# Vulnerability management platforms: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "vulnerability management platform" and as "vulnerability scanning and management tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/vulnerability-management-platforms/2026-11

**Standing:** Rapid7 InsightVM leads with 33% of first choices; verdict contested. 54 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Rapid7 InsightVM](https://www.gane.ai/index/it/vendors/rapid7-insightvm/index.md) | 33% | 11% | 57 |
| 2 | [Tenable Vulnerability Management](https://www.gane.ai/index/it/vendors/tenable-vulnerability-management/index.md) | 19% | 15% | 60 |
| 3 | [Qualys VMDR](https://www.gane.ai/index/it/vendors/qualys-vmdr/index.md) | 9% | 18% | 60 |
| 4 | [ManageEngine Vulnerability Manager Plus](https://www.gane.ai/index/it/vendors/manageengine-vulnerability-manager-plus/index.md) | 7% | 10% | 20 |
| 5 | [Microsoft Defender Vulnerability Management](https://www.gane.ai/index/it/vendors/microsoft-defender-vulnerability-management/index.md) | 6% | 10% | 31 |
| 6 | [Intruder](https://www.gane.ai/index/it/vendors/intruder/index.md) | 6% | 0% | 23 |
| 7 | [OpenVAS](https://www.gane.ai/index/it/vendors/openvas/index.md) | 6% | 38% | 21 |
| 8 | [Wiz](https://www.gane.ai/index/it/vendors/wiz/index.md) | 4% | 0% | 18 |
| 10 | [Tenable Nessus](https://www.gane.ai/index/it/vendors/tenable-nessus/index.md) | 2% | 35% | 20 |
| 14 | [Orca Security](https://www.gane.ai/index/it/vendors/orca-security/index.md) | 0% | 0% | 13 |

Rank is by share of first choices among all 93 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Tenable Vulnerability Management; alternatives CrowdStrike, Qualys VMDR, Rapid7 InsightVM, Wiz
- Gemini 3.5 Flash: Rapid7 InsightVM, Wiz; alternatives CrowdStrike Falcon Spotlight, Microsoft Defender Vulnerability Management, Orca Security, Qualys VMDR
- Perplexity Sonar: Rapid7 InsightVM; alternatives ManageEngine Vulnerability Manager Plus, Microsoft Defender for Cloud, Tenable Vulnerability Management, Vicarius vRx
- Grok 4.20: Tenable Vulnerability Management; alternatives CrowdStrike Falcon Exposure Management, ESET Vulnerability & Patch Mgmt, Qualys VMDR, Rapid7 InsightVM
- Mistral Small: Tenable Vulnerability Management; alternatives Intruder, ManageEngine Vulnerability Manager Plus, Qualys VMDR
- DeepSeek V4 Flash: ManageEngine Vulnerability Manager Plus, Rapid7 InsightVM; alternatives Qualys VMDR, Tenable Vulnerability Management
- Llama 4 Maverick: Intruder; alternatives Qualys VMDR, Rapid7 InsightVM, Tenable Vulnerability Management
- Qwen 3.7 Flash: Rapid7 InsightVM; alternatives CrowdStrike Falcon Spotlight, Intruder, Tenable Nessus, Tenable Vulnerability Management
- Kimi K2: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR
- GLM 4.7 FlashX: Rapid7 InsightVM; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Tenable Vulnerability Management, WithSecure Elements
- MiniMax M2.5: Qualys VMDR, Rapid7 InsightVM; alternatives CrowdStrike Falcon Spotlight, Intruder, Tenable Nessus
- GPT-6 Luna: Tenable Vulnerability Management; alternatives Microsoft Defender Vulnerability Management, Qualys VMDR, Rapid7 InsightVM
- Muse Glimmer 30B: Rapid7 InsightVM; alternatives Qualys VMDR, Tenable Vulnerability Management

## Sources the answers cite

68 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- vicarius.io: 30 answers, 39 citations
- axis-intelligence.com: 28 answers, 28 citations
- linfordco.com: 23 answers, 23 citations
- motadata.com: 21 answers, 21 citations
- techrepublic.com: 19 answers, 19 citations
- securityboulevard.com: 18 answers, 21 citations
- tenable.com: 17 answers, 27 citations
- sprinto.com: 17 answers, 17 citations

Pages named in the most answers:

- https://axis-intelligence.com/best-vulnerability-management-tools-tested (28 answers)
- https://linfordco.com/blog/choosing-vulnerability-assessment-tools (23 answers)
- https://motadata.com/blog/vulnerability-management-tools (21 answers)
- https://techrepublic.com/article/top-vulnerability-management-tools (19 answers)
- https://securityboulevard.com/2024/06/top-15-vulnerability-management-tools-for-your-business (17 answers)
- https://sprinto.com/blog/vulnerability-management-tools (17 answers)
- https://pdq.com/blog/best-vulnerability-management-tools (13 answers)
- https://ninjaone.com/blog/best-vulnerability-management-tools (12 answers)
- https://riskwatch.com/vulnerability-management-software (11 answers)
- https://blog.scalefusion.com/best-vulnerability-management-tools (9 answers)

## Warned against

- Qualys VMDR: 11 of 60 labels negative. "Avoid if support and ease-of-use are priorities; test against Tenable or Rapid7." (Grok 4.20, negative prompt)
- Tenable Vulnerability Management: 9 of 60 labels negative. "Avoid: Tenable unless you have specific needs for OT/legacy asset coverage and budget for $10K+ annually." (Kimi K2, direct prompt)
- OpenVAS: 8 of 21 labels negative. "Standalone Nessus (without a console), OpenVAS (without Kubelet/KQL integration) | Lacks the "Management" layer" (Qwen 3.7 Flash, negative prompt)
- Rapid7 InsightVM: 6 of 57 labels negative. "Avoid for tight budgets: Enterprise-heavy tools like Rapid7 InsightVM" (Grok 4.20, budget prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Rapid7 InsightVM at 33%.

- Intruder: 11% to 6%, −5. Inside the floor by 6 points · rank 3 → 6 of 93.
- Wiz: 0% to 4%, +4. Inside the floor by 7 points · rank 16 → 8 of 93.
- Vicarius vRx: 4% to 0%, −4. Inside the floor by 7 points · rank 7 → 17 of 93.
- Rapid7 InsightVM: 30% to 33%, +3. Inside the floor by 8 points · rank 1 of 93, unchanged.
- Tenable Vulnerability Management: 16% to 19%, +3. Inside the floor by 8 points · rank 2 of 93, unchanged.
- Microsoft Defender Vulnerability Management: 4% to 6%, +2. Inside the floor by 9 points · rank 6 → 5 of 93.
- OpenVAS: 4% to 6%, +2. Inside the floor by 9 points · rank 9 → 7 of 93.
- Tenable Nessus: 4% to 2%, −2. Inside the floor by 9 points · rank 8 → 10 of 93.
- Qualys VMDR: 9% to 9%, ±0. Inside the floor by 11 points · rank 4 → 3 of 93.
- ManageEngine Vulnerability Manager Plus: 7% to 7%, ±0. Inside the floor by 11 points · rank 5 → 4 of 93.
- Orca Security: 0% to 0%, ±0. Inside the floor by 11 points · rank 15 → 14 of 93.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.