Qualys TruRisk Eliminate Reviews

We use Qualys Patch Management to remediate vulnerabilities. Qualys synchronizes with both the Vulnerability Management, Detection, and Response module and the Patch Management module. This provides a unified view of which vulnerabilities can be patched through Qualys and allows patching to be initiated directly from the VMDR module.

Most Windows security patches are released on Patch Tuesdays and become available to us through Qualys the following day. Once available, we can initiate patching to reduce vulnerabilities within our infrastructure. This process primarily addresses critical security updates from Microsoft and other third-party applications, allowing us to mitigate vulnerabilities using Qualys proactively.

Qualys Patch Management effectively mitigates risks through its risk-based automation, enabling rapid vulnerability remediation.

The integration of Qualys Patch Management with Qualys VMDR allows us to use the same device identification ID for both patch management and vulnerability identification. This enables us to easily determine which vulnerability a patch addresses, access CVE information, and validate patches based on product or product family. For instance, if we have Google applications with vulnerabilities, we can efficiently identify and patch them without searching for specific versions or missions. By selecting assets in Patch Management, we can automatically patch QID-based or family-based vulnerabilities identified by VMDR. This integration streamlines the patching process and provides clear visibility into the vulnerability status of our assets.

Our previous patch management products had communication issues with their agents. Qualys Patch Management utilizes the same agent as their vulnerability management system, streamlining the process. Security agents are more reliable than standard IT solutions, and because our IT team prioritizes agent uptime, patching is more accessible, and risk is reduced within our infrastructure. Qualys Patch Management offers immediate benefits. If a patch requires a reboot, Qualys allows users to initiate one within a specified timeframe automatically. Upon rebooting, the machine reports to the Qualys console and is automatically scanned. If the patch is successfully installed, the console reflects the update within 20 to 30 minutes. This streamlined process ensures efficient patch management and reduces vulnerabilities.

Qualys Patch Management's TruRisk automation allows us to prioritize patching vulnerabilities with available patches. This prioritization helps us focus on critical vulnerabilities and quickly remediate them, improving our security posture. The TruRisk score provides a clear metric to demonstrate the effectiveness of our remediation efforts to leadership, showing how quickly we address critical vulnerabilities and enhance our security.

TruRisk automation enhances data accuracy across business units. Leveraging the Vulnerability Management Tool for Remediation within TruRisk, patching can be initiated based on a risk score mechanism query, which provides the TruRisk score for a specific business unit. A subsequent query determines patch dispatchability, triggering a patch job if applicable. This process can be streamlined using Patch Query Language to efficiently retrieve data and execute accurate patching, reducing risk based on TruRisk scores.

Initially, the IT team resisted using Qualys Patch Management for vulnerability remediation due to its critical importance. However, after we demonstrated how integrating Patch Management with Vulnerability Management provides a single report and effectively reduces vulnerabilities, we convinced them to adopt it. This consolidated approach enhances efficiency and streamlines patch management throughout our organization.

Qualys Patch Management significantly improved our patching rates. Qualys provides access to exclusive security patches and boasts a comprehensive knowledge base covering a wide range of applications, including third-party software like Google Chrome, Edge browsers, and SQL. As Qualys expands its knowledge base, our patch management rates continue to improve. Furthermore, the Qualys support team has been instrumental in helping us resolve patching issues, such as installation failures, by efficiently identifying the root cause, whether it stemmed from network problems or the Qualys platform itself. With their assistance and the robust Qualys product, we have successfully mitigated these challenges.

Qualys Patch Management has significantly reduced our organizational risks. Previously, when using other solutions, our patch percentage was low, resulting in high risk. Qualys Patch Management, integrated with VMDR, immediately improved our patch percentage. Features like patch initiation, recurring patches, scheduling, and randomized patch downloading have been crucial in mitigating risk, especially for employees working from home with network issues. The randomized download option ensures patches are successfully downloaded even with interruptions, resuming automatically when the network connection is restored. These capabilities ensure Qualys Patch Management effectively reduced our organizational risk by 88 percent.

