Qualys CyberSecurity Asset Management Reviews

Qualys CyberSecurity Asset Management serves multiple purposes. It provides comprehensive asset details, including serial numbers, UALs, UASs, and DTLSs, which are crucial for tracking updates and configurations. We can access detailed information like BIOS UI and installed software, enabling us to identify authorized, unauthorized, and missing applications. This comprehensive approach to asset management ensures that we have a clear understanding of our IT environment.

Qualys is a vulnerability management tool that utilizes agent scans to gather in-depth information about assets. This data includes details like installed software, their versions, and locations, which can be used for various purposes such as asset inventory, identifying end-of-life software, or tracking specific applications. By downloading this information in list format, Qualys helps address a range of asset management and security needs.

We use Qualys CyberSecurity Asset Management to manage our entire external attack surface. We've integrated our primary domain and all its subdomains into EASM, leveraging its full functionality. This integration allows us to gather crucial data. While we utilize existing features, we anticipate a new filter that will reduce noise from agent-based scans. This will help us identify vulnerabilities in any external-facing assets with public IPs and exposed ports. By pinpointing these vulnerabilities, we gain a clearer understanding of our infrastructure's security posture from an external perspective.

Some of the assets discovered by EASM include IP addresses, DNS lookups associated with those IPs, and the corresponding domain. EASM captures information based on the integrated ESAM profile. If an agent is already present, EASM merges the scan information with the agent data, and an ESAM symbol indicates this source. In addition to cloud-based assets, EASM also identifies on-premise assets with publicly exposed IPs.

Customers using Qualys CyberSecurity Asset Management for organizational purposes and formal reporting can submit requests to management, whether related to administrative or organizational perspectives. These requests are reviewed with consideration for their potential benefit to other Qualys customers. Therefore, any enhancements or requests made for our organization are also considered by the vendor providing the solution.

Qualys provides risk and threat intelligence monitoring with a built-in prioritization mechanism. This mechanism helps us prioritize exposed risk factors, such as vulnerabilities with varying levels of severity, low, ongoing, or emerging. The system monitors these vulnerabilities and allows for prioritized support. Additionally, the Qualys score increases based on the risk factor, ensuring that users are notified of critical vulnerabilities.

Qualys' TrueRisk scoring helps prioritize vulnerabilities in assets by considering multiple factors. These factors include asset criticality, which is determined by the asset's importance, e.g., critical server vs. UAT server and can be customized through tagging mechanisms. The scoring also incorporates Qualys' QDS code, vulnerability severity, and the presence of unpatched software. Additionally, factors like public IP exposure and the potential impact of even low-critical vulnerabilities are evaluated. By combining these elements, Qualys provides a comprehensive TrueRisk score that accurately reflects the overall risk posed by each asset.

Qualys Cybersecurity Asset Management utilizes deployed cloud agents as passive sensors, enabling real-time detection of network-connected assets. This functionality identified numerous devices sharing identical multicast or broadcast IP addresses and revealed asset details like hostname, IP address, MAC address, and operating system, contingent on protocol availability, e.g., DNS.

My favorite feature of Qualys CyberSecurity Asset Management is its ability to target missing software. Instead of applying the tool to all assets, we can tag specific groups of assets that require a certain application. This allows us to generate a QQL query to identify any assets missing from the software. By correlating this with QDS scores, we can accurately assess the risk level of high or low QDS scores associated with each asset and monitor them accordingly.

Qualys could improve by enhancing its dynamic tagging and role-based access control features, and by refining its user interface for a more intuitive and efficient user experience.

Qualys is currently not able to identify assets lacking DNS information. Collaboration with Qualys is underway to explore alternative protocols for hostname identification and enhance asset visibility.

I have been using Qualys CyberSecurity Asset Management for two years.

This platform demonstrates excellent stability with consistent 100 percent uptime and no glitches observed. Qualys CyberSecurity Asset Management is a reliable and stable choice.

I would rate the scalability of Qualys CyberSecurity Asset Management a nine point five out of ten.

We receive excellent technical support from Qualys, characterized by quick response times and the dedicated assistance of a Technical Account Manager who ensures the prompt resolution of critical issues.

