Qualys Enterprise TruRisk Platform Reviews

I was exploring Rapid7 and Tenable for my organization, but we have held off on that decision for some time. Currently, we are dealing with Qualys Enterprise TruRisk Platform. Our consumption is internal, and we operate as a service provider to consumers in the market. The use cases we have handled so far have not presented much of a challenge regarding scalability. We will learn more about scalability once we are expanding our use cases.

I have worked on the technology side covering overall risk assessment, which includes the application, data, the flow of information, various IT assets and all those associated risks, overall enterprise risk management pertaining to the technology side including people, process and assets, both digital and infrastructure.

Majorly, it focuses on application safeguarding, data safeguarding, sessions, API level security and all those related concerns. The ease of implementation, vendor diagnostics, REST APIs and other APIs provide a lot of flexibility to integrate various discrete IT landscapes that we operate into.

The governance part is the most prominent feature for us. We want to have a dashboard with just one click where the KPIs are pre-configured as per the business requirement and those things are monitored on a regular basis to check how things are moving. Governance and high-level management or board level visibility matter the most to us.

Resource utilization is always a challenge, so having proper visibility comes in very handy for us. Another use case we are also looking for is agents or artificial agents to monitor in real-time basis and make their own decisions to load balance or whatever best possible solutions they can work out on a real-time basis.

The governance part is the most prominent area for improvement. We want to have a dashboard with just one click where the KPIs are pre-configured as per the business requirement and those things are monitored on a regular basis to check how things are moving. Governance and high-level management or board level visibility matter the most.

We are trying to incorporate artificial models which can take care of many things that are currently taken care of manually or through certain jobs so that they can be automated with the help of AI models or agents. We will progress as the AI model matures with pattern learning and all those things.

We want self-decision capabilities. Not just analysis and giving alerts, but even taking decisions of actions and performing those actions. The first step would be to not only alert that there is an issue or threat, but to evaluate the threat itself in generality and suggest something. The second step is where those suggestions will definitely have some good minds working on them, but only if they are suitable will we make it as a learning model. Otherwise, we will discard and modify those things. The second level would be to let the learning model learn and then gradually figure out whether we can delegate the decision in the sense of the action that they can perform, see it and then evaluate whether it is falling in line as per the expectation. This is how we will progress on a use case basis only.

I have been using the solution for about two and a half years.

I believe we had almost small glitches and some outages about three to four times in the last two and a half years. These were not much of a concern because they have been resolved in the stipulated time. However, they have impacted us to a certain extent for those periods. In terms of stability, I would rate it somewhere around seven.

So far, the use cases that we have handled have not presented much of a challenge on the scalability part. We will learn about it once we are expanding our use cases. Intermittently we did face some scalability issues, but they were rectified by Qualys Enterprise TruRisk Platform team in consultation with AWS.

There is a global help desk as well as a regional help desk which takes care of support needs. Initially, it was a projectized phase, but now we are moving into a more operational phase. We do have support from them and we will see how things move on.

There are areas for improvement in their support structure. The first level is their interface with customers, and they also have an AI support system. I believe in the initial stages, if they can establish a confidence directly with agents or persons, that will definitely create a lot of trust built up. Slowly, once the account is mature enough, they can move into an AI-based support system on an elementary basis. Of course, we would definitely look forward to human intervention or expertise from subject matter experts as well, which is something that any support system requires.

Currently, there are two to three things to consider honestly. ROI will have its own timeline. I am looking at three years, more than three and a half years. In the initial phases, we are looking at efficiency improvements and reducing redundancies. These are the various things that we will be keeping an eye on. Overall ROI break even is something on three and a half years.

I was exploring Rapid7 and Tenable for my organization, but we have held off on that decision for some time.

As everybody knows, nothing is ideal and things keep evolving. At this moment, I do not want to highlight anything at this point. We were not exactly in a position to do extensive comparisons because it was intensive POCs, and although we did certain POCs, this solution came very close to our requirements. Qualys Enterprise TruRisk Platform is on the cusp of a lot of new advances that they bring to the table, which is what we also appreciate. They incorporate a lot of new things in the beginning technology space, making it available for us users makes our life easier. The overall offering is above average compared to others. My review rating for this solution is seven.

