Qualys PCI ASV cost 2026: VMDR plus per-IP scanning pricing read

The Qualys pricing model in plain English

Qualys prices PCI ASV scanning as a per-IP banded annual subscription. Small environments with up to 16 internet-facing IPs typically price in the $200 to $500 range. Mid-sized environments with 16 to 64 IPs price $500 to $2,000. Enterprise scoping (64+ IPs) crosses into the VMDR conversation, where the PCI ASV becomes a module of the broader Qualys Vulnerability Management subscription priced at $5,000 to $30,000 or more per year depending on total asset count, modules in scope, and contract term.

The per-IP banded model means cost steps at the tier boundaries are sharp rather than continuous. Passing the 16-to-32-IP boundary typically jumps the subscription 30 to 50 percent; passing the 64-to-128 boundary can roughly double it. The pricing model rewards buyers who actively manage their in-scope IP inventory through network segmentation and aggressive scope reduction. It penalises buyers who let internet-facing IP count drift up without commercial review.

Multi-year terms typically discount the year-one fee 10 to 15 percent for a three-year commitment with tier-threshold flexibility built in. The tier-threshold flexibility clause is the single most valuable negotiation lever: a three-year contract that locks in current-tier pricing through the term protects against the cost cliff at IP-band boundaries.

Three concrete cost scenarios

Triangulated from Vendr aggregated buyer data, Qualys free trial pricing, public Qualys customer case studies, and PCI engagement quotes shared on practitioner forums. Qualys does not publish a retail rate card so these are planning anchors rather than commitments.

Standalone PCI ASV vs the VMDR bundle

The decision between standalone PCI ASV and VMDR turns on whether the buyer needs vulnerability management beyond the PCI quarterly scan obligation. For Level 3 and Level 4 e-commerce merchants who only need PCI ASV (and have internal vulnerability management handled separately by cloud-provider tooling or open-source scanners), the standalone subscription is the right answer at $200 to $2,000 per year. For Level 1 and Level 2 enterprises who also need internal authenticated scanning, configuration assessment, patch management orchestration, and cloud security posture management, VMDR consolidates the tooling stack at materially better total cost of ownership.

The VMDR economics are favourable when the buyer would otherwise purchase three or more point solutions. A typical mid-market stack of standalone PCI ASV ($1,500/yr) plus Nessus Professional ($4,800/yr) plus a cloud-CSPM tool ($10,000/yr) plus an asset inventory tool ($8,000/yr) totals $24,300, versus a VMDR enterprise subscription that consolidates all four at $15,000 to $20,000 per year for equivalent functionality. The VMDR cost arbitrage grows with stack complexity.

The VMDR economics are unfavourable when the buyer only needs PCI ASV and has no broader VM ambition. Forcing a VMDR conversation onto a buyer who genuinely wants only quarterly external scanning is a 5 to 10x overspend that delivers no operational value. Buyers should resist VMDR pitches if the in-scope use case is genuinely PCI-only and the rest of the security stack is settled.

When Qualys wins and when it does not

Qualys wins for enterprises with existing or planned investment in the VMDR platform, where the PCI ASV module is a small marginal cost on a larger vulnerability management subscription. It wins for organisations that need genuine enterprise-grade reporting, compliance automation, and integration with broader IT operations tooling (CMDB, ITSM, SIEM). It wins for buyers who care about long-term vendor consolidation and want one VM platform across PCI, ISO 27001, SOC 2, internal scanning, and cloud security.

Qualys does not win for small merchants who only need PCI ASV (SecurityMetrics and Intruder price 30 to 60 percent below for small environments), for buyers who already use Nessus or InsightVM for internal scanning (the VMDR consolidation pitch falls flat), or for buyers who prioritise modern UX and rapid deployment (Tenable.io and Rapid7 InsightVM are typically faster to onboard).

Negotiating with Qualys

Three tactics. First, negotiate tier-threshold protection into multi-year contracts explicitly; this is the single most valuable cost-control clause and Qualys engagement managers will agree to it under modest pressure. Second, bring competitive quotes from Tenable.io and Rapid7 InsightVM for the VMDR-tier conversation; Qualys responds to these specific competitors and will match credible quotes down by 10 to 20 percent. Third, for standalone PCI ASV at the SMB tier, ask explicitly whether the SecurityMetrics PCI ASV product would meet the same compliance requirement; Qualys engagement managers know SecurityMetrics is the genuinely cheapest mainstream PCI ASV at small scale and will sometimes match SMB pricing to retain the account for future VMDR upgrade.

For combined PCI ASV plus internal authenticated scanning, bundle these explicitly in the proposal request. Qualys prices the bundle competitively because the authenticated-scanning capability is a high-margin add-on for them and they prefer to capture both line items in one contract.