GitHub Code Scanning vs Qualys Web Application Scanning comparison

GitHub Code Scanning vs. Qualys Web Application Scanning

Download the complete report

Helped 913,683 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

GitHub Code Scanning

Ranking in Static Application Security Testing (SAST)

17th

Average Rating

8.6

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

Qualys Web Application Scan...

Ranking in Static Application Security Testing (SAST)

13th

Average Rating

7.6

Reviews Sentiment

6.3

Number of Reviews

Ranking in other categories

Application Security Tools (20th)

Mindshare comparison

As of September 2026, in the Static Application Security Testing (SAST) category, the mindshare of GitHub Code Scanning is 1.2%, down from 1.5% compared to the previous year. The mindshare of Qualys Web Application Scanning is 1.9%, down from 2.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST) Mindshare Distribution
Product	Mindshare (%)
Qualys Web Application Scanning	1.9%
GitHub Code Scanning	1.2%
Other	96.9%

Static Application Security Testing (SAST)

Featured Reviews

AbhishekKumar20

Software Development Manager at Amazon

Code scanning identifies vulnerabilities quickly and improves team response with minimal setup

I have been using Git for approximately 13-14 years. I have used GitHub Code Scanning for about three to four years. The primary purpose is to identify any vulnerability in the code itself. The system logs vulnerabilities that we can immediately examine to see all the error-prone areas. The AI functionalities include predefined agents that scan through and immediately provide responses regarding the best nomenclature or code coverage percentage. It's actually a one-time setup, and the team benefits as long as they push code and changes in the repository itself. Every time we push something, we immediately check the total deviation, whether our code coverage has improved, or if any vulnerability has been identified. There is always a metrics dashboard that we can see and identify. Primarily, GitHub is used for doing the versioning itself in the repository. With vulnerability functionality being provided and AI agents available, it makes a complete package. As soon as we publish our code, we immediately get to know the test code coverage. This immediately informs us about all the vulnerable areas which are not being fully tested. If we address those areas, most vulnerabilities are resolved. Even after tests are added, if by any chance the test is not treated cleanly or corner cases are missed, GitHub Code Scanning immediately flags those corners. It's always beneficial to have because it's not humanly possible to check all corner case scenarios, but as a system where they diagnose each line item, that's very helpful.

Read full review

AnkitSharma13

Security Officer at a tech vendor with 10,001+ employees

Web scanning needs improvement but offers good vulnerability detection

The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does. If Qualys Web Application Scanning could improve its crawling capability, it would be more user-friendly. Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities, which isn't as beneficial from my point of view. The Vulnerability Management also relies heavily on version numbers and will flag vulnerabilities based on the component version, but it doesn't check if a real fix exists, leading to flags on components that actually have workarounds available.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It's very scalable, very easy to handle, and very intuitive."

"GitHub Code Scanning has positively impacted my organization as it helps us recognize errors and avoid many later issues which may arise."

"The static code analysis capability in GitHub Code Scanning is a very powerful feature, providing the ability to identify vulnerabilities and ensure code quality."

"GitHub Code Spaces brings significant value with its simplicity and ease of use."

"The solution helps identify vulnerabilities by understanding how ports communicate with applications running on a system. Ports are like house numbers; to visit someone's house, you must know their number. Similarly, ports are used to communicate with applications. For example, if you want to use an HTTP web server, you must use port 80. It is the port on which the web application or your server listens for incoming requests."

"We use GitHub Code Scanning mostly for source code management."

"Qualys Web Application Scanning has multiple features like threat protection and container security scanning in one box."

"It protects against zero-day vulnerabilities, like Heartbleed."

"It scans web applications to identify vulnerabilities during deployment."

"WAS gave us visibility into our externally exposed web applications and showed us vulnerabilities that we were not aware of and did not know how to test for."

"The Qualys Web Application Scanning solution offers a single comprehensive console and consolidated reporting, covering all aspects from on-prem to cloud and compliance, etcetera."

"What I remember from my experience with Qualys is that the simplicity of exporting reports and the simplicity and clarity of the reports included with the product is good."

"The best thing about this product is that it is really easy to use."

"It works with many different products."

More Qualys Web Application Scanning pros

Cons

"GitHub Code Scanning should add more templates."

"At times it becomes very annoying as it highlights certain things which are intuitive. They require code coverage for those aspects as an extra overhead."

"In my opinion, areas of GitHub Code Scanning that could be improved include that a few things are not visible to us, such as where it stores data and which path."

"When running code scans, GitHub Code Scanning provides recommendations for probable fixes. However, integrating a feature where developers receive real-time highlights of vulnerabilities when checking in or merging a PR would be beneficial."

"One area for improvement could be the ability to have an AI system digest the reports generated from code scanning and provide a summary. Currently, the reports can be extensive, and users may overlook details, such as outdated libraries, which could be highlighted for attention."

"I have dealt with Qualys's technical support, and any enhancements are challenging. I would rate them a five out of ten."

"The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does."

"The reporting contains too many false positives."

"The pricing does not seem to be competitive."

"We receive false positives sometimes when using a solution that could be improved. However, the technical team provides us with the exact explanation why it was giving us that kind of error."

"When comparing this solution to Veracode, Veracode has good interactive features and gives a clear understanding of what the vulnerabilities are, which error line of the vulnerability is on and what can be done. It gives interactive features, whereas this solution does not give a clear understanding of where or how to fix the problem."

"New features need to be added, specifically LLM-based solutions."

