New Relic Vulnerability Management

Name: New Relic Vulnerability Management
Brand: New Relic
Rating: 4.5 (195 reviews)

Leader

Data for Engineers

Est 2007|Valuation $6.1B|Raised $385.3M

LinkedIn 188K|Website|Web traffic 1.3M|FTEs 3,034|HQ San Francisco, California, US

MarketsVulnerability Management SCA

New Relic Vulnerability Management screenshot

Published May 16, 2026

01Common complaints

1) Requirement for comprehensive, asset-wide vulnerability management. Platforms such as Tenable, Qualys, and Rapid7 are typically more suitable when the primary requirement is network scanning, endpoint coverage, and remediation governance. 2) Lack of a standardized New Relic observability footprint. If an organization’s observability is distributed across multiple vendors or the New Relic footprint is minimal, adopting New Relic VM may introduce additional overhead. 3) Primary need for deterministic build-time enforcement. For PR/CI gating and developer-first policy enforcement, tools focused on build-time SCA and developer workflows (for example, Snyk) are typically stronger. 4) Low tolerance for usage-based billing variance. Organizations concerned about ingest-driven cost variability should account for governance and monitoring of telemetry usage before adopting additional modules. 5) Need for VM-specific compliance attestation as the primary control. New Relic’s service-specific terms state that Vulnerability Management is not a substitute for legal or security compliance assessments; buyers requiring attestation at the VM tool level should plan accordingly.

Deal disqualifiers

Needs that prioritize full enterprise VM program capabilities (network scanning, endpoint coverage, patch orchestration, formal compliance reporting) where New Relic VM is not positioned as the primary system of record.
Limited or no New Relic observability footprint and no plan to expand agent coverage.
Strict budget constraints with low tolerance for usage-based billing variability without strong cost governance.

Vendor-acknowledged or policy limitations

Not a compliance assessment tool: New Relic’s service-specific terms state that Vulnerability Management does not provide legal or security compliance attestation and disclaims liability for losses or interruptions resulting from use of the product.

Practical limitations from market context

Coverage depends on agent deployment and runtime visibility; services without instrumentation may be excluded from VM findings.
Not positioned as a comprehensive replacement for network and endpoint scanning; organizations requiring broad asset coverage should plan for complementary tooling.
Platform UX and NRQL learning curve can slow time-to-value for custom reporting and integrations.

Roadmap / feature evolution signals (examples)

Feature expansions have included language support additions (for example, PHP), RBAC features, integration of EPSS and ransomware prioritization signals, and partner integrations.

02Why they buy

Unique selling points supported by product documentation and independent coverage

Integration of security findings with observability context: vulnerabilities are correlated with service telemetry and ownership to support remediation prioritization.
Prioritization that incorporates exploitability signals beyond CVSS, such as EPSS and indicators related to ransomware activity.
Mechanisms to ingest third-party findings via APIs and quickstarts to centralize external security signals.

Where competitors may be differentiated

Snyk: deeper developer workflow integration and CI/CD policy enforcement.
Tenable/Qualys: broader enterprise VM governance and compliance reporting capabilities.
Dynatrace: runtime security integrated with detailed topology mapping and module-level pricing information.

03Field reports

Important limitation: VM-specific reviews are scarce

Most public reviews on Gartner Peer Insights, G2, and TrustRadius focus on New Relic as an observability/APM product rather than the Vulnerability Management module specifically. These product-level reviews are still relevant because VM is consumed through the same UI, workflows, and overall pricing model.

Gartner Peer Insights (New Relic product-level)

Available Peer Insights feedback includes negative usability comments such as:

user management requiring multiple steps and an unintuitive native query language experience (NRQL).

Interpretation: even if Vulnerability Management features meet technical requirements, successful adoption depends on the team's proficiency with NRQL and platform navigation.

TrustRadius (New Relic product-level)

TrustRadius reviews highlight positives for features such as synthetics value and alerting effectiveness, as well as organized UI areas. Reviews also list critiques—such as the learning curve and cost management—that buyers should review in full when evaluating the platform.

G2 (New Relic product-level)

G2 hosts numerous product-level reviews. Common themes include:

depth in APM, dashboards, and distributed tracing
concerns about pricing complexity and data ingest costs
friction from UI changes in some cases

Community / social (Reddit)

Community threads often reference:

inconsistencies in the UI and difficulties in obtaining support
billing and ingest confusion, including reports of unexpected billing (these are anecdotal and should be validated with account teams)

A limited number of posts compare New Relic Security features with other VM tools, indicating New Relic is being considered alongside other vendors but that peer experiences with VM specifically are limited publicly.

Reasons organizations adopt New Relic VM

Based on product capabilities and coverage:

To consolidate security findings alongside telemetry and service ownership within a single platform view.
To prioritize vulnerabilities using runtime-focused exploitability signals such as EPSS and indicators related to ransomware.
To leverage existing New Relic agent deployments to access runtime dependency insights with minimal additional tooling changes.

Reasons organizations choose competitors or replace New Relic VM

Patterns from product-level feedback and community commentary include:

concerns about cost predictability related to ingest-based pricing
a learning curve for the platform and NRQL
preference for specialized AppSec or vulnerability management platforms for build-time gating, developer workflows, or broad asset coverage

Public case studies specifically for Vulnerability Management

This research pass did not surface prominent VM-specific customer case studies with independently verified, quantified outcomes.

Vendor datasheets and product update pages (evidence but not independent validation)

New Relic provides datasheets and "what's new" entries documenting feature expansions (for example: language support, RBAC, EPSS integration, ransomware indicators).

Critical evaluation: these vendor-authored materials confirm capabilities and roadmap milestones but do not substitute for independent ROI verification. Buyers should request methodology for any vendor-provided metrics and seek independent references where possible.

04Best fit

Company size

Mid-market to enterprise organizations (e.g., organizations with hundreds to many thousands of employees) with multiple services and established SRE/DevOps practices and an existing New Relic observability footprint.

Industries

SaaS, fintech, e-commerce, media, and enterprises modernizing cloud-native platforms—environments where APM is commonly deployed.

Roles/personas

Decision makers: VP Engineering, Head of Platform/SRE, CISO/Director of AppSec, Security Engineering leaders
End users: SREs, backend engineers, platform engineers, AppSec engineers

Pain points addressed

Reducing tool fragmentation by aligning security findings with runtime context.
Prioritizing remediation among large volumes of CVEs using runtime and exploitability signals.
Mapping vulnerabilities to service ownership for clearer remediation responsibility.

Strong fit qualifiers

Broad APM agent deployment across services using New Relic.
Intent to operationalize vulnerability remediation in engineering workflows within an observability platform.
Interest in risk scoring augmented by exploitability and telemetry signals.

05The pitch

What the product does (objective value proposition)

New Relic Vulnerability Management is a runtime-focused vulnerability visibility and prioritization capability embedded in the broader New Relic observability platform. It correlates detected vulnerabilities (notably CVEs from libraries/dependencies observed via APM agents) with service context (entity/service catalog, ownership, telemetry, and workflows) so engineering, SRE, and security teams can prioritize remediation within the same platform. The product also supports ingesting findings from third-party security tools into a unified New Relic view.

Target market and positioning

Primary target segment: organizations already using New Relic for APM/observability that prefer to manage vulnerability findings within the same platform rather than deploying a separate VM/SCA solution.
Positioning: an integrated security and observability capability with emphasis on prioritization using exploitability signals and operational context in addition to CVSS.

Get a comprehensive analysis of New Relic Vulnerability Management including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →