By Martin Keller · Reepa Solutions
When a data security incident is investigated at a mid-sized company, the most common finding is not "we had no idea" but "we should have known." A vulnerability that has been sitting in a public bulletin for months, a forgotten internet address from an old project, a server that never appeared in the scan scope — these gaps appear in almost every incident report that lands on our desk. For management, CFOs and IT leads this creates a double burden: first, fines under GDPR Article 32 loom if technical and organisational measures do not reflect the state of the art. Second, NIS2 has required many mid-sized companies to implement structured vulnerability detection and remediation since October 2024. A suitable vulnerability management tool is therefore no longer a technical nice-to-have — it is a board-level topic with direct liability implications. This comparison maps out the categories, names the most important vendors with indicative costs, and delivers a clear decision matrix for the question of in-house licence versus external service provider. For more detail on embedding this into a broader security strategy, see our Cybersecurity Guide for Mid-Sized Businesses.
Why tool selection now has liability implications
Vulnerability management was long a pure IT discipline, run by system administrators. Those days are over. NIS2 Article 21 makes the continuous detection and remediation of vulnerabilities a documentation-required board responsibility — management bears personal liability if it fails in its supervisory duty. GDPR Article 32 requires that technical measures reflect the state of the art. An organisation that cannot demonstrate in an audit that continuous vulnerability detection is in place starts at a disadvantage in any dispute. Cyber insurers have responded accordingly: without a demonstrable vulnerability management process, policies are either unavailable today or premiums double.
The second driver is operational. Over the past eighteen months at Reepa Solutions we have repeatedly seen that mid-sized companies with between 100 and 800 employees do not themselves know an average of 15 to 40 percent of their internet-facing assets — old subdomains, test systems, cloud resources from completed projects, devices from subsidiaries. These forgotten areas are the most common root cause of incidents because they are never patched and never monitored. A modern vulnerability management tool must therefore not only check known assets but also deliver the external view — the perspective of an outside observer looking at your organisation.
Third, the market for supplier audits is pushing tool selection to the foreground. Industrial clients, insurers and large public-sector bodies now regularly request proof of a continuous vulnerability management process including the tool stack in their security questionnaires. Organisations that cannot produce this are eliminated from tenders. These three drivers together — regulation, external visibility, supplier pressure — make tool selection a strategic decision point for the next twelve months.
Four categories — what does each tool cover?
Before comparing vendors, clarity on the categories is essential. "Vulnerability management" is an umbrella term for four distinct tool classes that overlap but do not replace each other. The overview below maps functionality to a category, not to a product name — vendors typically cover several categories simultaneously.
| Category | What it delivers | Who needs it |
|---|---|---|
| Traditional Vulnerability Scanner | Authenticated and unauthenticated testing of known systems against a CVE database | Any company with its own servers, endpoints or cloud workloads |
| Attack Surface Management (ASM) | External discovery of all internet-facing assets via domains, certificates and cloud — including unknown ones | Organisations with a web presence, cloud services or distributed locations |
| Prioritisation Engine (VPT, EPSS, KEV) | Consolidates findings from multiple scanners, weighted by threat intelligence and business relevance | Organisations running multiple parallel tools with more than 5,000 open findings |
| Threat Intelligence Feed | Up-to-date information on which vulnerabilities are actively exploitable and in which sector | As an add-on to any larger tool — rarely a pure standalone |
The key practical distinction is this: a vulnerability scanner sees what you show it. Attack surface management sees what you have forgotten. The two are complementary. We recommend mid-sized companies start with a traditional scanner for internal inventory and introduce an ASM solution for external visibility in parallel — once the organisation operates more than 30 internet domains, multiple cloud providers or subsidiary companies.
Six vendors compared head to head
The market is consolidated but not monolithic. The list below briefly summarises the vendors that are relevant for European mid-sized businesses — not a comprehensive market analysis, but the selection that regularly appears on the evaluation shortlist in our engagements. Cost figures are indicative benchmarks from real engagements in 2024 to 2026 and may vary significantly depending on negotiation.
- Tenable Nessus / Tenable Vulnerability ManagementMarket leader in the traditional scanner segment. Nessus Professional as a standalone tool for smaller environments, Tenable Vulnerability Management as a cloud platform with asset discovery and prioritisation via the Vulnerability Priority Rating. Strengths: broad detection depth, mature reporting. Costs: Nessus Professional around €4,000 per year, Tenable VM from approximately €15 per asset per year.
- Qualys VMDRCloud-native platform with modules for asset discovery, patch management and endpoint detection. Strengths: strong integration with patch tools, solid cloud compliance modules. Weaknesses: can feel oversized for smaller setups. Costs: typically IP-based; in European mid-market setups between €8 and €20 per IP per year.
