Qualys CyberSecurity Asset Management Reviews

Qualys Cybersecurity Asset Management provides complete visibility of network assets, identifies vulnerable software, and helps prioritize them based on criticality. This facilitates effective patch management, offering valuable insights and reducing the attack surface.

To enhance network efficiency and minimize our vulnerability to cyberattacks, we have adopted Qualys Cybersecurity Asset Management.

The primary purpose of the external attack surface management is to provide clear insight into the data and infrastructure assets exposed to the internet. Qualys Cybersecurity Asset Management offers detailed information about these exposed assets, including websites, authentication methods, and MFA implementation. By considering all relevant risk factors, it provides a clear picture of vulnerabilities and prioritizes remediation efforts, enabling proactive risk mitigation. It also frequently scans our environment to re-evaluate the risk factors.

Qualys CyberSecurity Asset Management has helped to improve the organization's security posture significantly. It lets us confidently communicate with clients by showcasing a better security posture. We can evaluate and compare our security scores against vendor scores when onboarding vendors, enhancing understanding and transparency about our security landscape.

Qualys TruRisk scoring helps us prioritize vulnerabilities and identify the number of assets in our environment with a high-risk score.

Cybersecurity Asset Management's CMDB sync feature reduces our mean time to remediate from our three-day service level agreement to just 12 hours.

Qualys CyberSecurity Asset Management offers valuable features such as continuous vendor support, rapid response times, dedicated vendor partnerships, and advanced technical capabilities for risk identification. Moreover, it provides insightful suggestions for effective and efficient risk mitigation.

Further research and development are needed to enhance integration with other cloud agents and products, particularly improving communication with external products and vendors. Additionally, platform upgrades have presented challenges with slowness and other difficulties.

I have been using the solution for six years.

The stability rating for Qualys Cybersecurity Asset Management is six out of ten. This is mainly due to some disconnections and slowness issues, likely because we have integrated a large volume of machines.

The scalability of Qualys Cybersecurity Asset Management is rated nine out of ten.

The support is generally good, offering pre-communication for updates and providing training for analysts.

Neutral

The initial setup involved collaborating with the vendor on the proof of concept, configuration, and fine-tuning. This process presented some initial challenges, but once we gained a deeper understanding of the backend systems, it became straightforward.

The deployment spanned six to eight months.

Around ten people were involved in the deployment process.

Qualys CyberSecurity Asset Management has definitely saved time and resources, particularly from a security management perspective. By automating tasks, it significantly reduces the human resources required, leading to increased efficiency and productivity.

We have evaluated other products, including Trend Micro and Microsoft solutions. However, Qualys stands out in quickly identifying vulnerabilities and gaps within our network.

I would rate Qualys CyberSecurity Asset Management seven out of ten. To improve the rating, Qualys must address the issues of lagging and updating.

Our Qualys CyberSecurity Asset Management platform currently has three administrators and 12 end-users.

Qualys Cybersecurity Asset Management requires regular maintenance, including license renewals and software updates.

Qualys Cybersecurity Asset Management is centrally deployed and can be used in multiple locations.

The initial implementation of Qualys CyberSecurity Asset Management was protracted, taking two to three years to realize its benefits fully. This delay was attributed to the extensive time spent on the proof of concept, configuration, and subsequent fine-tuning to address the initial difficulties encountered.

Currently, we have 70,000 to 80,000 assets in our infrastructure. We have installed Qualys agents and started receiving vulnerability details. We use the TruRisk score and send reports to respective stakeholders and ask them to close them on priority. If they do not address vulnerabilities promptly, we quarantine the assets from the infrastructure. We also use Qualys CSAM along with VRM for handling vulnerabilities.

Qualys CSAM has provided insights into critical application vulnerabilities in our assets, which has helped us quarantine machines to prevent them from getting attacked. It has improved our ability to handle asset vulnerabilities efficiently in our infrastructure. It helped detect about 10,000 vulnerabilities so far. We do not have any high-risk vulnerability.

It discovered any open source, end-of-life, or end-of-support applications with critical or high vulnerabilities. Everything was discovered. We got them remediated.

We use the TruRisk score, but we also have our own criteria or formula for risk levels. We are using both.

With Qualys CSAM, we can see which assets have critical application vulnerabilities. This feature helps us prioritize and address these vulnerabilities more efficiently.