Positive

The initial deployment of Qualys CyberSecurity Asset Management is straightforward.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

We have Qualys Cybersecurity Asset Management deployed in multiple locations on various operating systems in a large scale environment.

I recommend Qualys Cybersecurity Asset Management due to its superior asset information collection capabilities, including comprehensive hardware and software inventorying. CSAM is continuously updated to encompass new technologies like GPUs and provides increased stability with reduced network noise. These ongoing enhancements make CSAM the optimal choice for effective asset management.

I suggest going for a full package that includes both external attack surface management and CyberSecurity Asset Management. The combination offers comprehensive protection and asset management.

Currently, we have 70,000 to 80,000 assets in our infrastructure. We have installed Qualys agents and started receiving vulnerability details. We use the TruRisk score and send reports to respective stakeholders and ask them to close them on priority. If they do not address vulnerabilities promptly, we quarantine the assets from the infrastructure. We also use Qualys CSAM along with VRM for handling vulnerabilities.

Qualys CSAM has provided insights into critical application vulnerabilities in our assets, which has helped us quarantine machines to prevent them from getting attacked. It has improved our ability to handle asset vulnerabilities efficiently in our infrastructure. It helped detect about 10,000 vulnerabilities so far. We do not have any high-risk vulnerability.

It discovered any open source, end-of-life, or end-of-support applications with critical or high vulnerabilities. Everything was discovered. We got them remediated.

We use the TruRisk score, but we also have our own criteria or formula for risk levels. We are using both.

With Qualys CSAM, we can see which assets have critical application vulnerabilities. This feature helps us prioritize and address these vulnerabilities more efficiently.

All required features are available in Qualys CSAM. However, it would be helpful if Qualys CSAM started incorporating AI models. An inclusion of threat details for AI and LLM-related risks would be beneficial.

We are not facing any issues with stability. Everything is smoothly managed by a different team, and our scheduled scans run without interruptions. The reports are automated, and the scans are scheduled. The reports are automatically sent to respective stakeholders. 

If there is going to be any downtime, they inform us in advance.

I have no issues with scalability. Everything is fine, and all necessary processes are in place.

We recently had some issues related to the continuous monitoring of the SaaS module. I am working with someone from the Qualys support team. He is helping us to resolve all the issues. One request is still open with the team because the risk scan was not happening at the application level. We opened a ticket and requested them to schedule a call. It might happen next week.

The support provided by Qualys is good. Their SMEs have sufficient knowledge, and if they are not the right contact, they quickly redirect us to someone who can help resolve issues. The only minor issue is occasionally being redirected to multiple teams, causing slight delays. I would rate their support a ten out of ten.

Positive

We have not used any alternatives to Qualys CSAM. Qualys CSAM is our primary tool.

A separate team within our organization manages its initial setup, deployment, and administration, so I do not have visibility on this process.

It is our main tool, and I find it better than others. 

I would rate Qualys CSAM a ten out of ten.

We use it to collect all software-related information, including external attack surface information. All of this information is validated here.

We were facing issues with collecting information about external facing assets and getting vulnerabilities for assets not managed by us. We also wanted visibility into particular IP address configurations or domain-based information. Qualys CyberSecurity Asset Management helps us with visibility into the assets that we do not know about or that someone is misusing.

Other than that, we are using it for software inventory purposes. We can see whether any unauthorized software is registered on any machine or whether any required security tool is not installed on the machine. We can also see if any specific assets are critical and if there is anything we need to focus on from a network perspective. From the portal, we can get all this information as a report.

The visibility into all the assets is the main improvement. We are able to see any new external-facing assets, as well as the assets that we do not manage. For example, for the asset that we do not manage, we could get information about a particular port being open on an IP address or operating system. It helped us with about 20% of our assets.

Management of unmanaged assets enhances the organization's risk assessment capabilities.

The TruRisk mechanism helps us in some scenarios by giving an asset criticality score. It helps us focus on critical assets.

Qualys CyberSecurity Asset Management helps us identify any end-of-life software or unmanaged assets. With the CAPS mechanism, the Qualys agent can validate unmanaged assets and provide information.

Authorized and unauthorized software visibility is the best feature for me. It helps me understand security controls on our network and where we lack visibility. With a single security tool, we are able to get an extensive list. 