- Rapid7 InsightVMStrong on risk scoring with the RealRisk Score methodology. Wide integration coverage with SIEM, ITSM and container tools. Strengths: meaningful executive reports, clear trend visualisation. Costs: from approximately €12 per asset per year at the standard tier, significantly more with InsightConnect automation.
- Nucleus SecurityPure prioritisation engine with no proprietary scanner. Consolidates findings from Tenable, Qualys, Rapid7, Snyk, Burp and others into a single risk view. Strengths: ideal when running three or more parallel scanners, rapid consolidation. Weaknesses: requires existing scanners as a data source. Costs: per asset, ranging from €6 to €15 per year.
- Holm SecuritySwedish vendor with GDPR-compliant EU hosting and a combined offering of vulnerability scanning and phishing simulation. Strengths: strong EU data protection story, comparatively affordable entry packages. Weaknesses: smaller detection database than the US market leaders. Costs: from approximately €6,000 per year for medium-sized environments.
- Greenbone OpenVAS / Greenbone EnterpriseOpen-source roots, commercial enterprise edition with BSI proximity and hosting in Germany. Strengths: no licence costs with the OpenVAS variant, high acceptance among German compliance auditors. Weaknesses: less convenience, more in-house operational effort. Costs: OpenVAS free plus operational overhead; enterprise appliances from approximately €8,000 per year.
For completeness: vendors such as Microsoft Defender Vulnerability Management cover endpoints very well and are already included in many Microsoft 365 E5 licences — a sensible addition, but not a replacement for a comprehensive server and network scanner. For pure cloud vulnerability management, Wiz is also playing an increasingly important role.
What does this realistically cost?
Licence costs are only part of the total cost. Anyone building out vulnerability management for a mid-sized company with 500 to 1,500 employees should factor in the following three cost blocks:
| Cost block | Range per year | Notes |
|---|---|---|
| Tool licence (scanner + ASM) | €10,000 – €60,000 | Highly dependent on asset count and add-ons |
| Implementation and tuning (year 1) | €15,000 – €40,000 | Asset inventory, scan profiles, report templates |
| Ongoing operations (in-house) | 0.3 – 1.0 FTE | Triage, reporting, response to findings |
| MSSP option instead of FTE | €20,000 – €80,000 | Includes tool licence, triage and monthly report |
The most common misconception in mid-market projects is that the licence is the main cost driver. In reality, operational and triage costs in the first two years are typically twice as high as the licence itself — simply because findings do not automatically become tickets, patches and reports. Anyone who does not plan for ongoing maintenance buys a tool that sits in the corner without delivering any value.
Free tool selection assessment
Wondering which tool or model fits your environment? We offer a free initial assessment: a 30 to 45 minute conversation, a focused review of your current situation, an honest recommendation per category and a realistic effort estimate.
Request a free tool selection assessment
A compact starting point at no cost and with no obligation. You receive a well-founded external perspective on your current vulnerability management maturity and concrete recommendations on which tool class to prioritise.
Request a free tool selection assessmentIn-house or MSSP — when does each approach make sense?
The question of whether to operate a vulnerability management tool in-house or source it through a Managed Security Service Provider is the most important fork in the road during tool selection. It depends less on the business model than on three factors: available staff capacity, asset count and the maturity of existing security processes.
| Indicator | In-house licence makes sense | MSSP model makes sense |
|---|---|---|
| Total asset count | More than 2,000 assets | Fewer than 2,000 assets |
| Dedicated staff | At least 0.5 FTE available | Under 0.3 FTE realistic |
| Existing SIEM / SOC connection | In place | Not in place |
| Compliance reporting needs | In-house reporting feasible | External report helpful |
| Industry context | High specific requirements (healthcare, critical infrastructure) | Standard sectors without critical infrastructure status |
| Geographic spread | Single centralised IT location | Distributed branch offices |
One observation from recent engagements: in mid-sized companies with fewer than 500 employees, the MSSP model is the more cost-effective choice in roughly three quarters of cases, because the internal triage effort is consistently underestimated. Above around 1,500 employees the picture flips — ongoing in-house ownership typically becomes more cost-efficient, provided the internal IT team has the necessary capacity. Organisations that run a hybrid model — licence in-house, triage and response via an external provider — often get the best of both worlds, but pay for the coordination overhead between the two sides.
Six selection criteria for the final decision
When evaluating a vendor, the selection should rest on a small number of hard criteria rather than feature lists. The following six questions consistently make the difference between a fitting and a mismatched tool in our advisory engagements.