All required features are available in Qualys CSAM. However, it would be helpful if Qualys CSAM started incorporating AI models. An inclusion of threat details for AI and LLM-related risks would be beneficial.

We are not facing any issues with stability. Everything is smoothly managed by a different team, and our scheduled scans run without interruptions. The reports are automated, and the scans are scheduled. The reports are automatically sent to respective stakeholders. 

If there is going to be any downtime, they inform us in advance.

I have no issues with scalability. Everything is fine, and all necessary processes are in place.

We recently had some issues related to the continuous monitoring of the SaaS module. I am working with someone from the Qualys support team. He is helping us to resolve all the issues. One request is still open with the team because the risk scan was not happening at the application level. We opened a ticket and requested them to schedule a call. It might happen next week.

The support provided by Qualys is good. Their SMEs have sufficient knowledge, and if they are not the right contact, they quickly redirect us to someone who can help resolve issues. The only minor issue is occasionally being redirected to multiple teams, causing slight delays. I would rate their support a ten out of ten.

Positive

We have not used any alternatives to Qualys CSAM. Qualys CSAM is our primary tool.

A separate team within our organization manages its initial setup, deployment, and administration, so I do not have visibility on this process.

It is our main tool, and I find it better than others. 

I would rate Qualys CSAM a ten out of ten.

Qualys CyberSecurity Asset Management serves multiple purposes. It provides comprehensive asset details, including serial numbers, UALs, UASs, and DTLSs, which are crucial for tracking updates and configurations. We can access detailed information like BIOS UI and installed software, enabling us to identify authorized, unauthorized, and missing applications. This comprehensive approach to asset management ensures that we have a clear understanding of our IT environment.

Qualys is a vulnerability management tool that utilizes agent scans to gather in-depth information about assets. This data includes details like installed software, their versions, and locations, which can be used for various purposes such as asset inventory, identifying end-of-life software, or tracking specific applications. By downloading this information in list format, Qualys helps address a range of asset management and security needs.

We use Qualys CyberSecurity Asset Management to manage our entire external attack surface. We've integrated our primary domain and all its subdomains into EASM, leveraging its full functionality. This integration allows us to gather crucial data. While we utilize existing features, we anticipate a new filter that will reduce noise from agent-based scans. This will help us identify vulnerabilities in any external-facing assets with public IPs and exposed ports. By pinpointing these vulnerabilities, we gain a clearer understanding of our infrastructure's security posture from an external perspective.

Some of the assets discovered by EASM include IP addresses, DNS lookups associated with those IPs, and the corresponding domain. EASM captures information based on the integrated ESAM profile. If an agent is already present, EASM merges the scan information with the agent data, and an ESAM symbol indicates this source. In addition to cloud-based assets, EASM also identifies on-premise assets with publicly exposed IPs.

Customers using Qualys CyberSecurity Asset Management for organizational purposes and formal reporting can submit requests to management, whether related to administrative or organizational perspectives. These requests are reviewed with consideration for their potential benefit to other Qualys customers. Therefore, any enhancements or requests made for our organization are also considered by the vendor providing the solution.

Qualys provides risk and threat intelligence monitoring with a built-in prioritization mechanism. This mechanism helps us prioritize exposed risk factors, such as vulnerabilities with varying levels of severity, low, ongoing, or emerging. The system monitors these vulnerabilities and allows for prioritized support. Additionally, the Qualys score increases based on the risk factor, ensuring that users are notified of critical vulnerabilities.

Qualys' TrueRisk scoring helps prioritize vulnerabilities in assets by considering multiple factors. These factors include asset criticality, which is determined by the asset's importance, e.g., critical server vs. UAT server and can be customized through tagging mechanisms. The scoring also incorporates Qualys' QDS code, vulnerability severity, and the presence of unpatched software. Additionally, factors like public IP exposure and the potential impact of even low-critical vulnerabilities are evaluated. By combining these elements, Qualys provides a comprehensive TrueRisk score that accurately reflects the overall risk posed by each asset.

Qualys Cybersecurity Asset Management utilizes deployed cloud agents as passive sensors, enabling real-time detection of network-connected assets. This functionality identified numerous devices sharing identical multicast or broadcast IP addresses and revealed asset details like hostname, IP address, MAC address, and operating system, contingent on protocol availability, e.g., DNS.

