ManageEngine Vulnerability Manager Plus

manageengine.com

From $57.92/mo Free plan WebWindowsmacOSLinuxAPISelf-hosted

Spec score 9.3 #1 of 35 in Vulnerability Scanning Software

What it is

ManageEngine Vulnerability Manager Plus identifies and assesses vulnerabilities across a network and helps teams prioritize and remediate them. Its risk prioritization uses AI-based scores, CVSS severity, EPSS and active attack trends. It includes out-of-the-box policies for more than 130 CIS benchmarks and supports downloading, testing and deploying patches across operating systems and more than 1,500 third-party applications. Pre-built, tested scripts can mitigate zero-day vulnerabilities. The product can discover network devices, scan firmware for vulnerabilities and remediate identified threats, but network-device management is on-premises only and requires extra licenses. Vulnerability Manager Plus supports Windows and Linux; macOS support is limited to patch management. It offers a free edition and a 30-day trial with unlimited endpoints. Listed annual prices include Professional On-Premises at $695 a year and Professional Cloud at $895 a year, each for 100 workstations and one technician. Enterprise options are listed at $1,195 a year on-premises and $1,545 a year in the cloud, on the same workstation and technician basis.

Spec sheet

What it does: Vulnerability Manager Plus combines endpoint discovery, vulnerability assessment, prioritization, compliance auditing and remediation in one console.Read 15 Oct 2026 · manageengine.com
Purpose: The product identifies and assesses vulnerabilities across a network and helps remediate them.Read 29 Sep 2026 · manageengine.com
Trial: The vendor offers a 30-day free trial with unlimited endpoints.Read 29 Sep 2026 · manageengine.com
Integrations: The integrations page advertises endpoint-vulnerability ingestion, endpoint-management workflows and forwarding audit logs to SIEM tools.Read 15 Oct 2026 · manageengine.com
Compliance: The product audits against more than 130 CIS benchmarks plus UK Cyber Essentials and NIST policies.Read 15 Oct 2026 · manageengine.com
Support: The vendor provides technical support by email for both on-premises and cloud customers, as well as support phone numbers by region.Read 29 Sep 2026 · manageengine.com
Headquarters: Pleasanton, California, United StatesRead 23 Sep 2026 · manageengine.com
Founded: 1996Read 23 Sep 2026 · manageengine.com
AI risk prioritization: Its risk scoring uses AI and machine-learning signals including CVSS, vulnerability age and active attack trends.Read 15 Oct 2026 · manageengine.com
API edition limit: The documented patch-details API is unavailable in the Professional edition.Read 15 Oct 2026 · manageengine.com
API implementation: The detailed-vulnerability API documents pagination with cursors, page limits up to 5,000 and sample Python requests using authorization tokens.Read 15 Oct 2026 · manageengine.com
API vulnerability data: Threat APIs return vulnerability, affected-system and misconfiguration data with filters for CVE, CVSS, severity, platform, exploit status and patch availability.Read 15 Oct 2026 · manageengine.com
Audit log forwarding: It can forward audit logs to syslog-compatible SIEM tools, including QRadar, Splunk, LogRhythm, and Elastic Security, using RFC 5424.Read 29 Sep 2026 · manageengine.com
Company founded: Gartner lists ManageEngine's founding year as 2002.Read 15 Oct 2026 · gartner.com
Company headquarters: LinkedIn lists headquarters at Del Valle, Texas, United States.Read 15 Oct 2026 · linkedin.com
Company ownership: ManageEngine is the enterprise IT-management division of Zoho Corporation.Read 15 Oct 2026 · gartner.com
Company size: LinkedIn lists ManageEngine as having 5,001–10,000 employees.Read 15 Oct 2026 · linkedin.com
Compliance certification: ManageEngine says Vulnerability Manager Plus is CIS-certified for the listed benchmark audits.Read 15 Oct 2026 · manageengine.com
Documentation depth: The help center covers architecture, installation, Windows/Mac/Linux agents, roaming users, cloud hosting, vulnerability remediation, patch deployment, compliance, exceptions and troubleshooting.Read 15 Oct 2026 · manageengine.com
High-risk software audit: Administrators can find and remove unauthorized, peer-to-peer, remote-desktop and end-of-life software.Read 15 Oct 2026 · manageengine.com
Licence: The EULA restricts copying, sublicensing, modification, reverse engineering and third-party access, indicating proprietary commercial software rather than open source.Read 15 Oct 2026 · manageengine.com
