We are planning for a vulnerability management solution, so I am looking out for evaluation criteria between the well known solutions like Nessus, Qualys and Nexpose. If anyone could share such evaluation points it would be really helpful.
- Bandwidth requirements
- System requirements
- Training offerings
- Accuracy (number of false positives)
- Time to scan
- Extra offerings
- Example: Nessus has web app tool; Nexpose doesn't
- Vulnerabilities detected (make a vulnerable device have all three scan it)
The free book from O'Reilly on DevOpsSec: Securing Software through Continuous Delivery notes that a vulnerability management solution should create directives for configuration-management tools (including Ansible, Chef, Puppet, Salt, Powershell DSC, and Docker).
This may preclude the three vendors you suggested, so I suggest looking at other solutions.
It sounds like you're looking for an ASV solution and each of these will scan and identify vulnerabilities using the same vulnerability databases and ranking methodologies. The main differentiators are generally cost, ease of use and reporting functionality.