Try our new research platform with insights from 80,000+ expert users

Cybersixgill vs Qualys VMDR vs Rapid7 Metasploit comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of January 2025, in the Vulnerability Management category, the mindshare of Cybersixgill is 0.2%, up from 0.1% compared to the previous year. The mindshare of Qualys VMDR is 11.1%, down from 13.7% compared to the previous year. The mindshare of Rapid7 Metasploit is 1.9%, up from 1.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management
 

Featured Reviews

reviewer1533792 - PeerSpot reviewer
Contains a huge amount of information regarding deep web and dark web, reducing investigation times
In the search engine, you are able to use operators. These operators allow you to do specific searches or open searches. The main things are: * If you want to search everything related to a specific malware family but you don't want to have anything related to specific search. So, you can just upload it from the search engine and search for it. * If you only wanted to know about one specific vulnerability, but you don't care what is in Telegram or GitHub as repositories, then it will only care for these things in the dark web forums. You can narrow your search to that. * If you want only sites in Spanish, but not in other languages, you can narrow your search to that. There are a lot of possibilities when using the search engine. It has become really useful for my analysts. The solution has enabled us to access sources that we have not seen anywhere else, such as Telegram. It also gives us access to the Genesis Marketplace. Otherwise, we would have to pay someone for that. However, with Cybersixgill, we can go to the platform and search for whatever we want.
Harold Jensen - PeerSpot reviewer
Good visibility but expensive and needs better support
Support: It's often overseas and often following a script, basically asking us to redo what we opened the case with. Multiple APIs: There seems to be a lack of easy onboarding into Qualys. We had to use manual inputs and some API calls to get items in place. Dashboard: It is very rudimentary with very little customization. The Qualys Scripting Language (QSL) works differently in different Qualys modules, so when you get it working in one area you have to modify the syntax in others. User account management: We often have to give users more rights than needed just to give them what they need. Integration with the various Qualys Modules: You can tell the UI is different based on of the different teams that created them. QSL syntax same in all modules Responsiveness of some of the components: They time out, you get a blank screen, etc. Backend updates between the various modules: You update connectors and information takes a few minutes to show in VMDR or Global Asset View Connectors: Connectors have a throttling issue with AWS which causes them to frequently fail unless you manually run them again.
Mani Bommisetty - PeerSpot reviewer
Comprehensive insights with robust vulnerability detection and streamlined alert management
Rapid7 has a significant advantage in providing a clear picture of my environment. It provides insight and incident detection response capabilities. When deployed with the same agent in servers or endpoints, it identifies vulnerabilities and monitors data transmission to external sources. Rapid7 offers comprehensive features within one platform, eliminating the need to integrate multiple tools to see all alerts in one place.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution’s approach of using limited open source intelligence and focusing, instead, on the Deep Web and Dark Web is what seals the deal. That is why I like them. I have other tools that I can aggregate all the open source intelligence from. I value Cybersixgill because it provides access to things that no one else does."
"They also provide some of the greatest notification capabilities. I put in a customer's company name and domain names, or sometimes I put in their IP addresses as a keyword. Once Sixgill collects information that includes those keywords, they then provide us email notifications. That means we can catch information related to our customers as soon as possible."
"The advanced analysis has made our security operations more efficient. It has also potentially given us quicker access to data that we might not have otherwise located."
"To be diligent for the customer, we usually go into Cybersixgill Investigative Portal to analyze and search things. The solution tells us the reputation of cyber threat actors. So, if someone has a reputation of one, it is a really bad idea to care about what that person is saying. However, if you find someone with a reputation of nine, then there is a high probability that we need to address the problem. You can get information about these type of actors in Cybersixgill Investigative Portal. They have a huge collection, which is like having the rules/goals of the dark web and deep web without having to go there. Our analysts avoid going dark web because they have Cybersixgill Investigative Portal and can get the news from their browser, searching wherever they want."
"Authenticated scans provide different options, including those using or not using the FactSet and adding option profiles."
"Continuous monitoring is a crucial feature that we use more frequently."
"The most valuable features of Qualys VMDR include patch management and the use of virtual scanners to scan appliances and devices, especially those provided by vendors where we cannot manage them ourselves."
"The reporting functionality is great."
"The most valuable feature is the vulnerability assessment."
"The biggest benefit is from a security operations perspective, where we are able to drive our security posture upwards by remediating any discovered vulnerabilities."
"The solution is easy to use."
"The most valuable features are vulnerability scanning, policy compliance scanning, and tablet for web application scanning."
"The solution is open source and has many small targetted penetration tests that have been written by many people that are useful. You can choose different subjects for the test, such as Oracle databases or Apache servers."
"The most valuable features of Metasploit include its powerful capabilities for exploitation and scanning."
"The most valuable feature for us is the support for testing Linux-based web server components."
"Rapid7 Metasploit is a useful product."
"The Search Engineering feature is good."
"It allows us to concentrate solely on identified vulnerabilities without the hassle of additional setup."
"Rapid7 offers comprehensive features within one platform, eliminating the need to integrate multiple tools to see all alerts in one place."
"The option to generate phishing emails has proven to be very valuable in understanding the behavior of users."
 

