Qualys CyberSecurity Asset Management Reviews

We primarily use it to collect asset information. Our primary value from it is in collecting on-premises assets, as well as the ability to tag those assets with custom tags. We are also using the external attack surface management portion a little bit. We have not fully operationalized it yet, but it looks intriguing.

Additionally, we are leveraging Qualys CSAM's capability to detect software and applications, as well as to identify unauthorized and authorized software in the environment.

From an inventory point of view, Qualys CSAM gets everything very well. We augment that with Qualys TotalCloud, so we get better insights into our cloud platform, but for our internal data centers, this is our source of truth for asset information.

Our favorite features are the tagging and the ability to quickly find assets in the portal. 

Additionally, I do like the fact that Qualys CSAM is integrated with the rest of our vulnerability scanning utilities. We use the full suite from Qualys. The fact that it is integrated makes it very easy to understand. It shares tagging information with VMDR. That is very nice.

Qualys CSAM has discovered assets not previously covered by our vulnerability management program. Primarily, if we have assets without vulnerabilities, they become less visible, but Qualys CSAM alerts us to them because they have IP addresses and are attached to our network. It could discover everything from printers to servers to endpoints. It could discover UPSs, network devices, and across all operating systems. It discovers our security badge readers and digital signage. We have to feed that the IP address ranges, but beyond that, it finds everything in our internal network.

We were able to realize its benefits within the first quarter of installing it. We did have to take some time to learn it and understand how to operationally leverage what it was telling us, but it was very quick.

In addition to vulnerabilities, Qualys CSAM helps identify other risk factors to a degree. For instance, we can see if servers or assets have incorrect naming standards. We have our network segmented into development model, test, and production, and we have server naming standards that identify which management they should be in. If a production server has the naming standard of a development model server, we can find that. That is one area we have used it for.

We are not fully using TruRisk, but we are using the Qualys detection score that is central to our corporate risk prioritization approach. It has completely replaced our homegrown one.

Some areas that would be helpful are more comprehensive tagging and the ability to set up better dynamic rules. 

Also, in the area of software categorization, having only three categories (approved, unapproved, unknown) is limiting. We would prefer more options, such as 'approved only for pilot' or 'approved for this line of business,' allowing for better granularity in categorizing software.

They do not yet have a built-in integration with the service management tool that we use. We do not use ServiceNow. We use a different one. We are using a product called Symphony Summit.

We started using it probably about a year and a half ago. It became operational around mid-2023.

We have encountered very little instability. I have subscribed to their update notifications, and I love getting the release notes because there is always something new in there that is exciting. They are constantly adding capabilities. I love that. It is a bit challenging to keep up at times, but if you want to maximize the value of the tool, you have to stay on top of release notes. As far as stability goes, there is almost nothing. Overall, there are almost no issues. If there are any issues, they usually affect the entire pod. It is not specific to CSAM.

With roughly 10,000 assets under management. We have not encountered any issues with scalability at all.

I have not personally contacted technical support, but I know we get a very good response. We have an excellent technical company who will escalate and support us. We have had a pretty good experience with technical support.

I used to have some involvement with a CMDB product from BMC called ADDM. It was similar to Qualys CSAM, but due to a lack of organizational appetite to support it, it was replaced. That is the closest thing to Qualys CSAM that I have ever played with.

It is a cloud solution. We do have cloud agents that reside on our endpoints or assets. I do like the fact that Qualys CSAM uses the same agent on the assets as all the other Qualys products. That was a big plus over other things that we looked at.  They required another agent to be installed.

Its initial setup was fairly easy. It takes a little bit of time to get things fully operational and standardized, but Qualys CSAM was easy to install and get up and running. We had to sit back and think about how we best wanted to represent the tagging. That took some time. We are still playing with that. The biggest challenge has been coming up with the best way for us to represent the assets and software discovered by Qualys CSAM.

We had to consider the best way to represent tagging in our system and ensure everything was standardized, but the setup process itself was straightforward.

It did not take us long to fully deploy it. It took less than a week because we already had the cloud agents installed for VMDR. We or our account manager flipped the switch to turn the license on, and we started collecting data right away.

The deployment of Qualys CSAM was a one-person job. We had an additional person for backup reasons, but the job primarily required only one person.

Its maintenance is being taken care of by Qualys. The software tagging is manual, so we have to go in and manually say that product XYZ is no longer approved. That is the only maintenance we do on that platform. It is just whether or not the software is approved or not.

The pricing is fair. I would love to see the price come down a little bit, but we do get a lot of value out of it. We are squeezing every ounce of value we can out of the tool.