Limit: G2 deployment model: G2 reviewers report that on-premises distribution-server requirements can fit poorly with remote or hybrid businesses and that there is no MSP offering.Read 15 Oct 2026 · g2.com
Limit: Gartner Peer Insights: Gartner reviewers cite a slow, dated interface and manual patch deployment that limits immediate selection to 50 clients.Read 15 Oct 2026 · gartner.com
Limit: GetApp: GetApp reviewers mention higher-tier feature costs, vague chat-support endings and a desire for more explanatory videos and learning paths.Read 15 Oct 2026 · getapp.com
Limit: Software Advice: Software Advice reviewers report that advanced functions need better guidance, patch approvals can be cumbersome and source-code security review is missing.Read 15 Oct 2026 · softwareadvice.com
Limit: Trustpilot: Trustpilot reviews of ManageEngine as a company include complaints about breaking patches, slow support and reports that require complex queries for drill-downs.Read 15 Oct 2026 · trustpilot.com
Network devices: On-premises deployments can inventory network devices, scan firmware vulnerabilities and apply firmware remediation.Read 15 Oct 2026 · manageengine.com
Patch management: Native patching can download, test and deploy updates for Windows, macOS, Linux and more than 1,100 third-party applications.Read 15 Oct 2026 · manageengine.com
Platform support: Vulnerability Manager Plus supports Windows and Linux, while patch management alone is supported for macOS.Read 29 Sep 2026 · manageengine.com
Praise: G2 usability and value: G2 reviewers describe the product as cost-effective, cross-platform, customizable, easy to implement and supported by responsive assistance.Read 15 Oct 2026 · g2.com
Praise: GetApp: GetApp reviewers repeatedly praise the built-in CIS configuration management, intuitive dashboards, detailed reporting and single-console vulnerability, patch and compliance workflows.Read 15 Oct 2026 · getapp.com
Praise: Software Advice: Software Advice summaries praise endpoint visibility, automated remediation, user-friendly dashboards, affordability and integrated patching.Read 15 Oct 2026 · softwareadvice.com
Rating on G2: 4.6 out of 5 from 4 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights: 4.2 out of 5 from 18 ratingsRead 15 Oct 2026 · gartner.com
Rating on GetApp: 4.6 out of 5 from 42 reviewsRead 15 Oct 2026 · getapp.com
Rating on Software Advice: 4.7 out of 5 from 41 reviewsRead 15 Oct 2026 · softwareadvice.com
Rating on Trustpilot: 3.0 out of 5 from 15 reviewsRead 15 Oct 2026 · trustpilot.com
Release news: The October 2026 release notes say agent executables were signed with a new digital certificate before the prior certificate expired.Read 15 Oct 2026 · manageengine.com
REST API: The public API exposes scope-of-management endpoints including summaries, computer lists and agent install, uninstall and removal actions.Read 15 Oct 2026 · manageengine.com
Risk prioritization: It prioritizes vulnerabilities using AI-based risk scores, CVSS severity, EPSS, and active attack trends.Read 29 Sep 2026 · manageengine.com
Security configuration: It detects insecure passwords, excessive privileges, memory-protection gaps and other configuration weaknesses against CIS and STIG guidance.Read 15 Oct 2026 · manageengine.com
Security controls: Official security documentation states role-based access, encrypted database fields, TLS 1.2 transport, SHA-256, AES-256/ECDHE ciphers and digitally signed binaries.Read 15 Oct 2026 · manageengine.com
Self-hosting: The product is offered as both cloud and on-premises software, with documented server, distribution-server and secure-gateway components.Read 15 Oct 2026 · manageengine.com
System baseline: For 1–250 computers, the server requirement starts at a 2-core Intel Core i3 or four virtual CPUs, 4 GB RAM, 5 GB disk, 1 Gbps NIC and 1 Mbps bandwidth.Read 15 Oct 2026 · manageengine.com
System quarantine: Quarantine policies can isolate systems that fail conditions based on patches, software, services, registry entries or file versions.Read 15 Oct 2026 · manageengine.com
Vulnerability assessment: It ranks vulnerabilities using exploitability, severity, age, affected-system count and fix availability.Read 15 Oct 2026 · manageengine.com
Web server hardening: The hardening module reports causes, impact and remedies for web-server flaws such as expired SSL and unsafe web-root access.Read 15 Oct 2026 · manageengine.com
Zero-day mitigation: Prebuilt tested scripts can mitigate selected zero-day exposures before a vendor patch exists.Read 15 Oct 2026 · manageengine.com

