SIDE BY SIDE · FACTS ONLY

JupiterOne vs Qualys: asset inventory facts side by side

SHORT ANSWER

JupiterOne describes 2 of the five approaches on the pages we read and Qualys describes 4; they differ on CAASM aggregation, Agent-based inventory, External attack surface management and CMDB-centred inventory. On collection, JupiterOne works without new agents and Qualys relies on its own agent. Many estates run two of these approaches together, so the question is often which pair, not which one; we do not score either.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How do their approaches compare?

Top bar: JupiterOne
Lower bar, lighter: Qualys CSAM

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

What are the facts, side by side?

From each vendor's own pages. Differs marks rows where the recorded status or check value differs.
Fact	JupiterOne	Qualys CSAM
Positioning	A cyber asset platform built on a security graph: more than 200 integrations feed assets and their relationships into a graph you can query in plain English or with a pre-built query library.	Qualys's Cybersecurity Asset Management product, which Qualys describes as one platform and one view of cyber risk for unknown assets across the attack surface.
Deployment	SaaS with API integrations; useful coverage depends on how many integrations a team configures. Source: JupiterOne platform · Read 27 Sep 2026	Uses the Qualys agent, which can also act as a passive sensor; deployment options are not detailed on the page we read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
CAASM aggregationDiffers	Described 200+ pre-built integrations feed a security graph of devices, users, networks, applications, data, code repositories, security controls and owners. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources Not described on the pages we read.
Agent-based inventoryDiffers	Not in our sources Not described on the pages we read.	Described Collects through the Qualys agent, which can also act as a passive sensor. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
External attack surface managementDiffers	Not in our sources Not described on the pages we read.	With a condition The product page links to Qualys EASM; we did not read that page. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
CMDB-centred inventoryDiffers	Not in our sources Not described on the pages we read.	With a condition Syncs with ServiceNow and BMC ITSM tools rather than acting as a CMDB. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Exposure management	With a condition Blast radius views on the graph; Unified Vulnerability Management, announced in May 2026, deduplicates findings across tools. Source: GlobeNewswire: JupiterOne AI system mapping and Unified Vulnerability Management · Read 27 Sep 2026	With a condition Describes one platform and one view of cyber risk; the detail is not on the page we read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Servers and network devicesDiffers	Partly Networks are a listed asset class; network devices are not called out. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Cloud workloadsDiffers	Partly Covered through integrations; cloud workloads are not named as a class on the platform page. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
SaaS applicationsDiffers	Partly Applications are a listed asset class. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Identities as assetsDiffers	Matches Users are a listed asset class. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Off-network laptopsDiffers	Partly Devices are a listed asset class, through the endpoint tools you integrate. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
OT and IoT devices	Not in our sources	Not in our sources
Internet-facing discoveryDiffers	Not in our sources	Partly Qualys EASM is linked from the product page; not read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Offers its own agentDiffers	Not in our sources	Matches Qualys agent, usable as a passive sensor. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Works without new agentsDiffers	Matches Builds its graph from API integrations. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Merges records from several sourcesDiffers	Partly The graph maps relationships between assets; how duplicate records merge depends on the data each integration supplies. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Feeds or updates a CMDBDiffers	Not in our sources	Matches Syncs with ServiceNow and BMC ITSM tools. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Cross-source queries and reportsDiffers	Matches Graph queries in plain English, a pre-built query library and compliance insights. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Workflows, tickets or actionsDiffers	Partly Alerts are documented; write-back actions into other systems are not. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Price or pricing basis publishedDiffers	Matches Annual list prices of $25,000, $50,000 and $100,000 by tier. Source: JupiterOne pricing · Read 27 Sep 2026	Not in our sources
Free tier or trialDiffers	Not in our sources	Matches Free trial offered. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Platform it is part of	None	None
Integrations	200+ pre-built security integrations. Source: JupiterOne platform · Read 27 Sep 2026	ServiceNow and BMC ITSM sync; other integrations are not listed on the page we read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Price	Published: Small-Market $25,000 a year; Mid-Market $50,000 for 12 months up to 200,000 data points; Enterprise $100,000 for 12 months up to 400,000 data points; custom above 1 million data points. Priced on data points and term. No free tier or trial mentioned. Source: JupiterOne pricing · Read 27 Sep 2026	Not published Not published. A free trial is offered. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026

Where do they differ?

CAASM aggregation: JupiterOne describes it; Qualys is not in our sources.
Agent-based inventory: JupiterOne is not in our sources; Qualys describes it.
External attack surface management: JupiterOne is not in our sources; Qualys describes it with a condition.
CMDB-centred inventory: JupiterOne is not in our sources; Qualys describes it with a condition.
Servers and network devices: JupiterOne partly matches; Qualys is not in our sources.
Cloud workloads: JupiterOne partly matches; Qualys is not in our sources.
SaaS applications: JupiterOne partly matches; Qualys is not in our sources.
Identities as assets: JupiterOne matches; Qualys is not in our sources.
Off-network laptops: JupiterOne partly matches; Qualys is not in our sources.
Internet-facing discovery: JupiterOne is not in our sources; Qualys partly matches.
Offers its own agent: JupiterOne is not in our sources; Qualys matches.
Works without new agents: JupiterOne matches; Qualys is not in our sources.
Merges records from several sources: JupiterOne partly matches; Qualys is not in our sources.
Feeds or updates a CMDB: JupiterOne is not in our sources; Qualys matches.
Cross-source queries and reports: JupiterOne matches; Qualys is not in our sources.
Workflows, tickets or actions: JupiterOne partly matches; Qualys is not in our sources.
Price or pricing basis published: JupiterOne matches; Qualys is not in our sources.
Free tier or trial: JupiterOne is not in our sources; Qualys matches.

Can they work together?

Neither vendor's pages we read name the other as an integration. That does not mean they cannot work together; ask both vendors.

Choose JupiterOne if

You want to ask relationship questions across assets, users and code
You need a published price before a sales call

Choose Qualys if

You already run the Qualys agent and want asset management from the same data
You need sync with ServiceNow or BMC

Which limits should you check?

JupiterOne

OT and IoT devices are not listed among its asset classes.
Write-back actions into other systems are not documented, and no free tier or trial is mentioned.

Qualys

No price published.
Which third-party sources it reads, and its SaaS, identity and OT coverage, are not described on the page we read.

Put JupiterOne and Qualys in the asset census with others Run the finder

Questions people ask

Is JupiterOne or Qualys better?

Neither is scored on this site. JupiterOne describes 2 of five approaches and Qualys 4 on the pages we read, and they differ on 18 recorded facts. Which fits depends on where your assets live, whether you can install agents, your CMDB and your tools; the finder checks those.

Do JupiterOne and Qualys work with a CMDB?

JupiterOne: Not in our sources. Qualys: Matches. Syncs with ServiceNow and BMC ITSM tools.

Do JupiterOne or Qualys publish prices?

JupiterOne: Published: Small-Market $25,000 a year; Mid-Market $50,000 for 12 months up to 200,000 data points; Enterprise $100,000 for 12 months up to 400,000 data points; custom above 1 million data points. Priced on data points and term. No free tier or trial mentioned. Qualys: Not published. A free trial is offered.