Gartner has updated quite a few research papers that cover this subject in an analytical manner -- http://blogs.gartner.com/anton-chuvakin/2015/12/29/a-quick-update-on-our-research/
However, this is a paywall that many do not have the resources for. 451 Group did an analysis of the CORE INSIGHT product seen here -- http://www.coresecurity.com/system/files/attachments/451-Research-Reprint-Core-Security-Nov14.pdf -- a paper that mentions many other vendors in the space, even though some have changed their names.
The NIST CSF and other primary frameworks provide little guidance other than "to do vuln mgmt" (not a great answer).
My recommendation is to understand what you have invested already in vulnerability management, vulnerability assessment, and vulnerability scanning -- as well as penetration testing and red teaming analysis, red team engagements, and cyber exercises. One point of reference, especially for cyber exercises, is MITRE. I really enjoyed the Cyber Exercise Playbook.
In classic or legacy environments, especially large-installation infrastructures as you describe -- you will typically only see two major commercial vendors play, but perhaps a few others that conjoin for the larger vuln mgmt picture. The best, Tenable, does not see a lot of integration among other vendors which is why Qualys seems to be a dominant vendor -- with Tripwire (formerly nCircle) being the second (although Nessus is the de-facto standard for the number of CVEs it can actively scan for and the deepness and accuracy it can muster, especially with credentialed scans -- Qualys being good at non-credentialed scans). Others, such as Trustwave TrustKeeper and Dell/EMC/RSA come to mind, but only incidentally, perhaps with a structured-program perspective such as compliance-driven.
My cyber model precludes a lot of the above. In my model, which I hope is included in future versions of the NIST CSF or similar standards, the OpenGroup FAIR risk analysis model is at the forefront, with threat assessment driving the whole picture -- where Vulnerability is always 100 percent. This model dictates that a Cyber Operations team be responsible for the vulnerability management and assessment processes, including vulnerability scanning. Modern controls, such as app whitelisting combined with EDR, or reversely, network-behavioral analysis combined with sandbox-exploding malware distribution network detection (or all four) cause a severe issue with vulnerability scanning (and vice versa). Thus, a new model for vulnerability management and assessment is necessary.
When building the concepts for a new framework for vulnerability management and assessment, I have devised a few known-good techniques. The first is to throw out continuous scanning and point-in time assessments. The concept of vulnerability management and assessment is normalized with other vulnerability, exploit, and threat data. SensePost opened my mind to this concept here -- https://www.sensepost.com/blog/2014/using-maltego-to-explore-threat-vulnerability-data/ -- but many other players, including Splunk and the vFeed project, have continued in this vein. The unwritten framework has to do with two primary concepts: red teaming analysis and red-team engagements. Red teaming analysis (RTA) is a technique that involves theorizing the probable threats and targets, with specific weapons, TTPs, and strategic areas (e.g., beachheads) placed into a table and worked through scenarios. This is usually a 6-month planning stage, followed by the red-team engagement, a 6-week hands-on assessment.
In a red-team engagement, traditional vulnerability assessment and scanning tools may or may not be utilized. Primary toolkits such as PowerShellEmpire may not include nmap, Nessus, NeXpose, or any other vulnerability scanners because it already includes advanced-evasion techniques (AET) such as SPN scanning and/or find-fruit scripting. I can imagine many scenarios that do include a Nessus plugin (for a specific, planned test case), or using NeXpose for just fingerprinting. nmap is typically done as slow as possible, with patches and modifications to provide AET, and only port at a time -- although a better use of bandwidth and time might be a tool such as pbscan. Other AET tools that can be leveraged with any of these are SniffJoke and/or McAfee Evader. Commercial tools can't provide these offensive capabilities today -- and I have not seen it on any roadmaps.
Almost any large infrastructure will lead the analysts engaging in RTA and red-team engagements to utilize data-aggregation tools. My top recommendations are LAIR framework, Faraday, and Dradis Pro -- although Splunk can certainly be a great source for long-term or correlation needs (i.e., integration to other data points, such as threat and exploit data). Which brings me to another point, how to integrate secure-configuration management data. Many frameworks talk about secure-configuration management (e.g., PCI DSS Section 2.2), but again, no major guidance is given. The Center for Internet Security offers its benchmarks and some tooling for free, but the CIS-CAT tool and other elements are locked behind their paywall. Some MITRE work through OVAL is available in the FOSS tool, ovaldi, and commercially through Joval. Some vendors do provide a gap analysis between patch, vuln, and config management, but they are difficult to configure -- I think you're more likely to have success in a Cyber Operations program with a platform such as Splunk Enterprise.
Splunk did a good job at explaining some of these paradigms at their recent SplunkSec conference -- https://conf.splunk.com/session/2015/conf2015_CMerchant_Oracle_SecurityCompliance_AffordableSecurityMakingThe.pdf -- and SANS in a recent paper on vulnerability data analytics -- https://www.sans.org/reading-room/whitepapers/metrics/applying-data-analytics-vulnerability-data-36532
