Automox vs. Qualys VMDR

Automox is well-suited for managing workstations but lacks flexibility for server environments.
It excels in scenarios where systems may not regularly connect to the corporate network but have internet access, ensuring devices can still check in and receive timely patches. This provides organizations with confidence in maintaining patch compliance across remote endpoints.
However, effective use of Automox requires staff who are proficient in PowerShell scripting. The platform has limited native support for third-party applications, often requiring custom worklets to manage software updates. It performs best in environments that primarily rely on widely used, off-the-shelf software.

Incentivized

Qualys VMDR supports both remote scanning and as well as agent based scanning. With a complex infrastructure with over 2 million devices and 100s getting added and removed on daily basis makes the operations challenging. Qualys VMDR has a great feature to do discovery scan to detect active devices on the network and perform vulnerability scans on those assets. Authentication is also easy to setup and use.

Incentivized

• Shows applications installed on a specific asset
• Able to push policies and updates remotely , creating policies is easy.
• Keep track of compliant devices and when is the last time they have connected to the servers
• All the great information provided within one single device

Incentivized

• Qualys VMDR automates the remediation process for risks without code.
• Scans and detects all of our assets whether they are IT or IOT
• Analyzes our environment for misconfigurations and measures risk against industry benchmarks

Incentivized

• I was not aware that the starting default policies are inactive until I activate them. That would have been a nice pop up to see on first login.
• I think the pricing for integrating 3rd party apps could be more competitive. The base tier is so affordable, the jump up is a bit high.
• I'd like the option to remember my device and not have to use 2FA on every single login to the dashboard from the same device.
• I looked, and cannot find, but would appreciate an iOS mobile app of the dashboard to monitor and adminstrate from my mobile device.

Incentivized

• Qualys VMDR can definitely improve on its reporting of assets as we have caught devices not captured in the Qualys VMDR scans.
• We would like to see an improvement on the dashboard interface as it is faulty sometimes.
• Qualys VMDR should focus on more competitive pricing as it is very expensive.

Incentivized

This is a software that just works. Once configured its a set and forget kind of tool that keeps things up to date and alerts me if something is wrong. I was able to work through an expansion project to deploy an additional 500 devices in almost no time and create a robust self-patching environment.

Incentivized

Next to Veeam (which is a tremendous product for backup/DR) this is the best service/software I have used in the past three decades. Should be called the Swiss Army Knife of security.

Incentivized

It is super simple to set up and deploy, Maintaining it also easy as pie. It gives great detailed information daily on patches that succeed and ones that fail as well. with remote, patching, scanning, and monitoring all in one pane it has saved us money hand over fist with the tools we no longer need to have for our organization.

Incentivized

infrastructure to identify vulnerabilities

Always available with the exception on maint windows

Incentivized

Once in a while it would be slow -

Incentivized

1. Simplicity and Ease of Use 2. Cross-Platform Support 3. Powerful Automation with Worklets 4. Real-Time Visibility and Control 5. Fast and Reliable Cloud-Based Updates 6. Strong Security Focus

Incentivized

This is iron but I am giving it 5 star and I can give more If I can do because they are best in support. So once you own this product they will assign a dedicated support for you and when you are under the weather with anything just connect them with anything call, ping or ticket they will come like Genie.

Implementing Automox successfully starts with a clear strategy for organizing and grouping devices based on operating systems, environments, or business criticality. This ensures that patching and configuration policies can be applied with precision. A phased rollout approach is essential—beginning with a pilot group allows teams to test patching schedules, reboot behaviors, and custom Worklets before scaling across the organization. Leveraging Worklets from the start can significantly boost automation by enforcing security baselines and performing routine system tasks. Integration with existing SOC tools, such as SIEMs, enhances visibility and response time by correlating patch compliance with threat intelligence. Additionally, aligning patching schedules with operational downtimes minimizes disruptions, and consistent monitoring and reporting helps maintain compliance and prepare for audits. Overall, Automox offers a streamlined and effective solution, but its true value is unlocked through thoughtful planning, testing, and integration with existing IT and security workflows.

Incentivized

Not really - the integrations via connectors is not heavy lifting. Any complexity has to do with a service that requires more steps (i.e. AWS/GCP)

Incentivized

We felt that Automox provided us with the functionality our MSP offered, including OS and device patching, as well as remote control capabilities, but in a better and more manageable way. We also felt the usability of the tool gave us the ability to be effective in our way of working, as well as integrating with Rapid7 was a massive benefit for us.

Incentivized

Qualys VMDR was selected against competitors because of the depth of insight the platform provides. When stacked against other competitors, platforms like Syxsense couldn't produce the same level on insight and reporting like how Qualys VMDR does. Qualys VMDR also does a great job at gathering information about the latest security definitions and using those to analyze our environment to alert of any vulnerabilities. Something that Syxsense couldn't.

Incentivized

Outside some pretty arcane apps or OS this is painless. The problem - and self-inflicted - is that older stuff is not supported.

Incentivized

• Being a start up, we have pivoted our strategies a number of times. The pay as you go model has worked very well for us, and has prevented us from overprovisioning
• The time saved pulling reports to provide to auditors has been well worth our small spend on the solution
• We have no need to maintain a scanning tool or invest in hardware thanks to the SaaS nature of Automox

Incentivized

• Cut down on manual efforts to investigate or remediate vulnerabilities, which can be a big driver of ROI
• Avoidance of potential incidents with upfront risk mitigation
• Patching efficiency gains

Incentivized