Like every product, there are nuances. You have to understand that there are different categories of software. When it detects software, it puts it into various categories. It took us a little while to understand their taxonomy for the software side, so my advice would be to spend a little time understanding that.

We have had good luck with the API. To automate things, we are leveraging their CSAM API, and it is working fine, but there is a little bit of a learning curve. In terms of the core product, you turn it on and it just starts. If you have VMDR already in place, it starts to collect data for you right away, within minutes.

I would rate Qualys CSAM a nine out of ten. If they had a connector for the service management tool that we use, it would be a ten.

I use it primarily with tagging, asset counts, and groups that we can put them in, and we also use it to tell if a device has been merged and seen in Qualys CyberSecurity Asset Management, so that's beneficial for us too.

I use it primarily with tagging, asset counts, and groups that we can put them in, and we also use it to tell if a device has been merged and seen in Qualys CyberSecurity Asset Management, so that's beneficial for us too.

I think Qualys CyberSecurity Asset Management could provide more capabilities for us to be able to manually merge a device if we know that it's the correct device. We appreciate that, but the GUI is a bit cumbersome. I know they redesigned it, but we don't really have any ability for cloud agents to see a history of logins and a history of scans. I would love a history; the activity log is problematic. It just takes so long to actually get in there and do some work. In general, I use Splunk for capabilities that I just can't seem to get out of Qualys CyberSecurity Asset Management. They pull in Qualys information and I have all these capabilities of searching, filtering, and other features that just for instance, all the scan data, they pulled into Splunk. Now I know the scan, the time, the option profile, all that good information, but I couldn't do that inside Qualys CyberSecurity Asset Management. I would much rather have it in Qualys than have to pump it over to Splunk, so we use Splunk quite a bit for our vulnerabilities and reopenings and other concerns.

For room for improvement, I would like to see more capabilities to be able to manually merge devices, a history of logins and scans, the activity log could be improved, support ticket priority, and sorting and filtering of the columns. The activity log is terrible. Additionally, we're trying to get authentication completed, but I'm having a difficult time authenticating Linux to a domain, so I'll probably be contacting my TAM or support.

I have been using it for five years, the whole time I've been here.

I haven't seen any lagging, crashing, downtime, or any sort of instability; we watch the notifications, so for the most part, we haven't really had any major outages other than when we tried to renew and we didn't get the renewal in, which cut off certain modules that we couldn't get into. That was the only major issue.

Qualys CyberSecurity Asset Management is fine for scalability because we're at maybe 17,000 assets, so there is no issue there.

I have contacted the technical support or customer support. It was terrible for a while, but now it's better because we actually get answers back pretty quickly. I don't like that we can't increase the priority of a ticket; we can't escalate it unless we escalate it to our TAM, but that's kind of a pain in itself as well.

If I were to put the support on a scale from 1 to 10, I would give them an 80%, something like that, which is about an eight.

Positive

I did not use anything before Qualys CyberSecurity Asset Management.

The initial deployment of Qualys CyberSecurity Asset Management was set up when I came online, so I have no experience with setting up a Qualys environment from the start.

I do not have a favorite feature.

I do not know if Qualys CyberSecurity Asset Management identifies all other risk factors for our assets in addition to vulnerabilities.

We don't use CMDB Sync, which is a feature that they have.

As far as I know, it covers all of our domains regarding External Attack Surface Management.

We haven't actually gone to TruRisk yet; we're kind of in the middle of getting that set up. We're probably just beginning in many ways.

We used passive sensors a couple of times, but we just couldn't get them placed where we needed to get them placed. They were giving us all kinds of incorrect IPs, so we stopped.

I don't think it was difficult at all when I first started using Qualys CyberSecurity Asset Management.

I'm still somewhat learning about it, but I do remember how long it took me to fully understand the interface and all the intricacies.

There's no maintenance on Qualys CyberSecurity Asset Management, as far as I know, other than our own.

I would rate this product a 9 out of 10.

We use it for scanning, vulnerability management, a little bit of policy compliance, and some web application scanning.

We primarily implemented it for StateRamp compliance requirements with NIST 800-53.

There have been some instances where devices that were not known to be in a specific place were discovered. They were primarily EC2 instances deployed in an AWS account. Our systems are scalable. They scale in and out all the time, so it is hard to give a precise number of the devices discovered. It probably discovered 3% to 5% of the overall system.

In addition to vulnerabilities, it identifies other risk factors for our assets. It does not cover all, but it covers about 80%.