My favorite feature of Qualys CyberSecurity Asset Management is its ability to target missing software. Instead of applying the tool to all assets, we can tag specific groups of assets that require a certain application. This allows us to generate a QQL query to identify any assets missing from the software. By correlating this with QDS scores, we can accurately assess the risk level of high or low QDS scores associated with each asset and monitor them accordingly.

Qualys could improve by enhancing its dynamic tagging and role-based access control features, and by refining its user interface for a more intuitive and efficient user experience.

Qualys is currently not able to identify assets lacking DNS information. Collaboration with Qualys is underway to explore alternative protocols for hostname identification and enhance asset visibility.

I have been using Qualys CyberSecurity Asset Management for two years.

This platform demonstrates excellent stability with consistent 100 percent uptime and no glitches observed. Qualys CyberSecurity Asset Management is a reliable and stable choice.

I would rate the scalability of Qualys CyberSecurity Asset Management a nine point five out of ten.

We receive excellent technical support from Qualys, characterized by quick response times and the dedicated assistance of a Technical Account Manager who ensures the prompt resolution of critical issues.

Positive

The initial deployment of Qualys CyberSecurity Asset Management is straightforward.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

We have Qualys Cybersecurity Asset Management deployed in multiple locations on various operating systems in a large scale environment.

I recommend Qualys Cybersecurity Asset Management due to its superior asset information collection capabilities, including comprehensive hardware and software inventorying. CSAM is continuously updated to encompass new technologies like GPUs and provides increased stability with reduced network noise. These ongoing enhancements make CSAM the optimal choice for effective asset management.

I suggest going for a full package that includes both external attack surface management and CyberSecurity Asset Management. The combination offers comprehensive protection and asset management.

Qualys Cybersecurity Asset Management helps us manage our technical debt by identifying end-of-life and end-of-service software and hardware within our IT infrastructure.

Qualys CSAM is primarily a cloud-based solution. The only optional on-premise component is a passive sensor that monitors network traffic at our egress point. This sensor collects data and sends it to the Qualys Cloud interface for analysis, but it's not essential for using CSAM.

The external attack surface management identified unexpected assets, suggesting some exist outside our known inventory. While these may not be directly managed by us, the process has brought valuable awareness to the fact that our core servers are externally hosted, prompting a review of similar situations.

An external attack surface management scan revealed several outsourced name services, along with one unexpected third-party-linked IP. It's unclear if this was due to past consulting work or a registration error, but since it wasn't relevant to our company, it was easily excluded from future scans.

The benefits of Qualys CyberSecurity Asset Management are immediate. We already had the cloud agents installed. They were already on all the servers and workstations. Once we upgraded from the VMDR included GAV (Global AssetView) to CSAM, it was no time before I could see the end-of-life, end-of-service software, and hardware.

In addition to vulnerabilities, CSAM provides a better view of other risk factors, but VMDR is very powerful. VMDR was already seeing our limitations in hardening our vulnerabilities. CSAM enhanced our view by adding more visibility and insight into what we have.

TruRisk scoring goes beyond traditional vulnerability scoring like CVSS to prioritize both vulnerabilities and assets based on real-world exploitability and industry targeting. This provides a clearer picture of our actual risk by considering factors like published exploits and what attackers are currently focusing on, allowing us to quickly identify critical issues and avoid wasting time on vulnerabilities with a high theoretical risk but low real-world threat.

Qualys Cloud Agents can now be configured as passive sensors to discover all devices on our network in real-time, eliminating the requirement for separate virtual or physical passive sensor appliances. These cloud agent sensors monitor network broadcasts instead of egress traffic, and they can even designate a secondary sensor to take over if the primary becomes unavailable, ensuring continuous asset discovery and populating our CSAM platform with managed and unmanaged devices.

The end-of-life and end-of-service software and hardware are some of my favorite features. The insight into the endpoints with the cloud agent is also valuable. We get more value than we do with the global asset view that comes with VMDR.

The CMDB Sync feature currently only works with ServiceNow, which is common in larger organizations. If the feature could integrate with other, more affordable CMDB options, like those used by smaller businesses, we would be more likely to use it.

