Qualys Patch Management Reviews

We utilize Qualys Patch Management to patch our customers' virtual machine environments. This includes performing tasks and remediation actions in conjunction with Qualys Vulnerability Management, Detection, and Response.

We implemented Qualys Patch Management for the zero-touch patches.

Qualys Patch Management's risk-based approach simplifies the automation of risk mitigation.

The automatic inclusion of relevant patches in Qualys Patch Management based on Qualys VMDR findings streamlines remediation. This integration simplifies patching tasks by providing a direct solution from VMDR to Patch Management, making it easier to address vulnerabilities.

Qualys Patch Management is user-friendly. We used to have a different tool that did not provide good solutions or responses, so we tested Qualys Patch Management internally and with a few customers. As a result, the time to push patches, get updates, or push zero-day patches has significantly decreased compared to the previous tool. We realized the benefits of Qualys Patch Management within the first quarter.

Qualys' TruRisk automation improves our operational efficiency by enabling us to remediate vulnerabilities without requiring direct involvement from our security team.

Qualys Patch Management streamlines our vulnerability management process by providing a single source of truth to assess, prioritize, and remediate vulnerabilities across all assets. This consolidated approach has significantly reduced our workload, enabling us to meet all compliance standards and accelerate remediation from weeks to days.

We have significantly improved our patch rates using Qualys Patch Management, though the exact improvement varies depending on the vulnerabilities. For critical issues, typically those with a CVSS score of four or five or higher, we contact the customer and, upon their approval, immediately patch the relevant item. This includes application software, configurations, Microsoft Patch Tuesday updates, and zero-day vulnerabilities.

We augmented our vulnerability solution with Qualys Patch Management to address patching deficiencies within our customer base. Many clients operate in silos with disparate IT teams, hindering comprehensive patching efforts. Our adoption of Qualys Patch Management enables us to centrally manage and execute patching through its VMDR capabilities, resulting in higher success rates compared to decentralized client-managed patching.

We have seen a significant reduction in our customer's risk, around 70 to 80 percent.

Qualys Patch Management excels with its automated patch scheduling and retrieval. The system efficiently executes jobs, provides clear messaging, and simplifies the management of installations and residual file removal.

Qualys's current response time for releasing solutions to zero-day vulnerabilities, which takes approximately 12 to 16 hours, needs improvement. The goal is to reduce this timeframe to under 12 hours. Additionally, their platform requires enhanced support for multi-tenancy.

I have been using Patch Management for the last two years.

I would rate the stability of Qualys Patch Management nine out of ten.

Qualys Patch Management's scalability is eight out of ten because it does not provide good support for multi-tenancy.

Qualys' technical support is good.

Positive

We previously used patching solutions like Kaseya VSA, but now prefer Qualys Patch Management due to its integration with VMDR. This single-solution approach reduces remediation time significantly.

The initial deployment is straightforward. It involves installing agents and scanner appliances, which automatically manage everything. The deployment can be completed within a few days.

The pricing is reasonable and less expensive than the previous tool.

I would rate Qualys Patch Management eight out of ten.

Our customers who use Qualys Patch Management are small and medium-sized businesses.

Qualys Patch Management does not require any maintenance.

I would recommend Qualys Patch Management to other users because of its advantages over other tools. This tool is good compared to others.

In the previous company, the customer was using Qualys Patch Management tool, and they were using more than one lakh assets in that organization. The Qualys Patch Management tool helped significantly in that case.

The risk-based approach Qualys Patch Management uses is very good for easily getting the details. That is one of the factors in the prioritization of the vulnerability. We can see if a patch is or is not available. The details are easily obtained through risk analysis. If everything is available, we still need to know which one to prioritize, and this approach helps us significantly with priorities.

We saw an improvement in our patch rates from using Qualys Patch Management, especially with respect to automated patches. 

We got the consolidated data, and using automated Patch Management for a few assets saved a lot of time because we don't have to do it manually or raise tickets for everything. 

By trusting Qualys Patch Management, we remediated many vulnerabilities, especially with Windows.

The consolidated report we received from the solution was very time-saving because, in the dashboard, we could get all the patch details for a particular patch and all the assets listed. That was very easy. Instead of going through Excel sheets, we could easily pull up the data and produce it based on the operating system, distribution, and other things. 