The scanning results are pretty good, and some of the insights are quite valuable. The fact that it is a largely cloud or SaaS product means that there is less management and maintenance required. Those are all benefits we like.

We have had challenges modifying the agent configuration. Particularly, when we want to change the tenant that the agent is pointing to, we have had difficulties making that reliable and working properly. For Windows agent installations, updates require more than a simple configuration change. It requires a download and install, which we find cumbersome, but once it is in place, it is pretty good.

We have been using the solution for about two years.

Our systems are scalable, so they scale in and out all the time.

It is above average. There have been issues where we had to bring in Qualys and other vendors. There was some finger-pointing back and forth about who was responsible, which is common, but overall, they are responsive and generally knowledgeable.

Neutral

For web application scans, we previously used WebInspect, but we changed due to scalability issues. WebInspect could not meet our frequent scan requirements without significant infrastructure improvements. Qualys seems to be able to handle it better.

We also used Tenable IO, which was not very cloud-aware, whereas Qualys has better AWS cloud integrations and capabilities.

It was a little time-consuming, but we did not find it overly complex.

The first time, it took about two weeks. Subsequently, because we worked out the kinks and figured out some things, we could get a new system up and running in a couple of days.

It requires regular patching maintenance, the same as any other OS. There is nothing outside of what I would consider normal. We have two people involved in maintenance.

Two people were involved full-time with a handful of support staff. Their roles included security vulnerability engineer, network engineer, and network architect. We also had some consulting professional services provided by Qualys.

It has reduced the amount of in-house development and configuration changes needed to make the scanners compatible with the AWS cloud. It has reduced the number of development and scripting hours along with maintenance hours. It has allowed fewer individuals to manage the system overall, providing some ROI benefits.

The pricing is market-competitive. We have large licenses through a corporation, but I am only involved with a small portion of it, so I do not know its price.

Defense-in-depth is very important. There are many layers to a network. There are many layers to an operating system, and there are many layers to applications. It is essential to provide security, detection, and prevention at each one of those layers.

To a colleague at another company who says they only need to add External Attack Surface Management to their vulnerability management detection/response program but they do not need the full depth of the CSAM offering, I would say that they are likely to get hacked.

We do not use Qualys CSAM for the entire attack surface. We primarily use it for production deployments. Our entire attack surface, corporate-wise, is managed elsewhere. It is competitive. It is not the best that I have seen, but it is competitive.

TruRisk Scoring helps prioritize vulnerabilities and assets, but we do not use it all that much. Our reporting requirements are tied to CVE rankings. While we sometimes take a look at it, we do not rely on it.

We use the solution's CMDB Sync feature, but we use it more as a confirmation of an existing CMDB tool we have.

I would rate Qualys CSAM an eight out of ten.

We are using Qualys CyberSecurity Asset Management for daily activities such as identifying new assets through network scanning and agent-based scanning for newly provisioned assets. When any new asset enters the network, we can identify it. We follow up with the team if any Windows device or other device does not have an agent installed, as we can still maintain visibility. We have established a process where if any machine that supports agents is not installed with a Qualys agent, we can follow up with the team appropriately using that particular data.

We use the True Risk Score for vulnerability prioritization, though we do not solely rely upon it since some assets may be decommissioned soon or not in use. From Qualys CyberSecurity Asset Management, we primarily focus on internet-facing assets. We have created separate tasks for internet-facing assets and track the True Risk dashboard specifically for these assets. If the True Risk Score is higher for any internet-facing assets, then we take action accordingly. The True Risk Score is very helpful for prioritization.

The initial setup was straightforward and easy. We needed to create customized tags, group them twice, and validate whether the operating system detection was true positive or false positive. We encountered some false positives, which required coordination with the IT team for verification. In six months, we had approximately 20-25 machines that needed verification on a weekly basis. We coordinated with the IT team to identify the exact operating system specifications.

Qualys CyberSecurity Asset Management helps us prioritize assets according to operating system, kernel version, installed software, and current version information. The ASM assists with attack surface management from an outside perspective, showing how the environment appears, including misconfigured assets or end-of-life/support assets. This information is visible in both ASM and Qualys CyberSecurity Asset Management. I would suggest purchasing Qualys CyberSecurity Asset Management instead of ASM for better results.

We have been using the solution for approximately six months, not quite reaching one year yet.

We have never experienced instability issues. The system is stable with excellent responsiveness and user interface. We have never encountered slowness issues.

The scalability is excellent as we manage more than one hundred thousand assets, including over one hundred thousand endpoints, approximately 2,600 servers, and more than 1,200 network devices. It is very easy to use, and the categorization never fails to display accurate information.