Qualys CyberSecurity Asset Management could be more cost-effective by offering a much lower price point or including it with existing VMDR subscriptions. Additionally, providing more pre-built reports would improve accessibility for organizations by reducing the need for custom report creation.

I have been using Qualys CyberSecurity Asset Management for one year.  however, I have been using Qualys solutions for over 20 years.

Qualys CyberSecurity Asset Management has been very reliable, with only occasional syncing issues following major updates, which is common for cloud-based software. Overall, I've been impressed with its stability.

Qualys CyberSecurity Asset Management is designed to scale effectively for environments of all sizes. While our environment may be on the smaller side, the solution is proven to handle deployments ranging from just a hundred devices to well over ten thousand, ensuring smooth operation regardless of our specific needs.

I've been a long-time Qualys user, so my technical support interactions tend to involve complex issues. For example, when the CSAM component was new and I encountered a bug, their team promptly cleared the back-end database, resolving the problem. Their expertise and willingness to help have been consistently impressive.

Positive

The initial deployment is easy, especially if a client is already on VMDR, to enable CSAM we only need a license.

One person can deploy VMDR and CSAM if they have the necessary access and permissions. For complex deployments with separate network management duties, involving the right personnel for whitelisting is crucial. Deployment time varies: for existing VMDR users, it's nearly immediate; for new implementations, it can take a bit longer, depending on team size and experience. Working with experienced professionals can expedite the process.

Qualys CyberSecurity Asset Management can be expensive since it is an add-on to VMDR. The cost seems to be a barrier to entry for some organizations, and a lower price point might lead to more automatic adoption of CSAM.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

Qualys Cybersecurity Asset Management seems to offer a more comprehensive solution than what I've seen from competitors like Tenable and Rapid7. While I haven't reviewed their offerings recently, in the past they primarily focused on vulnerability scanning, which isn't as extensive as Qualys CSAM's asset management capabilities.

No maintenance is required. Everything is self-updating from Qualys. From cloud agents to sensors, all of those are automatically updated.

Organizations that rely solely on external attack surface management for vulnerability management are making a dangerous assumption. This approach presumes complete knowledge of their assets, which is unrealistic without full visibility into internal and external environments. Companies with a 'we're secure' attitude often have poor security, while those welcoming security assessments tend to have a strong security posture.

CSAM's tagging features, especially dynamic tagging with its easy-to-use rules, can significantly improve your efficiency across various tasks like patch and vulnerability management. By automating manual work, dynamic tags free up your time. Take advantage of the free CSAM training and consider consulting a trusted partner to accelerate your learning and implementation – their experience can save you weeks of effort.

We use it to identify all our assets, including those on our premises, cloud, and remote environments. It continuously monitors our assets, collects details like installed software, configurations, and vulnerabilities, and also assesses asset criticality and risk level. It prioritizes our vulnerabilities based on the business impact.

Qualys CyberSecurity Asset Management has given us a view into all portions of our assets, including printers and others, enabling us to uncover many previously unknown assets. Some of the assets were not shown by other solutions. There were some assets that were not registered in our CMDB. Teams had some assets that were connected to the network but were not registered. With the help of Qualys CyberSecurity Asset Management, we got a view of our complete posture. We were able to view all the assets.

We were able to see its benefits within a few weeks of deployment. We uncovered many assets that were previously unknown. It gives an overview of assets daily. 

It does its job of covering the attack surface, but we also use other solutions.

In addition to vulnerabilities, it also identifies all the other risk factors for our assets.

TruRisk Scoring helps prioritize vulnerabilities and assets, but its effectiveness varies from organization to organization. For us, it works, but sometimes, we have to manually prioritize assets.

We have leveraged the solution's ability to convert already-deployed Qualys Cloud Agents into passive sensors that detect assets connected to the network in real-time. It is pretty good in terms of insights or visibility.

The CMDB Sync feature has reduced our mean time to remediation by 15% to 20%.

The integration with different third-party tools, such as cloud providers like Azure and AWS, and asset management tools like CMDB systems, is valuable. 

It also helps detect shadow IT groups and enforce policies and compliance, ensuring that assets adhere to regulatory and internal security policies. It helps our team to maintain an accurate and up-to-date asset inventory.