My favorite feature of Qualys Patch Management is its flexibility in executing scripts before and after patching. This is particularly useful for third-party or enterprise applications that require registry modifications to address vulnerabilities. We leverage this functionality to deploy scripts that adjust registry values, effectively patching vulnerabilities and enhancing the security of our machines. The ability to automate these tasks through Qualys Patch Management streamlines our workflow and improves our overall security posture.

Qualys could improve its randomized download feature and provide more detailed information about patch failures, including the reason for failure. This could include specifying whether the failure is related to a file download error, network interruption, application crash, or installer error based on the operating system. These enhancements would offer more insights into the patch management process and improve overall functionality.

I have been using Qualys Patch Management for the last two years.

The stability of Qualys Patch Management is a nine out of ten. While it's generally stable, there have been occasional issues, particularly when new patches for Linux have been introduced.

Qualys Patch Management's scalability is a ten out of ten. It scales efficiently across different machines globally, ensuring patches are deployed smoothly.

Qualys' technical support has been excellent. Their team has effectively resolved various issues, including some that originated within our network.

The initial setup was straightforward, leveraging the existing vulnerability management tool, which facilitated easy integration of Patch Management.

Deploying software to a single machine takes approximately one minute. However, in an organization with 1,000 machines, a traditional push deployment method could take up to four days to complete.

I would rate Qualys Patch Management ten out of ten. Qualys Patch Management has significantly benefited our security and remediation efforts.

Qualys Patch Management is deployed across multiple locations and time zones in various countries. While most of the IT team has access to view Qualys Patch Management, only a few individuals can initiate patching. Those with view access can assess the patching capabilities and compliance of specific machines, while a limited number of authorized personnel can deploy the patches.

Qualys Patch Management requires minimal maintenance, primarily involving updating the agent software on managed devices.

I would recommend Qualys Patch Management to those using a vulnerability management solution as it helps significantly in reducing risks. It provides various options such as using third-party repositories for patches, which are beneficial for comprehensive patch management.

Hybrid Cloud

We use Qualys Patch Management to mitigate and remediate all critical vulnerabilities present within our infrastructure.

We implemented Patch Management to address critical vulnerabilities in our infrastructure. This proactive measure mitigates the risk of compromise that could arise from unpatched vulnerabilities.

Patch Management has tremendously increased our security posture. Previously, we used to manage patching manually and remotely, which did not provide accurate data. With Qualys, all the details are readily available on the dashboard, aiding us in submitting details to management. It has significantly helped in providing management with up-to-date data, leading to improved satisfaction. We saw the benefits of implementing Qualys Patch Management within the first quarter.

Qualys Patch Management gives us a single source of truth for assets and vulnerabilities that must be assessed, prioritized, and remediated. This has drastically affected our operations because the features present on Qualys are amazing, and it's user-friendly compared to other tools.

We've observed an improvement in our patch rates by up to 50 percent. Utilizing the Patch Management tool allows us to download comprehensive compliance reports detailing the number of patches applied to each server, which is significantly beneficial.

Qualys Patch Management's risk reduction recommendation report offers comprehensive and customizable details, including in-depth vulnerability information with plugin output not found in other tools. This makes Qualys a superior solution for managing and understanding security risks. Qualys Patch Management's risk reduction recommendation report provides a helpful scoring system, the QDS, which can be mapped to our asset classification system, allowing us to prioritize and address vulnerabilities according to their risk level.

The risk reduction recommendation report has identified vulnerabilities that, if addressed, would yield the most significant risk reduction. Prioritizing these vulnerabilities based on their severity allows us to focus on the most critical risks to our organization and take appropriate remediation action.

We have created widgets with the assistance of the Qualys support team to add them to our existing vulnerability management solution, which has been instrumental in helping us track vulnerabilities related to our infrastructure.

Qualys Patch Management has significantly reduced our organizational risk by up to 70 percent by identifying vulnerabilities in our infrastructure and prioritizing remediation efforts. This has allowed us to reduce vulnerabilities and strengthen our overall security posture effectively.

Qualys Patch Management offers valuable features like scheduling and on-demand patching, allowing us to conveniently push patches to our servers at designated times.