I basically use Qualys Enterprise TruRisk Platform to scan my internal networks and the URLs we work on. These two are the test cases, and then we scan the clusters. If we have an IP hosted on the Kubernetes clusters, we just pick that IP address and scan it for vulnerabilities. That is one use case from that scanner. When we have an IP range from 0 to 32 in the ports, we try to scan it from there. If one IP has multiple applications, we try to scan it on that particular part where it is hosted as an external network and it scans all those things along with the web applications. It's a SAST thing which we do.

The favorite feature of Qualys Enterprise TruRisk Platform is that it provides the whole information of a particular vulnerability. If it detects a vulnerability from a web application, it will provide the whole summary of where it could go wrong in the future if you don't want to test it out now. You can take a note of it and then give the summary to your engineering team.

It will also provide the information of the CVEs related to it, CVSS score related to it, and the CVEs will help you to understand more about how bad it can get. The comprehensive summary can be downloaded in the form of a CSV or PDF, or you can also take the output as .json if you want to send it on some clusters. This is one of the best parts about Qualys Enterprise TruRisk Platform.

One thing which I really want Qualys Enterprise TruRisk Platform to improve is the UI. While it might not be the case for everyone and it's subjective, in my team, most people agree on that part. The UI should be more user-friendly. If you have uploaded a file containing many IP addresses, you don't have a straightforward option to check what the IP addresses were. If we want to search an IP address from the list, we need to check it one by one.

Also, when we download something, the feature should be upfront. When we get the result of the scan, it should be 'download this file'. In many scanners, when you go to the download option, you get the options for particular formats immediately. However, in this case, when you click on download, it loads another page before giving you the output options for PDF or CSV. This feature should be upfront.

I have been using it for the past five or six years.

It just runs continuously without issues. Sometimes it happens that our internal network is not working that efficiently, so we might suffer loading issues for some time, but that's not something which needs to be addressed from Qualys Enterprise TruRisk Platform's end.

I had to reach out to support a couple of times, or three or four times. That was because some scans crashed, which happened initially during setup. Once we supplied 130 URLs to it for scanning one by one, and it crashed in between. We did not have any clue what happened, so we had to reach out to support. I have a mixed experience with it as I faced it twice. From my perspective, the platform works really neat and clean, but sometimes it does have issues.

They are very fast with their support. If something goes wrong, such as when the scan is not loading or the output is not coming straightforward, we send them a mail and they typically reply within a day. If it's PT time, they will reply as soon as possible. I have seen replies in less than two or three hours. Their support is really good.

Positive

We use Acunetix and Tenable, but I still feel Qualys Enterprise TruRisk Platform provides better results. That is the reason we have been using it for a while. I have used it along with Tenable, which was Nessus previously, and Acunetix. We have separate scanners for different technologies, but Qualys Enterprise TruRisk Platform has been doing better than those solutions because it's the pioneer in scanning for what we do now. Many teams in different organizations, at least in India, use Acunetix or Tenable.

The setup was easy and straightforward. When it was first set up, we just went ahead, implemented it on our local environment, and it went really smoothly. There were not many complications. You just set it up with a couple of IP addresses with ports which you want to use on Qualys Enterprise TruRisk Platform and then everything works fine. The competitors have some complications in installing or starting the scanner. For example, Nessus and Acunetix are quite complicated to start. Qualys Enterprise TruRisk Platform does a better job in that aspect.

I would pick Tenable as the best alternative for Qualys Enterprise TruRisk Platform. We can supply similar things to Tenable and scan multiple URLs at one time. The GUI is simple, making it user-friendly for those not familiar with scanners. They have a clean interface where everything is in front of them. The output process is simple - when the scan is complete, you click a button and it downloads the file without additional steps. These features are similar to Qualys Enterprise TruRisk Platform, except for the downloading part where Qualys Enterprise TruRisk Platform requires an extra page to check options.

Qualys Enterprise TruRisk Platform has been really good in every aspect. On a scale of 1-10, I rate it a nine out of ten.

The use cases include a cloud environment, so we want to secure the cloud, cloud workloads and cloud payloads, and complete private cloud. We obtained this product to secure and run our scans and provide us with the risk rating and vulnerabilities, combining them to provide Qualys Enterprise TruRisk Platform. We use it for that purpose.

The major benefits of the product include that Qualys Enterprise TruRisk Platform is very detailed and combines with the vulnerability management solution, providing us the true risk platform to outline the risky applications and payloads in the network. This is a stand-out feature.

Another major advantage is that it is easy to use. It is easy to generate and simple to operate, and it supports cloud-based scanning, so we can access it from anywhere. It does not need to be on-site, which is another point for cloud-based access.

Regarding integration, Patch Management is an addition that we did not have before, but it is another important feature we can integrate with Qualys Enterprise TruRisk Platform. When speaking about patching workflows for Windows, Linux, macOS, or third-party applications, there is no difference when using Qualys Patch Management to cover these diverse environments.

The Remediation Cockpit within Qualys Enterprise TruRisk Platform influences the handoff and collaboration between our SecOps teams and application owners. For example, we have Kubernetes and CI/CD pipelines that we are securing. We work with the development team by providing reports to them, and they fix these issues.

The primary disadvantage is that it requires a lot of compute resources to implement. We need to have a very heavy compute environment in order to install and work with Qualys Enterprise TruRisk Platform.

Hypothetically, we would like to see the vulnerability reporting more enhanced to provide more reports on the vulnerability solution, allowing for both a generic overview and a detailed overview.

We started using this product two years ago.

Regarding stability, Qualys Enterprise TruRisk Platform is 99.9% stable generally.

Qualys Enterprise TruRisk Platform is indeed scalable.

The customer service from Qualys is good and pretty good. On a scale from zero to ten, we could give seven points for support. The reason for the seven is that the response time should be improved. They take a lot of response time, so this is one of the negatives that they need to work on.

When choosing Qualys Enterprise TruRisk Platform, we were comparing it to Tenable. From our personal experience, the biggest difference between Tenable and Qualys Enterprise TruRisk Platform is that Qualys Enterprise TruRisk Platform is more in-depth and provides more reporting, but it requires a lot of compute resources. Tenable is less compute-hungry but requires very high-level reports. Qualys Enterprise TruRisk Platform is better than Tenable when it comes to reporting and vulnerabilities.

When we talk about the installation and deployment part of the product, it is indeed complex and not straightforward.

There is value for money. In case of any attack and compromise, there is a big value return on investment. If there is no attack and no compromise, then there is less value return on investment. We can quantify this based on money, based on assumptions that if something got hacked or compromised.

Regarding the price for the product, we believe it is moderate.

The decision to deploy Qualys Enterprise TruRisk Platform as a primary solution is influenced by the fact that it provides not only vulnerability management but also a true risk platform and patch management. We were looking for an all-in-one platform to implement for cloud security, which is why we opted for it.

We work with the product as an integrator. We did not use the Zero-Touch Patching feature. The overall review rating we are providing for Qualys Enterprise TruRisk Platform is seven out of ten.

My main use case for Qualys Enterprise TruRisk Platform is to integrate it with different cybersecurity solutions and other solutions and to identify the main findings and be able to prioritize when selecting where we are going to dedicate human resources and what the main problems are in the technology infrastructure.

A specific example of how I have recently used the platform to prioritize a finding or manage a security incident is that it helps us locate those that are truly exploitable, and those are the kinds of findings we prioritize.

When using Qualys Patch Management to cover diverse environments, my patching workflows for Windows and Linux mainly differ because they are very fast and they are the ones we use the most.

When deciding to use the capabilities of Qualys TruRisk Eliminate to remediate vulnerabilities without available patches, I mainly consider applying mitigations.

Qualys Enterprise TruRisk Platform has positively impacted my organization by improving the patching process by dedicating efforts to those assets with a higher level of risk, providing a single score and a single rating to identify what the main exposure is.

The single score has made decision-making or communication with other areas of the company easier because we all agree on and can visualize what the desired risk level is and what measures to take to reduce the observed exposure.

The Remediation Cockpit within Qualys TruRisk Eliminate has influenced collaboration between security teams and application or remediation owners by reducing the gap and improving communication.

I consider the best features offered by Qualys Enterprise TruRisk Platform to be the integration and the prioritization scheme, as that is one of the main features.

Regarding integration, I have mainly integrated it with the organization's cloud, and prioritization basically allows us to determine which assets have the highest risk and obtain information from the company, the risk appetite, and the business units, so we can more appropriately focus our efforts on those applications that are indeed important for the business.

I value the automatic reports, which are highly commented and well-structured.

Regarding the artificial intelligence capabilities of Qualys Enterprise TruRisk Platform, I find its governance and level of security to be very appropriate.

The accuracy and reliability of the results offered by the platform's artificial intelligence are very good; it helps us anticipate the main exposures and one another.

The integration of Qualys Patch Management with TruRisk has influenced the prioritization of patches for known exploited vulnerabilities or items from the CISA catalogue by allowing us to execute them autonomously.

I think Qualys Enterprise TruRisk Platform could be improved by integrating it more with external artificial intelligence agents to integrate them into the ecosystem we have, thus feeding it through external agents in addition to those provided by Qualys.

I have been using the tool for three months.

I consider Qualys Enterprise TruRisk Platform to be stable.

I perceive the scalability of Qualys Enterprise TruRisk Platform positively; it has been able to adapt to my organization's changing needs.

My experience with customer support for Qualys Enterprise TruRisk Platform has been very good.

My approach to deploying Qualys Cloud Agent for patching is determined by what is going to make it easier for us by facilitating near real-time visibility of the vulnerability and the level of accuracy of the detected vulnerability.

I have seen a return on investment, particularly in terms of time savings.

I estimate that I have managed to save about thirty percent time since I started using the platform.

My experience with the price, implementation cost, and licensing of Qualys Enterprise TruRisk Platform is that it is easy to implement, fairly competitive in price, and offers a very good experience.

Before choosing Qualys Enterprise TruRisk Platform, we evaluated other options, specifically CrowdStrike's vulnerability management solution.

I rate Qualys Enterprise TruRisk Platform a nine out of ten due to the ease of integration.

Regarding the Zero-Touch Patching feature of Qualys Patch Management to apply patches automatically, I have not used it yet.

I evaluate and manage the possible operational impact of patch deployments or other remediation actions within Patch Management, especially in relation to system uptime or application availability, and this is a major challenge, especially for high-availability applications, but in general it helps a great deal when deploying.

There is no specific answer about the considerations that influenced my decision to implement Qualys TruRisk Eliminate as a main solution, as it is simply very good.

My advice to others who are considering using Qualys Enterprise TruRisk Platform is to first properly integrate the modules for identification and detection of vulnerabilities and also integrate CISA before integrating ETM.

My main use case for Qualys Enterprise TruRisk Platform is for patching and remediation.

I specifically address Patch Tuesday updates when using Qualys Enterprise TruRisk Platform for patching and remediation.

In addition to patching, I also remove unauthorized software with Qualys Enterprise TruRisk Platform.

I only deal with Windows patching when using Qualys Patch Management; we have a different team for the others.

We target all of them for deploying Qualys Cloud Agent for patching, particularly across workstations, servers, and other devices.

We're still exploring the criteria for leveraging Qualys Patch Management's zero-touch patching feature to automatically apply patches based on risk.

Qualys Enterprise TruRisk Platform has positively impacted my organization because we can see vulnerability and risk and quantify it.

To quantify risk, I use the dashboard a lot, and it has been incredibly helpful since using Qualys Enterprise TruRisk Platform.

One of the best features Qualys Enterprise TruRisk Platform offers is the ratings on how easy it is to remove software.

The ratings on how easy it is to remove software make me feel confident that a patch or remediation will actually work.