The deployment is somewhat complicated and could be made more user-friendly for most users. It is currently not user-friendly for all users. It is good but can be improved. It is a new product, and they are working on it.

There is limited coverage for non-IT assets; although effective for IT assets, it may struggle with OT technologies, IoTs, and some non-traditional assets without proper integrations. 

It is dependent on the Qualys ecosystem. It works only with Qualys VMDR and other Qualys modules. If an organization relies on multiple security vendors, integration would require additional customization. Improving the integration part would be beneficial.

I have used the solution for two years.

It is stable. I would rate it an eight out of ten for stability.

It is scalable. I would rate its scalability a nine out of ten.

They are good.

Positive

For us, it was easy because we had experienced professionals. They did not face any issues. If it was done by someone with two, three, or four years of prior experience, they would struggle a bit. 

We already had other Qualys subscriptions, such as patch management, so we just bought the CSAM solution and started activating CABS. Though it is never fully done, as we develop it every day, after purchasing, it was mostly done within two weeks.

We had a team of five, consisting of two senior and three junior members.

Overall, I would give Qualys CyberSecurity Asset Management a nine out of ten.

Our primary tool for asset inventory is Qualys CyberSecurity Asset Management, which our software asset management team also utilizes to check our software library.

We deploy Qualys Cloud agents as passive sensors to gain comprehensive asset visibility and identify gaps in policy agent coverage. Additionally, we are collaborating with our cyber defense center team to enhance external service management.

Our cyber defense center team effectively utilizes Qualys CSAM, an external service management tool, to cover the entire attack surface.

The external service management tool has helped discover over 6,000 assets that were previously discovered.

We immediately saw the benefits of Qualys CyberSecurity Asset Management. As platform owners, we collaborate with the validation and cyber defense center teams to ensure asset availability and address any discrepancies.

Qualys CyberSecurity Asset Management helps identify all risk factors using the TruRisk score.

TruRisk Insights assists in identifying vulnerabilities and prioritizing them from highest to lowest risk.

We have begun utilizing Qualys Cloud agents as passive sensors and are currently investigating the necessary protocols to maximize the effectiveness of this feature. 

Our cybersecurity, IT, and cloud software teams effectively use Qualys to gain comprehensive visibility into our software environment, aided by excellent support. This visibility enables us to integrate Qualys into various facets of our operations, including our internal tools, allowing us to efficiently share updates with both the IT team and end-users, thus streamlining our workflow.

The most valuable feature is the Management sensor, which helps identify gaps in policy agent availability, thereby improving agent utilization. Additionally, the tool's code aids in risk identification and mitigation.

The Qualys CAPS service requires further exploration and improvement, particularly in its handling of protocols and reactivity with MAC and IP addresses for CAP agents. Enhanced functionality in these areas would increase the service's effectiveness and efficiency. We anticipate updates that will address these issues and optimize our use of the service.

We have been using CSAM for more than two years. 

We have not encountered significant stability issues with Qualys CyberSecurity Asset Management. The design appears robust, and we have not experienced any latency problems.

Qualys Cybersecurity Asset Management has proven to be a highly scalable solution for us over the past couple of years, seamlessly integrating new features as we have expanded from a few licenses to a much larger deployment.

We receive excellent support from Qualys. Our Technical Account Manager is very responsive and helpful in addressing any concerns that arise.

Positive

The initial deployment was straightforward. We integrate CSAM with other Qualys modules including VMDR.

The Qualys Cybersecurity Asset Management pricing is well-aligned with our usage.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

Qualys CyberSecurity Asset Management does not require maintenance on our end.

To gain comprehensive visibility and reporting within the policy, new users should deploy the agent. This action provides a complete overview of vulnerabilities and support statuses, offering valuable insights for both IT management and cybersecurity purposes.

I am working as a senior security analyst. I provide enterprise vulnerability management solutions. CyberSecurity Asset Management helps us categorize all the assets and products. We can see the current software assets and the software or product lifecycle. We can see details about the end-of-life or the end-of-support in CyberSecurity Asset Management.

We create customized tags for the assets. In my environment, there are IT servers and OT servers, so we need to customize the tags based on the servers. 

We can deep dive into asset inventory and check the external attack surface. We do attack surface management for the servers that are external or public-facing servers. We need deep investigations of assets to see if there is any vulnerability or suspicious activity in the server. For that purpose, I utilize the Qualys CSAM module.

