SIDE BY SIDE · FACTS ONLY

Qualys vs Rapid7: asset inventory facts side by side

SHORT ANSWER

Qualys describes 4 of the five approaches on the pages we read and Rapid7 describes 3; they differ on CAASM aggregation, Agent-based inventory, External attack surface management and CMDB-centred inventory. On collection, Qualys relies on its own agent and Rapid7 does not describe its collection method on the pages we read. Many estates run two of these approaches together, so the question is often which pair, not which one; we do not score either.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How do their approaches compare?

Top bar: Qualys CSAM
Lower bar, lighter: Rapid7 Surface Command

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

What are the facts, side by side?

From each vendor's own pages. Differs marks rows where the recorded status or check value differs.
Fact	Qualys CSAM	Rapid7 Surface Command
Positioning	Qualys's Cybersecurity Asset Management product, which Qualys describes as one platform and one view of cyber risk for unknown assets across the attack surface.	Rapid7's attack surface product, combining external discovery (EASM) with asset discovery and a unified internal and external inventory (CAASM), part of the Rapid7 Command platform.
Deployment	Uses the Qualys agent, which can also act as a passive sensor; deployment options are not detailed on the page we read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Part of the Rapid7 Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026
CAASM aggregationDiffers	Not in our sources Not described on the pages we read.	Described Asset discovery and a unified inventory (CAASM) including devices, software, identities and controls. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Agent-based inventoryDiffers	Described Collects through the Qualys agent, which can also act as a passive sensor. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Not in our sources Not described on the pages we read.
External attack surface managementDiffers	With a condition The product page links to Qualys EASM; we did not read that page. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Described Internal and external attack surface visibility (EASM), including unknown internet-facing assets and shadow IT. Source: Rapid7 Surface Command · Read 27 Sep 2026
CMDB-centred inventoryDiffers	With a condition Syncs with ServiceNow and BMC ITSM tools rather than acting as a CMDB. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Not in our sources Not described on the pages we read.
Exposure management	With a condition Describes one platform and one view of cyber risk; the detail is not on the page we read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	With a condition Includes an Exposure Management dashboard and remediation hub; vulnerability scanning sits in the Exposure Command Essentials tier above it. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Servers and network devicesDiffers	Not in our sources	Partly Internal attack surface visibility is described; network devices are not called out. Source: Rapid7 Surface Command · Read 27 Sep 2026
Cloud workloadsDiffers	Not in our sources	Partly InsightCloudSec sits in the same platform. Source: Rapid7 products · Read 27 Sep 2026
SaaS applications	Not in our sources	Not in our sources
Identities as assetsDiffers	Not in our sources	Matches Identities are part of the unified inventory. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Off-network laptops	Not in our sources	Not in our sources
OT and IoT devices	Not in our sources	Not in our sources
Internet-facing discoveryDiffers	Partly Qualys EASM is linked from the product page; not read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Matches External attack surface visibility (EASM). Source: Rapid7 Surface Command · Read 27 Sep 2026
Offers its own agentDiffers	Matches Qualys agent, usable as a passive sensor. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Not in our sources
Works without new agents	Not in our sources	Not in our sources
Merges records from several sourcesDiffers	Not in our sources	Matches A unified asset inventory (CAASM). Source: Rapid7 Surface Command · Read 27 Sep 2026
Feeds or updates a CMDBDiffers	Matches Syncs with ServiceNow and BMC ITSM tools. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Not in our sources
Cross-source queries and reportsDiffers	Not in our sources	Partly Asset graph and blast radius views. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Workflows, tickets or actionsDiffers	Not in our sources	Matches Remediation hub and built-in, SOAR-ready automation and integrations in the Surface Command package. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Price or pricing basis publishedDiffers	Not in our sources	Partly Pricing basis published: asset types and use cases in scope; no amounts. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Free tier or trial	Matches Free trial offered. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	Matches Public trial. Source: Rapid7 Surface Command · Read 27 Sep 2026
Platform it is part of	None	Rapid7: Shares the Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026
Integrations	ServiceNow and BMC ITSM sync; other integrations are not listed on the page we read. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	SOAR-ready integrations, with Exposure Command, InsightVM and InsightCloudSec in the same platform. Source: Rapid7 Surface Command · Read 27 Sep 2026
Price	Not published Not published. A free trial is offered. Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026	No amounts published. Priced on the asset types and use cases in scope; Start Trial offered. Exposure Command Essentials adds vulnerability scanning and Ultimate adds cloud, IaC and DAST. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026

Where do they differ?

CAASM aggregation: Qualys is not in our sources; Rapid7 describes it.
Agent-based inventory: Qualys describes it; Rapid7 is not in our sources.
External attack surface management: Qualys describes it with a condition; Rapid7 describes it.
CMDB-centred inventory: Qualys describes it with a condition; Rapid7 is not in our sources.
Servers and network devices: Qualys is not in our sources; Rapid7 partly matches.
Cloud workloads: Qualys is not in our sources; Rapid7 partly matches.
Identities as assets: Qualys is not in our sources; Rapid7 matches.
Internet-facing discovery: Qualys partly matches; Rapid7 matches.
Offers its own agent: Qualys matches; Rapid7 is not in our sources.
Merges records from several sources: Qualys is not in our sources; Rapid7 matches.
Feeds or updates a CMDB: Qualys matches; Rapid7 is not in our sources.
Cross-source queries and reports: Qualys is not in our sources; Rapid7 partly matches.
Workflows, tickets or actions: Qualys is not in our sources; Rapid7 matches.
Price or pricing basis published: Qualys is not in our sources; Rapid7 partly matches.

Can they work together?

Neither vendor's pages we read name the other as an integration. That does not mean they cannot work together; ask both vendors.

Choose Qualys if

You already run the Qualys agent and want asset management from the same data
You need sync with ServiceNow or BMC

Choose Rapid7 if

You already run InsightVM or another Rapid7 product
You want internal and external assets in one inventory

Which limits should you check?

Qualys

No price published.
Which third-party sources it reads, and its SaaS, identity and OT coverage, are not described on the page we read.

Rapid7

No price amounts published; pricing depends on the asset types and use cases in scope.
Vulnerability scanning sits in the Exposure Command tiers, and SaaS apps and OT are not described on the pages we read.

Put Qualys and Rapid7 in the asset census with others Run the finder

Questions people ask

Is Qualys or Rapid7 better?

Neither is scored on this site. Qualys describes 4 of five approaches and Rapid7 3 on the pages we read, and they differ on 14 recorded facts. Which fits depends on where your assets live, whether you can install agents, your CMDB and your tools; the finder checks those.

Do Qualys and Rapid7 work with a CMDB?

Qualys: Matches. Syncs with ServiceNow and BMC ITSM tools. Rapid7: Not in our sources.

Do Qualys or Rapid7 publish prices?

Qualys: Not published. A free trial is offered. Rapid7: No amounts published. Priced on the asset types and use cases in scope; Start Trial offered. Exposure Command Essentials adds vulnerability scanning and Ultimate adds cloud, IaC and DAST.