policies.
• Policy library: prebuilt policies mapped to frameworks such as NIST, PCI DSS and HIPAA.
• Audit Fix: remediates failed controls from the same console.
• Audit reporting: standardized compliance reports for auditors.

Pros of Qualys Compliance Solutions:

• Streamlined compliance reporting and auditing
• Real-time monitoring for continuous compliance
• Runs alongside other Qualys apps on the same platform
• Pre-configured templates to simplify setup
• Saves time and resources on compliance management

Cons of Qualys Compliance Solutions:

• No published price; quotes are per asset
• Licensed separately from VMDR, according to Vendr

Best for:

• Enterprises with strict compliance requirements
• Organizations needing automated compliance reporting
• Financial, healthcare, and government sectors

Qualys TotalCloud CSPM Pricing and Features

Qualys sells cloud security posture management (CSPM) as part of TotalCloud, its CNAPP. Qualys CSPM connects to AWS, Microsoft Azure, Google Cloud and OCI accounts through the providers’ APIs, with no agents, and checks configurations against more than 1,000 built-in controls, according to Qualys.

Qualys CSPM pricing runs on Qualys Units, at the ratios in the calculator section above. Qualys does not publish the dollar price of a QLU, and the TotalCloud listing on AWS Marketplace, sold by Carahsoft, is for private offers only. Billing units vary across CSPM tools, so convert each quote to a price per virtual machine before you compare.

Key features of Qualys TotalCloud CSPM:

• Agentless onboarding: connectors read cloud accounts through provider APIs.
• Built-in controls: more than 1,000 checks, including CIS foundation benchmarks.
• Compliance mapping: over 40 mandates, such as PCI DSS, HIPAA, NIST CSF and GDPR.
• One-click remediation: fixes misconfigurations for over 50 high-visibility controls.
• Attack paths: TruRisk Insights shows how misconfigurations combine into routes to compromise.

Pros of Qualys TotalCloud CSPM:

• No agents to deploy for posture checks
• Storage, database and network resources add no units
• Same TruRisk scoring as VMDR
• No-cost 30-day trial

Cons of Qualys TotalCloud CSPM:

• No published dollar price per QLU
• CSPM covers configuration; vulnerabilities inside workloads need workload protection, priced separately in QLU
• The shared QLU pool (QFlex) is available on request, per Qualys documentation

Best for:

• Teams already on VMDR that want cloud posture in the same console
• Multi-cloud estates across AWS, Azure, Google Cloud or OCI
• Clouds with many storage and network resources and fewer virtual machines

The same per-VM conversion works for a cloud-native CSPM quote, such as one built on Wiz pricing.

Qualys Enterprise TruRisk Platform Pricing and Features

The Qualys Enterprise TruRisk Platform is an all-in-one security solution that combines vulnerability management, threat intelligence, compliance automation, and risk assessment.

Qualys publishes no price for the Enterprise TruRisk Platform; it is quoted by asset count and the apps included. Its Enterprise TruRisk Management (ETM) app is metered in Qualys Units, according to Qualys documentation.

Key features of Enterprise TruRisk Platform:

• Risk-based prioritization: TruRisk scores combine severity, exploitability, threat intelligence and business context.
• Unified risk view: aggregates Qualys and non-Qualys risk factors in one place, according to Qualys.
• Real-time threat intelligence: live threat indicators feed the scores.
• Cloud delivery: no on-premises hardware to run the platform.

Pros of Qualys Enterprise TruRisk Platform:

• Real-time risk prioritization based on real-world threat intelligence
• Works across the Qualys apps you already license
• Provides a clear view of risk across the entire infrastructure
• Enhances decision-making with detailed risk reporting
• Helps align security efforts with business goals

Cons of Qualys Enterprise TruRisk Platform:

• No published price; the quote depends on asset count and apps
• A platform contract commits several risk areas to one vendor at once

Best for:

• Large enterprises managing complex IT infrastructures
• Organizations looking for an integrated risk management solution
• Businesses needing full security lifecycle management

How to Negotiate Qualys Pricing With the Per-Asset Rate

A Qualys quote is a per-asset rate multiplied by an asset count, across several apps. Buyers in Vendr’s 2026 dataset saved 13% on average, and each lever below works on one side of that multiplication:

• Get the rate for every app. Ask for VMDR, Patch Management, Policy Audit and TotalCloud as separate lines, each with its unit and unit price, so each one can be checked against the public figures on this page.
• Clean the count first. Qualys documentation counts any host, IP address, URL, web application or user identity it scans as an asset, and tells customers to set purge rules so inactive assets do not inflate usage. Purge before the count that sets your band.
• Buy a band with headroom. Vendr reports overage fees or mid-term true-ups at higher per-asset rates when assets exceed the contract, and suggests negotiating a 10% to 20% buffer above your current count.
• Bring your own QLU total. For TotalCloud, run the calculator before the call and ask the quote to state the QLU count and the price per QLU. A quote that counts more units than your own total needs an explanation.
• Show a published competitor rate. Tenable and Rapid7 publish per-asset prices, compared in the next section, and Vendr reports that competitive evaluations drove a further 10% to 20% off in final negotiations.