The GUI has areas that need improvement, particularly in the accuracy of results when adding dashboards and running queries.

I have been using Qualys Patch Management for the last two years.

The stability of Qualys Patch Management is impeccable. I would rate it ten out of ten.

Qualys consistently upgrades itself with major changes and new technologies. They introduce new modules as needed, making Patch Management highly scalable.

Qualys support is exceptional. Whenever we need custom reports, we log a ticket with Qualys.

Positive

We transitioned from Nessus Security Center to Qualys due to challenges with Nessus's automatic patch deployments, which resulted in unplanned downtime on critical systems. A proof of concept and vendor support confirmed Qualys as a more suitable solution for our needs.

The initial setup was straightforward. Before deciding to implement it, we conducted a month-long POC to ensure all requirements were met. The deployment took over 25 days.

I would rate Qualys Patch Management ten out of ten. 

We are conducting testing in a UAT environment. Our risk mitigation approach involves deploying a patch only after thorough testing in the UAT environment confirms the absence of issues.

We use an internal ticketing system called TUSOM. While previous discussions with our Qualys TAM indicated that integration with TUSOM was not possible, we have recently re-engaged with them, and they are now working on a solution to enable integration.

Approximately 13 individuals have administrative access to Qualys Patch Management, while the remainder have read-only access for viewing reports.

Maintenance is required before we can implement the policy. As a result, we are conducting preliminary testing in the UAT environment. Additionally, Qualys will notify us of any planned maintenance.

I recommend starting with a proof of concept to ensure Qualys Patch Management meets your requirements. In my experience, it is highly user-friendly and has excellent support, making it superior to other products.

On-premises

I advise other folks on how to use Qualys Patch Management. The use cases I have seen are to patch regular end-user systems, servers, and to patch all available vulnerabilities or some vulnerabilities.

Qualys Patch Management puts an intelligent cross-section between a set of assets, the vulnerabilities those assets have, and the available patches that can be used to address those vulnerabilities. With a lot of other patching solutions I have seen that are not connected to a vulnerability management platform, you have to go through the trouble of picking out the software or component in the operating system that you need to patch, and then deploy it using whatever means are available to you. However, the work for picking out what patches you need is still up to you. What I have found with Qualys Patch Management is that it helps to reduce that by a pretty large percentage.

The integration of Qualys Patch Management with VMDR is very important. It is everything. The entire point is to say if it is patchable and Qualys can take care of it, here is what you need to do it. That is what lends to the overall impact because without that, you need to go out to some website, pull the installer, try to funnel it into some automation platform, set it up, schedule it, and complete all the other necessary steps. The way Qualys currently has it set up, when it has a published patch, you can target the endpoints and schedule it automatically in such a way that it will just take care of it for you.

Qualys Patch Management could make a few enhancements to the reporting for various patch jobs. An ability to see specific reports on endpoints failing specific patches multiple times would be valuable, with the specific intent being to locate endpoints without digging through the details of each individual patch job's patch progress. This would reveal whether there are endpoints that have specific configurations that may be causing a patch to fail. That would greatly aid in the troubleshooting of said issues.

I have been working with Qualys Patch Management for roughly a year and a half.

I have noted no unusual lagging, no crashing, and no downtime with Qualys Patch Management.

The answer to the question about overall scalability depends on how you treat what is and is not patchable. Qualys Patch Management is limited specifically to what can host a cloud agent. As far as scalability, if you are looking to address operating systems, then it is 100% scalable. If you are looking to patch other things, currently, as I understand it, that is a limitation that the tool has.

The initial deployment of Qualys Patch Management is incredibly easy. If you have done the Vulnerability Management component, the way it is set up is that Vulnerability Management has two different ways to get information, primarily. There are a couple of other ways you can do this, but you either scan IP addresses or you install a cloud agent. It is a little installer that goes on an endpoint and it collects vulnerability data. Qualys Patch Management uses the pre-existing cloud agents to deploy patches. You flip a switch on the back end and you are ready to go by the time the next check-in happens.

