How much vulnerability management costs for 5,000 assets: Qualys, Tenable and Rapid7 priced

The scanner is no longer the expensive part

Security teams logged 48,185 new CVEs in 2025, a 20.6% jump on the previous year, according to Jerry Gamblin's 2025 CVE Data Review as reported by Tech Insider. NIST's National Vulnerability Database stopped enriching every entry: as of April 2026 it moved all unenriched CVEs published before 1 March 2026 to "Not Scheduled" status and now prioritises only those tied to CISA's Known Exploited Vulnerabilities catalog, federal software or Executive Order 14028 systems.

That gap is why the three vendors still anchor most shortlists, and why each now sells its own scoring layer on top of the raw feed. The buying consequence is simple: the scan engine is table stakes, and the modules that rank and route findings are where the annual number is decided. A 5,000-asset estate that buys scanning alone gets a list; the same estate buying prioritisation and ticketing gets a work queue.

The pricing pages do not settle this for you. Qualys, Tenable and Rapid7 all run quote-only sales, and the per-asset figures in circulation come from third-party tracking rather than the vendors. Cost the base platform and the two modules a 5,000-asset estate actually needs before comparing anything.

What each per-asset rate actually buys

Qualys sells vulnerability management as VMDR inside its Enterprise TruRisk Platform, priced per asset per year. Third-party tracking cited by Ciphers Security puts VMDR at $17–$33 per asset per year, last verified September 2026. The vendor's own page describes the product as a single platform for security and compliance, which is the argument for buying more modules from the same invoice rather than fewer.

Tenable's cloud product is Tenable Vulnerability Management, sold under the Tenable One exposure management platform, at $26–$38 per asset per year on the same tracking. Tenable also sells Nessus Professional as a flat annual licence per scanner at $4,790 a year with unlimited assets per scanner, which is a different shape of contract and the one small teams use. Its on-premises option is Security Center, which Tenable brought to version 6.9.1 on 16 September 2026.

Rapid7 sells InsightVM, cloud-managed on the Insight Platform, and Nexpose, the on-premises equivalent, on an identical per-asset model. Ciphers Security puts InsightVM at approximately $1.62–$1.93 per asset per month billed annually, which is $19.44–$23.16 per asset per year. Rapid7 now bundles InsightVM into Exposure Command, with an Essentials tier adding attack surface management and an Ultimate tier adding cloud and application security.

The mechanism that decides the bill is what counts as an asset. Ciphers Security defines it as any IP-addressable endpoint the scanner monitors, and states that workstations, servers, network appliances, cloud instances and containers each count as one. An estate that has moved workloads into containers can find its asset count rising without a single new employee.

The shortlist on the terms a buyer signs

The table below sets the three cloud-managed products side by side on the terms that move a 5,000-asset contract: the price model, the published rate, the term and what the base tier includes. Every figure is a third-party estimate, because none of the three vendors publishes a list price.

Two rows deserve attention before the call. Tenable's flat Nessus licence is the only published number in the set, and it is per scanner rather than per asset, so it does not scale the same way and is not the enterprise product. Rapid7's Exposure Command tiers change what the per-asset rate covers, so a quote for InsightVM alone is not comparable to a quote for Exposure Command Ultimate.

The published ranges overlap enough that volume and term will decide the outcome. At the top of each band the spread between Qualys and Tenable is $5 per asset per year, which on 5,000 assets is $25,000 annually and worth a second round of negotiation.

What 5,000 assets costs on each rate

Run the published bands against 5,000 assets and the arithmetic is blunt. Qualys VMDR at $17–$33 per asset per year is $85,000 to $165,000 a year. Tenable Vulnerability Management at $26–$38 is $130,000 to $190,000. Rapid7 InsightVM at $1.62–$1.93 per asset per month is $9,720 to $11,580 a month, or $97,200 to $115,800 a year.

Those are base-platform numbers and nothing more. Each vendor sells prioritisation, compliance reporting and ticketing as separate capability, and the pages above do not publish module prices for any of the three. That absence is the finding: the number a 5,000-asset estate needs cannot be assembled from public pages, and the only route is a written quote that itemises the modules.

Ciphers Security's worked examples show the same model at smaller scale, with a 500-asset deployment at around $11,580 a year at list and 2,000 assets near $43,200. Those figures sit at the top of the Rapid7 band, which suggests the lower end of the range is a volume rate rather than a starting price.

The per-asset model also has a ceiling the buyer should test. Tenable's Nessus Professional at $4,790 per scanner per year with unlimited assets is the only flat price published anywhere in this set, and it exists because per-asset billing becomes the wrong shape below a certain estate size. Ask each vendor where their per-asset rate stops falling as asset count rises.

The two modules that decide the renewal

The base platform finds vulnerabilities. The module that ranks them is what the security team actually works from, and all three vendors now lead with their own scoring rather than raw CVSS. Tenable's Vulnerability Priority Rating combines threat intelligence and context-aware scoring to rank impact and weaponisation, and Tenable describes Hexa AI as the agentic layer of Tenable One for remediation.

Rapid7's answer is the Exposure Command bundle, which brings vulnerability findings together with attack surface, cloud and application risk into one model. Qualys frames the same problem as consolidation onto a single platform, which is a commercial argument as much as a technical one: fewer vendors, one invoice, one asset count across modules.

For a 5,000-asset estate the practical question is whether the asset count is shared across modules or counted separately for each. If the same 5,000 assets are counted again for compliance scanning and again for cloud posture, the effective rate is a multiple of the published one. Ask for the quote to state the asset count per module, not just the total.

The compliance module matters for any estate facing PCI DSS or a similar audit, and none of the three pages above publishes a price for it. The question to put in writing is the annual cost of the base platform plus prioritisation plus compliance reporting, at 5,000 assets, on a three-year term, with the asset definition attached.

The decision rule

Choose Qualys VMDR if the estate is large, price-sensitive and already consolidating security spend onto one platform, because the published band starts lowest at $17 per asset per year and the vendor's pitch is fewer invoices rather than more capability. Choose Tenable Vulnerability Management if the estate is compliance-heavy and the team wants the broadest exposure management platform behind the scanner, and accept that the published band tops out at $38 per asset per year and that Security Center 6.9.1 is the on-premises route if data residency rules it.

Choose Rapid7 InsightVM if the estate is mid-market and the team wants vulnerability findings joined to attack surface and cloud risk in one Exposure Command view, since the monthly band of $1.62–$1.93 per asset lands between the other two at 5,000 assets. Wait on all three if the estate cannot state its asset count, because every published rate is per asset and an unknown count makes every quote incomparable.

Before signing, ask each vendor for the per-asset rate at 5,000 assets with prioritisation and compliance modules included, the asset definition per module, and the rate at 7,500 assets to see where the volume discount stops. The vendor that answers all three in writing is the one whose renewal will not surprise you.