Bahrain, Saudi Arabia
QualysFind, prioritise and fix the vulnerabilities that matter most
Qualys VMDR (Vulnerability Management, Detection and Response) discovers your assets, assesses them for vulnerabilities and misconfigurations, and ranks what to fix first, as part of the Qualys Enterprise TruRisk Platform.
- Agent and scanner
- Cloud Agents, network scanners and passive sensors collect asset and vulnerability data
- TruRisk
- Prioritisation using real-time threat indicators and TruRisk scoring
- Patch-ready
- Identify missing patches, and deploy them with a Patch Management subscription
- ITSM integration
- Open vulnerabilities can become tickets in ServiceNow
Problems Qualys is used to solve
Vulnerability management fails less often from missing scans than from incomplete inventories and unclear priorities.
| Topic | What it can lead to | How Qualys helps |
|---|---|---|
| Unknown or forgotten assets | What it can lead to: Devices and services that are never scanned and never patched. | How Qualys helps: Builds an asset inventory from Cloud Agents, scanners, passive sensors and cloud inventory. |
| Thousands of findings with no clear order | What it can lead to: Teams patch by severity alone and miss what is being exploited. | How Qualys helps: VMDR’s prioritisation report uses real-time threat indicators and TruRisk to narrow the list. |
| Laptops and remote devices missed by network scans | What it can lead to: Devices that are rarely on the office network stay unassessed. | How Qualys helps: The Cloud Agent assesses the device wherever it is, without relying on a network scan window. |
| Slow remediation handoffs | What it can lead to: Findings sit in reports while IT teams wait for tickets. | How Qualys helps: Integration with ServiceNow routes vulnerabilities to resolver groups; patches can be deployed with Patch Management. |
| End-of-life software | What it can lead to: Systems that no longer receive security updates. | How Qualys helps: CyberSecurity Asset Management (CSAM) reports end-of-life and end-of-support assets. |
| Unseen internet-facing assets | What it can lead to: Exposed services that attackers find before you do. | How Qualys helps: External attack surface management (EASM) in CSAM finds and monitors internet-facing risks. |
What Qualys does
Qualys delivers its applications from one cloud platform. VMDR is the core vulnerability management application; other applications add asset management, patching, cloud and web application security.
Asset discovery and inventory
VMDR starts by building an inventory of devices from agents, scanners, passive sensors and cloud inventory.
Vulnerability assessment
Continuous assessment for vulnerabilities and misconfigurations as changes occur.
Threat prioritisation
A prioritisation report of assets, vulnerabilities and available patches, ranked using real-time threat indicators or TruRisk mode.
Remediation and patching
Identify the missing patches for prioritised vulnerabilities and deploy them with a Patch Management subscription, or route work through ServiceNow.
CyberSecurity Asset Management
Discovers, classifies and enriches assets with business context, tracks software and end-of-life technology, and includes EASM.
Cloud and application security
TotalCloud, Qualys’s CNAPP for cloud and container environments, and web application scanning for web apps and APIs.
How Qualys collects data, and where each method fits
Most environments use more than one method. Choosing the right mix decides how complete your view is.
| Topic | How it works | Best suited to |
|---|---|---|
| Cloud Agent | How it works: A lightweight agent on the device that reports to the Qualys platform. | Best suited to: Laptops, servers and cloud workloads, including devices that are rarely on the corporate network. |
| Network scanners | How it works: Scans run against IP ranges from a scanner. | Best suited to: Network devices and systems where an agent cannot be installed. |
| Passive sensor | How it works: Discovers devices by observing network traffic, without needing knowledge of network design. | Best suited to: Finding unknown devices on the network. |
| Qualys Gateway Service | How it works: Lets Cloud Agents work in restricted networks. | Best suited to: Locked-down data centres, industrial networks and OT environments with limited internet access. |
| Cloud inventory | How it works: Collects asset information from cloud environments. | Best suited to: Keeping cloud resources in the same inventory as on-premises assets. |
Is your vulnerability management working?
A self-check that applies whatever scanner you use. Tick what is already in place: nothing you select is saved or sent.
How VirtuThinko helps you adopt Qualys
- 01
Requirements
Understand your asset types, networks, cloud environments and current scanning process.
- 02
Proof of concept
Deploy Cloud Agents and a scanner to a sample of systems and review the findings with your team.
- 03
Design and deployment
Plan agent rollout, scanner placement, authentication for scans, asset tags and dashboards.
- 04
Tuning and handover
Set up prioritisation, reports and ticketing integration, and train your team.
- 05
Ongoing support
Help with reviewing findings, tracking remediation and adding applications, as agreed.
Vulnerability Management, Detection and Response. Qualys describes it as covering asset discovery and inventory, vulnerability assessment, threat prioritisation and remediation.
Usually both. Qualys positions Cloud Agents as working where network scanning cannot, such as on remote devices, while scanners cover devices that cannot run an agent.
VMDR identifies the patches needed for prioritised vulnerabilities. Qualys notes that patches are only deployed if you have a Patch Management subscription.
Qualys’s risk scoring used in prioritisation. In VMDR you can prioritise using age, real-time threat indicators and attack surface, or using Qualys TruRisk mode.
Yes. Cloud inventory brings cloud assets into the inventory, Cloud Agents can run on cloud workloads, and TotalCloud is Qualys’s cloud-native application protection platform (CNAPP).
Explore Qualys for your organisation
Tell us roughly how many assets you have, where they run and how you scan for vulnerabilities today. A member of our team will contact you to arrange an initial conversation about whether Qualys fits and what a proof of concept would involve.