JFrog Xray vs Qualys TotalCloud comparison

JFrog and Qualys are both solutions in the Vulnerability Management category. JFrog is ranked #24 with an average rating of 8.0, while Qualys is ranked #13 with an average rating of 8.8. Additionally, 100% of JFrog users are willing to recommend the solution, compared to 100% of Qualys users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 16, 2024

JFrog Xray and Qualys TotalCloud are two prominent products in the software security and vulnerability management landscape. JFrog Xray is favored for its feature set, while Qualys TotalCloud excels in its overall offering, outweighing Xray’s pricing and support.

Features: JFrog Xray stands out with its robust integration capabilities, effective vulnerability scanning, and seamless functionality within CI/CD pipelines. Qualys TotalCloud is praised for its extensive threat intelligence, comprehensive cloud-native security features, and broader range of security measures.

Room for Improvement: Users of JFrog Xray wish for better scalability, more detailed reporting features, and enhanced user interface. For Qualys TotalCloud, the desire is for improved API performance, more intuitive setup processes, and faster scan times.

Ease of Deployment and Customer Service: JFrog Xray is noted for straightforward deployment, but some users report challenges with customer support responsiveness. Qualys TotalCloud users enjoy an efficient deployment process and exemplary customer service, suggesting a more favorable support experience compared to JFrog Xray.

Pricing and ROI: JFrog Xray is often viewed as more cost-effective in the initial setup, with solid ROI attributed to its seamless integration in DevOps workflows. Qualys TotalCloud, despite potentially higher costs, is valued for its comprehensive security coverage which users see as justifying the investment. Qualys is perceived to offer superior return on investment in terms of security.

To learn more, read our detailed JFrog Xray vs. Qualys TotalCloud Report (Updated: January 2025).

Buyer's Guide

JFrog Xray vs. Qualys TotalCloud

January 2025

Download the complete report

Helped 831,158 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Mokshi Pandita

DevOps Engineer at Rambøll Danmark A/S

An intelligent solution that prioritizes which vulnerability to target first in your project

We could create any number of repositories, but we can create only thirty projects with JFrog Xray. If I want things to work, it has to be one project and multiple repositories that belong to different real projects. So I have a limitation of thirty projects, despite being a premium customer. JFrog Xray does not have a dashboard. Although I am able to generate reports, there is no proper dashboard where I can see the total number of vulnerabilities, the total number of license issues, and how many vulnerabilities are fixed. Second, I found the shift left approach missing with JFrog Xray. JFrog Xray has integration with IDEs, but it does not tell you about the vulnerabilities until the artifact is created. However, Snyk could directly integrate with your repository and would not allow you to build unless you fix the problem.

Read full review

Vikasha Sharma

Deputy Vice President at a financial services firm with 10,001+ employees

Enables us to mitigate and prioritize risks, ultimately reducing our attack surface for critical assets

