Vulnerability Management Tools

Wiz is the leader in having an all-in-one cloud security platform by expanding into CTEM, ASPM, and Runtime capabilities all within a single dashboard. Their posture and vulnerability capabilities remain the strongest, while there are better standalone code and runtime vendors out there.

Axonius provides holistic asset management for cloud and on-premise that extends deeply into the vulnerability management space. They have a strong focus on integrations and a robust API.

Qualys offers just about every vulnerability scanner you could want from a single vendor - from cloud to on premise to code. They have great vulnerability insights and scanning capabilities in a holistic place, but the platform UX can be difficult compared to more specialized vendors.

JupiterOne is fundamentally a data platform for managing all of your assets and security integrations. They can create custom dashboards, queries, and graphs across assets and vulnerability data.

Acquired by Wiz. Dazz aggregates your security vulnerabilities into a single dashboard which allows easy assignment and risk based prioritization. Their approach to this problem does a lot of automated lookup work and has some advanced ability to find where container images are coming from. Dazz differentiates by being focused on remediation, rather than just prioritization.

Tenable offers a robust ecosystem of vulnerability scanning solutions, most recently consolidated with their Tenable One Exposure Management platform. Tenable offers scanning from cloud to DAST to network scanning, and is widely deployed across enterprises in order to consolidate different scanners. Their exposure management platform has done a great job bringing together their various data points, creating a more unified experience that the platform had been missing.

Intruder offers holistic network vulnerability scanner, DAST, and CSPM scanning solutions, a great option for mid size businesses looking for a flexible scanner

Tamnoon is one of the first cloud focused MDR/MSSPs that helps you prioritize, fix, and respond to CNAPP, CSPM, and CDR alerts. The use a combination of humans and AI guidance to help fix your detection backlog.

Phoenix security is more on the vulnerability management side of ASPM, but they offer their own SCA and DAST options alongside existing scanners. Due to the emphasis on management & orchestration, they offer a wide variety of contextualizations and in depth vulnerability data. An especially great fit for enterprises.

Due to their beginnings focusing on runtime environments, DevOcean has created an amazing combination of features - from code to cloud visibility, combined with insights from log data, and a lot of data enrichment to assets, not just vulnerabilities.

Acquired by Tenable. Vulcan offers the robust flexibility of the legacy offerings in this category, but with a much nicer UI/UX. A strong choice for enterprises looking to manage huge amounts of very diverse assets, but a lot of the setup will be manual tinkering (no worse than the incumbents).

Maze uses agentic AI to find the exploitability of vulnerabilities in cloud environments, increasing the risk score for true positives, while giving demonstrable proof when false positives cannot be exploited.

Konvu provides robust AI prioritization and autofixing, currently for SCA vulnerabilities but expanding to others as well. These are some of the strongest prioritization and fixing capabilities I've seen within the SCA category, and it's a great help for teams struggling to burn down their backlog.

Acquired by Orca Security, Opus focuses on providing root cause analysis - mostly with containers and IaC. Their foundation is building resources and ownership, and then enabling alerting and communication per group to be flexible to different workflows. They provide workflows upon vulnerability detection.

Mondoo is ambitiously building an all in one vulnerability scanner and management tool - from endpoints to IaC. Currently they're strong at asset and vulnerability scanning, but weaker at the remediation workflows.

Acquired by ZScaler. Avalor creates a platform for the vulnerability fixes you're probably coding yourself. They offer an elegant no/low code approach for uniting all of your vulnerability data in one place. Their approach heavily relies on the flexibility of their data standardization.

Vicarius is just a straight up better version of most legacy vulnerability scanners. They have great agent based scanning, reporting, and prioritization for endpoints, but are not as advanced on the cloud or kubernetes side.

Armorcode is a holistic vulnerability management solution for application security teams. While there's less "magic" happening than in the other providers, I'm also the most confident it would actually work - even down to providing python scripts you can run in pipeline to send vulns to their platform.

Zafran has built a vulnerability management platform focused on risk prioritization and response/mitigation actions that can be taken while things are getting fixed. Their main differentiator is taking into account mitigating security controls that are in place.

Metahub is a uniquely open source context provider for working through your CSPM findings. It provides a lot of valuable context to CSPM findings to help you prioritize based on actual exposure.

Tromzo pulls in rich metadata from your various tools, and uses that metadata to create groupings and prioritizations of your vulnerabilities. They uniquely offer a yaml file for adding custom tools and pulling together data.

Dependency Track is an open source option for creating vulnerability dashboards and notification workflows.

Brinqa is another incumbent to the vulnerability management that is a good fit for large organizations with complex mixed infrastructures. A lot of the setup will be manual, but a strong query language and customization comes as a result.

Cyclops provides a cloud focused remediation platform based on ingesting and maximizing the use of metadata from various tools.

Tonic accelerates prioritization and remediation of vulnerabilities and threats, with a Context-Driven Unified Exposure Management platform. Powered by Agentic AI and a security Data Fabric, Tonic extracts meaningful and actionable context from unstructured organizational knowledge and threat intelligence, empowering security teams with superior visibility, dramatic reduction in false positives, and a sharp focus on findings that matter. Leading organizations, including Fortune 500 companies, rely on Tonic to slash remediation time and reduce risk to key business processes.

Seemplicity's take on the remediation market heavily emphasizes workflow building via their GUI. Their workflow builder offers robust dispatching of the relevant tickets to the right teams.

Conviso provides a vulnerability management platform that integrates with numerous providers. They also provide services for assistance along the way.

Acquired by Armis. Silk Security offers some unique features like assigning ownership to domains, and provides the rare value of showing asset ownership and code to cloud asset tracking. Another unique feature is their leaderboard - something not enough products have leaned into as a motivator.

Acquired by Invicti. Kondukto's strength is integrating with just about every tool you could want, including open source ones, to prioritize and remediate in a single platform. They provide a great Jira workflow for working through findings.

SecOps Solution has created a network based scanner for detecting and remediating vulnerabilities across hosts. It's an elegant solution that's great for non-containerized environments.

Nucleus's approach to vulnerability remediation emphasizes risk based prioritization, which we think is less exciting than the functionality around getting the right information to the right teams, automatically. They have a more traditional model for standardizing data.

RevealID maps attack paths in and out of various systems, allowing you to see in the event of a vulnerability exploitation, what the blast radius would be. For example, you can map out the impact of an exploitation of a specific asset, and prioritize accordingly.

Copperhelm provides automated cloud security remediation