It is able to discover assets or servers that are public-facing. For example, if there is a domain in the organization with a lot of external or public IPs, and these IPs are being used for an e-commerce website or any kind of website, hackers would want to hack these websites using ransomware. They might also do a DDoS attack to take down these websites. For such websites or web servers, we need such a module so that we can proactively gather any vulnerabilities that can be exploited and take the required steps to mitigate them before exploitation.

Qualys CSAM has saved a huge amount of time and manual effort. Features like Asset Purge Rule and dynamic tags have reduced a lot of time and manual effort of the team. In Qualys CSAM, we can get the EASM module. We can integrate CSAM or ESAM with any kind of ticketing tool, such as ServiceNow. When integrated with a ticketing tool such as ServiceNow, a vulnerability incident is created in ServiceNow for any critical or high-severity vulnerability. The incident is assigned a remediation owner. We just need to investigate whether the vulnerability is a true positive or a false positive and if remediation has been done or not. Previously, these all things had to be done manually, but now, we have automated them using Qualys CSAM. It has saved a lot of time and improved vulnerability discovery and asset segmentation in our estate.

We are able to identify two things. The first one is the vulnerability level or risk factors. The second one is the product life cycle, which is also important, so we can determine if a product is end-of-life or end-of-support. If it comes under the end-of-life or end-of-support category, we need to check with the vendor team, and we need to ask for possible workarounds. Otherwise, we can go to the project team and tell them to upgrade the product or operating system. There is a risk factor when a product is end-of-life or end-of-support. It becomes a vulnerable product. This is an additional benefit that we get, and we can ask the vendor or the project team to mitigate the issues.

When I need to prioritize external or internal facing servers, I use TruRisk Scoring. It is very effective. When I need to prioritize vulnerabilities, there are a lot of attributes that I need to keep in mind such as CVSS score, severity, etc. There are a lot of factors, so when I need to determine the top ten vulnerable servers, I use TruRisk Scoring. It is very helpful.

We have implemented cloud agents and deployed specific sensors. In our environment, we have on-premises servers and Azure and AWS clouds. We have implemented cloud agents and designed the configuration profile for those cloud agents. In Qualys CSAM, we can visualize if the cloud agent is active or not and if the scan frequency is working fine or not. We can monitor these from the Qualys CSAM module. When we implement the Asset Purge Rule on-premises or on cloud servers, there should be two sources in Qualys CSAM. One is the IP-based source, and the second one is the agent-based source. They are also monitored by Qualys CSAM. We can generate a report in Excel or CSV format, and by using the report, we can do the risk assessment and prioritize things.

I have four years of experience in cybersecurity, and I have used a lot of tools. Qualys CyberSecurity Asset Management has some advantages over others.

The first one is a feature called dynamic tag. When you implement a dynamic tag using a query, you do not need to manually tag all the servers. It categorizes all the servers that come under that query. The tagging part is automatically done within a few minutes. It reduces the effort.

The second feature is a feature called Asset Purge Rule. For example, there might be some servers or products that have not been used for the last 90 or 120 days. If they are still being reported in Qualys, it will be difficult to prioritize the servers or products to determine the top ten vulnerable servers or products. Previously, if we wanted to purge those assets or remove them from scanning, we had to do that manually, whereas Qualys CyberSecurity Asset Management provides a feature for that. We do not need to do anything from our side. A server older than the last 90 days will automatically get purged or removed from the account or scanning scope. Whenever we generate the scan report, there will be only assets or servers that are reporting in Qualys. The ones that are not reporting are automatically purged. This is known as data sanitization or vulnerability report sanitization. This is done by Qualys CSAM through the Asset Purge Rule feature. These are its core features for me.

In Qualys CSAM, there is a module called EASM. One improvement that they can make in the EASM module is the scan frequency. After EASM is configured the first time, it allows you to do the complete configuration, but if you want to reconfigure it, it will not ask or provide any option for scan frequency. For that, you need to raise a case with Qualys and talk to the Qualys team.

