Share your experience using IBM Tivoli CMDB [EOL]

My main use case for Qualys Exposure Management is to handle vulnerability across multiple systems since we have a large number of systems where risk management is a serious consideration. We thought of bringing Qualys Exposure Management into our infrastructure to scan various systems and provide us with vulnerability scan reports so that we can remediate and resolve issues effectively.

A recent specific example of how I'm using Qualys Exposure Management is by enabling Qualys agents on employee laptops, which provide continuous information about the machines. This is particularly useful for remote laptops that rarely connect to corporate networks, as Qualys agent tracks everything on the user's end and sends any vulnerabilities to Qualys cloud for scanning and reporting to network admins.

In our day-to-day operations, Qualys Exposure Management tracks systems across various endpoints, ensuring that all production systems are monitored. We find Qualys Exposure Management powerful due to its combination of asset tags and cloud agent scanning capabilities, coupled with connectors and other mechanisms that enhance its functionality. This diverse range of options for performing vulnerability scans greatly benefits our projects and contributes to organizational growth.

Qualys Exposure Management has positively impacted my organization by enhancing security and operational outcomes. Before implementing Qualys Exposure Management, we relied on alerts that often missed critical vulnerabilities, but now we prioritize risks effectively, resulting in better asset visibility, faster remediation, and improved SLA compliance, which in turn has built trust with our customers.

After implementing Qualys Exposure Management, our critical vulnerabilities' mean time to resolve (MTTR) decreased from around 20 days to five to seven days, resulting in a 65-70% improvement. Additionally, we now meet SLA targets with 90% of critical findings addressed within the designated time frame.

The best features of Qualys Exposure Management include its risk prioritization mechanism, which focuses on business context to identify vulnerabilities that need fixing first, rather than solely relying on CVSS scores. It also has excellent asset discovery capabilities that continuously identify endpoints, servers, and network devices while keeping track of the systems being scanned.

The risk prioritization feature has significantly helped my team by allowing us to focus on the most critical vulnerabilities detected across our 10,000+ servers. For instance, if server A has a CVSS score of 9.8, but server B has a higher true risk score due to its Log4j enablement, it gets prioritized for remediation. This multi-dimensional assessment approach helps us concentrate on the most pressing risks first.

The dashboards and reporting features of Qualys Exposure Management are crucial as they turn vulnerability data into insightful views. They provide information on risk levels, asset prioritization, patch statuses, and top risky assets, which makes identifying systems that need attention much easier. The dashboards offer real-time operational views, while reports cover packaged information for longer durations.

In terms of governance and security, Qualys Exposure Management is a fantastic tool that ensures regular vulnerability scans of systems and compliance with organizational information security standards to keep data secure from attackers.

Regarding its AI capabilities, Qualys Exposure Management adds value through AI-powered risk analysis, better prioritization, threat intelligence enrichment, and risk summarization, which help us focus on critical vulnerabilities before they are exploited.

Some areas for improvement in Qualys Exposure Management include simplifying the learning curve, as understanding the system can be challenging for some users.

Other needed improvements are in the UI/UX, simplifying navigation, enhancing reporting flexibility, and better handling of false positives. The learning curve and a need for simpler onboarding materials could also greatly help new users.

I believe I have covered all the necessary improvements needed for Qualys Exposure Management that are crucial for organizations today.

I have been using Qualys Exposure Management for more than four years.

Qualys Exposure Management is definitely stable.

Qualys Exposure Management is very scalable, as the level of service you receive depends on how you utilize the system. It has no limitations and is designed to grow with your needs.

Customer support is really great, with an average ticket turnaround time of about three days, and they respond swiftly to high-priority incidents, often resolving them in under 30 days.

Previously, we used Microsoft Defender but switched to Qualys Exposure Management because Defender's multiple use cases became complex and costly, whereas Qualys Exposure Management consolidated everything into one tool with robust reporting capabilities.

We have seen a return on investment through reduced employee counts and decreased incident resolution times, resulting in better SLA outcomes and an increase in the number of customers utilizing our services.

My experience with pricing is that it is moderate; the setup cost was reasonable, with licenses based on the number of systems being scanned. We use the Q-flex consumption model, where we pay based on the volume of flex consumed for scanning assets.

