# Vulnerability management platforms: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "vulnerability management platform" and as "vulnerability scanning and management tool", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/vulnerability-management-platforms/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/vulnerability-management-platforms/index.md

**Standing:** Rapid7 InsightVM leads with 45% of first choices; verdict clear leader. 44 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Rapid7 InsightVM](https://www.gane.ai/index/it/vendors/rapid7-insightvm/index.md) | 45% | 21% | 52 |
| 2 | [Intruder](https://www.gane.ai/index/it/vendors/intruder/index.md) | 16% | 0% | 19 |
| 3 | [ManageEngine Vulnerability Manager Plus](https://www.gane.ai/index/it/vendors/manageengine-vulnerability-manager-plus/index.md) | 9% | 6% | 16 |
| 4 | [OpenVAS](https://www.gane.ai/index/it/vendors/openvas/index.md) | 9% | 24% | 21 |
| 5 | [Tenable Vulnerability Management](https://www.gane.ai/index/it/vendors/tenable-vulnerability-management/index.md) | 7% | 14% | 43 |
| 6 | [Tenable Nessus](https://www.gane.ai/index/it/vendors/tenable-nessus/index.md) | 5% | 36% | 14 |
| 7 | [Microsoft Defender Vulnerability Management](https://www.gane.ai/index/it/vendors/microsoft-defender-vulnerability-management/index.md) | 2% | 19% | 27 |
| 11 | [Qualys VMDR](https://www.gane.ai/index/it/vendors/qualys-vmdr/index.md) | 0% | 19% | 48 |
| 12 | [Wiz](https://www.gane.ai/index/it/vendors/wiz/index.md) | 0% | 6% | 16 |
| 13 | [Orca Security](https://www.gane.ai/index/it/vendors/orca-security/index.md) | 0% | 0% | 12 |

Rank is by share of first choices among all 68 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightVM; alternatives Aikido Security, ESET Vulnerability & Patch Management, UpGuard
- GPT-5.4 mini: Tenable Vulnerability Management; alternatives Arctic Wolf, Qualys VMDR
- Gemini 3.5 Flash: Vicarius vRx; alternatives CrowdStrike Falcon Exposure Management, Intruder, Microsoft Defender Vulnerability Management, Orca Security
- Perplexity Sonar: Rapid7 InsightVM; alternatives ManageEngine Vulnerability Manager Plus, Microsoft Defender for Cloud, Vicarius vRx
- Grok 4.20: Rapid7 InsightVM; alternatives CrowdStrike Falcon Spotlight, Qualys VMDR, Tenable Vulnerability Management
- Mistral Small: Rapid7 InsightVM; alternatives ESET Vulnerability & Patch Management, UpGuard
- DeepSeek V4 Flash: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
- Llama 4 Maverick: Rapid7 InsightVM
- Qwen 3.7 Flash: Rapid7 InsightVM; alternatives ManageEngine Vulnerability Manager Plus, Qualys VMDR, Tenable Vulnerability Management
- Kimi K2: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
- GLM 4.7 FlashX: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management
- MiniMax M2.5: Rapid7 InsightVM; alternatives Cisco Vulnerability Management, Orca Security, Tenable Vulnerability Management, Wiz

## Sources the answers cite

60 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- axis-intelligence.com: 32 answers, 32 citations
- vicarius.io: 29 answers, 51 citations
- gartner.com: 28 answers, 35 citations
- techrepublic.com: 26 answers, 27 citations
- upguard.com: 24 answers, 24 citations
- expertinsights.com: 20 answers, 23 citations
- orca.security: 20 answers, 21 citations
- riskwatch.com: 20 answers, 20 citations

Pages named in the most answers:

- https://axis-intelligence.com/best-vulnerability-management-tools-tested (32 answers)
- https://techrepublic.com/article/top-vulnerability-management-tools (26 answers)
- https://gartner.com/reviews/market/vulnerability-assessment (23 answers)
- https://upguard.com/blog/top-vendor-vulnerability-tools (22 answers)
- https://orca.security/resources/blog/best-vulnerability-management-tools (20 answers)
- https://riskwatch.com/vulnerability-management-software (20 answers)
- https://vicarius.io/articles/6-best-consolidated-vulnerability-management-platforms-for-mid-market-security-and-it-teams-2026 (18 answers)
- https://expertinsights.com/security-operations/the-top-vulnerability-management-solutions (17 answers)
- https://cybervendorguide.com/guides/vulnerability-management (16 answers)
- https://technologymatch.com/blog/tenable-vs-qualys-vs-rapid7-vm-platform-comparison (15 answers)

## Warned against

- Rapid7 InsightVM: 11 of 52 labels negative. "One comparison mentioned some user complaints about Rapid7 Nexpose (OS fingerprinting issues, filtering problems, RBAC limitations)" (MiniMax M2.5, negative prompt)
- Qualys VMDR: 9 of 48 labels negative. "Steep learning curve... False positives... Support delays... Avoid if you need quick onboarding or responsive support." (Grok 4.20, negative prompt)
- Tenable Vulnerability Management: 6 of 43 labels negative. "powerful, highly accurate, and standard for compliance, though they can sometimes feel overly complex for smaller teams" (Gemini 3.5 Flash, scale prompt)
- Tenable Nessus: 5 of 14 labels negative. "Buying a standalone scanner (like *Tenable Nessus Professional* ...) and trying to run an enterprise program with it... Why to avoid" (Gemini 3.5 Flash, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.