The support is extremely helpful, deserving a 10 out of 10 rating. They resolve issues within one day, possibly because customers are purchasing this product, so they may be focusing more attention on Qualys CyberSecurity Asset Management.

The deployment took less than one week. After the purchase, everything was set up and completed within that timeframe.

We have only used Qualys CyberSecurity Asset Management. For asset management, there are alternatives such as Rapid7 and CrowdStrike, but Qualys has a wider range of categorizations in their Asset Management solution, making it superior.

We have contacted customer support when identifying false positive operating systems. When IT teams report discrepancies in operating system identification, we coordinate with support. Registry key changes were implemented to correct these issues, which helped the agent identify the exact operating system. Some registry keys were preventing the agent from identifying the correct operating system.

Regarding integration, we need additional customized dashboards based on software versions or organization-specific software. The agent can collect the data, but we need customized dashboard capabilities for internal software specific to our organization.

Qualys CSAM covers the entire attack surface, including assets in the cloud, public-facing assets, and private hosting. We can create categorizations and analyze True Risk for these assets before prioritizing vulnerability remediation.

Regarding CMDB integration, the service now team is working on the integration, which is expected to complete within two months. We have provided the required attributes and requirements.

This review rates Qualys CyberSecurity Asset Management 10 out of 10.

We use Qualys CyberSecurity Asset Management mainly for asset management consolidation because we are using different tools. We have around 256 locations and 480 sites. We have created multiple platforms and are managing all the assets through Qualys CyberSecurity Asset Management.

We primarily focus on discovering and assessing vulnerabilities in internet-facing assets, web servers, and cloud services. Our activities include DNS enumeration, web crawling, and enhancing transparency in our processes. In the automotive sector, we also work with IT and OT devices. We assess the vulnerabilities of critical assets based on their contributions and potential exploits related to physical security. Our team checks for payload validations and actively monitors for exploitation attempts.

Additionally, our software team continuously monitors asset vulnerabilities, feeding this information into our Security Information Management (SIM) and vulnerability management systems, as well as Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms.

The main thing I appreciate about Qualys CyberSecurity Asset Management is the cloud environment while tracking software and zero-day vulnerability risk, alongside asset discovery and tagging, as well as attack surface management. This is mainly focused on hardware and software assets across all on-premises and cloud environments, where we are tracking the lifecycle states and identifying vulnerabilities and everything related to risk management.

Integration of Qualys CyberSecurity Asset Management, particularly with ServiceNow, takes a very long time, and it needs prioritization of patch rules based on vulnerability risk. It should support complex environments, including MSP domains and multi-tenant setups.

The initial setup can be complex and requires coordination between IT and security teams, as API integration takes significant time. We have faced limitations on patch frequency control and legacy system support multiple times.

Additionally, the discovery elimination for unknown assets in CSAM should be enabled, as the discovery platform didn't segregate values properly when we are doing IT and OT assets. Furthermore, effective integration with CMDB such as ServiceNow for asset synchronization and a strong classification of risk scoring needs to allow us to focus on high-risk assets.

I have been using Qualys CyberSecurity Asset Management for around eight months.

We haven't observed any significant issues in the service. There were some issues about six months ago, but since then, it's been fine. Occasionally, we experience slowness, which might be a network issue on our end, but we only faced slowness once in the last six years, and that issue was addressed effectively.

We have a ticketing system in place and an internal team. Additionally, we have a technical account manager assigned from Qualys. Whenever we need support, we coordinate directly with this manager, and the Qualys support team assists us as needed, which happens occasionally.

I am happy with the quality and speed of the support provided by Qualys. We frequently reach out for support regarding different applications such as vulnerability management and web application scanning, especially given that we use multiple solutions for various clients. The support includes telephone availability, live chat options, and a solid support ticketing system. Additionally, the certification provided by Qualys has been beneficial for my SOC team, helping them with demo training and certification programs. We escalate incidents through the customer support portal for ongoing support tickets.

Positive

We also use BeyondTrust and TrapX. TrapX is suitable only for a very limited range of assets. It is primarily designed for the IT sector and may not be appropriate for other industries, such as automotive or healthcare, where multiple devices are involved.

When working in a small environment, everything tends to run smoothly. However, in larger and more distributed IT environments, especially at the lower tiers, challenges arise in compliance tracking and asset visibility. Initially, when we deploy these systems, we face multiple difficulties, particularly in coordinating with the support team. We have a technical account manager in place, and I hope they can help us navigate these issues more effectively.