TotalCloud provides written explanations that guide remediation and eliminate risk. We have used Qualys for over ten years, and TotalCloud and TruRisk for the last two to three years, successfully leveraging their benefits. Our technical account manager is responsive to our requests for additional features or suggestions, ensuring our needs are met. I would rate the helpfulness of written explanations compared to visualizations of attack paths a nine out of ten. The explanations effectively detail how the scores are derived, making them verifiable and useful for regulatory audits. This allows us to clearly justify the chosen approach and the tool's output. Qualys TotalCloud has significantly benefited our organization by reducing our vulnerability count and overall team size. The platform's user-friendly interface has streamlined management, eliminating the need for additional staff and enabling us to efficiently handle our workload. With the support of our technical account manager and their team, we saw initial benefits within a month, achieving full utilization within six months due to the minimal learning curve. TotalCloud provides a single, prioritized view of risk. We are also evaluating Qualys' new Enterprise Threat Management module, part of their enterprise risk platform, recently launched at the Qualys Security Conference. While we are still assessing this module, the dashboards are well-designed, configurable, and useful. The single, prioritized view of risk has significantly streamlined our workload by consolidating multiple sources, resulting in an estimated 60 percent reduction in effort due to the tool's prioritization capabilities. Our use of TruRisk allows us to effectively justify our risk management processes to regulators and auditors. The system provides clear and verifiable risk assessments, which facilitates a smooth audit process and ensures compliance with regulatory requirements. The comprehensiveness of range of risk found by TruRisk Insights is an eight out of ten. The TruRisk Insights feature has helped us identify assets with high vulnerability scores, significantly impacting our business by enabling us to mitigate and prioritize risks, ultimately reducing our attack surface for critical assets. Previously, we applied the same logic to all assets, but TruRisk now allows us to pinpoint the areas of maximum risk and prioritize our efforts accordingly. We've improved our security posture by 30 to 40 percent and reduced our attack surface, consistently maintaining good security scores, such as our Bitsight Security Rating, since implementing Qualys TruRisk over two years ago.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"With PingSafe, it's easy to onboard new accounts."

"The most valuable feature is the easy-to-understand user interface, which allows even non-technical users to comprehend and resolve issues."

"I recommend SentinelOne due to its high-security capabilities, which are essential to safeguard data and systems from potential threats."

"We noted immediate benefits from using the solution."

"The tool identifies issues quickly."

"The real-time detection and response capabilities overall are great."

"We've seen a reduction in resources devoted to vulnerability monitoring. Before PingSafe we spent a lot of time monitoring and fixing these issues. PingSafe enabled us to divert more resources to the production environment."

"We mostly use alerts. That has been pretty good. If we use the alert system from Amazon, it is much costlier to us, so we use PingSafe."

More SentinelOne Singularity Cloud Security pros

"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."

"The solution is stable and reliable."

"JFrog Xray shows us a list of vulnerabilities that can impact our code."

"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."

"JFrog Xray's reporting feature has a lot of options in it, including scanning."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

More JFrog Xray pros

"The most valuable feature is the consolidated information that it provides from various platforms."

"The dashboards are particularly valuable as they offer a comprehensive view of the environment, highlighting any misconfigurations."

"I would rate Qualys TotalCloud ten out of ten."

"TotalCloud provides a single, prioritized view of risk."

"One of the most valuable features of Qualys TotalCloud is FlexScan, which is specifically for internet-facing VMs. We found this feature to be very useful. It was a key differentiator for us."

"The most valuable feature is extensibility."

"One of the features I appreciate is the ability to generate daily reports without relying on anyone else."

"The scalability is good as well. I would rate it ten out of ten."

More Qualys TotalCloud pros

Cons

"One potential drawback is the cost of SentinelOne Singularity Cloud Security, which may be prohibitive for smaller businesses or startups, particularly those in regions with lower average incomes, such as India."

"I would like PingSafe's detections to be openly available online instead of only accessible through their portal. Other tools have detections that are openly available without going through the tool."

"We recently adopted a new ticket management solution, so we've asked them to include a connector to integrate that tool with Cloud Native Security directly. We'd also like to see Cloud Native Security add a scan for personally identifying information. We're looking at other tools for this capability, but having that functionality built into Cloud Native Security would be nice. Monitoring PII data is critical to us as an organization."

"SentinelOne currently lacks a break glass account feature, which is critical for implementing Single Sign-On."

"For SentinelOne, improvements could be made in managing Internet dependency as cloud-based operations can pose challenges in environments with limited connectivity."

"There is room for improvement in the current active licensing model for PingSafe."

"The area of improvement is the cost, which is high compared to other traditional endpoint protections."

"PingSafe filtering has some areas that cause problems, and to achieve single sign-on functionality, a break-glass feature, which is currently unavailable, is necessary."

More SentinelOne Singularity Cloud Security cons

"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."

