No more typing reviews! Try our Samantha, our new voice AI agent.

AWS Security Hub vs Devo comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 18, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
55
Ranking in other categories
Vulnerability Management (5th), Container Security (8th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (6th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
AWS Security Hub
Average Rating
7.6
Reviews Sentiment
6.5
Number of Reviews
27
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (8th), Cloud Security Posture Management (CSPM) (20th)
Devo
Average Rating
8.2
Reviews Sentiment
6.5
Number of Reviews
30
Ranking in other categories
Log Management (21st), Security Information and Event Management (SIEM) (16th), IT Operations Analytics (7th), AIOps (17th)
 

Mindshare comparison

Cloud Security Posture Management (CSPM) Mindshare Distribution
ProductMindshare (%)
AWS Security Hub2.5%
Wiz10.3%
Prisma Cloud by Palo Alto Networks7.5%
Other79.7%
Cloud Security Posture Management (CSPM)
Log Management Mindshare Distribution
ProductMindshare (%)
Devo1.4%
Splunk Enterprise Security7.3%
IBM Security QRadar4.6%
Other86.7%
Log Management
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
Misbah Mohammed Kollathodi - PeerSpot reviewer
Engineering Technical Leader Sre (Cloud/Kubernetes Security) at Cisco
Centralized compliance monitoring has strengthened our cloud security posture and daily governance
AWS Security Hub is something which I basically use to see how much your infrastructure is compliant. It is basically what we call a CSPM, which is a cloud security posture management tool. You can automate the best practices and continue with security best practices; it will give you your misconfigurations and aggregate all your tickets in one place. The best thing about AWS Security Hub is that it is a single point of place where you can get all your misconfigurations without having to go to each service and check. For example, if your business deals with any compliance like PCI DSS or FSBP and ISD, you can check how much your infrastructure is compliant with these standards. Each standard has several security controls, and AWS Security Hub checks these security controls and tells us what percentage your application and infrastructure is compliant with these standards. It also has integration with GuardDuty, Inspector, and other AWS services. In that aspect, it provides a lot of findings. It also supports some third-party product sources. I believe it will reduce your effort to correct those findings and can automate the security tests, consolidate the view of findings across accounts and providers. You can also apply remediation for these findings and automate that; for example, if somebody opens the security group, you can use tools such as Amazon Inspector to close this port when this finding comes. So I would say it is a good tool for cloud security, cloud security posture management, compliance management, and all these things. If you are dealing with sensitive data, it is very critical. A lot of people are using AWS Security Hub today in our company, maybe in every account we have. It is a must for cloud security. I believe bigger organizations use that, so it is a need for our security strategy.
Usama Khan - PeerSpot reviewer
Team Lead Soc at a tech services company with 51-200 employees
Advanced threat hunting has improved SOC visibility and now supports faster incident response
Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default. I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved. Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of Qualys TotalCloud is the visibility it provides."
"The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility."
"Once you have your vulnerabilities fixed and your patches pushed out using Qualys TotalCloud, then you are able to eliminate threats and cyber risk."
"I would rate Qualys TotalCloud ten out of ten."
"If I had to say something positive about the product that brings me the biggest benefit, I would say it has accurate reports, gets new update CVEs, zero-day attack detection, and is easy to manage with its GUI."
"I like the web API security and IoT scanning features the most. The user-friendly design of TotalCloud's interface enables customers to navigate it and use its full potential easily"
"The best features in Qualys TotalCloud include the total asset management of the cloud environment. It is very easy to export the report and see the vulnerabilities related to the cloud specifically."
"One of the features I appreciate is the ability to generate daily reports without relying on anyone else."
"Within AWS Security Hub, there is a feature for aggregating and prioritizing security findings which allows for better risk prioritization based on misconfiguration, as they know AWS thoroughly."
"I find all of the features to be highly valuable."
"One of the most effective features of AWS Security Hub is the easy access to a dashboard with a ready-to-use security score."
"Currently, our organization utilizes AWS for various purposes, including SaaS (Software as a Service), PaaS (Platform as a Service), and hosting applications in the cloud. We develop our applications and use AWS services as a platform for basic functions and secondary development needs. Additionally, we rely on PaaS for accounting services. Approximately, 50% of our applications are hosted in the cloud environment, making it a significant part of our current setup."
"Though I'm still in the initial evaluation phase for AWS Security Hub, I would recommend it to others because it has good features."
"I really like the seamless integration with the AWS account structure. It can even be made mandatory as part of the landing zone. These are great features. And there's a single pane of glass for the entire account."
"The solution is very good at detection and providing real-time alerts."
"The solution shows us our compliance score."
"The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."
"Overall, Devo is awesome, but it's got some room to grow."
"Devo is simpler and easier for beginners because the data ingestion is more streamlined and it includes a visual query interface, whereas Splunk is more complex but also more flexible."
"Overall, I have no issues with it and my guys love it."
"The features I find most valuable in Devo are that it works on unstructured data."
"Devo helps us to unlock the full power of our data because they have more than 450 parsers, which means that we can ingest pretty much any type of log data."
"Devo has improved our visibility, log management efficiency, and investigation capabilities positively."
"The Hyperstream engine and real-time alerting help my team by leveraging a stream-oriented architecture that minimizes latency during data ingestion."
 