I have heard of a few alternatives to Qualys Patch Management and have recently looked into one. At the moment, I have not seen any alternatives that are as smooth a transition as Qualys offers. I have not seen anything as robust as Qualys to date.

I am familiar with the pricing, and I would say that for the price and the impact that specific service has, I think it is worth it. As somebody who has done vulnerability management remediation in the past, I know how much of a fight that is. Having a solution Qualys Patch Management that can take care of a very large chunk of it, I think it is definitely worth the price.

In my experience, you do need VMDR, Vulnerability Management. That is a requirement for Qualys Patch Management. You cannot do it the other way.

It depends on the specific nature of how ownership of assets is divvied up in a given environment. If it is a one-person situation where one IT person is responsible for all assets, one person can take care of this. It is a matter of ensuring the cloud agent is installed and that everything is configured for patch.

It depends on how you set up Qualys Patch Management. You can work with Qualys, and Qualys will help you set it up, or you can reach out to a third party and have them help you. As far as needing to do some maintenance, there are some considerations. Making sure you check that the patches are working every once in a while is definitely necessary. Making sure that any new devices are added to the patch job is important to confirm. The rest is automatic.

I give this product a rating of 8.

I have been dealing with Qualys Patch Management for up to nine years. When speaking about the use cases, it is clear in terms of what purposes I use patch management for.

Speaking about the advantages of Qualys Patch Management, it is clear that when I speak about a risk-based approach, I am in a position to assess it compared to a patch-based approach. If I take a risk-based approach for creating automation to address risks, I would assess it positively. It is really effective.

Qualys Patch Management can give me a single source of truth for assets and vulnerabilities, and it is clear that this affects the way my security and IT team work together. I wonder if you are using the risk reduction recommendation report.

When it comes to whether it helps to see what vulnerabilities would reduce the most risk in the company, that is clear, and I wonder if you are using the integrations with CMDB and ITSM tools for ticket management.

In terms of quantifying how much it reduces the cost, I have no issues asking. You have covered many positive aspects for Qualys Patch Management, but if we speak about anything negative or any potential areas for improvement, I would say that in terms of stability, the product is very reliable and stable in general. However, in terms of scalability, it still has the potential to be better.

I have been in the business since 2013.

In terms of stability, I would say Qualys Patch Management is very reliable and stable in general. However, in terms of scalability, it still has the potential to be better.

In terms of scalability, Qualys Patch Management still has the potential to be better.

When I discuss the deployment procedure and initial setup, I wonder if it is complex for Qualys Patch Management or quite straightforward, and whether I have my clients everything on the cloud or if there is a hybrid model.

Regarding whether it allows me to close tickets much faster, I am not sure if that is possible to quantify, but perhaps it is subjective.

In terms of quantifying how much it reduces the cost, I have no issues asking.

If I compare the product with competitors, it is clear to say that the price is fair for Qualys Patch Management or if it still seems a bit expensive.

When I think about how many years I have been working with IT products, I realize that I have been in the business since 2013.

I mentioned that I work with Qualys VMDR and if we speak about integration between these two products, I am curious about whether the solution TruRisk Automation helps remediate vulnerabilities without involving my security team. What do I think about TruRisk Automation?

When speaking about the patch rates, I am curious about how much it has reduced the organizational risk.

I would rate this review as a comprehensive assessment of Qualys Patch Management's capabilities and areas for improvement.

Hybrid Cloud

Amazon Web Services (AWS)

I use Qualys Patch Management to patch vulnerable applications such as Mozilla Firefox and Java. Additionally, I use features like registry updates and scripting options available in the Patch Management deployment module. Our usage is about 70%.

Qualys Patch Management is beneficial for addressing critical vulnerability alerts quickly, providing significant improvements in mitigating risk within our organization. It is very helpful to push patches for critical vulnerability alerts in that one shot to remediate vulnerabilities.

It is very helpful in reducing risk in our organization. This is the only tool we are using to patch applications in our environment.

The availability of patches for required applications from Qualys itself is convenient, making it easy for me to push patches. 