"Lacks deeper reporting, the ability to compare things."

"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."

"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."

"JFrog Xray does not have a dashboard."

"Since we have been using the solution via APIs, there are some limitations in the APIs."

"The speed of JFrog Xray should improve. Other solutions have better performance."

"JFrog Xray's documentation and error logging could be improved."

More JFrog Xray cons

"Although TotalCloud is a helpful tool, some of its advanced features are still under development."

"There is room for improvement in vulnerability scanning, particularly for PaaS environments. Currently, Qualys does not have full access to these instances, which limits its effectiveness."

"Qualys' customer service provides quality answers, but the response time is long, even though it is within the SLA."

"The patching process with Qualys Patch Management, which is part of TotalCloud, does not cover installing certain prerequisites on the servers or workstations."

"Qualys TotalCloud needs to improve its accuracy for non-Windows operating systems."

"With the growing integration of AI, I would like Qualys to enhance its service offerings to better accommodate AI-related risks."

"The patching process with Qualys Patch Management, which is part of TotalCloud, does not cover installing certain prerequisites on the servers or workstations. This shortcoming means we must rely on SCCM when any service stack updates or additional prerequisites are needed."

"Their customer support needs improvement."

More Qualys TotalCloud cons

Pricing and Cost Advice

"The tool is cost-effective."

"SentinelOne offers excellent pricing and licensing options."

"PingSafe is cost-effective for the amount of infrastructure we have. It's reasonable for what they offer compared to our previous solution. It's at least 25 percent to 30 percent less."

"I understand that SentinelOne is a market leader, but the bill we received was astronomical."

"We have an enterprise license. It is affordable. I'm not sure, but I think we pay 150,000 rupees per month."

"Singularity Cloud Workload Security's licensing and price were cheaper than the other solutions we looked at."

"PingSafe falls somewhere in the middle price range, neither particularly cheap nor expensive."

"The features included in PingSafe justify its price point."

More SentinelOne Singularity Cloud Security pricing and cost advice

Information not available

"Qualys TotalCloud offers competitive pricing given its comprehensive suite of features, including integration, assessment, remediation, and detection capabilities, all within a single platform."

"Qualys TotalCloud offers cost-effective licensing flexibility."

"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."

"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."

"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."

"The cost is high, but it meets our organizational needs."

"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."

"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."

More Qualys TotalCloud pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.

See recommendations

831,158 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

25%

Manufacturing Company

13%

Computer Software Company

12%

Government

Computer Software Company

20%

Financial Services Firm

14%

Government

12%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven.

See all answers

What needs improvement with PingSafe?

The areas with room for improvement include the cost, which is higher compared to other security platforms. The dashb...

See all answers

What do you like most about JFrog Xray?

JFrog Xray shows us a list of vulnerabilities that can impact our code.

See all answers

What needs improvement with JFrog Xray?

X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL. More support ...

See all answers

What is your primary use case for JFrog Xray?

Our primary use case for X-ray includes multiple activities such as security and vulnerability scanning. We already u...

See all answers

What is your experience regarding pricing and costs for Qualys TotalCloud?

Qualys TotalCloud is cost-efficient and was selected for its value compared to other products.

See all answers

What needs improvement with Qualys TotalCloud?

In TotalCloud, I would suggest improvements in policy checks to cater to various inventory types like VPCs, subnets, ...

See all answers

What is your primary use case for Qualys TotalCloud?