False positives were the biggest concern. 

We also had some concerns with respect to the Cloud Agent. VMDR is something that whoever uses Qualys Patch Management will always use. We used both, but sometimes we got different details in Patch Management and VMDR. The data differs, especially with Cloud Agent-installed assets. We have had to contact their technical support many times, especially for Cloud Agent troubleshooting. We raised many feature requests with Qualys for Cloud Agent and faced many issues with it. Cloud Agent always gave us trouble, not just with Qualys, but with other tools too. However, compared with others, Qualys did have more issues with Cloud Agent.

I used Qualys Patch Management for one year.

The platform maintenance is according to what we have seen. A few times Qualys was not reachable for very few minutes, but stability-wise, it is a very good product.

Scalability-wise, Qualys Patch Management is a very good product. I never faced any issues with any of that.

I would rate them a ten out of ten for support because they are very approachable. Whenever we raise a request and mention the priority of the ticket, they respond immediately via email or call.

Positive

We were using another tool before Qualys Patch Management, though I don't remember which one. When we did the PoC, compared to Qualys, the other tool was giving less data, and that is why we moved to Qualys Patch Management.

My overall rating for Qualys Patch Management is a ten out of ten.

We use Qualys Patch Management for server deployment and workstation deployment. It is also used for vulnerability management, managing open ports, and remediating vulnerabilities.

The risk-based management involves process automation, identifying vulnerabilities through scheduled reports, and ongoing patch deployments.

Qualys Patch Management utilizes advanced algorithms within its management policies to effectively address vulnerabilities. It accurately identifies threats and provides the necessary solutions to remediate bugs in end-user systems.

TruRisk automation streamlines our vulnerability remediation process by automatically identifying and deploying necessary patches, eliminating the need for constant security team involvement. Previously, the security team would provide monthly scan profiles and assign them to us. We would then scan endpoints, identify vulnerabilities or partially/fully installed patches, and use Qualys reports to address any patching failures. TruRisk automates this entire workflow, increasing efficiency and reducing our reliance on manual intervention from the security team.

Qualys Patch Management offers a single source of truth to identify, prioritize, and address vulnerabilities across all assets. This ongoing monthly process consistently identifies vulnerabilities in our network, devices, and systems. Using a standardized remediation template, we scan for vulnerabilities and implement necessary fixes to ensure ongoing security.

It reduces costs through automated deployments, eliminating the need for manual monitoring and machine checks. By creating a job to identify machines with low disk space or those not requiring patches, we generate a report and exclude unnecessary machines from the patching schedule. This automation removes machines that don't need patches, ensuring only those requiring updates are involved, and reduces manual effort by approximately 50 percent through automated scheduling and issue identification.

I have been managing patches for the past two years. Previously, the tools available lacked automation and couldn't handle all tasks, including scheduling. Now, with Qualys Patch Management, we can schedule jobs, automatically identify and fix bugs, and significantly reduce the time spent on patching. For instance, tasks that once took ten hours can now be completed in three.

Our patch rate was 85 percent before implementing Qualys Patch Management, and now it is 98 percent.

We utilize Qualys Patch Management's ITSM tools for ticket management, which has proven highly beneficial for our operations. We are integrating Qualys Patch Management with ServiceNow and BMC Remedy. This integration automatically identifies and closes approximately 50 to 60 percent of tickets.

Adding Qualys Patch Management to our existing vulnerability management tools has provided us with an on-demand capability to patch our internal devices as needed.

Qualys Patch Management helped reduce our organization's risk by patching 98 percent of vulnerabilities.

Qualys Patch Management is an effective tool for vulnerability remediation. It identifies vulnerabilities, creates profiles, and recognizes vulnerabilities on the endpoint, all within a user-friendly environment.

The availability of Qualys Patch Management needs to be improved.

I have been using Qualys Patch Management for almost five years.

There are times when Qualys Patch Management is unavailable.

I would rate the scalability of Qualys Patch Management a nine out of ten.

Technical support is good, providing seamless efforts in their support.

Positive

We use multiple tools. On-demand, we use Qualys alongside other solutions like Tanium, Rapid7, and SCCM to manage machines both inside and outside the organization.

The initial deployment is straightforward. It does not take much time to deploy. Everything is completed within the four-hour schedule.