We can update the registry with special features such as Registry Update. We can also run scripts via the Patch Management module. These features are very helpful in our operations. 

I struggled to see patch availability for some applications in the Qualys console, requiring me to use third-party repositories. If repositories could be integrated within the Qualys module, it would simplify the patching process for me. 

Additionally, there are glitches in the VMDR vulnerability section while querying for particular vulnerabilities. There are unwanted commands in the KQL which sometimes hinder my results. For example, we sometimes could get CVE IDs while running a query, but at other times, we could not.

I have been working with Qualys Patch Management for around nine months.

As of now, I have not encountered any performance issues or stability issues.

I have not faced any limitations or scalability issues.

We have more than 25K assets. We have three people to do the administrative things.

The support team is responsive and provides detailed information. They share the required documents when we need them. They are very helpful in resolving issues. I would rate them a nine out of ten.

Positive

We previously used Microsoft SCCM for patch management. We switched to Qualys because it centralizes vulnerability detection and patch availability, reducing our workload. We can find the vulnerabilities and see patch availability for those vulnerabilities. It saves time.

With Microsoft SCCM, we could push patches for the applications we wanted to, but with Qualys Patch Management, we could not push some third-party applications. That is the one main difference. Another thing is that whenever we ran the script, we could not see the results or outcome after running the script with Qualys Patch Management, whereas in SCCM, we could see the output of the script. These are the two main differences between Microsoft SCCM and Qualys Patch Management.

It is a SaaS solution. I was not involved in its initial setup, but we are in the process of deploying agents in our entire organization. 

It does not require maintenance from our side. If anything is required, we raise a ticket. So far, we have faced only one issue. Usually, a Qualys agent having a newer version is automatically upgraded, but in our environment, on some machines, we are not able to see the latest version. We are working with the Qualys team to resolve it.

I did not evaluate any other options before choosing Qualys.

It is a very good tool to reduce the vulnerabilities in our organization. Our current usage is about 70%, but we have started utilizing more features. We are planning to increase its license in our environment when there is an increase in the assets.

I would recommend it to others. It is a very good solution for finding vulnerabilities and patching them.

I would rate Qualys Patch Management an eight out of ten.

Public Cloud

Other

I use Qualys Patch Management as a single platform for patch management. We have Microsoft, Adobe, and various other apps. I create a scheduled task to push all the required patches to the laptops so that they have the latest version of these apps.

We also do compliance checks to ensure that, for example, we have the golden image on our servers and laptops. We use it for scanning to ensure that configurations are correct and based on the CIS guidelines.

All our servers and laptops have the Qualys agent, and we can then push the patches to those devices.

Patch Management offers a patch-based approach to vulnerabilities. It helps us prioritize and schedule critical or high-severity patches to address issues.

Patch Management gives us a single source of truth for assets and vulnerabilities that need to be assessed, prioritized, and remediated.

I use Patch Management with Qualys VMDR. After the patches are deployed, I check Qualys VMDR to verify if the issues have been addressed.

The Risk Reduction Recommendation Report is fine. It has some general information. It can give insights to people who are not familiar with the findings. I can generate a report and share it with different IT groups to help them understand the issue and the suggested solution. It can help address 70% to 80% of the issues. The rest of them might require further discussion to come up with a solution.

Patch management significantly helped us track and reduce vulnerabilities. For example, before adopting Qualys Patch Management, we found 10,000 or more vulnerabilities. We have now addressed those, limiting existing vulnerabilities to around hundreds. There is a great improvement.

Patch Management supports various software lists when compared to Microsoft Intune. It is especially beneficial for non-Microsoft applications. I can create a schedule, and various patches can be automatically deployed. There is no need to create a PowerShell script. It helps reduce the manual workload for patch deployment. 

I deploy patches to endpoints and servers every month. However, despite a job showing as successful, I need to examine the job in detail. For instance, if I have deployed patches to 100 endpoints, even though the job status says that it is successful, I still have to go deep into endpoints one by one to identify if there are some failures. It would be better if Qualys Patch Management identifies whether the process has failed at the first instance and provides a retry button or retry mechanism, allowing retries for failed patches. This feature would reduce my manual workload. 