We use TotalCloud for CSPM or Cloud Security Posture Management. We have integrated our cloud accounts with TotalClou...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 28% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 23% of the time

AWS GuardDuty vs SentinelOne Singularity Cloud Security

Compared 8% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 6% of the time

More SentinelOne Singularity Cloud Security Competitors

Black Duck vs JFrog Xray

Compared 19% of the time

Trivy vs JFrog Xray

Compared 14% of the time

Veracode vs JFrog Xray

Compared 7% of the time

Snyk vs JFrog Xray

Compared 6% of the time

Prisma Cloud by Palo Alto Networks vs JFrog Xray

Compared 6% of the time

More JFrog Xray Competitors

Wiz vs Qualys TotalCloud

Compared 38% of the time

Prisma Cloud by Palo Alto Networks vs Qualys TotalCloud

Compared 11% of the time

AWS GuardDuty vs Qualys TotalCloud

Compared 11% of the time

Amazon Inspector vs Qualys TotalCloud

Compared 9% of the time

Rapid7 InsightCloudSec vs Qualys TotalCloud

Compared 3% of the time

More Qualys TotalCloud Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

December 2024

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

JFrog Xray

January 2025

Download JFrog Xray product report

Buyer's Guide

Qualys TotalCloud

January 2025

Download Qualys TotalCloud product report

Also Known As

PingSafe

JFrog Security Essentials

Qualys TotalCloud with FlexScan

Learn More

SentinelOne

JFrog

Qualys

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

If you are a team player and you care and you play to WIN, we have just the job you're looking for.

As we say at JFrog: "Once You Leap Forward You Won't Go Back!"

TotalCloud is the Qualys approach to Cloud Native Application Protection Platform (CNAPP) for cloud infrastructure and SaaS environments. With TotalCloud, customers extend TruRisk insights (transparent cyber risk scoring methodology) from the Qualys Enterprise TruRisk Platform to their cloud environments allowing for a seamless unified view of cyber risk across on-prem, hybrid, and multi-cloud environments.

Features and capabilities of Qualys TotalCloud include, but are not limited to:

Discover: Complete visibility and insights into cyber-risk exposure across multi-cloud. Continuously discover and monitor all your workloads across a multi-cloud environment for a 360-degree view of your cloud footprint. Identify known and previously unknown internet-facing assets for 100% visibility and tracking of risks.

Assess: Comprehensive cloud-native assessments with FlexScanTM. Extensive scanning capabilities with Qualys FlexScan, including no-touch, agentless, API- and snapshot-based scanning, along with agent- and network-based scanning for in-depth assessment. Use these multiple scanning methods to scan a workload to get a unified and comprehensive view of vulnerabilities and misconfigurations.

Prioritize: Unified security view to prioritize cloud risk with TruRiskTM. Experience a unified risk-based view of cloud security with insights across workloads, services, and resources. Qualys TruRisk quantifies security risk by workload criticality and vulnerabilities; it correlates with ransomware, malware, and exploitation threat intelligence to prioritize, trace, and reduce risk.

Defend: Real-time protection against evolving and unknown threats with InstaProtectTM. Qualys enables continuous monitoring of all cloud assets to ensure they are protected against threats and attacks at runtime. Qualys keeps your cloud runtime safe by detecting known and unknown threats across the entire kill chain in near real-time across a multi-cloud environment.

Remediate: Fast remediation with QFlow – no code, drag-and-drop workflows. The integration of QFlow technology into Qualys TotalCloud saves security and DevOps teams valuable time and resources. Automation and no-code, drag-and-drop workflows help simplify the time-consuming operational tasks of assessing vulnerabilities on ephemeral cloud assets, alerting on high-priority threats, remediating misconfigurations, and quarantining high-risk assets.

Sample Customers

Information Not Available

google, amazon, cisco, netflix, oracle, vmware, facebook

Information Not Available

Buyer's Guide

JFrog Xray vs. Qualys TotalCloud

January 2025

Free Report: JFrog Xray vs. Qualys TotalCloud

Find out what your peers are saying about JFrog Xray vs. Qualys TotalCloud and other solutions. Updated: January 2025.

DOWNLOAD NOW

831,158 professionals have used our research since 2012.

See our JFrog Xray vs. Qualys TotalCloud report.

See our list of best Vulnerability Management vendors and best Container Security vendors.

We monitor all Vulnerability Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.