For initial setups in smaller environments, everything is manageable. However, when scaling up to larger and distributed IT environments, there are significant challenges. For instance, the processes for asset visibility and content stacking can be quite complex. Automated tagging and continuous updates are essential for reducing manual asset management and enhancing the vulnerability prioritization process. Currently, significant initial configuration is required, along with software categorization and detailed reporting. In our work with a client, we would have customer calls for deployments, which would often coincide with support calls. Unfortunately, the documentation provided was not user-friendly, making it difficult to check and follow the necessary procedures.

For vulnerability management, we have a good price. We have a solid deal in place for the first and second years. However, as we expand to multiple locations, the pricing varies. For some clients, we have been able to adjust the pricing downwards due to lower costs for certain applications.

The risk score and asset evaluation are primarily based on multiple factors, including the asset criticality score and the Qualys Detection Score (QDS) for vulnerabilities, as well as their severity levels. Additionally, we consider the Asset Criticality Score (ACS) to reflect the value of critical assets. The QDS is also used for the Common Vulnerability Scoring System (CVSS) base score and to assess exploits, while checking on the maturity level and mitigation controls in place.

I would rate Qualys CyberSecurity Asset Management a nine out of ten.

The use cases for Qualys CyberSecurity Asset Management (CSAM) include getting software details, such as identifying software that is reaching end-of-life (EOL) or has already become EOL, and getting asset details.

Additionally, the integration with Shodan through External Attack Surface Management (EASM) helps get asset details of public-facing assets.

I also use its reporting capabilities. I can generate reports related to software with queries.

I also used the web application to see potential web-hosted assets for our subscription.

ESAM covers the entire attack surface. Earlier, we were using a third-party vendor, but we now completely rely on Qualys for ESAM. It scans the assets and also tags them based on the domain and subdomain. It discovers more and provides complete details about the assets, such as the external interface and internal interface. It correlates them, and we get the complete details of the assets, which were not given by the other solution. It just gave the IPs. We had to take the IP, put it in Qualys, and check the details. With Qualys, it is very easy to get the asset details.

We were able to realize its benefits immediately after the deployment. 

We use the TruRisk score, but based on the QDS and ACS, we have also derived our own severity for the organization. We assess whether it is really exploitable and being exploited in the wild.

We had some issues with the agents and detections until May, but after the version upgrade to 5.4, we saw a tremendous improvement in detection. We have 99.9% detections, and we were also able to achieve 84% patching and compliance in five days because of the detections.

I like the EASM part because it provides visibility into unmanaged assets that are public-facing. Previously, we had to log in to Shodan and get the details. Instead of that, Qualys has an external scanner that scans the assets belonging to, for example, Infosys. We give the domain, subdomains, and any related subsidiaries in the configuration. Based on that, it scans the domain and gives correlated results with the public-facing IP and the internal IP used in Infosys for an asset. I can see both interfaces in EASM. I can see the software details for all the assets and any ports that are open on the assets.

For some of the software, there was no life cycle or general information. We wanted them to give details in the database as and when the software comes. I raised a ticket for that, and after that, they updated the details for more than one million software.

They should address the false positives generated in EASM. It is fetching assets that have Infosys as the keyword. They should fix that.

When we click on the web application, it only shows potential web assets. The application details are not there.

Overall, CSAM has matured a lot. These are the few enhancements that need to be done.

I have been using the solution for three years. I use it regularly for my day-to-day activities.

We have not seen any issues with stability such as lagging, crashing, or downtime.

Qualys CSAM is highly scalable. I would rate its scalability a ten out of ten.

Customer service is efficient, with a support executive being assigned within 24 hours. They respond based on ticket severity. The support team actively involves themselves in resolving raised issues.

We also have governance calls where we raise tickets and troubleshoot and resolve any concerns.

For EASM, we were previously using another solution. They only provided basic details like IP addresses. With CSAM, we have comprehensive asset details, including enumeration and routing details. We also have TruRisk details.

The other vendor only gives me the ID. They do not tell me who the owner is. Qualys gives me all the information about the assets, software, vulnerabilities, open ports, and interfaces. We get the network summary and asset summary in one place.

Its initial setup was relatively straightforward. The deployment did not take much time.

Its maintenance is taken care of by Qualys.

The deployment was done in-house by one person, without the need for an external integrator or consultant.

The pricing for Qualys CSAM is nominal.

I would rate Qualys CSAM a ten out of ten. I am very satisfied with its features, including dynamic and static tagging, and the comprehensive details it provides for asset management. I am happy with it.