Additionally, I can verify version controls and port details for major applications.

There can be further simplification to reduce the overall noise and provide ESAM-related data. Some data modification might also be required, but that is not as critical as noise reduction.

I have used Qualys CyberSecurity Asset Management for over three years.

Its stability is good. I do not have an issue with it. I would rate it a ten out of ten for stability.

Its scalability is good. I would rate it a ten out of ten for scalability.

We are located in different countries. It is being used by our admin team with more than 50 people.

I would rate their support a nine out of ten. We might not always get a good solution. We might get only a workaround.

Positive

From the start, I have been using this solution in this organization.

It is very easy for me to deploy. There is no complexity. 

Its implementation takes about a week, but it can vary.  

Being a SaaS solution, it does not require much maintenance. It has an uptime of 99.9%. It is working perfectly with the scheduled information.

It has reduced resources and the time spent on gathering and combining data from different tools into a single tool. It used to be a tedious job, but it has now been reduced with the single software.

I would recommend this solution if you want a unique software to collect all the inventory data and have information about the attack surface.

I would rate Qualys CyberSecurity Asset Management a nine out of ten.

We use Qualys CSAM for information related to EOL and EOS applications. For the machines connected to Qualys CSAM, we have information about the serial number and hardware ID. We have some integration mechanisms with AD. All these helped us to make sure the agents and applications that we use are good enough to run in our infrastructure.

We have a mechanism called authorized and unauthorized applications inside our organization. Qualys CSAM helps us implement this by reporting unauthorized applications through pop-ups or alerts. This mechanism ensures that any unauthorized application is quickly identified, and appropriate measures are taken swiftly. The tool provides valuable insights into our infrastructure.

For external attack surface management, we have a configuration profile that we configure with the domain name. With this domain name, we get all the information from Qualys. They have integration with Shodan and their own scanning mechanism to get publicly exposed IPs or domains for our organization and its subsidiaries. 

It is a useful solution for us for IT-related or security-related activities. We get information about all the assets in our organization, and we also get to know if any ports are open or exposed to the Internet.

It helps us with risk prioritization. It highlights any vulnerabilities that are exploitable. We have various reports. We can see EOL or EOS software or any unauthorized applications. All these reports are triggered in a daily manner. We get the latest list every day. We can also use the dashboard.

In addition to the asset criticality score that we have configured, we have the TruRisk score. All this data helps us to prioritize the assets and vulnerabilities. 

The most valuable features of Qualys CSAM include the ability to manage authorized and unauthorized applications efficiently. This feature helps in validating applications and maintaining a secure environment. 

Additionally, Qualys CSAM offers comprehensive data, including serial numbers, BIOS information, and software details related to EOL and EOS. These capabilities are crucial for ensuring infrastructure readiness and security.

In my opinion, the area that needs improvement is the role-based access control (RBAC). The access privilege management needs to be more robust and streamlined to enhance user access management. Additionally, improvements to the user interface could be beneficial.

I have been using Qualys CSAM for one and a half years.

I would rate the stability of Qualys CSAM a ten out of ten. The agent-related stability is excellent, and we have not experienced any lags.

The scalability of Qualys CSAM is good. It is a SaaS platform. I would rate it a nine out of ten for scalability.

We have it at multiple locations and countries. We have multiple networks and subsidiaries. We have about 300k users.

The customer service is excellent. I would rate them a nine out of ten. Although there have been occasional delays in response time, the support generally addresses issues promptly and effectively.

Positive

I have only used Qualys CSAM in this organization and have not switched from any previous solutions.

We have a hybrid setup. The initial setup is straightforward, requiring a single code within an agent file, making the deployment process very easy.

Other than the upgrades, it does not require any maintenance from our side.

I would strongly recommend Qualys CSAM to other users because of its reliable detection logic and high level of support. We have not seen any glitches with it. In the case of any issues, we can get them resolved promptly, maintaining efficiency. 

I would rate the Qualys CSAM a ten out of ten for its overall performance.

Our primary tool for asset inventory is Qualys CyberSecurity Asset Management, which our software asset management team also utilizes to check our software library.