Cons

"TotalCloud could improve its scanning of niche devices like Wi-Fi dongles and USB modems because they are often untested. It covers everything else, like laptops, mobile devices, and Bluetooth IoT devices. They can improve on the small IoT devices because hackers and testers use these."
"The cost of Qualys TotalCloud is high and could be more competitive."
"There is a lack of data segregation according to criticality or inventory."
"In my opinion, the combination of detection and protection features in Qualys TotalCloud cannot protect but can only detect."
"Qualys TotalCloud needs to enhance its scanning capabilities in the IP domain, as it currently lacks the functionality to resolve IPs to their corresponding domain names."
"The cloud licensing unit system is unclear, especially since "units" aren't well-defined."
"The vulnerability part is good, but the policy compliance module needs improvement because it involves a lot of manual work. Specifically, the remediation part of the controls requires enhancements."
"Some major banks and insurance companies require an on-premises solution for comprehensive vulnerability management, which TotalCloud does not offer."
"Many findings are too generic or irrelevant to the environment, which can lead to false positives."
"I would like a more fine-grained capability for creating custom rules and a more user-friendly experience programmatically in writing queries and configuring custom security rules, making it quicker and easier."
"The support must be quicker."
"The solution will only give you insight if you have configure rule enabled. It should work more like Prisma Cloud and Dome9 which have a better approach."
"Right now, there are some difficulties we're facing with AWS Security Hub, and we need our central team to mitigate the issues."
"However, the sheer number of services can be overwhelming when implementing something new."
"Although AWS Security Hub does a periodic scan of your overall infrastructure, it doesn't do it in real time."
"The solution should be easier to learn and use"
"One major area for improvement for Devo... is to provide more capabilities around pre-built monitoring. They're working on integrations with different types of systems, but that integration needs to go beyond just onboarding to the platform. It needs to include applications, out-of-the-box, that immediately help people to start monitoring their systems. Such applications would include dashboards and alerts, and then people could customize them for their own needs so that they aren't starting from a blank slate."
"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts."
"There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler."
"Devo has a lot of cloud connectors, but they need to do a little bit of work there."
"Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution."
"The Activeboards feature is not as mature regarding the look and feel."
"Technical support needs to be more direct. For example, when we submit a ticket, the support team will delegate a task to the operations team, for example, or various other teams."
"There's room for improvement within the GUI. There is also some room for improvement within the native parsers they support. But I can say that about pretty much any solution in this space."
 

Pricing and Cost Advice

"Qualys TotalCloud is expensive."
"The cost is high, but it meets our organizational needs."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly."
"Security Hub is not an expensive solution."
"The price of AWS Security Hub is average compared to other solutions."
"AWS Security Hub's pricing is pretty reasonable."
"AWS Security Hub is not an expensive tool. I would consider it to be a cheap solution. AWS Security Hub follows the PAYG pricing model, meaning you will have to pay for whatever you use."
"There are multiple subscription models, like yearly, monthly, and packaged."
"The cost is based on the number of compliances, core checks, and services required, and for more than 10,000 recommendations, the charge is just one dollar."
"The price of the solution is not very competitive but it is reasonable."
"The pricing is fine. It is not an expensive tool."
"Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."
"It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less."
"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."
"Our licensing fees are billed annually and per terabyte."
"I like the pricing very much. They keep it simple. It is a single price based on data ingested, and they do it on an average. If you get a spike of data that flows in, they will not stick it to you or charge you for that. They are very fair about that."
"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."
"Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is."
"The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this point they do, but when we first negotiated with them, there were only three or four tiers."
report
Use our free recommendation engine to learn which Cloud Security Posture Management (CSPM) solutions are best for your needs.
921,338 professionals have used our research since 2012.
 

Comparison Review

it_user186927 - PeerSpot reviewer
Director of Operations at a comms service provider with 10,001+ employees
Feb 16, 2015
Cybereason vs. Interset vs. SQRRL
Capture DB - they all use NoSQL db and hence solve the ad hoc query and 'go back in time' problem with current best of breed SIEM and DLP solutions that rely on real time analysis of incoming logs (and don't store them). This means deeper and quicker iterative threat analysis and assessment…
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
12%
Manufacturing Company
11%
Financial Services Firm
10%
Financial Services Firm
11%
Manufacturing Company
11%
Comms Service Provider
7%
Computer Software Company
7%
Financial Services Firm
16%
Outsourcing Company
11%
Construction Company
10%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise11
Large Enterprise39
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise5
Large Enterprise14
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise6
Large Enterprise15
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
We purchased Qualys TotalCloud for GCP and Azure as well. It is comparatively better than others regarding pricing. T...
What needs improvement with Qualys TotalCloud?
I am unsure about how Qualys TotalCloud can be improved. I do not have anything else to add about the needed improvem...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is telemetry, although I am unsure about the specifics. A quick specific examp...
Which is better - Azure Sentinel or AWS Security Hub?
We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...
What needs improvement with AWS Security Hub?
I do not see any areas for improvement in AWS Security Hub itself, but the cost factor is something that is the main ...
What is your primary use case for AWS Security Hub?
AWS Security Hub is something I have used daily as it is a part of my job for cloud security purposes. If you are dea...
What is your experience regarding pricing and costs for Devo?
The pricing could be simpler, and while the initial setup cost for a new instance is a bit expensive, the licensing c...
What needs improvement with Devo?
In terms of improvements, I think Devo falls short with their support model, as they rely mainly on their support tea...
What is your primary use case for Devo?
Devo is the bank's centralized log management platform that my team and I rely on the most. For centralized log manag...
 

Also Known As

Qualys TotalCloud with FlexScan
SQRRL
No data available
 

Overview

 

Sample Customers

Information Not Available
Edmunds, Frame.io, GoDaddy, Realtor.com
United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
Find out what your peers are saying about Wiz, SentinelOne, Microsoft and others in Cloud Security Posture Management (CSPM). Updated: October 2026.
921,338 professionals have used our research since 2012.