Compared to other tools, the price of Qualys Patch Management is reasonable.

I would rate Qualys Patch Management a nine out of ten.

Qualys Patch Management is deployed in multiple departments and locations. We have five members that administor the solution.

No maintenance is required from our end.

I recommend Qualys Patch Management because it is effective in past deployment and vulnerability management. It identifies necessary patches instead of scanning the entire machine.

My organization uses Qualys Patch Management internally, including its core patching functionality and Vulnerability Management, Detection, and Response. As a consultant, I help several Qualys user clients with best practices and similar tasks, addressing use cases ranging from vulnerability reduction and patch management to asset management.

Qualys is a cloud-based platform. While they offer a private cloud option at a higher cost, their core functionality resides in the cloud. The lightweight agents we install on our systems simply collect data and upload it to the cloud-based Qualys interface. The only exceptions are passive sensors like network sniffers and on-premise scanners, which are optional deployments for specific needs. This cloud-centric approach eliminates the need for us to manage on-premise servers, unlike some competing products like baramundi.

Qualys query language simplifies patch selection by allowing us to define risk-based criteria. We can target patches based on severity medium to critical and Qualys rating while excluding specific unwanted patches like "Patch xyz". As long as a patch meets our pre-approved criteria, it's automatically selected, making the approval process quick and efficient.

The Patch Management integration with VMDR including all development patches and configuration changes required to remediate vulnerabilities detected by the VMDR is significantly important.

While Qualys offered benefits initially, the deployment of the cloud agent truly transformed our security posture. Previously, regular scans provided only point-in-time vulnerability identification. Now, with continuous updates from the cloud agent every four hours, we have near real-time visibility into our risk levels, allowing us to prioritize and swiftly address vulnerabilities to minimize overall security exposure.

TruRisk automation streamlines vulnerability remediation by prioritizing threats based on real-world exploitability, not just a generic CVSS score. This allows us to focus on the most critical issues first, avoiding the time-wasting whack-a-mole approach of patching everything at once. While all vulnerabilities eventually need to be addressed, TruRisk helps us prioritize effectively and work through them in a methodical way.

Qualys' prioritization feature streamlines vulnerability management by offering a central hub to find, rank, and address critical security issues. This unified approach significantly improves collaboration between security and IT teams. Previously, prioritizing vulnerabilities was often a matter of simply patching critical ones. Patching policies also play a role, with most companies aiming for a 30-day window or less for critical patches. While the industry average turnaround is 17 days, faster patching remains crucial. Qualys' TruRisk scoring system helps identify outliers – vulnerabilities that might slip through the cracks in a well-managed environment. Traditional patching methods, like Microsoft's WSUS, may miss these outliers, but Qualys excels at finding them, providing better communication and faster remediation.

This single source has helped reduce soft costs where employees were wasting time spinning their wheels searching for answers. This newfound focus allows them to dedicate their energy to more important tasks.

Prior to implementing patch management, a random sampling of systems would often reveal outdated patches, some exceeding 60 days old. However, with patch management in place, finding such aged patches is now a rarity.

We integrated Patch Management on top of Qualys VMDR. This gave us a lot more visibility and accuracy.

Patch Management has helped to reduce our organizational risk.

The most valuable feature in Patch Management is the Qualys query language for set-it-and-forget-it patching for our preapproved patches, and our preapproved schedules, That is extremely helpful compared to the old days of patching.

A common area for improvement in Patch Management, both within our environment and others I've encountered, is the lack of built-in driver updates. Ideally, the system would handle updates for network interface cards, video cards, and other components, eliminating the need to rely on manufacturer-specific tools like Dell Update or HP Update. Integrating these patching options would significantly improve the overall functionality.

Qualys Patch Management primarily updates operating systems, third-party software including Adobe products and many more, leaving video card drivers and firmware updates to other tools. This focus on core software is understandable, as driver and firmware updates can be more complex.

The price has room for improvement.

I have been using Qualys solutions for over 20 years.

Qualys Patch Management is very stable. They clearly communicate any scheduled maintenance in advance, and these updates typically require no downtime. In rare cases of major maintenance, they might announce limited portal access during specific hours. Like any software, occasional minor glitches can occur, but we can easily check for known issues at status.qualys.com before troubleshooting on our own. Overall, Qualys Patch Management is a reliable solution.