We deploy Qualys Cloud agents as passive sensors to gain comprehensive asset visibility and identify gaps in policy agent coverage. Additionally, we are collaborating with our cyber defense center team to enhance external service management.

Our cyber defense center team effectively utilizes Qualys CSAM, an external service management tool, to cover the entire attack surface.

The external service management tool has helped discover over 6,000 assets that were previously discovered.

We immediately saw the benefits of Qualys CyberSecurity Asset Management. As platform owners, we collaborate with the validation and cyber defense center teams to ensure asset availability and address any discrepancies.

Qualys CyberSecurity Asset Management helps identify all risk factors using the TruRisk score.

TruRisk Insights assists in identifying vulnerabilities and prioritizing them from highest to lowest risk.

We have begun utilizing Qualys Cloud agents as passive sensors and are currently investigating the necessary protocols to maximize the effectiveness of this feature. 

Our cybersecurity, IT, and cloud software teams effectively use Qualys to gain comprehensive visibility into our software environment, aided by excellent support. This visibility enables us to integrate Qualys into various facets of our operations, including our internal tools, allowing us to efficiently share updates with both the IT team and end-users, thus streamlining our workflow.

The most valuable feature is the Management sensor, which helps identify gaps in policy agent availability, thereby improving agent utilization. Additionally, the tool's code aids in risk identification and mitigation.

The Qualys CAPS service requires further exploration and improvement, particularly in its handling of protocols and reactivity with MAC and IP addresses for CAP agents. Enhanced functionality in these areas would increase the service's effectiveness and efficiency. We anticipate updates that will address these issues and optimize our use of the service.

We have been using CSAM for more than two years. 

We have not encountered significant stability issues with Qualys CyberSecurity Asset Management. The design appears robust, and we have not experienced any latency problems.

Qualys Cybersecurity Asset Management has proven to be a highly scalable solution for us over the past couple of years, seamlessly integrating new features as we have expanded from a few licenses to a much larger deployment.

We receive excellent support from Qualys. Our Technical Account Manager is very responsive and helpful in addressing any concerns that arise.

Positive

The initial deployment was straightforward. We integrate CSAM with other Qualys modules including VMDR.

The Qualys Cybersecurity Asset Management pricing is well-aligned with our usage.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

Qualys CyberSecurity Asset Management does not require maintenance on our end.

To gain comprehensive visibility and reporting within the policy, new users should deploy the agent. This action provides a complete overview of vulnerabilities and support statuses, offering valuable insights for both IT management and cybersecurity purposes.

I have been working with Qualys for approximately two and a half years. I have used this module to manage security postures in cloud environments, and it is essentially used for hybrid management systems. This allows me to adhere to security practices across cloud environments.

I appreciate the feature that simplifies cloud security posture, offering insights into vulnerabilities, and reducing the complexity of managing the security program. It provides a proactive security posture, identifying risks before attempts are made. It is also scalable in hybrid management, offering dynamic capabilities in cloud environments, providing visibility to thousands of assets. Additionally, it is beneficial in discovering what's occurring in the cloud environment and provides visibility in asset discovery. It helps monitor assets continuously, granting real-time visibility, which aids the IT environment in maintaining these assets. External attack surface management allows me to consider things from an attacker's perspective. I've improved on faster remediation and reduced risk breaches, as the module enables me to quickly identify vulnerabilities and take necessary actions. Decision-making is straightforward, allowing risk prioritization and action accordingly.

Qualys is continually developing, adding new features each year. Previously, there was no on-demand scan feature in a cloud agent, but multiple features have since been added to my cloud agent module. In CSAM as well, I expect features that make security and IT team tasks easier, eliminating manual efforts. Features enhancing the interaction with IT or security teams should be added, such as a ticketing feature that, if an issue arises in the CSAM module, enables direct ticket creation in systems like ServiceNow. This would streamline assigning tickets to appropriate teams.

I have used the solution for two and a half years.

I do not think there are any issues.

It's scalable. I do not face any limitations.

I would rate the technical support nine out of ten. They are effective; if I raise a ticket, they directly contact me and solve my problems, whether related to deployment or unresolved vulnerabilities.

