Vulnerability management solution evaluation criteria

Question

We are planning for a vulnerability management solution, so I am looking out for evaluation criteria between the well known solutions like Nessus, Qualys and Nexpose. If anyone could share such evaluation points it would be really helpful.

As this question is asking for software evaluation *criteria*, not a software recommendation, I am voting not to close it as off-topic. — Neil Smithline, Jun 07 '16 at 17:41
I tried to edit out the part of the question focusing more on product recommendation (or comparison) and leave the part about evalution criteria in an attempt to make it more on topic. airhack, feel free to rollback if you want to. — Anders, Jun 07 '16 at 20:21

score 2 · Answer 1 · answered Jul 08 '16 at 05:18

2

Bandwidth requirements
System requirements
Training offerings
Reporting
Accuracy (number of false positives)
Time to scan
Extra offerings
- Example: Nessus has web app tool; Nexpose doesn't
Vulnerabilities detected (make a vulnerable device have all three scan it)

answered Jul 08 '16 at 05:18

zerocool

21
4

Number of false positives is very important criteria. Each positive must be investigated to determine if it is false positive, if most of them are false positive it creates a lot of work and also makes you treat any positive less seriously. – Kirill Sinitski Oct 06 '16 at 12:57

score 0 · Answer 2 · answered Jun 07 '16 at 21:26

The free book from O'Reilly on DevOpsSec: Securing Software through Continuous Delivery notes that a vulnerability management solution should create directives for configuration-management tools (including Ansible, Chef, Puppet, Salt, Powershell DSC, and Docker).

This may preclude the three vendors you suggested, so I suggest looking at other solutions.

score 0 · Answer 3 · answered Jun 08 '16 at 02:48

It sounds like you're looking for an ASV solution and each of these will scan and identify vulnerabilities using the same vulnerability databases and ranking methodologies. The main differentiators are generally cost, ease of use and reporting functionality.

score 0 · Answer 4 · answered Jan 31 '20 at 07:01

0

One other answer offered "Reporting" as a criteria but I want to specify and clarify the reporting should probably also include historical logging of scans for audit purposes.

answered Jan 31 '20 at 07:01

d1str0

2,348
14
24

Vulnerability management solution evaluation criteria

4 Answers4