How much does Qualys VMDR cost per asset in 2026?

Qualys VMDR (Vulnerability Management, Detection and Response) is priced per asset with reported 2026 list rates between $199 and $250 per asset per year, depending on volume and contract length. Qualys does not publish a list price; every deal is a direct quote based on asset count, module selection, and contract term. A 100-asset estimate lands near $19,900 annually at the published per-asset rate (Ciphers Security, July 2026).

What is the AWS Marketplace tier for Qualys VMDR?

Qualys VMDR is listed on AWS Marketplace in tiers based on managed host count: 128 hosts at $596 per month, 256 hosts at $942 per month, 512 hosts at $1,489 per month, 1,024 hosts at $2,352 per month, 2,048 hosts at $3,719 per month, and 5,120 hosts at $6,805 per month. AWS Marketplace pricing reflects cloud subscription contracts that bundle the platform, support, and standard maintenance (CostBench, August 2026).

How much does Qualys Web Application Scanning cost?

Qualys Web Application Scanning (WAS) starts at approximately $1,995 per year for 25 web applications, which works out to about $79.80 per app per year at the entry tier. A 100-application deployment costs approximately $7,980 per year. WAS covers OWASP Top 10 detection, API security, DevSecOps integration, and compliance reporting (Beagle Security, 2026).

What does Qualys Patch Management cost?

Qualys Patch Management is licensed as an add-on to VMDR and adds approximately 15 to 25 percent over the VMDR line. At a representative $199 per asset per year VMDR rate, Patch Management adds roughly $30 per asset per year. A 100-asset Patch Management deployment costs approximately $3,000 per year on top of the $19,900 VMDR line (Beagle Security, 2026).

What is the typical Qualys contract size?

The median Qualys contract is $35,337 per year per Vendr transaction data spanning 104 verified purchases. Mid-market 500-asset VMDR deployments land near $99,500 per year at list; 1,000-asset deployments near $199,000 with volume discount. Enterprise deployments with 5,000+ assets commonly spend $400K to $2M+ annually, with negotiated effective per-asset rates below the $199 published minimum (CostBench + Vendr, August 2026).

What is the Qualys Community Edition?

Qualys Community Edition is free for evaluation and tiny shops. It covers up to 16 internal IPs plus 3 external IPs plus 1 web application. Community Edition is the right path for students, security researchers, and very small businesses with constrained budgets, but it is not suitable for production mid-market or enterprise environments that need continuous multi-vector scanning (Beagle Security, 2026).

Qualys Pricing 2026: VMDR Cost per Asset Breakdown

Quick Answer

Qualys VMDR pricing in 2026 runs $199 to $250 per asset per year at list, with AWS Marketplace tiered listings from $596 per month for 128 hosts to $6,805 per month for 5,120 hosts. Web Application Scanning starts at $1,995 per year for 25 apps. Patch Management adds 15 to 25 percent over VMDR. The median Qualys contract sits at $35,337 per year per Vendr (CostBench + Vendr, August 2026).

Qualys is positioned as the price-leader in the enterprise vulnerability management category. Per-asset rates run 20 to 40 percent below Tenable at common mid-market scales.

Last verified: Sep 15, 2026.

At a glance

VMDR list $199 to $250 per asset per year
AWS Marketplace $596 per month for 128 hosts, scaling to $6,805 per month for 5,120 hosts
Web Application Scanning from $1,995 per year for 25 apps (~$79.80 per app per year)
Patch Management adds 15 to 25 percent over VMDR (~$30 per asset per year)
Community Edition free for 16 internal IPs plus 3 external IPs plus 1 web app
Median contract $35,337 per year per Vendr

Qualys modules and per-asset pricing

Qualys sells its platform as discrete modules that share a per-asset license pool. VMDR is the flagship scanning product and the entry point for virtually every enterprise Qualys deployment. Policy Compliance, Patch Management, Web Application Scanning, and TotalCloud CSPM are sold as add-ons that draw from the same asset count. There is no per-user fee for core scanning; cost scales with the size of the environment, not the size of the team (Vendr, 2026).