I am clear and have used Qualys CyberSecurity Asset Management earlier, focusing on VMDR and web application scanning only, as I used it only for those two modules, while acknowledging that it has many other modules. We specifically use AWS.

As a user, whenever I'm doing testing, it's nice to have a scanner that can simplify my job. The results I get are really helpful in reducing the amount of time I need to spend and gives me more time to focus on particular things.

The best features of Qualys CyberSecurity Asset Management include its ability to scan and consider each and every endpoint based on the target we have given. This makes it stand out. When I use Burp Suite for identifying any version-related vulnerabilities or any vulnerabilities, I get almost 90% false positives, whereas Qualys CyberSecurity Asset Management provides accurate content that identifies all the endpoints, making it better in that way. The review results for finding vulnerabilities and reporting also show that Qualys CyberSecurity Asset Management identifies most of them; although there are still false positives, it's not 100% perfect. However, compared to other scanners, Qualys CyberSecurity Asset Management is the best.

The user interface is friendly and looks cool. Others can be very difficult to use, and also difficult to map; in Qualys CyberSecurity Asset Management, everything is easy to understand. The fact that I didn't need external resources such as YouTube videos, unlike other tools, is a great feature. In addition to vulnerabilities, it helps identify other risk factors for my assets, with fast support when issues are raised.

When I started using Qualys, there was no one there to teach me, so I went online and did it myself and got certified. One can easily understand the technology.

As of now, the support, results, and low false positives do not necessitate changes.

I have more than three years of experience with Qualys CyberSecurity Asset Management.

I would rate stability at nine out of ten. 

We haven't experienced downtime or bugs, which led us to shift from other scanners to Qualys CyberSecurity Asset Management.

Regarding scalability, I'm uncertain if the organization expects using it with more than 15 users, however, it definitely makes my job easier.

I rate support at a nine out of ten due to the immediate assistance provided whenever there is an issue. When issues get raised, support is very fast.

Positive

We've used other vendors, like the Burp Suite and Nessus. The user interface is very good in Qualys. The mapping is harder in other solutions.

The deployment was not complex; when I joined, the company had already been using Qualys CyberSecurity Asset Management, and I didn't deploy or implement anything; I just received access in my second year after demonstrating my personal progress.

Qualys CyberSecurity Asset Management saves about 20% of my time during pen testing, allowing us to complete tasks in 3.5 days instead of five.

I did not use the CMDB Sync feature. As a pen tester, I want a scanner that simplifies my job, and Qualys CyberSecurity Asset Management is the only scanner that meets that need. Without it, manual checks would take five days for complete pen testing, but now, using the results, we can complete it within 3.5 days, reducing my time by almost 20%, allowing me more focus.

I did not use the external attack surface management module. I would recommend Qualys CyberSecurity Asset Management because it is easily understandable, requiring no guidance if someone knows cybersecurity terminologies, allowing them to initiate scans directly. I can't think of negative points at the moment, as I haven't used other scanners recently, though I am examining HCL AppScan documentation. I believe that integrating any AI module into Qualys CyberSecurity Asset Management would be beneficial, especially to simplify technical support interactions since AI is becoming commonplace in other scanners.

I would rate Qualys CyberSecurity Asset Management a ten out of ten overall.

I use Qualys CyberSecurity Asset Management for vulnerability management and patch management, as it gives me a global view of our infrastructure, including what is installed and what assets we have. As we always say, before securing your infrastructure, you need to know what you have. I use Qualys CyberSecurity Asset Management to obtain this global view of our infrastructure.

I recently implemented external attack surface management and have not yet explored it extensively. I'm in the process of discovering its features over time; I began monitoring our subdomains and websites from an external view about a month ago. Therefore, I don't have a detailed answer regarding its effectiveness yet. I am still in the early stages of implementing the external attack surface management solution. We haven't reached a point to provide feedback or evaluate how well it has helped us discover any previously uncovered assets in the vulnerability management program. I am currently working on this and plan to present my findings to our IT leadership.

In addition to identifying vulnerabilities, Qualys CyberSecurity Asset Management monitors our infrastructure, including tracking certificates and user access to assets. This information is useful in our IT department for compliance purposes.

The TruRisk scoring feature of Qualys CyberSecurity Asset Management helps prioritize vulnerabilities and assets, offering more information than traditional metrics, where we usually focus only on severities four and five. By examining TruRisk, we find vulnerabilities of severity five that might not be as dangerous as they appear, allowing us to target the exact vulnerabilities we need to fix better than just relying on severity alone. However, not all IT departments may focus on TruRisk, as most tend to adhere to traditional approaches.