For reporting issues, we can check if the findings are addressed in the VMDR, but to verify if the latest patches have been applied on the endpoints or servers, we have to examine scheduled jobs one by one. 

It would help if error messages were clearer about causes, like endpoints being offline. This improvement would streamline troubleshooting, helping users ensure their PCs are on when deploying patches. Fail status alerts providing specific fail details would facilitate easier checks.

I have been using Qualys Patch Management for at least two years.

It is highly stable. I would rate it an eight out of ten for stability.

We are utilizing it fully. It serves our needs.

We get the first response to a question within two days, but when we have follow-up questions, they take longer, and the case may get dragged a little bit. It is not fit for us sometimes.

Neutral

Intune is a comparison point, but previously, we had Ivanti Patch Management. Qualys Patch Management is much better, considering the number of issues we could address with it.

The initial setup was quite a normal process. We needed to install the appliance and establish firewall rules to allow traffic with different software. For the endpoint part, Qualys agents were installed on the machines. We had no serious challenges deploying to most endpoints or configuring the firewall.

I am currently conducting a patch management review and evaluating new features or products, and Qualys Patch Management still meets our requirements.

I would rate Qualys Patch Management an eight out of ten. 

I am a cybersecurity engineer focused on vulnerability assessment and penetration testing. We use Qualys Patch Management to scan our client infrastructure and external-facing applications. We collect asset details from clients and perform activities using Qualys VMDR to prepare and submit reports. If vulnerabilities are detected, we conduct patch management.

We implemented Qualys Patch Management to simplify patching processes and maintain a comprehensive record of all assets, both those already patched and those requiring patching.

Qualys Patch Management's risk-based approach to automation is effective in addressing vulnerabilities. By configuring policies, patches are applied automatically, eliminating concerns about oversight and ensuring comprehensive mitigation.

The integration of Patch Management and VMDR is critical for medium and large organizations because it automatically includes relevant patches and configuration changes to remediate detected vulnerabilities. This allows organizations to gain clear visibility into device vulnerabilities and take immediate action to mitigate risks.

Qualys Patch Management keeps our clients informed of all security aspects. It keeps the quality up to date, with vulnerability databases and new CVEs based on the CVSS score. Clients are pleased with the insights on their security posture and any security gaps.

We use TruRisk automation and the Qualys knowledge base, with its batch management and information-sharing features, to remediate vulnerabilities without involving the security team.

Qualys Patch Management provides a centralized platform to identify, prioritize, and address vulnerabilities across all assets. This allows us to tailor vulnerability assessments and patching strategies for clients with critical assets, such as servers hosting public-facing web applications, by leveraging asset criticality tags to create dedicated sections within the platform.

Qualys Patch Management has helped improve our patch rate by 35 percent.

Qualys Patch Management helps reduce our client's organizational risk by 50 percent.

Qualys Patch Management allows us to structure all the patches together and schedule patch management sessions. If we do not need a particular patch, it can push it automatically. It provides insight into the organization's security posture and keeps databases updated with new CVEs.

The pricing of the solution is slightly high compared to other tools in our field. It’s manageable for clients, but as a service provider, it can be challenging due to the lower cost of vulnerability assessments and penetration testing.

I have been using Qualys Patch Management for the past two years.

Qualys Patch Management is a stable solution. I would rate its stability as a ten out of ten.

Scalability could be improved, as not everyone can afford it, and some may not fully understand how to use Qualys.

During the license purchase process, there was some delay in technical communication from Qualys. 

Positive

The deployment involved a team of six people and took about half a year.

Qualys Patch Management has saved time and resources by reducing the need for human resources. Clients are satisfied with the insights and reduced vulnerabilities over time.

While the cost of Qualys Patch Management is slightly high compared to alternative tools, it is not excessively expensive. I would rate the pricing as a seven or eight out of ten for expense.

I would rate Qualys Patch Management ten out of ten.

Our clients who use Qualys Patch Management are medium to enterprise-level businesses.

Qualys handles the maintenance for Patch Management.