"Please add manual penetration testing features. Also I didn't like the license terms and the features were limited compared to other tools used for web applications."

More Qualys Web Application Scanning cons

Pricing and Cost Advice

"GitHub Code Scanning is a moderately priced solution."

"The minimum pricing for the tool is five dollars a month."

"Qualys Web Application Scanning's pricing is a bit expensive compared to other solutions available in the market."

"It is an expensive platform."

"We normally purchase an annual license."

"We are on an annual license for the solution and the pricing could be more affordable."

"The cost is $30,000 USD for one year to cover WAS (Web Application Security) and the VM (Virtual Machine) security in a company with 200 employees."

"I rate the software’s pricing a six out of ten."

"Qualys WAS' pricing is competitive."

"Pricing was reasonable and competitive. It was not too far above the other products."

More Qualys Web Application Scanning pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

913,683 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

11%

Financial Services Firm

11%

Computer Software Company

Outsourcing Company

Financial Services Firm

13%

Manufacturing Company

11%

Outsourcing Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	6
Large Enterprise	27

Questions from the Community

What is your experience regarding pricing and costs for GitHub Code Scanning?

The organization pays for the license of GitHub Code Scanning, but specific price details are unknown.

What needs improvement with GitHub Code Scanning?

In my opinion, areas of GitHub Code Scanning that could be improved include that a few things are not visible to us, such as where it stores data and which path. There is a separate team for that w...

What advice do you have for others considering GitHub Code Scanning?

I am an end user only here with GitHub Code Scanning. I currently might be using the latest version of GitHub Code Scanning, but I don't remember the specific version. I have not utilized the real-...

What is your experience regarding pricing and costs for Qualys Web Application Scanning?

Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.

What needs improvement with Qualys Web Application Scanning?

What is your primary use case for Qualys Web Application Scanning?

I use Qualys Web Application Scanning, and we are using Vulnerability Management. By Vulnerability Management, I mean not TotalCloud; they have some on-premises solutions also. Patch Management and...

SonarQube vs GitHub Code Scanning

Comparisons

Compared 17% of the time

Coverity Static vs GitHub Code Scanning

Compared 9% of the time

Aikido Security vs GitHub Code Scanning

Compared 5% of the time

Semgrep vs GitHub Code Scanning

Compared 4% of the time

Checkmarx One vs GitHub Code Scanning

Compared 4% of the time

More GitHub Code Scanning Competitors

Checkmarx SAST vs Qualys Web Application Scanning

Compared 8% of the time

SonarQube vs Qualys Web Application Scanning

Compared 7% of the time

Veracode vs Qualys Web Application Scanning

Compared 6% of the time

GitHub vs Qualys Web Application Scanning

Compared 6% of the time

OWASP Zap vs Qualys Web Application Scanning

Compared 5% of the time

More Qualys Web Application Scanning Competitors

Product Reports

GitHub Code Scanning

Download GitHub Code Scanning product report

Qualys Web Application Scanning

Download Qualys Web Application Scanning product report

Also Known As

No data available

Qualys WAS

Overview

Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub.

GitHub

Qualys Web Application Scanning offers advanced vulnerability management, progressive scheduling, and seamless integration with DevOps environments. Its user-friendly design enables enterprises to enhance security with comprehensive scanning and detailed forensic insights.

Qualys Web Application Scanning addresses enterprise-level security challenges by providing robust solutions for vulnerability management, penetration testing, and compliance checks. While easing the navigation process, it supports risk mitigation with precise risk ratings, minimal false positives, and detailed reporting. However, it faces challenges with its complex interface, authenticated scanning, and automation features. Integrating smoothly with CI/CD pipelines, it is suitable for continuous and automated scanning, adapting to diverse company requirements.

What are the standout features of Qualys Web Application Scanning?

Progressive Scheduling: Enables efficient management of scanning activities, optimizing for time-sensitive scenarios.
Vulnerability Management: Offers robust identification and management of vulnerabilities across various applications.
Integration with DevOps: Seamlessly integrates with CI/CD pipelines, supporting rapid development cycles.
Risk Ratings: Provides precise risk assessments, crucial for prioritizing security efforts.
Engaging Dashboard: Offers an intuitive interface for navigating security tasks efficiently.

What benefits or ROI should users look for in Qualys Web Application Scanning reviews?

Scalability: Supports enterprise needs with a design adaptable to diverse security demands.
Risk Mitigation: Detailed alerts and forensic insights aid in reducing potential threats.
Comprehensive Reporting: Facilitates informed decision-making with clear, concise reports.
Penetration Testing: Enhances security assessments with ongoing evaluation capabilities.

Organizations across sectors like education, banking, and international data centers leverage Qualys Web Application Scanning for conducting penetration testing, scanning web applications, and managing vulnerabilities. It aids in audit security and compliance, identifying threats, and generating user-friendly reports, making it a valuable asset for maintaining strong security postures.

Qualys

Sample Customers

Information Not Available

BskyB, Cartagena, ClearPoint Learning Systems, Connect Group, du, Fortrex Technologies, HBOR, HDI, Highlights for Children, The Lithuanian State Enterprise Centre of Registers, City of Miami Beach, Microsoft, MidlandHR, MSCI Inc., Northern Arizona University, Ofgem, Olympus Europa, PhoneFactor, RTL Nederland, ThousandEyes, VGZ Organisatie B.V.

GitHub Code Scanning vs. Qualys Web Application Scanning