Plans and prices

Free Free Free edition; $0.00 annual subscription price Read 29 Sep 2026 · manageengine.com

Free Edition Free permanent all features · 25 endpoints · 1 admin user Read 15 Oct 2026 · manageengine.com

Professional Cloud (100 workstations) $90 a month monthly subscription 100 workstations · 1 technician Read 15 Oct 2026 · manageengine.com

Enterprise Cloud (100 workstations) $155 a month monthly subscription 100 workstations · 1 technician Read 15 Oct 2026 · manageengine.com

Professional — On-Premises $695 a year Annual subscription; 100 workstations, single technician 100 workstations · 1 technician Read 29 Sep 2026 · manageengine.com

Professional On-Premises (100 workstations) $695 a year annual subscription 100 workstations · 1 technician Read 15 Oct 2026 · manageengine.com

Professional — Cloud $895 a year Annual subscription; 100 workstations, single technician 100 workstations · 1 technician · Cloud service available only on subscription Read 29 Sep 2026 · manageengine.com

Professional Cloud (100 workstations) $895 a year annual subscription 100 workstations · 1 technician Read 15 Oct 2026 · manageengine.com

Enterprise — On-Premises $1,195 a year Annual subscription; 100 workstations, single technician 100 workstations · 1 technician Read 29 Sep 2026 · manageengine.com

Enterprise On-Premises (100 workstations) $1,195 a year annual subscription 100 workstations · 1 technician Read 15 Oct 2026 · manageengine.com

Enterprise — Cloud $1,545 a year Annual subscription; 100 workstations, single technician 100 workstations · 1 technician · Cloud service available only on subscription Read 29 Sep 2026 · manageengine.com

Enterprise Cloud (100 workstations) $1,545 a year annual subscription 100 workstations · 1 technician Read 15 Oct 2026 · manageengine.com

Every ManageEngine Vulnerability Manager Plus plan and price →

Strong points and limits

Strong points

Prioritizes risk using CVSS, EPSS and attack trends.
Policies cover more than 130 CIS benchmarks.
Patch support covers over 1,500 third-party applications.
30-day trial includes unlimited endpoints.
Free edition is available.

Limits

macOS support is limited to patch management.
Network-device management is on-premises only.
Network-device management requires additional licenses.
Cloud edition is available only on subscription.

Who it suits

It suits teams responsible for vulnerability assessment, patch deployment and remediation across Windows and Linux environments. Teams managing network devices should note that this capability is on-premises only and needs additional licenses.

ManageEngine Vulnerability Manager Plus in depth

Read the full write-up

Overview

ManageEngine Vulnerability Manager Plus is vulnerability management software for organizations that need to assess and remediate security issues across their network. It best suits teams managing Windows and Linux endpoints that want prioritization, patching, and compliance tools together. Its remediation breadth is a strength, but macOS support stops at patch management, and network-device management requires extra licenses.

Key features

Assessment and prioritization

The product supports authenticated scanning and agent-based assessment, then tracks remediation so teams can follow findings through to action. Its risk scoring draws on AI-based analysis, CVSS severity, EPSS, and active attack trends. That combination gives security teams several inputs for prioritizing work, rather than making severity the only guide.

Patching, zero-days, and compliance

Teams can download, test, and deploy patches across operating systems and more than 1,500 third-party applications. Pre-built, tested scripts can mitigate zero-day vulnerabilities, adding a remediation option beyond routine patch cycles. Out-of-the-box policies cover more than 130 CIS benchmarks, which makes the product relevant to teams pairing vulnerability work with compliance tasks.