I recommend Qualys Patch Management to others due to its ability to enhance organizational and client security posture while reducing time and costs associated with vulnerability assessment and auditing.

Public Cloud

Other

We do it for our OS patching across multiple clouds. If we don't put GE Vernova on there, then I can say we use it for AWS and Azure, plus on-prem. It's used across OS platforms too, so Windows and Linux-based. Our OS team uses it monthly to patch, and then we also supplement third-party software, such as Chrome, Edge, Notepad++, Wireshark, and all that software that people will install and forget to uninstall and forget that they have to patch it. We do that almost weekly as well.

My favorite feature is reoccurring jobs. We had some requirements where we needed some options added to do reoccurring jobs, and they were able to add that in. Now we mostly use reoccurring jobs, and we don't have to touch them. The hardest part now is just getting change controls through our change management team instead of actually creating the jobs.

It has simplified so much from a cost overhead and perspective.

For Qualys Patch Management, I actually talked with their product manager last week during their conference. Unified QQL needs improvement because while they have QQL in Qualys Patch Management, it doesn't pull in the same tokens as VMDR or CCM, so I can't search by similar things. Also, grouping or foldering for Qualys Patch Management jobs would be beneficial because if different groups own different jobs, it all gets dumped into what is essentially a flat file. You're just scrolling through it. You can search, but if we were able to do foldering, that would be great. The third piece would be having an approved catalog. For example, instead of my IT teams doing the patching, I wanted to enable our internal customers, our app teams, to run the jobs themselves but only on patches that we say are good - a curated catalog that the company patch admin approved.

Their frontline support could be improved. I'm really close with Qualys and spoke at the conference last week. They already know all this. They know that their support could be better. They just need to get more knowledgeable and not necessarily seem to have to pass the buck to engineering or VulnSig or the product teams.

We've been using it since April of last year, so April of '24, which is approximately 18 months.

There are times where Qualys sometimes delays or doesn't have the catalog updated. For example, Red Hat comes out with an update and a week later, it wasn't in the Qualys catalog, which causes us to scramble.

On our pod, we don't experience issues. One of my colleagues on a different pod has issues there. I'm on their biggest pod that brings in the most revenue, so they're very cautious with what they do on that.

Their frontline support could be improved. I'm really close with Qualys and spoke at the conference last week. They already know all this. They know that their support could be better. They just need to get more knowledgeable and not necessarily seem to have to pass the buck to engineering or VulnSig or the product teams.

Neutral

We used WSUS and custom scripts for Linux before. On-prem, we used SSM for AWS and Patch Management for Azure. It was complicated because there were so many different moving parts. That's where Qualys Patch Management comes in and is able to work across all platforms. It's easy because you don't have to manage all kinds of different things for every cloud. Your agent's already on the box because we have a rule that every server has to have an agent on it.

The setup was actually easy. We already had VMDR deployed and agents everywhere, so it was a couple clicks to enable it.

The implementation took approximately a month, though some of that was due to our delay. We had one to two people involved, and part of the timeline was due to our internal processes, not Qualys Patch Management.

You can always drive pricing down, but I think it's reasonable. For what we get out of it, I think it's a reasonable investment.

I think that's where we have to go as an industry because you can't address everything all the time. Adding the risk on top, if it's an external asset compared to something internal inside your vault, the risk is much greater for exfiltration of data. The risk-based approach absolutely is the right way to go about it.

I rate Qualys Patch Management a nine out of ten.

Hybrid Cloud

Other

Our use case for Qualys Patch Management is patching and updating. We use it for adding and removing local admin to the machines, along with various other tasks.

Qualys Patch Management helps the IT and security teams work together by enabling the IT team to handle Patch Tuesday and Microsoft patches. With Patch Management, I can monitor when patches have not been applied and help ensure 100% coverage on Patch Tuesday for the desktop team. 

Qualys Patch Management has helped reduce our organization's risk by 20%, and we have seen an improvement in our patch rates.

The best feature of Qualys Patch Management is the ability to schedule jobs. I have browser updates that run automatically every day to update the three browsers, and I don't have to worry about it.