We evaluated CrowdStrike and other solutions but found them lacking in service and budget; Qualys Exposure Management offered a better SLA and outcomes, which made us happy with our decision.

My advice for others considering Qualys Exposure Management is that it is a great tool for securing systems from vulnerabilities that can significantly impact revenue. I recommend it for mid to large-scale enterprises, as smaller organizations may find the cost and learning curve challenging. I rate Qualys Exposure Management a nine out of ten.

I use Qualys Enterprise TruRisk Management for vulnerability management. We receive reports daily from Qualys Enterprise TruRisk Management that show which systems have vulnerabilities and prioritize them based on risk factors. This allows us to identify which systems have more vulnerabilities or higher risk levels and take appropriate action. We primarily use this tool for patch management and vulnerability patch management.

The most valuable feature is the ability to get vulnerability lists for bulk systems. My company has more than 300,000 employees, so we can generate a report of all systems and filter the results by location. This is the most interesting aspect of the tool. Additionally, Qualys Enterprise TruRisk Management provides many scoring metrics for critical and non-critical vulnerabilities, as well as high-risk ratings. This allows us to prioritize which vulnerabilities are more critical and focus on those first. Qualys Enterprise TruRisk Management also provides resolutions for vulnerabilities. For example, if a Windows update is missing, we can patch those systems directly from Qualys Enterprise TruRisk Management. It will connect directly to the Microsoft site and download the patch, so there is no need to search for patches separately. The patch will install directly from Qualys Enterprise TruRisk Management itself. For vulnerability management, Qualys Enterprise TruRisk Management is very good for our organization.

The primary issue is with the reporting functionality. Even though we fix vulnerabilities, the reports do not reflect the changes immediately. Sometimes we need to manually run a script to scan the systems before Qualys Enterprise TruRisk Management will update the scan results. The main issue is the reporting delay, and sometimes the Qualys Enterprise TruRisk Management agent will not scan the system, which means we do not receive accurate reports in a timely manner. Additionally, there are many metrics for calculating vulnerabilities, such as the Qualys ID, severity scores, CVSS scores, and other metrics. The abundance of information can be confusing. These two aspects are the most significant negatives I have experienced with this tool.

I have been using this tool for the last one year.

I experienced a stability issue last week. For approximately 12 hours, we did not have access to Qualys Enterprise TruRisk Management. Even when we regained access, instead of displaying all 300 plus systems, it only showed fewer than 50 systems. This issue persisted for 12 hours and was only resolved after one day. I am uncertain whether the issue was caused by Qualys Enterprise TruRisk Management or our internal team. In one year of use, I have experienced this issue only once, when we lost access for one day.

Qualys Enterprise TruRisk Management is highly scalable. As my company has many employees, the tool performs very well for handling this large number of users. I believe the tool is very scalable for enterprise environments.

I cannot contact Qualys Enterprise TruRisk Management directly. Only our Qualys team can contact them. I do not have the ability to contact them directly.

I have not used other solutions in this company. However, in my previous company, I used a tool called ManageEngine. Compared with ManageEngine, Qualys Enterprise TruRisk Management is by far better.

In my company, we have nearly 300,000 employees and approximately five or six team members dedicated to Qualys Enterprise TruRisk Management. They handle the deployment, access management, and patching for the entire organization. The size of the implementation team depends on the company size. If the company has very few users, such as 10 to 100 users, one fully dedicated team member is sufficient for managing the deployment.

I am not familiar with the pricing structure. I know that Qualys Enterprise TruRisk Management charges per user, but I do not have detailed knowledge of the pricing. The pricing decisions are handled by the marketing team and senior management, so I do not have information about those details.

Qualys Enterprise TruRisk Management is very easy to use. If we have access to the system, there is no need for high technical knowledge, and an average person can navigate and use this tool easily. The tool is also available as a web application, making it very easy to access. If we have internet connectivity and a password, we can access it from any laptop or location. The entire process depends on the type of vulnerability being addressed. For example, for Windows patch updates, the process takes between half an hour and one hour to fully complete, depending on internet speed. I consider this a normal timeframe and it does not take excessively long. I would rate this review an 8.5 out of 10.