Network devices and integrations

Vulnerability Manager Plus can discover network devices, scan them for firmware vulnerabilities, and remediate identified threats. That is useful for teams managing infrastructure as well as endpoints, but network-device management is on-premises only and needs additional licenses. Integrations include Splunk and ServiceDesk Plus; audit logs can be forwarded to syslog-compatible SIEM tools including QRadar, Splunk, LogRhythm, and Elastic Security using RFC 5424.

Pricing

The Free edition costs nothing. Paid editions are annual subscriptions:

Professional — On-Premises: $695 a year for 100 workstations and one technician. This is the lowest-cost paid option for teams choosing self-hosted deployment.

Professional — Cloud: $895 a year for 100 workstations and one technician. Cloud service is available only on subscription, making this the Professional choice for teams preferring cloud deployment.

Enterprise — On-Premises: $1,195 a year for 100 workstations and one technician. It is the higher-priced on-premises edition, though the listed seat allowance is the same as Professional.

Enterprise — Cloud: $1,545 a year for 100 workstations and one technician. This is the highest-priced listed edition and keeps the same stated workstation and technician allowance.

The vendor offers a 30-day free trial with unlimited endpoints, useful for evaluating the product beyond the paid editions' stated 100-workstation allowance. Technical support is available by email for on-premises and cloud customers, with phone numbers by region.

Platforms

The platform supports Windows and Linux for vulnerability management; macOS is supported for patch management alone. Deployment options include cloud and self-hosted, with a hybrid deployment model. Teams that need macOS vulnerability assessment should look elsewhere, while network-device management also requires an on-premises deployment.

Who it's for

This is a strong fit for organizations managing Windows and Linux endpoints that want vulnerability prioritization connected to patching, remediation tracking, and CIS-benchmark policies. It is less suitable for teams that need full macOS vulnerability management, cloud-based network-device management, or a clearly stated Free-edition capacity before committing.

Pros and cons

Pros: Risk prioritization combines AI scores, CVSS, EPSS, and active attack trends, giving teams multiple signals for triage.

Pros: Patch workflows cover operating systems and more than 1,500 third-party applications, with tested scripts for zero-day mitigation.

Pros: Policies for more than 130 CIS benchmarks and remediation tracking support teams that need findings tied to follow-up work.

Cons: macOS support is limited to patch management, so it does not cover the same vulnerability-management scope as Windows and Linux.

Cons: Network-device management is restricted to on-premises use and requires additional licenses.

Cons: Every listed paid edition is sized for 100 workstations and one technician, so larger teams should confirm what expansion will cost.

Alternatives

Compare vulnerability management software or network vulnerability scanners if you want to weigh broader category options. For a scanning-focused shortlist, see vulnerability scanning software.

Intruder is another freemium option with a free plan and trial; its free tier covers five infrastructure targets, excludes web apps, and includes weekly external scans.

OpenVAS offers a free virtual appliance with a community feed, but its free edition has limited enterprise features and no default support.

Qualys External Attack Surface Management is worth considering for a 30-day, no-cost CSAM with EASM offering; it has no free plan.

NSAuditor AI is a freemium alternative with a free Community plan.

Nuclei is a free, MIT-licensed CLI primarily intended as a standalone tool, rather than a paid subscription edition.

ScanTitan has a Professional plan at $119 a year for vulnerability and exposure scanning, malware monitoring, and uptime monitoring.

Pentest-Tools Port Scanner offers a free plan for open-port and service discovery; its NetSec plan starts at $95 a month.

Rapid7 Surface Command is a paid alternative with a free trial.

Verdict

Choose ManageEngine Vulnerability Manager Plus if your team primarily manages Windows and Linux endpoints and wants to connect risk prioritization with patching, remediation tracking, and CIS policies. Its broad remediation toolkit is the main reason to choose it; limited macOS scope and the on-premises, extra-license requirement for network devices are the main reasons to look elsewhere.

Verdict

Vulnerability Manager Plus combines vulnerability prioritization, compliance policies, patching and remediation tools. Compare the annual edition prices and deployment requirements, especially if you need macOS patching or network-device management.