Positive

I have been using Qualys from the beginning and have not used any other solution extensively. However, I have some familiarity with Rapid7, but it lacked the level of detail found in Qualys.

The initial setup was smooth, particularly with the cloud agent installation and sensor deployment. After the initial stage and the licensing part were completed, I became involved in creating user IDs and as an administrator, I managed user access, including giving privileges to admins. I coordinated with the Linux, Windows, and Mac teams to download and install the agent and conduct testing.

I received assistance from the Qualys support team, specifically from the ACCPL team provided by Qualys. It was a third-party team.

As mentioned earlier, it saves time and facilitates direct communication with real issues I have faced.

At present, I do not think so; however, I may consider CrowdStrike as it has some features, though not as detailed.

The CSAM module is great and continually improving with updates. I would rate it nine out of ten. However, based on the company's budget, Qualys offers limited features, which can also be utilized in other environments. I rate the overall solution nine out of ten.

Currently, we are using it for asset inventory to determine how many Windows machines and how many Linux machines there are. Accordingly, we categorize them. 

We prioritize the assets according to vulnerability and risk score, identifying the most critical and vulnerable assets. We obtain this information from Qualys CyberSecurity Asset Management and use it for vulnerability remediation and prioritization.

We have visibility into public-facing IPs and open ports. It helps us in covering the entire attack surface.

We are able to discover various assets such as servers, endpoints, and different operating systems. It is connected to the VMDR console, patch management module, and cloud agent. We can see all the information through the console. We are able to see any outdated versions of software or end-of-support devices. We can then take action accordingly.

We were able to see its benefits immediately. Previously, we used a formula, but now, CSAM enables vulnerability prioritization without spending time creating or applying formulas.

TruRisk Score provides insight into an asset, indicating its risk score and vulnerability. If the score exceeds a particular threshold, we focus on the asset and consider a risk exception. If vulnerabilities are not remediated, we attempt remediation by consulting the TruRisk dashboard. This dashboard is also used to showcase to management without needing customization.

It provides most of the information needed regarding the assets, including the operating system and whether the assets are network devices or servers. The device type is available as well. We can prioritize vulnerabilities and assign a risk score. 

The main aspect that needs improvement is the user interface, which should be more intuitive. It is not easy for a new user because it provides a lot of details. Capturing information quickly is difficult. The user interface should be improved to make information more accessible.

I have been using it for two years. We got it along with our VMDR.

There are no stability issues, and I would rate it a ten out of ten.

I would rate it a seven out of ten in scalability.

Sometimes, when I encounter challenges or discrepancies in the console data, I communicate with support and receive good responses. The technical support of Qualys is noteworthy, as I have not experienced delayed responses.

Positive

We have not used any other solution before.

Deployment is easy because we do not need to configure much on CSAM. It automatically populates data, requiring us to only focus on cloud agent deployment and scanning, which makes it very easy.

The full implementation took about a month. We had 2,500 assets. Initially, we only onboarded servers. That was easy. After that, we onboarded endpoints. Overall, it took three to four months to populate all the data.

It does not require any maintenance from our end because we are using the cloud version.

The entire team, consisting of four people, worked on the Qualys implementation.

The pricing is reasonable relative to the features provided, as it collects all module data and operates as a main, centralized inventory, making it a cost-effective solution.

Qualys offers an automated solution for asset inventory. I would recommend it to anyone looking for a similar solution.

I would rate the solution an eight out of ten.

I am working as a senior security analyst. I provide enterprise vulnerability management solutions. CyberSecurity Asset Management helps us categorize all the assets and products. We can see the current software assets and the software or product lifecycle. We can see details about the end-of-life or the end-of-support in CyberSecurity Asset Management.

We create customized tags for the assets. In my environment, there are IT servers and OT servers, so we need to customize the tags based on the servers. 

We can deep dive into asset inventory and check the external attack surface. We do attack surface management for the servers that are external or public-facing servers. We need deep investigations of assets to see if there is any vulnerability or suspicious activity in the server. For that purpose, I utilize the Qualys CSAM module.

It is able to discover assets or servers that are public-facing. For example, if there is a domain in the organization with a lot of external or public IPs, and these IPs are being used for an e-commerce website or any kind of website, hackers would want to hack these websites using ransomware. They might also do a DDoS attack to take down these websites. For such websites or web servers, we need such a module so that we can proactively gather any vulnerabilities that can be exploited and take the required steps to mitigate them before exploitation.