- Asset discovery: does the tool find our unknown assets? Let the tool run during a proof-of-concept phase and compare the results with your official asset list. If the tool finds fewer assets than you already know about, it is not an ASM tool.
- Prioritisation: does the tool deliver a defensible risk ordering? A backlog of 5,000 findings is a pile; a top-50 list with justifications is a roadmap. Check whether the tool performs this reduction automatically.
- Compliance reports: do the templates fit GDPR, NIS2 and ISO 27001? Pre-built report templates for auditors save more days than the licence costs. Ask for sample reports from comparable engagements.
- Integration: does the tool connect with Jira, ServiceNow and your SIEM? Findings that do not automatically become tickets stay open. Verify integration depth specifically against an end-to-end workflow.
- Data sovereignty and EU hosting: where are the scan results stored? For many mid-sized businesses, EU or DACH hosting is a hard requirement. Clarify this before the pilot, not after.
- Support: how quickly does an English-language answer arrive? Submit a substantive question through the support portal before signing the contract. Response time is a reliable indicator of the operational experience that follows.
These six questions are deliberately pragmatic — they do not replace a complete selection process, but they rule out the most common mistakes. Running all six against three vendors typically produces a well-founded recommendation within four weeks. For embedding this in a broader cybersecurity plan, we recommend cross-referencing our cluster articles on ISO 27001 Certification Costs and the GDPR IT Security Checklist.
Frequently asked questions
What is the difference between a vulnerability scanner and an attack surface management platform?
A traditional scanner checks the systems you explicitly point it at — you define IP ranges, hostnames and credentials, and the scanner returns a vulnerability list. Attack surface management inverts the logic: the platform independently discovers your internet-facing assets via domains, certificates and cloud discovery — including assets you have forgotten about. In practice, mid-sized companies need both: a scanner for known internal systems and an ASM tool for the external view.
Which tool is suitable for companies with 50 to 200 employees?
For this size range, Tenable Nessus Professional, Qualys VMDR Express or a self-managed Greenbone solution are typical choices. The decisive factor is asset count, not headcount. Companies with fewer than 500 IT assets — servers, endpoints and cloud workloads combined — can get by with a traditional scanner. From around 1,000 assets or in distributed cloud environments, a larger platform with cloud discovery and a prioritisation engine starts to pay off.
Is an MSSP worth it instead of an in-house tool licence?
A Managed Security Service Provider makes sense when you cannot dedicate a full-time role to vulnerability management. Pure tool licences are cheaper than an MSSP, but tools without active operation deliver no value. We recommend in-house tooling only from around 2,000 assets with a dedicated person at 50 percent capacity. Below that threshold, an MSSP model with a monthly reporting cadence is generally the more cost-effective choice.
How are the licensing costs of the major vendors structured?
Tenable and Rapid7 typically charge per asset per year; Qualys often charges per IP address. Realistic ranges for mid-sized environments are ten to thirty euros per asset per year at the standard tier, higher for enterprise editions with threat intelligence add-ons. Implementation effort and ongoing maintenance add to this — the tool licence alone is typically only one third of total costs over the first two years.
Do we really need a prioritisation engine like Nucleus Security?
Once you run several scanners in parallel — for example Tenable for internal servers, Burp Suite for web applications, Snyk for code dependencies — consolidating findings becomes the bottleneck. A prioritisation engine ranks thousands of findings by business relevance, threat intelligence and exploit availability. For companies running only one scanner vendor with a manageable asset list, a separate prioritisation engine is generally overkill.
Is an open-source tool like Greenbone OpenVAS sufficient?
For a basic inventory and technical scanning — yes, Greenbone delivers solid results, particularly in the German market given its proximity to the BSI. What commercial platforms add on top is prioritisation based on threat intelligence, cloud-native integration, asset discovery convenience and professional support. Organisations that can and want to build this themselves do well with Greenbone. Those who need fast time-to-value are usually happy to pay for commercial tools.
Ready to select the right tool for your environment?
Let us talk for 30 minutes with no obligation. We will walk through your asset landscape, map your requirements to the four tool categories and deliver an honest recommendation — in-house or MSSP — along with a realistic roadmap. Our Cybersecurity Pillar Guide describes how to embed this comprehensively into your security process.
Schedule a 30-minute conversation
IT security and cloud architect with more than ten years of experience. Developing Reepa Security with his team — an offensive audit platform for mid-sized businesses. Writes regularly about vulnerability management, NIS2, GDPR compliance and tool selection in the DACH market.
Reviewed: 22 May 2026 · More about Martin