Vulnerability and exposure
Vulnerability management platforms that queue the finding you already have (2026)
A 2026 shortlist of queues and scanners. Public docs, not a pentest cookbook. ASM overlap declared.
Expertise: Vulnerability and exposure · Level: Intermediate · 12 min read
A scanner without a queue is a PDF.
ASM lists what the internet already sees. This page is the ticket the scanner opened. Overlap declared. I will not publish an exploit replay.
Six queues. Two open desks. Two known scanners. One Kenna successor. One aggregator. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| DefectDojo | Open finding queue you can host | BSD-3-Clause |
| Faraday | Open-core workspace for findings you already collected | GPL-3.0 (community) / commercial |
| Qualys | Known enterprise scanner plus queue | Commercial |
| Tenable | The other known scanner estate | Commercial |
| Cisco Vulnerability Management | Kenna-shaped risk on a Cisco contract | Commercial |
| Vulcan | Aggregate findings into a queue you can assign | Commercial |
DefectDojo
Best for open finding queue you can host
DefectDojo ingests scanner exports and dedupes into findings. You operate it. The product is the queue.
Key features
- Many parser importers
- Dedup they document
- You host it
- BSD-3-Clause
Why we like it
This is the hidden gem. A second scanner is useless if the ticket is a spreadsheet.
Limits
You staff it. Importers lag. Not a network scanner by itself.
Faraday
Best for open-core workspace for findings you already collected
Faraday is a workspace for pentest and scanner output. Community edition you can host. Enterprise if you pay.
Key features
- Workspaces
- Importers
- Self-host community
- Commercial extra
Why we like it
When the work is still a pentest export, a workspace is the honest shelf.
Limits
GPL on community. Not Qualys. You still own the scan scope.
Qualys
Best for known enterprise scanner plus queue
Qualys VMDR is the known scanner estate. Agents, appliances, a ticket story. Procurement already wrote the name.
Key features
- Authenticated scan they sell
- Agents
- Dashboards
- Commercial
Why we like it
Known shelf. If it is already scanning, start by feeding DefectDojo or the built-in queue, not a fourth scanner.
Limits
Commercial. Agent tax. We did not run a tenant. Own assets only.
Tenable
Best for the other known scanner estate
Tenable Vulnerability Management, formerly Tenable.io, is Nessus at estate scale. Overlap with Nessus-the-engine is declared.
Key features
- Nessus-shaped engine
- Estate console
- Agents they sell
- Commercial
Why we like it
Second known scanner so Qualys is not a one-logo page.
Limits
Commercial. Noise. Own assets only. We did not run it.
Cisco Vulnerability Management
Best for kenna-shaped risk on a Cisco contract
Kenna is now Cisco Vulnerability Management. The pitch is risk on findings you already have, not a new scanner brand.
Key features
- Risk scoring they sell
- Connectors
- Cisco estate
- Commercial
Why we like it
Name the rename so old Kenna bookmarks still work.
Limits
Commercial. You still need scanners. We did not run a tenant.
Vulcan
Best for aggregate findings into a queue you can assign
Vulcan (and similar Nucleus-class desks) sit on top of scanners. The product is prioritization and tickets.
Key features
- Aggregation they sell
- Tickets
- Connectors
- Commercial
Why we like it
When you already bought two scanners, the hole is the merge.
Limits
Commercial. Another console. Public pages are not a lab. Nucleus is a sibling you can evaluate the same way.
What the internet thinks about vulnerability management platforms
VM threads treat the unowned finding as the real metric. We keep that line. A critical with no team is theater.
pquerna on Hacker News, Mar 2023: “the method I have most often used is when dealing with Vuln-overload is to "Reclassify".”
Prove DefectDojo still publishes
Confirm DefectDojo still publishes. Import only scans of assets you own.
curl -fsSIL https://www.defectdojo.org/ | head -n 8FAQs
Does this replace ASM?
No. ASM is the public name. This page is the ticket. Link both.
Scanner or queue first?
If you already scan, buy the queue. If you scan nothing, start with a scoped scanner on assets you own.
Will you publish exploits?
No.
Is this a scored bake-off?
No.