Term length and quarter-end timing also move a Qualys quote, according to Vendr, and the per-asset rate is the number to anchor every other concession on.

Qualys Pricing vs Tenable and Rapid7: Published Per-Asset Prices

Tenable and Rapid7 sell vulnerability management on the same per-asset model and publish entry prices, which makes them the closest public reference for a Qualys quote. The figures below were checked on October 19, 2026.

Qualys VMDR vs Tenable Vulnerability Management

Pricing comparison: Tenable’s buy page sells Tenable One Vulnerability Management online for up to 250 assets; in Tenable’s US store, 100 assets cost $3,700 for a 1-year subscription, or $37 per asset. Qualys sells VMDR in AWS host packages, so compare the two at the same asset count.

Pricing notes: Tenable’s store prices vary by country, and larger estates go through Tenable sales. Tenable One Exposure Management is sold by quote, which puts the rest of Tenable pricing in the same position as most Qualys apps.

Qualys VMDR vs Rapid7 InsightVM

Pricing comparison: Rapid7’s pricing page lists InsightVM from $1.62 per asset per month at 500 assets, which is $19.44 per asset a year, or $9,720 a year for 500 assets.

Pricing notes: Rapid7 now packages InsightVM inside Exposure Command, whose packages are quoted, so ask whether the per-asset rate applies to your scope. The wider Rapid7 pricing lineup follows the same quote-based pattern.

Qualys TotalCloud CSPM vs Rapid7 InsightCloudSec

Pricing comparison: Rapid7 lists InsightCloudSec from $5,775 a month for up to 500 instances, or $138.60 per instance a year. Qualys publishes the CSPM unit ratio of 8 QLU per virtual machine and keeps the dollar price per QLU to the quote.

Pricing notes: multiply your quoted price per QLU by 8 to get a per-VM figure you can set next to Rapid7’s per-instance rate; at about $17.33 per QLU, the two list prices match.

These are list prices at entry volumes. Put them next to the per-asset rate in your Qualys quote, and the gap shows where to push. If the gap is large, a wider field of Tenable alternatives covers the same per-asset category.

Qualys Finance and Procurement FAQ

What counts as an asset in a Qualys contract?

Any host, system, endpoint, IP address, device, URL, web application, user identity or other object that Qualys scans or processes, according to Qualys documentation. Inactive assets keep counting until purge rules remove them, so set those rules before the count that sizes your contract.

Can you buy Qualys through AWS Marketplace?

Yes. Qualys sells VMDR and VMDR ProtectIT on AWS Marketplace as host packages for US buyers, billed through your AWS account on 1-month or 12-month contracts. TotalCloud is listed there by Carahsoft for private offers only.

Are scanners included in the Qualys VMDR price?

Qualys lists unlimited virtual scanners, Cloud Agents, passive sensors, agent gateways and container sensors as part of VMDR. Vendr’s 2026 data notes that scanner appliances can still appear as separate line items, so ask whether your quote includes any.

Does a Qualys quote include professional services?

Usually not. Vendr’s 2026 data shows implementation, integration and training quoted separately, adding 10% to 25% to the total contract value. Ask for a fixed-fee services line so it does not grow with hourly billing.

How UnderDefense Works on Top of Qualys

Qualys tells you which assets are exposed, and attackers move before the patch lands. Verizon’s 2026 DBIR found exploitation of vulnerabilities was the most common initial access vector, at 31%, and only 26% of critical CISA KEV vulnerabilities were fully remediated in 2025, with a median of 43 days. Someone has to watch the exposed assets during those weeks; IBM’s 2026 breach study puts the average breach at $4.99 million.

UnderDefense builds an agentic AI platform that unifies security operations and compliance on top of the stack you already own, so Qualys stays your exposure source. The table shows what changes for your team.

Every investigative step is visible to your team, so the patch owner sees why an asset was escalated.

Have Qualys findings waiting on the next patch window? Book a triage demo