I utilize the CMDB sync feature in Qualys CyberSecurity Asset Management. I want to mention that previously, in my last position, we used traditional CMDBs, but now we synchronize the CMDB with Qualys. This correlation with other information in Qualys, the VMDR module, gives us better visibility and correlation between our asset inventory and our vulnerability inventory.

The correlation between the VMDR and CMDB in Qualys CyberSecurity Asset Management affects our meantime to remediation significantly. If there is a vulnerability in one software, the CMDB correlation can provide all assets with this vulnerable software, allowing us to deploy remediation efforts efficiently and focus on the exact assets that require attention.

One of the useful cases for Qualys CyberSecurity Asset Management is during compliance or audit missions, where we need to report on assets with specific software. For instance, if we need to confirm how many assets comply with our software whitelist, Qualys CyberSecurity Asset Management greatly assists us in obtaining these reports quickly and with enhanced visibility of information.

I mainly appreciate Qualys CyberSecurity Asset Management for its patch management capabilities, which are essential in my job for deploying patches and remediating vulnerabilities. While deploying patches, I utilize Qualys CyberSecurity Asset Management to identify exactly which assets are vulnerable and which require new software installations or updates. One thing I appreciate about Qualys CyberSecurity Asset Management is that it is user-friendly; the interface is easy to navigate, and it provides extensive information. Before using Qualys CyberSecurity Asset Management, I relied on multiple applications for information, but it consolidates all that information from different platforms into one solution.

Qualys CyberSecurity Asset Management continues to improve and get better day by day, particularly with enhancements dashboards. I encountered a few problems while using Qualys CyberSecurity Asset Management, particularly regarding software inventory management. I primarily check for deployed updates; however, sometimes both updates and software types appear together on one list, making it hard to differentiate. For example, when I review what's deployed on my laptop, I see Microsoft software, Windows updates, and other software mixed together, resulting in noisy reports. 

Additionally, I find that while information is available regarding which users have access to our servers, retrieving it often requires checking servers individually rather than obtaining a consolidated extraction when needed. These two use cases are beneficial, but improvements in these features would be greatly appreciated.

I have been using Qualys CyberSecurity Asset Management for two years.

The scalability of Qualys CyberSecurity Asset Management system is satisfactory. It is indeed scalable. 

I have previously worked with Qualys technical support, and they were quite helpful and responsive, providing us with the exact solutions we needed when we reached out for assistance. I would rate the tech support of Qualys a perfect ten out of ten for their performance.

Positive

I have worked with different solutions associated with the CMDB, and for patch management.

We utilize the cloud version of Qualys, which is hosted on AWS. I haven't been involved in the purchasing or initial setup of this part.

Regarding the deployment of Qualys CyberSecurity Asset Management, I did not work directly on the project. I typically find that the project is already completed, so my role involves deploying the Qualys agent. I think this process is smooth, as my colleagues who manage the project have not reported any significant problems.

To a colleague at another company who believes they only need external attack surface management for their vulnerability management and detection response program, I would advise them to fully utilize Qualys CyberSecurity Asset Management for a better experience. By using all its features, rather than limiting themselves to just external attack surface information, they can gather more comprehensive information that can enhance their job performance.

For organizations considering Qualys CyberSecurity Asset Management, my advice is to fully utilize all the features available to maximize the experience. By leveraging all information provided, IT professionals can enhance their operations since every detail matters, and more information generally leads to better outcomes.

I would rate Qualys CyberSecurity Asset Management an eight out of ten.

Qualys Cybersecurity Asset Management provides complete visibility of network assets, identifies vulnerable software, and helps prioritize them based on criticality. This facilitates effective patch management, offering valuable insights and reducing the attack surface.

To enhance network efficiency and minimize our vulnerability to cyberattacks, we have adopted Qualys Cybersecurity Asset Management.

The primary purpose of the external attack surface management is to provide clear insight into the data and infrastructure assets exposed to the internet. Qualys Cybersecurity Asset Management offers detailed information about these exposed assets, including websites, authentication methods, and MFA implementation. By considering all relevant risk factors, it provides a clear picture of vulnerabilities and prioritizes remediation efforts, enabling proactive risk mitigation. It also frequently scans our environment to re-evaluate the risk factors.

Qualys CyberSecurity Asset Management has helped to improve the organization's security posture significantly. It lets us confidently communicate with clients by showcasing a better security posture. We can evaluate and compare our security scores against vendor scores when onboarding vendors, enhancing understanding and transparency about our security landscape.