Qualys Patch Management is highly scalable. 

Qualys technical support has been excellent recently. While there have been occasional periods of lower satisfaction in the past, similar to any organization, they seem to be prioritizing customer happiness. This is evident by their recent staffing improvements, which have led to my last few support requests being resolved quickly and efficiently.

With extensive system use, I've occasionally received initial responses from what seems like level-one support. I then need to clarify and request further troubleshooting before they escalate the issue.

Positive

Qualys Patch Management deployment is straightforward as long as we have the right team, whether it's a consulting firm or our own IT staff familiar with whitelisting. This is because whitelisting the Qualys Cloud Agent on systems protected by endpoint security tools like Carbon Black or CrowdStrike is crucial to prevent them from blocking the agent. Fortunately, the whitelisting requirements are well-documented, making implementation smooth for a prepared team.

A single person can handle the deployment if they have permission to distribute the cloud agent, install on-premise scanners, and build the virtual machine for the scanner. In fact, several of my colleagues successfully manage deployments for large organizations on their own.

Qualys Patch Management's pricing is competitive. While some perceive it as expensive, competitor tools are similar. While a free option like Microsoft WSUS exists, it lacks features. While I'd prefer Qualys VMDR to include Cyber Security Asset Management for a more attractive overall package, Patch Management itself remains competitively priced. Scaling brings lower per-asset costs, and Qualys recently introduced better pricing bundles for smaller environments.

To verify Qualys Patch Management's effectiveness, I've occasionally used free tools like Patch My PC to scan for missed patches. These scans consistently come up clean, giving me confidence that Qualys Patch Management is doing a good job.

While both Qualys Patch Management and baramundi Update Management are powerful tools, Qualys offers a clear advantage in ease of use. For organizations with large IT teams that can handle a more hands-on approach, baramundi can be effective, but it requires more ongoing management compared to Qualys' set-and-forget approach. Notably, baramundi goes beyond patching with software distribution capabilities, but this additional functionality comes at the cost of increased complexity. Ultimately, for those seeking a simpler solution, Qualys is the better choice.

I would rate Qualys Patch Management ten out of ten.

While the initial setup involves deploying cloud agents, Qualys Patch Management is low maintenance. Updates for both agents, signatures, and related components are automatic. Qualys handles maintenance in the cloud, and new systems are easily enrolled with agents through software distribution or policy enforcement.

New Qualys Patch Management users should consult the documentation and training resources before deploying. While a trusted partner can assist with implementation, understanding the process is crucial. Qualys offers free training to cover essential steps like agent deployment, configuration, and security considerations to ensure successful patching. Don't skip these steps, as seemingly minor setup issues can hinder functionality. This applies not just to Qualys, but to any endpoint security solution.

Mostly, I've used it because I'm working in the Vulnerability Management Team. I've done the POC for Patch Management and then handed over the product to the Patch Management Team, which handles the patching. I tested the module by Qualys, exploring the functionality of the Patch Management module, such as available patches. All these tasks were completed by me before procuring the product, and then access was provided to another team that uses it for patching. As part of the Vulnerability Management Team, my work involves overseeing the entire Qualys product, including VMDR, FedRAMP, cloud agents, and other functionalities.

The first thing I would say is the ease of use. It's so user-friendly that even a newcomer in IT can use it directly. It helps reduce our attack surface by patching all software vulnerabilities and deploying patches directly from the console. The connection and integration between different tools are excellent, allowing continuous monitoring of the types of patches released, which can be quickly deployed onto the systems. The dashboards help identify what type of patch I want to deploy and which patches are missing.

There is room for improvement in the inclusion of more patches. That's the only improvement I would suggest. Not all patches are available on Qualys, so they need to get licenses for other patches as well. That would be more helpful.

I have used the solution for 3 years.

It's quite stable. I would say it’s a nine.

Scalability, it's dependable.

Technical support, I would say it’s about seven and a half.

We used BigFix before.

For Patch Management, the testing part took about one to two weeks. Procurement took one week because it was pending with the procurement team. Overall, I guess it took about a month.