For those patches that I have to download for Patch Management, I would prefer if I could upload them to a repository instead of having to download them every time.

I have been using the solution for about eight months.

I haven't experienced any bugs, glitches, or downtime, so I would rate Qualys Patch Management a ten out of ten for stability.

For scalability, I would rate it a ten out of ten. We have approximately 8 to 10 users using this solution.

I would rate the vendor support a ten out of ten.

Positive

We had another patch management solution, but we were using Qualys for VMDR and moved everything into Qualys Patch Management for the simplicity of the user interface and because we had an existing relationship with Qualys. That way we can not only manage our vulnerabilities, but if the vulnerability requires a patch, it's very easy to fix it in Qualys. We were using BigFix for patch management.

The deployment was easy.

The agents self-update, and by using Qualys Cloud, that's all handled by the vendor, so the maintenance aspect requires little to no interaction from our end.

It has improved our patch rate by 40%.

Regarding the single source of truth, it really at this juncture has not reduced costs as of yet.

I would recommend this product to other users because it's very user-friendly. I can't speak to the pricing aspect, but from a user standpoint, it's a very good product.

I would rate it a nine out of ten.

Public Cloud

Other

We are in the education industry, and we perform weekly scans. On weekends, we scan our entire management, servers, and expectations. Then on Monday, I set up some weekly reports. From these, I'll have my vulnerabilities and Patch management reports showing which third-party applications I installed on users' workstations. I tested these on a Monday or Tuesday with Patch Management. If all goes well, by Wednesday or Thursday, I'm patching the rest of the environment. In terms of workstations, I scan and patch them weekly, but for servers, I wait for the Microsoft patching cycle. Only then do we patch the servers, allowing for a restart for each update. After the Microsoft updates, we can restart our servers.

The auto patch is useful. On zero-day vulnerabilities or patches, we can automatically apply those without user interference. We can drastically decrease vulnerabilities, especially third-party ones, such as a Java update that usually takes time to test on different machines. With Patch Management, machines can be grouped into test workstations, and a fix can be deployed and monitored for a day or two. If nothing goes wrong, it is deployed to all users. In Koketso Towers, you will notice about one thousand or five thousand mortgages decrease. This has helped us keep up with vulnerabilities, especially on workstations. Test management is a module added to the vulnerability management scanner, which also has the auto-fix feature. We don't usually use this on servers but on workstations. For instance, if there's a vulnerability that is not a zero-day, but something else, we can test and deploy it almost immediately from the workstation.

I do not have any major problems. I think it's working great. My recommendation would be not just for Patch Management but for Qualys itself. I am using Qualys through a third party or reseller. The issue is that when buying Qualys licenses, from my side, I'm buying for about seven thousand five hundred users or machines. I also need to buy licenses for another seven thousand five hundred for patch management. We dislike having to pay extra. We don't mind paying for additional modules like Certificate View. The test management part requires buying licenses. We are trying to negotiate with our reseller. If they can't provide us, we'll go straight to Qualys and see if they can assist.

I have been using Patch Management for about six months now.

The solution is very stable. I have encountered no problems so far.

We don't interact much since our service is managed. We only contact Qualys if there are serious issues. Last year, we communicated with Qualys two times when our service provider couldn't assist us in resolving one vulnerability.

Positive

We started before moving to VMDR. We used a previous version called Qualys VM, and now it's Qualys VMDR. With Qualys VM, we had access to the console.

The setup was straightforward. We began by installing the scanner, scanning the entire environment, and then categorizing items as servers, workstations, etc., applying tags accordingly. It took us about two weeks to have it fully operational with both daily and monthly reports set up. The deployment is easy through SCCM from Microsoft, as we deploy based on our AD groups.

I would give it a ten out of ten. It is an excellent module to have within the environment, as most environments have Windows Patch cycles, but not for third-party applications. Patch Management not only addresses third-party applications but can also patch vulnerabilities. It allows seamless deployment from the console if a patch for a vulnerability is available. I would rate the overall solution a 10 out of 10.

Hybrid Cloud

Other