Qualys CSAM has saved a huge amount of time and manual effort. Features like Asset Purge Rule and dynamic tags have reduced a lot of time and manual effort of the team. In Qualys CSAM, we can get the EASM module. We can integrate CSAM or ESAM with any kind of ticketing tool, such as ServiceNow. When integrated with a ticketing tool such as ServiceNow, a vulnerability incident is created in ServiceNow for any critical or high-severity vulnerability. The incident is assigned a remediation owner. We just need to investigate whether the vulnerability is a true positive or a false positive and if remediation has been done or not. Previously, these all things had to be done manually, but now, we have automated them using Qualys CSAM. It has saved a lot of time and improved vulnerability discovery and asset segmentation in our estate.

We are able to identify two things. The first one is the vulnerability level or risk factors. The second one is the product life cycle, which is also important, so we can determine if a product is end-of-life or end-of-support. If it comes under the end-of-life or end-of-support category, we need to check with the vendor team, and we need to ask for possible workarounds. Otherwise, we can go to the project team and tell them to upgrade the product or operating system. There is a risk factor when a product is end-of-life or end-of-support. It becomes a vulnerable product. This is an additional benefit that we get, and we can ask the vendor or the project team to mitigate the issues.

When I need to prioritize external or internal facing servers, I use TruRisk Scoring. It is very effective. When I need to prioritize vulnerabilities, there are a lot of attributes that I need to keep in mind such as CVSS score, severity, etc. There are a lot of factors, so when I need to determine the top ten vulnerable servers, I use TruRisk Scoring. It is very helpful.

We have implemented cloud agents and deployed specific sensors. In our environment, we have on-premises servers and Azure and AWS clouds. We have implemented cloud agents and designed the configuration profile for those cloud agents. In Qualys CSAM, we can visualize if the cloud agent is active or not and if the scan frequency is working fine or not. We can monitor these from the Qualys CSAM module. When we implement the Asset Purge Rule on-premises or on cloud servers, there should be two sources in Qualys CSAM. One is the IP-based source, and the second one is the agent-based source. They are also monitored by Qualys CSAM. We can generate a report in Excel or CSV format, and by using the report, we can do the risk assessment and prioritize things.

I have four years of experience in cybersecurity, and I have used a lot of tools. Qualys CyberSecurity Asset Management has some advantages over others.

The first one is a feature called dynamic tag. When you implement a dynamic tag using a query, you do not need to manually tag all the servers. It categorizes all the servers that come under that query. The tagging part is automatically done within a few minutes. It reduces the effort.

The second feature is a feature called Asset Purge Rule. For example, there might be some servers or products that have not been used for the last 90 or 120 days. If they are still being reported in Qualys, it will be difficult to prioritize the servers or products to determine the top ten vulnerable servers or products. Previously, if we wanted to purge those assets or remove them from scanning, we had to do that manually, whereas Qualys CyberSecurity Asset Management provides a feature for that. We do not need to do anything from our side. A server older than the last 90 days will automatically get purged or removed from the account or scanning scope. Whenever we generate the scan report, there will be only assets or servers that are reporting in Qualys. The ones that are not reporting are automatically purged. This is known as data sanitization or vulnerability report sanitization. This is done by Qualys CSAM through the Asset Purge Rule feature. These are its core features for me.

In Qualys CSAM, there is a module called EASM. One improvement that they can make in the EASM module is the scan frequency. After EASM is configured the first time, it allows you to do the complete configuration, but if you want to reconfigure it, it will not ask or provide any option for scan frequency. For that, you need to raise a case with Qualys and talk to the Qualys team.

It only allows us to add the domain. There are only certain criteria that we can use to create a new profile inside EASM. I know that EASM is a new module in Qualys, and it is improving day by day, but it currently does not have the same configuration area that CSAM has. In the future, I hope it will be improved so that we are able to handle the configuration of EASM on our own. We do not have to raise any kind of vendor ticket or Qualys support ticket for that. Mainly, the configuration area needs improvement. Currently, we do not have all the rights to do the configuration. For any critical change, we cannot wait for the vendor to resolve the ticket. Just like CSAM, we should be able to do the configuration on our own in EASM.