It only allows us to add the domain. There are only certain criteria that we can use to create a new profile inside EASM. I know that EASM is a new module in Qualys, and it is improving day by day, but it currently does not have the same configuration area that CSAM has. In the future, I hope it will be improved so that we are able to handle the configuration of EASM on our own. We do not have to raise any kind of vendor ticket or Qualys support ticket for that. Mainly, the configuration area needs improvement. Currently, we do not have all the rights to do the configuration. For any critical change, we cannot wait for the vendor to resolve the ticket. Just like CSAM, we should be able to do the configuration on our own in EASM.

I have been using it for two years. I have been using it since 2022.

It is stable. I would rate it an eight out of ten for stability.

It is scalable. I would rate it a ten out of ten for scalability.

It is being used in multiple locations such as India, Germany, and the UK. As of now, there are 15 users. In the future, we will onboard more.

I was previously working on other projects where I used Tenable Nessus and Rapid7.

I joined this project about two years ago. It was a new project, but I knew the advantages of Qualys. I have done certification in Qualys. It was the VMDR or Vulnerability Management Detection and Response certification. At that time, I got to know that Qualys has a lot of advantages. I knew that if we could implement this solution, it would be helpful to prioritize the vulnerabilities and vulnerable servers and products in our overall estate. That is why we switched and started implementing Qualys in the organization.

Overall, with Qualys as a tool, not only CSAM, we can do everything. We can do on-premises vulnerability scanning and cloud agent scanning. If we want to do security policy compliance, that also comes under Qualys. Qualys CSAM has various features for assets and custom tagging. There are lots of features.

It is a hybrid deployment currently, but in the future, it will completely be on the cloud.

Its deployment is straightforward. Everything is mentioned in Qualys documentation. We can find information about all the states and configurations. Even if we have a basic license, we can raise a case with the vendor. They are helpful. They can help us to resolve any issues or problems. They help to solve the problem as soon as possible. It has been a great experience.

If we start from the documentation part, it takes us more than one week because there are some client approvals we need. To cover everything, it takes almost 12 to 13 days to complete the overall process and start working with the tool.

Two people are fine for its deployment. If there are three, that will be an advantage, but it does not require more than three people.

It has saved time and resources. Previously, tagging took a lot of our time. We also needed more project members. When there are 5,000 servers, doing it manually takes a lot of time. It has reduced the time and resources required. It is cost-effective. It has saved about 45% of the time.

It is cost-effective because, in a single tool, we are getting everything. All the solutions come in a single license or price. In my opinion, Qualys is one of the best solutions available in the market for vulnerability management, policy compliance, and security compliance.

I would recommend this solution because by using a single solution, we can cover the three main pillars of CyberSecurity: vulnerability management, asset and product lifecycle management, and compliance management. It is the best product. In a single product, we can do all these things. These are the three pillars of cybersecurity.

Nowadays, cyber threats are increasing. As vulnerability analysts and managers, our prime focus is to gather all the servers and categorize the servers based on the operating system technology. It can be an IT or OT server. It can be public-facing or private-facing. Our main focus is to gather vulnerabilities, and based on the severity of the vulnerabilities, we have to prioritize the servers. We can shortlist the top ten vulnerable servers. The remediation team can then focus on them to mitigate vulnerabilities. To implement that solution, we need to categorize everything. The categorization part has to be done as per the CSAM model. If we want to do external server categorization, we have to go for external attack surface management or EASM, or we can use CSAM for internal servers.

When you get the product license, external attack surface management is not available. It is not activated. You need to activate it from CSS and configure it. It asks for domain details and the domain you want to focus on. Based on the domain details, it configures external attack surface management. You also need to consider the scan schedule, such as, after how much time, it will launch a discovery scan. You need to provide information about how many servers or products are managed by Qualys or how many are unmanaged but still detected in Qualys. After the configuration, you have to wait for the first discovery scan. When that is completed, Qualys looks for the domain name mentioned in the configuration area and pulls out details related to that domain. It shows the status and any vulnerabilities, and whether an asset is managed or unmanaged. You have the overall data, and you can also define or prioritize based on TruRisk Score, which is generated by external attack surface management.

We are not using the CMDB Sync feature. We have integrated Qualys CSAM with ServiceNow CMDB, so all the onboarded servers or products are directly reflected in ServiceNow CMDB. When any high-severity vulnerability is detected by Qualys CSAM through discovery scans, it automatically raises a ServiceNow incident, which is automatically assigned to the asset owner or product owner. This automation has been implemented by our team.

