// scanner: qualys-vmdr
Qualys VMDR pricing 2026: quote-only, partner-reported ~$199 per asset per year
Cloud-native VMDR with TruRisk scoring. No public list price; quote-only above community-edition caps.
author: Oliver Wakefield-Smith · verified 2026-06-26
// direct-answer
What does Qualys VMDR cost in 2026?
Quote only (partner-reported ~$199 / asset / yr). Cloud-native VMDR with TruRisk scoring. No public list price; quote-only above community-edition caps.
Pricing snapshot
- VMDR baseQuote only. Third-party estimates ~$199/asset/yr at small estates.
- TotalCloud (CSPM)Add-on, quote-only
- PCI Compliance AppAdd-on, quote-only, ASV-included tiers exist
- Community EditionFree, capped at 16 assets
What scales, what does not
- Qualys list pricing has not been published on the product page in over 12 months. The $199/asset/yr figure cited across analyst write-ups is partner-reported and not a Qualys-quoted rate.
- TruRisk scoring is now the default prioritisation layer; do not budget on raw CVSS-only output.
- PCI ASV is sold as an integrated app, often a cleaner audit path than stitching Tenable + a separate ASV.
Where it hits the ceiling
Qualys wins on enterprise-grade inventory + PCI evidence packaging. Pricing opacity is the real friction.
// faq
FAQ
- Is Qualys VMDR pricing public?No. Qualys VMDR pricing is quote-only as of 2026-06-26. Figures cited are partner-reported.
- Is there a free tier of Qualys VMDR?No formal free tier. Trials and PoCs are common.
- Does Qualys VMDR cover web application scanning?Limited; for serious web DAST coverage pair with Burp Enterprise, Invicti, or Acunetix.
- Does Qualys VMDR produce PCI ASV evidence?Yes; Qualys VMDR either is a PCI Approved Scanning Vendor or its output is regularly used as part of an ASV-attested package.
- How often does Qualys VMDR update its vulnerability content?Daily for commercial scanners (Tenable plugins, Qualys signatures, Rapid7 recog). Open-source OpenVAS NVT feed is daily but lags commercial coverage by hours to days.