We have saved time and resources by detecting vulnerabilities, which helps us patch many assets. I can't quantify it exactly, but it's significant as it prevents vulnerabilities from being exploited. If those vulnerabilities were open and we did not have Qualys or similar solutions, we would have been at risk of attacks. I cannot give a specific number, but having a Vulnerability Management tool has a significant impact.

These two tools are completely different. BigFix is a full-fledged patching tool where you can directly apply patches but cannot view vulnerability data. On Qualys, you can see vulnerabilities and deploy patches directly. It offers a different perspective by allowing you to view a vulnerability and deploy a remedying patch. Qualys acts like both a vulnerability management tool and a patching tool, which is quite beneficial. Tools like Nessus, Rapid7 handle vulnerability management, while BigFix, SCCM handle patching.

I would recommend it because of its ease of use and integration as both a Vulnerability Management and Patch Management tool. I rate it nine out of ten.

We use almost every module that Qualys has, except the EDR, which is endpoint protection. They came up with that module last year. We use their patch management, vulnerability scanners, cloud agents, and network passive scanners. We are using everything that is available.

They have a very good approach called TruRisk. If an exploit is publicly available or something is public-facing, they have an in-depth categorization process, so I do not have to think about what to patch first. Qualys take care of that. They assess them based on many factors. They have a team that works on that and goes through every aspect of the vulnerability in terms of how easily it can be exploited, and then they put a priority on it.

TruRisk automation has not helped us remediate vulnerabilities without needing to involve our security team. That is because we have been having some issues with the Windows Store app. We blocked it now but did not block it before, so it got installed on some of the machines. Because of that, we have to deal with it manually because Patch Management cannot do that. They will look for attributes, and they still exist. We cannot delete or update them because the Windows Store app is blocked, so we have to deal with those things manually.

They have a dashboard, which is very useful. I heavily rely on the dashboard. I create additional widgets if I have to, but the dashboards they have in their library are sufficient and very easy to use. I already know their language and I can build queries if necessary. 

Having this single source of truth affects the way our security and IT teams work together. Instead of me telling or sending screenshots, I can send them a link. When I send the link, others can see the exact same screen and easily drill down on endpoints.

This single source of truth helps reduce costs. It saves time, and time is always equal to money.

Patch Management has improved our patch rates. Previously, our approximate patching duration to close a vulnerability or remediate a vulnerability was almost 30 to 40 days. Right now, it does not exceed 11 days. Qualys has its own priority levels. They have priority 4, priority 3, priority 2, and priority 1 levels. Priority 4 ones are the most dangerous ones. They are patched right away. For other priorities, it was 30 to 40 days and then it was 21 days. The last one was about 14 days and now it is 11. It is a very good progress from what it was before.

I do not use their Risk Reduction Recommendation Report, but I usually go for the dashboard. The dashboard usually tells everything such as the end-of-life hardware, software, or other things. When I drill down, I can generate a report and present it to my IT colleagues and tell them that we need to get rid of this equipment or this software. We need to do something with it. This is an on-demand report, so I can put it on my schedule, and when I need it, I can generate it.

Patch Management has definitely helped to reduce our organization's risk. It is hard to provide metrics because, with the security field, you cannot be very precise about how secure you are. However, I can sleep at night and not stress about if some computer is being patched. I do not worry about situations where when you have a lot of systems, some of them you cannot patch because they have old applications. If you patch them, it will break something. I do not have that stress because I can rely on Qualys to do its job. In my previous job, I have had systems that I could not patch. I had to request a window to do the patchwork. With Qualys, I do not have to do that. There is a work/life balance. I got back my Saturdays and Sundays. In my previous job, I came to the job on Saturday and Sunday when people were not there and patched the systems. With Qualys, it is definitely not the case. We do not have to do that.

Patch Management, if configured correctly, works effectively without requiring further action. There are some applications that Patch Management cannot update, but they have a Custom Assessment and Remediation module to update third-party software. That module completes patch management, and you can now update everything.

The vulnerability scanner is solid and thorough. Vulnerability scans go through everything such as the endpoints, servers, and hardware.

They are constantly working on making it better. There is no 100% reliable or working application or software. There are caveats with the network passive sensor when it does not merge or something does not feel right, but whenever I have to report on those things, someone from their support team jumps on and tries to help us, which is why I like it. They should keep it up. 