Overall, I would rate Qualys CSAM a ten out of ten.

We primarily use Qualys CyberSecurity Asset Management for zero-day vulnerabilities. Essentially, this is one of the critical aspects we maintain. The main point is that within Qualys, we receive solutions based on the criticality of the issue. Assuming it's a zero-day vulnerability, we have fixes that provide extensive information on addressing these issues.

I would rate Qualys ability to cover the entire attack surface a nine out of ten.

Previously, we used Tenable as our preferred tool but switched to Qualys for the cost-effectiveness. However, upon switching to Qualys, our primary concern was ensuring the seamless deployment of agents across our infrastructure. Fortunately, Qualys agents proved to be remarkably lightweight. Additionally, Qualys excels in network security, allowing us to identify vulnerabilities, track SSL and TSL certificates, and monitor their expiration dates. Qualys also offers robust password management capabilities, surpassing Tenable in this regard. Moreover, Qualys' reporting functionality is unparalleled, outperforming competitors like Tenable and other tools in the market.

Qualys identifies all risk factors for our assets. For example, assigning a globally traceable computer name or using easily compromised passwords can create vulnerabilities. Qualys provides immediate alerts if any compromise occurs in our environment, highlighting specific loopholes. Consider a scenario where a programmer in a testing environment uses a simple password instead of a complex one. Hackers can easily exploit this, and Qualys will immediately identify the issue, generate a report pinpointing the responsible individual, and notify us. This real-time identification and reporting capability surpasses traditional PAM solutions, allowing for swift remediation of potentially exploitable changes.

We use the risk scoring to prioritize the issues by criticality.

We use Qualys to convert deployed cloud agents into passive sensors for VM ESX. Whenever new servers or network devices are added, Qualys immediately detects them and flags them as unregistered assets on the network. Based on this information, other teams often reach out to us to onboard or install an agent for enhanced visibility and management within Qualys.

The most valuable aspect we receive from Qualys is the remediation. It provides detailed solutions in a user-friendly manner that our IT team finds easy to understand.

After exporting the reports, we used to receive them in CSV format. The most important aspect of these reports is their customization. While the reports are already good, they have the potential to be even better, which is what I expect. Additionally, the agent's processing speed and CPU utilization should be improved significantly. Currently, whenever the agent is running, it consumes over ten percent of my CPU, indicating that CPU consumption is another area Qualys needs to address.

The cost aspect of Qualys is an area of improvement.

I have been using Qualys CyberSecurity Asset Management for almost seven years.

I would rate Qualys' stability a seven and a half out of ten. Occasionally, there's slowness from an agent or potentially a network issue on our end when pushing data to the core server. This can cause slight delays, depending on the environment.

I would rate the scalability of Qualys ten out of ten.

The technical support is a major advantage of using Qualys. Whenever we encountered any difficulties with generating or scanning, they were quick to assist us.

Positive

We previously used Tenable but switched to Qualys primarily because of CPU utilization. Qualys also offers solutions that are much easier to use compared to Tenable, which simplifies our workflow. Although I'm unsure how Qualys delivers their solutions, it significantly improves our experience. This ease of use was the main factor in our decision to switch from Tenable to Qualys. Even though Tenable's results were very accurate, Qualys provided easier remediation solutions. Additionally, Qualys' security and detection timing were also favorable factors in our decision.

I strongly prefer Qualys over Tenable. I'm a huge fan of Qualys, and I believe people should recognize its capabilities.

The deployment in our environment was straightforward. The deployment took one week for over 4,000 servers. One person was enough for the deployment.

In a testing environment without the usual deployment setup, we might deploy hundreds of servers for testing. At that time, we lacked other tools and had to individually dump data and run scripts due to credentials and other factors. Domain-based environments linked through Azure are easier, but workgroups that don't communicate with public or private networks are more challenging. Fortunately, most of our machines were domain-related, simplifying Qualys deployment.

The cost for Qualys CyberSecurity Asset Management is high.

I would rate Qualys CyberSecurity Asset Management nine out of ten.

No maintenance is required from our end other than managing our database.

I recommend running Qualys in a test environment first before deploying it to production. This process is simpler in an agentless environment.