Cons

"We need real-time updated information. If we could have this, it would be amazing. For example, if someone was posting something, then ten second later, it was on the platform. Sometimes, it takes a minute or hours right now, depending on the forum."
"The breadth of access to data is good, but there are gaps. More data would be my suggestion because the platform is good and I have no complaints about the system. I think it is just a case of always trying to get more data sources."
"Sixgill has strong capabilities based on search queries, but there is some difficulty in using Sixgill. Their querying is very powerful but it can be difficult. It's not hugely complex but you need some skill to use Sixgill querying."
"Regarding their scraping abilities, things could be solidified. There are definitely improvements that could be made on the specificity for setting certain queries."
"The reporting and dashboards could improve in Qualys VM. However, they have improved since the previous versions."
"Qualys VMDR identifies vulnerabilities and suggests fixes. However, it does not automate patching unless the patch management module is purchased separately."
"If AI features were integrated, it could enhance the capabilities significantly."
"Qualys does have an on-prem solution, but it is very expensive."
"We face issues while scanning multiple assets."
"There are scenarios where a vulnerability is reported once yet not in subsequent scans, even if we have not fixed it."
"The customer support is very bad."
"Make some minimal dashboard improvements."
"Better automation capabilities would be an improvement."
"I think areas with shortcomings that need improvement are more integration and automation."
"We'd like them to offer better coverage of malware."
"Rapid7 Metasploit can add a GUI feature because it is only available online."
"The reporting feature needs improvement. The time taken to fetch reports based on the number of events can be extensive, unlike Tenable, which is more user-friendly and faster."
"The initial setup was a bit "tweaky" for the open-source version."
"If your company's patch is not up to date, but you have other detection or defense solutions such as endpoint detection and response and antivirus software, the product exploit may not work effectively. This is because its exploit database update process is slow and not real-time. For zero-day vulnerabilities or new security threats, relying on Rapid7 Metasploit alone may not be effective."
"I would like to see more capabilities, more functions, and more features. More types of attack vectors."
 

Pricing and Cost Advice

"Sometimes, Cybersixgill Investigative Portal is cheaper than its competitors."
"The pricing and licensing are good. It is expensive for us because the US dollar is quite strong compared to our dollar. Otherwise, it is quite reasonable for what it is. All the tools in the market are around the same price from my experience."
"The pricing is cheap compared with Recorded Future. Sixgill's cost-effectiveness is very good."
"The license is on a yearly basis."
"It is a high cost product. Compared to the other solutions, it is around 15 to 20% higher in cost."
"Qualys VM is better suited for medium to large companies because the price can be too much for smaller customers."
"Qualys VM is quite expensive. It's a subscription-based license, and it's yearly. Right now, it's open for me, and I don't have any limitations or caps on the licenses. They are seeing if the product is viable for 4500 users. I can add as much as I want, and at the end of the subscription, they'll let me know how many licenses were actually used and bill me accordingly. On a scale from one to five, I would give their pricing a three. It's still expensive."
"The price is very reasonable."
"We do see over $100,000 in terms of price, for mid-size programs. You likely will pay more than $100,000 without any discount. It is a bit pricey."
"I used to work there, so I never paid for the product. As an employee, we get a lifetime license for personal use, and that's what I'm using. It is a comprehensive platform, so there is a lot more to it. There could be other solutions that are probably a little bit cheaper, but it depends on what people need. Different people have different needs. It offers many things on the same platform. If you add all the things up, it should be cheaper, but I have not done any analysis specifically."
"There are no additional fees in addition to the standard licensing fees."
"It is a reasonably priced solution. I would rate it from five out of ten."
"I have used the free version of Rapid7 Metasploit."
"There are two versions available, one of which is the Pro version, and the other is the free version."
"Rapid7 Metasploit is cheaper than Tenable.io Vulnerability Management."
"The cost is approximately $15 per device."
"The great advantage with Rapid7 Metasploit, of course, is that it's free."
"We pay monthly. The pricing is reasonable."
"I use the open-source version of this product. Pricing is not relevant."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
831,369 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Manufacturing Company
11%
Financial Services Firm
11%
Government
8%
Educational Organization
36%
Financial Services Firm
10%
Computer Software Company
10%
Manufacturing Company
6%
Computer Software Company
19%
Financial Services Firm
10%
Manufacturing Company
9%
Educational Organization
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

Ask a question
Earn 20 points
What is your primary use case for Qualys VM?
Qualys VM is used for vulnerability scans for the internet and applications using application exchange. There are man...
What do you like most about Qualys VMDR?
I like that we have many scanners and channels that don't overload. It helps us scan and track easily. Also, the tagg...
What is your experience regarding pricing and costs for Qualys VMDR?
For smaller enterprises, the pricing is on the pricier side. However, for larger enterprises, it's considered okay. I...
What do you like most about Rapid7 Metasploit?
I use Rapid7 Metasploit for payload generation and Post-Exploitation.
What needs improvement with Rapid7 Metasploit?
The reporting feature needs improvement. The time taken to fetch reports based on the number of events can be extensi...
 

Also Known As

No data available
Qualys VM, QualysGuard VM, Qualys Asset Inventory, Qualys Container Security, Qualys Virtual Scanner Appliance
Metasploit
 

Overview

 

Sample Customers

Current customers include large enterprises, financial services, manufacturing, GSIs, MSSPs, government and law enforcement entities.
Agrokor Group, American Specialty Health, American State Bank, Arval, Life:), Axway, Bank of the West, Blueport Commerce, BSkyB, Brinks, CaixaBank, Cartagena, Catholic Health System, CEC Bank, Cegedim, CIGNA, Clickability, Colby-Sawyer College, Commercial Bank of Dubai, University of Utah, eBay Inc., ING Singapore, National Theatre, OTP Bank, Sodexo, WebEx
City of Corpus Christi, Diebold, Lumenate, Nebraska Public Power District, Prairie North Regional Health, Apptio, Automation Direct, Bob's Stores, Cardinal Innovations Healthcare Solutions, Carnegie Mellon University
Find out what your peers are saying about Tenable, Qualys, Wiz and others in Vulnerability Management. Updated: December 2024.
831,369 professionals have used our research since 2012.