I have been using it for two years. I have been using it since 2022.

It is stable. I would rate it an eight out of ten for stability.

It is scalable. I would rate it a ten out of ten for scalability.

It is being used in multiple locations such as India, Germany, and the UK. As of now, there are 15 users. In the future, we will onboard more.

I was previously working on other projects where I used Tenable Nessus and Rapid7.

I joined this project about two years ago. It was a new project, but I knew the advantages of Qualys. I have done certification in Qualys. It was the VMDR or Vulnerability Management Detection and Response certification. At that time, I got to know that Qualys has a lot of advantages. I knew that if we could implement this solution, it would be helpful to prioritize the vulnerabilities and vulnerable servers and products in our overall estate. That is why we switched and started implementing Qualys in the organization.

Overall, with Qualys as a tool, not only CSAM, we can do everything. We can do on-premises vulnerability scanning and cloud agent scanning. If we want to do security policy compliance, that also comes under Qualys. Qualys CSAM has various features for assets and custom tagging. There are lots of features.

It is a hybrid deployment currently, but in the future, it will completely be on the cloud.

Its deployment is straightforward. Everything is mentioned in Qualys documentation. We can find information about all the states and configurations. Even if we have a basic license, we can raise a case with the vendor. They are helpful. They can help us to resolve any issues or problems. They help to solve the problem as soon as possible. It has been a great experience.

If we start from the documentation part, it takes us more than one week because there are some client approvals we need. To cover everything, it takes almost 12 to 13 days to complete the overall process and start working with the tool.

Two people are fine for its deployment. If there are three, that will be an advantage, but it does not require more than three people.

It has saved time and resources. Previously, tagging took a lot of our time. We also needed more project members. When there are 5,000 servers, doing it manually takes a lot of time. It has reduced the time and resources required. It is cost-effective. It has saved about 45% of the time.

It is cost-effective because, in a single tool, we are getting everything. All the solutions come in a single license or price. In my opinion, Qualys is one of the best solutions available in the market for vulnerability management, policy compliance, and security compliance.

I would recommend this solution because by using a single solution, we can cover the three main pillars of CyberSecurity: vulnerability management, asset and product lifecycle management, and compliance management. It is the best product. In a single product, we can do all these things. These are the three pillars of cybersecurity.

Nowadays, cyber threats are increasing. As vulnerability analysts and managers, our prime focus is to gather all the servers and categorize the servers based on the operating system technology. It can be an IT or OT server. It can be public-facing or private-facing. Our main focus is to gather vulnerabilities, and based on the severity of the vulnerabilities, we have to prioritize the servers. We can shortlist the top ten vulnerable servers. The remediation team can then focus on them to mitigate vulnerabilities. To implement that solution, we need to categorize everything. The categorization part has to be done as per the CSAM model. If we want to do external server categorization, we have to go for external attack surface management or EASM, or we can use CSAM for internal servers.

When you get the product license, external attack surface management is not available. It is not activated. You need to activate it from CSS and configure it. It asks for domain details and the domain you want to focus on. Based on the domain details, it configures external attack surface management. You also need to consider the scan schedule, such as, after how much time, it will launch a discovery scan. You need to provide information about how many servers or products are managed by Qualys or how many are unmanaged but still detected in Qualys. After the configuration, you have to wait for the first discovery scan. When that is completed, Qualys looks for the domain name mentioned in the configuration area and pulls out details related to that domain. It shows the status and any vulnerabilities, and whether an asset is managed or unmanaged. You have the overall data, and you can also define or prioritize based on TruRisk Score, which is generated by external attack surface management.

We are not using the CMDB Sync feature. We have integrated Qualys CSAM with ServiceNow CMDB, so all the onboarded servers or products are directly reflected in ServiceNow CMDB. When any high-severity vulnerability is detected by Qualys CSAM through discovery scans, it automatically raises a ServiceNow incident, which is automatically assigned to the asset owner or product owner. This automation has been implemented by our team.

Overall, I would rate Qualys CSAM a ten out of ten.