Qualys TruRisk scoring helps us prioritize vulnerabilities and identify the number of assets in our environment with a high-risk score.

Cybersecurity Asset Management's CMDB sync feature reduces our mean time to remediate from our three-day service level agreement to just 12 hours.

Qualys CyberSecurity Asset Management offers valuable features such as continuous vendor support, rapid response times, dedicated vendor partnerships, and advanced technical capabilities for risk identification. Moreover, it provides insightful suggestions for effective and efficient risk mitigation.

Further research and development are needed to enhance integration with other cloud agents and products, particularly improving communication with external products and vendors. Additionally, platform upgrades have presented challenges with slowness and other difficulties.

I have been using the solution for six years.

The stability rating for Qualys Cybersecurity Asset Management is six out of ten. This is mainly due to some disconnections and slowness issues, likely because we have integrated a large volume of machines.

The scalability of Qualys Cybersecurity Asset Management is rated nine out of ten.

The support is generally good, offering pre-communication for updates and providing training for analysts.

Neutral

The initial setup involved collaborating with the vendor on the proof of concept, configuration, and fine-tuning. This process presented some initial challenges, but once we gained a deeper understanding of the backend systems, it became straightforward.

The deployment spanned six to eight months.

Around ten people were involved in the deployment process.

Qualys CyberSecurity Asset Management has definitely saved time and resources, particularly from a security management perspective. By automating tasks, it significantly reduces the human resources required, leading to increased efficiency and productivity.

We have evaluated other products, including Trend Micro and Microsoft solutions. However, Qualys stands out in quickly identifying vulnerabilities and gaps within our network.

I would rate Qualys CyberSecurity Asset Management seven out of ten. To improve the rating, Qualys must address the issues of lagging and updating.

Our Qualys CyberSecurity Asset Management platform currently has three administrators and 12 end-users.

Qualys Cybersecurity Asset Management requires regular maintenance, including license renewals and software updates.

Qualys Cybersecurity Asset Management is centrally deployed and can be used in multiple locations.

The initial implementation of Qualys CyberSecurity Asset Management was protracted, taking two to three years to realize its benefits fully. This delay was attributed to the extensive time spent on the proof of concept, configuration, and subsequent fine-tuning to address the initial difficulties encountered.

Currently, we have 70,000 to 80,000 assets in our infrastructure. We have installed Qualys agents and started receiving vulnerability details. We use the TruRisk score and send reports to respective stakeholders and ask them to close them on priority. If they do not address vulnerabilities promptly, we quarantine the assets from the infrastructure. We also use Qualys CSAM along with VRM for handling vulnerabilities.

Qualys CSAM has provided insights into critical application vulnerabilities in our assets, which has helped us quarantine machines to prevent them from getting attacked. It has improved our ability to handle asset vulnerabilities efficiently in our infrastructure. It helped detect about 10,000 vulnerabilities so far. We do not have any high-risk vulnerability.

It discovered any open source, end-of-life, or end-of-support applications with critical or high vulnerabilities. Everything was discovered. We got them remediated.

We use the TruRisk score, but we also have our own criteria or formula for risk levels. We are using both.

With Qualys CSAM, we can see which assets have critical application vulnerabilities. This feature helps us prioritize and address these vulnerabilities more efficiently.

All required features are available in Qualys CSAM. However, it would be helpful if Qualys CSAM started incorporating AI models. An inclusion of threat details for AI and LLM-related risks would be beneficial.

We are not facing any issues with stability. Everything is smoothly managed by a different team, and our scheduled scans run without interruptions. The reports are automated, and the scans are scheduled. The reports are automatically sent to respective stakeholders. 

If there is going to be any downtime, they inform us in advance.

I have no issues with scalability. Everything is fine, and all necessary processes are in place.

We recently had some issues related to the continuous monitoring of the SaaS module. I am working with someone from the Qualys support team. He is helping us to resolve all the issues. One request is still open with the team because the risk scan was not happening at the application level. We opened a ticket and requested them to schedule a call. It might happen next week.

The support provided by Qualys is good. Their SMEs have sufficient knowledge, and if they are not the right contact, they quickly redirect us to someone who can help resolve issues. The only minor issue is occasionally being redirected to multiple teams, causing slight delays. I would rate their support a ten out of ten.

Positive

We have not used any alternatives to Qualys CSAM. Qualys CSAM is our primary tool.

A separate team within our organization manages its initial setup, deployment, and administration, so I do not have visibility on this process.

It is our main tool, and I find it better than others. 

I would rate Qualys CSAM a ten out of ten.