They can maybe do check-ins with the customers once a month. All the vendors are doing it nowadays. Qualys can do regular check-ins to go over not only all the vulnerabilities but also the overall process to see if there is anything where we might need improvement. They know about the latest trends, and they have meetings about them. They can relay to us some newer information that we do not know, but they saw in our environment. That would be a nice thing.

I have probably been using it for three years, give or take.

I have interacted with them many times. Their support is good and reactive. When we needed support, it took a day or two. We can always reach out to our technical account manager. He is able to get on board with the engineers to help resolve issues, which I appreciate. If we need to fix something urgently, he can always help us.

Positive

We also use Microsoft through the GPL, and we have KACE, which checks for missing patches and applied patches, but mostly, we use Qualys. Qualys would be our single pane of glass where we see all those.

I joined after the initial deployment was completed, but I deployed a couple of scanners, like vulnerability scanners on the VMs, and that process was easy. It was self-explanatory and straightforward. You just spin one up, put the IP address, and it works.

It does not require any maintenance. It is a cloud agent. As long as the cloud agent is installed on the endpoint, we are collecting all the information and the system is being patched. That is a good part.

It took us some time to realize its benefits. I went to a Qualys conference, and that was when I started to realize its benefits. Till then, I thought Rapid7 was a good one or Manage Engine was a good one. I thought those products were good, and they also patch third parties whereas Qualys did not patch third parties. After going to Qualys, they explained there is a way to do that. It was a longer way, which I did not do. We decided to go with an MSP that specializes in installation and fine-tuning the Qualys product. When they did everything, I did not have to touch any configuration with Qualys Patch Management. Everything was going through. With the way we did things previously, it was going through, but it was a longer approach. It was taking a little longer and was more manual. We did not properly utilize tagging. We did not properly utilize the patching process scheduling. The MSP guys did tagging. They did automation of the patch management according to the risks. That was very important. Previously, we had six or seven jobs and sometimes, we manually patched individual machines. After the MSP guys did the fine-tuning, we had only two scheduled jobs, and that was it. The first job does 10 to 15 testing computers, and then the next one does the old machines.

I would rate Qualys Patch Management a nine out of ten.

I am a cybersecurity engineer focused on vulnerability assessment and penetration testing. We use Qualys Patch Management to scan our client infrastructure and external-facing applications. We collect asset details from clients and perform activities using Qualys VMDR to prepare and submit reports. If vulnerabilities are detected, we conduct patch management.

We implemented Qualys Patch Management to simplify patching processes and maintain a comprehensive record of all assets, both those already patched and those requiring patching.

Qualys Patch Management's risk-based approach to automation is effective in addressing vulnerabilities. By configuring policies, patches are applied automatically, eliminating concerns about oversight and ensuring comprehensive mitigation.

The integration of Patch Management and VMDR is critical for medium and large organizations because it automatically includes relevant patches and configuration changes to remediate detected vulnerabilities. This allows organizations to gain clear visibility into device vulnerabilities and take immediate action to mitigate risks.

Qualys Patch Management keeps our clients informed of all security aspects. It keeps the quality up to date, with vulnerability databases and new CVEs based on the CVSS score. Clients are pleased with the insights on their security posture and any security gaps.

We use TruRisk automation and the Qualys knowledge base, with its batch management and information-sharing features, to remediate vulnerabilities without involving the security team.

Qualys Patch Management provides a centralized platform to identify, prioritize, and address vulnerabilities across all assets. This allows us to tailor vulnerability assessments and patching strategies for clients with critical assets, such as servers hosting public-facing web applications, by leveraging asset criticality tags to create dedicated sections within the platform.

Qualys Patch Management has helped improve our patch rate by 35 percent.

Qualys Patch Management helps reduce our client's organizational risk by 50 percent.

Qualys Patch Management allows us to structure all the patches together and schedule patch management sessions. If we do not need a particular patch, it can push it automatically. It provides insight into the organization's security posture and keeps databases updated with new CVEs.

The pricing of the solution is slightly high compared to other tools in our field. It’s manageable for clients, but as a service provider, it can be challenging due to the lower cost of vulnerability assessments and penetration testing.

I have been using Qualys Patch Management for the past two years.

Qualys Patch Management is a stable solution. I would rate its stability as a ten out of ten.