Product or module	Pricing model	Typical 2026 price	Best for
Community Edition	Free	$0 (16 internal plus 3 external assets plus 1 web app)	Labs, evaluation, tiny shops
VMDR (core)	Per asset per year	$199 to $250 per asset	Vulnerability management baseline
Patch Management	Add-on to VMDR	+$30 per asset per year (15 to 25 percent)	Closing the remediation loop
Web Application Scanning (WAS)	Per app per year	From ~$1,995 (25 apps)	DAST for web apps and APIs
Policy Compliance	Per asset per year	Quote-based (bundled discount)	PCI DSS, CIS, SOC 2 audits
Virtual Scanner Appliance	Per appliance per year	~$8,000 to $9,000 each	Scanning segmented networks
Enterprise TruRisk Platform	Quote-based	Custom (volume-tiered)	Consolidated multi-module suite

VMDR combines asset discovery, vulnerability scanning, the Qualys TruRisk score (a risk-prioritization metric that ranks findings by real-world exploitability rather than raw CVSS), and response workflows in one license. The published per-asset rate sits between $199 and $250 per asset per year, confirmed across multiple 2026 pricing analyses. Patch Management as an add-on adds 15 to 25 percent over VMDR, and Web Application Scanning starts at approximately $1,995 per year for 25 apps (Beagle Security, 2026).

Worked examples at 100, 500, 1,000, and 5,000 assets

Asset count and contract length drive the discount tier. The table below uses the published per-asset rate to estimate annual spend at four common scales, before any volume discount (Ciphers Security, July 2026).

Environment size	Asset count	VMDR base estimate per year
Small team	100 assets	~$19,900
Growing mid-market	500 assets	~$99,500 (pre-discount)
Mid-market	1,000 assets	~$199,000 (expect volume discount)
Enterprise	5,000+ assets	Quote-based, negotiated well below list

Two caveats keep these numbers honest. First, the larger numbers are list math; at 1,000+ assets, volume discounting routinely pulls the effective per-asset rate down. The real invoice is lower than $199 multiplied by asset count. Second, VMDR is sold as an annual subscription, so this is recurring spend, not a one-time license. At 5,000+ assets, enterprises commonly spend $400K to $2M+ annually, with negotiated effective per-asset rates below the $199 published minimum (vendorbenchmark.com, 2026).

Enterprise TruRisk Platform bundle economics

Bundling VMDR with Policy Compliance, Patch Management, and TotalCloud unlocks deeper discounts than module-by-module purchasing. Enterprise TruRisk Platform is Qualys's consolidated multi-module suite, sold quote-based at volume-tiered pricing. List pricing for the platform runs $60 to $100 per IP per year; enterprise negotiated pricing brings effective rates to $36 to $65 per IP per year. At 10,000 IPs, TruRisk Platform totals approximately $360,000 to $650,000 per year before any add-on modules (vendorbenchmark.com, 2026).

The Platform bundle economics matter most for organizations that need VMDR plus Policy Compliance plus Patch Management. Buying each module separately delivers a higher combined line item than the consolidated platform license. Buyers should request line-item pricing for each module rather than accepting blended package pricing; individual module costs reveal which components carry the margin and which are effectively bundled in at low incremental cost (vendorbenchmark.com, 2026).

Hidden costs and asset scope discipline

Three line items routinely push real first-year cost above the list price. Professional services for initial deployment run 15 to 30 percent of the first-year license. Virtual Scanner Appliances for segmented networks cost $8,000 to $9,000 each per year. Asset scope creep is the single biggest source of year-over-year cost growth; cloud workloads and ephemeral assets accumulate quickly and the per-asset count silently grows without a corresponding renewal conversation (Vendr, 2026).

Qualys fiscal year ends January 31, so Q4 deals (November through January) achieve the deepest discounts. Platform bundle deals tend to achieve higher percentage discounts than individual module purchases. Competitive evaluations against Tenable and Rapid7 achieve 35 to 45 percent discounts. Multi-year commitments (3-year) add 8 to 15 percent on top of negotiated discounts. The single most important move before signing is to model the true asset and license-unit count, because that one number drives the entire bill (vendorbenchmark.com, 2026).