Scalability could be improved, as not everyone can afford it, and some may not fully understand how to use Qualys.

During the license purchase process, there was some delay in technical communication from Qualys. 

Positive

The deployment involved a team of six people and took about half a year.

Qualys Patch Management has saved time and resources by reducing the need for human resources. Clients are satisfied with the insights and reduced vulnerabilities over time.

While the cost of Qualys Patch Management is slightly high compared to alternative tools, it is not excessively expensive. I would rate the pricing as a seven or eight out of ten for expense.

I would rate Qualys Patch Management ten out of ten.

Our clients who use Qualys Patch Management are medium to enterprise-level businesses.

Qualys handles the maintenance for Patch Management.

I recommend Qualys Patch Management to others due to its ability to enhance organizational and client security posture while reducing time and costs associated with vulnerability assessment and auditing.

Our primary use case is to try to reduce our time to remediate. One of our sister teams, the attack surface team, uses the scanning piece. Therefore, we thought it would be best to close the ecosystem and use the patching piece. The feedback from the PoC made it evident that making a shift was necessary.

By implementing Qualys Patch Management, we wanted to reduce the meantime to remediate and have the ability to weigh our threats so that we are not just patching everything; we are patching what is most critical to our environment.

The automation capability that it has to create jobs, set them, and forget them was very intriguing to our business.

The risk-based approach is beneficial because not everything that requires a patch poses a true risk. It makes much more sense because everything that requires a patch may not necessarily be an exposure or true risk. As a leader, it allows me to make sure that I am directing our efforts into something that means. We are not chasing things around because that does not produce a lot of value in the end. 

We were able to realize its benefits immediately. We configured it and used it in the test and a few production machines. It was easy to build jobs and associate the tags that were being used. With the full knowledge base that Qualys has, we did not have to decipher what scanning is saying versus what the actual resolution is. Having all that built into one solution is just great.

Qualys Patch Management gives us a single source of truth for assets and vulnerabilities that need to be assessed, prioritized, and remediated. That is why we purchased it.

The most valuable features are the ease of managing both first-party and third-party patching, the generation of dashboards, and the provision of real-time information. It provides real-time information, with the agent checking in every four hours, offering nearly up-to-date information at any time of the day. This is in contrast to our previous tool, where we did not have this capability.

There is room for improvement in the detection logic. It sometimes detects open vulnerabilities that are not truly there, such as orphan files that are not really exploitable. It would be helpful if they were classified as information-only rather than Sev 4 or Sev 5.

I have been using Qualys Patch Management for a couple of months. We are a new customer for Qualys Patch Management. We are just onboarding it.

We have done a couple of PoCs for two to three months.

We have not experienced any downtime, glitches, or bugs, so I would rate its stability very high.

Qualys Patch Management appears to be dynamic. It should be able to scale with our needs as the organization grows.

I am still investigating this aspect. I have not had a need to open any tickets or cases.

Neutral

We previously used Ivanti. We switched to Qualys to simplify our toolset because we faced challenges bridging the gaps between what Qualys was identifying and what Ivanti was reporting. This change was made to reduce confusion and the effort involved in aligning two systems.

We already had the vulnerability management piece from Qualys, and we just added Patch Management.

The scanning piece has definitely reduced risks, and now, with Patch Management, we will be able to bridge the gap and see further reductions in risks.

Qualys vulnerability management is in the cloud, but with us turning on the Patch Management piece, it is probably going to be a hybrid setup. We will have a piece in the cloud and then some data collector pieces that will allow us to locally deploy patches versus having the machines go out on the Internet.

It is pretty straightforward. We are still in the process of onboarding. We are not done yet.

Seven people are currently involved in the implementation phase. Its usage will be global. Phase one is just our server management. We have about 2,100 servers. Our IT group has about 45 to 50 people.

Qualys Patch Management is expensive.

When we did our PoC, we already had the VMDR piece. We enabled the patch piece and brought the right hand and the left hand together. This integration automatically should include all the relevant patches and configuration changes required to remediate vulnerabilities detected by VMDR. It will be crucial. That is still to be determined, but when two of our critical service delivery organizations are using the same sheet of music or the same tool, it makes us more agile and more responsive to the threats we are trying to protect our business against.

I would rate Qualys Patch Management a nine out of ten.