The CVE rating helps a lot for prioritizing patches for known exploited vulnerabilities or CISA catalog items, as well as the TruRisk score.

Qualys Enterprise TruRisk Platform can be improved in terms of cost; perhaps bringing it down would be beneficial.

It is an ongoing challenge to evaluate and manage the potential operational impact of patch deployments within Qualys Patch Management, especially in relation to maintaining system uptime or application availability. We need to balance patch management with the uptime of systems.

I have been using Qualys Enterprise TruRisk Platform for four weeks.

Qualys Enterprise TruRisk Platform appears to be stable.

I have not experienced any stability issues with Qualys Enterprise TruRisk Platform.

Qualys Enterprise TruRisk Platform appears adequate in terms of scalability.

The customer support for Qualys Enterprise TruRisk Platform appears adequate.

I did not previously use a different solution.

I have the metrics about how long it is taking us to fix things with Qualys Enterprise TruRisk Platform, which I believe are quite good; I do not believe they kept metrics before.

I rate Qualys Enterprise TruRisk Platform an eight out of ten. I gave it an eight because I have not used it enough to give it a ten. Regarding Qualys Enterprise TruRisk Platform's AI capabilities, I do not have extensive experience with that. Based on what I have seen so far, the accuracy and reliability of output from Qualys Enterprise TruRisk Platform are quite good. My advice for others looking into using Qualys Enterprise TruRisk Platform is to ensure you understand what it does.

The major use cases from my side for Qualys Enterprise TruRisk Platform integrate with our VMDR, Qualys VMDR. Basically, what TruRisk does is it helps with risk prioritization. We do all the integrations with existing products, which again is Qualys VMDR for us. We also integrate with a couple of other products, next-gen antivirus and others. Then it helps us normalize the overall risk that we have, not just looking at vulnerabilities. Based on that, we just prioritize whether this patching process or putting in any security controls is worth an effort or not. If it is worth the effort, then how do we prioritize? Which ones should go at the top? Which one needs to be dealt with first, and then gradually, the non-critical ones can stay down the chain.

The threat prioritization feature of Qualys Enterprise TruRisk Platform helps for resource allocation, especially for the crown jewel applications that we have. Of course, we feed that via CMDB into the tool. So we kind of prioritize what risks need to be taken care of, and then depending upon who owns it or we have a detailed RACI matrix which shows that hey, this particular thing or gap needs to be fixed by the network team, for example, or infrastructure team, server team, then we allocate those resources based upon priority. If it is a very high risk to the business, then we allocate resources based on that kind of risk prioritization, which is what the tool is meant to do. It is done on an ad-hoc basis, so on the process side, it needs to be taken care of from the process and cannot be automated, the resource allocation. But once we know that it is a high priority, then we allocate the resources within the span of time and that needs to be dealt with.

The benefits of visibility from Qualys Enterprise TruRisk Platform is that it is the central tool. The first thing that we integrate with is our asset inventory or CMDB, and we do it via ServiceNow. So we have all the assets, and then a lot of it depends on or it is a prerequisite to have very clean and hygienic CMDB. So there we have got all the assets, we have got all the applications, the business owners, stakeholders, and all of those. Then there is asset criticality, which is the most important thing that gets fed into TruRisk, and that is something which creates a positive or a negative bias on the risk that comes in because it is us, the business owners who understand the criticality of it, and that is more a subjective thing. So that is fed and then that is the most central integration. Then we do integrate with Qualys VMDR and all the other platforms which spit out their own various versions of vulnerabilities and risk and all of that. The tool then quantifies it and then prioritizes which ones need to be handled at the top.

Positive aspects of Qualys Enterprise TruRisk Platform are that it is mandatory for every organization. Every day we have so many security products, and then all of them spit out their own version of risk. Unless we consolidate them and quantify them, there is no way we can actually prioritize. Palo Alto may be giving some particular vulnerability a CVSS score or some high risk. Then some other product may be giving something else, and then our team does not understand which one to prioritize. That is where we absolutely need this tool so that it integrates with everyone. We have also integrated that with our ServiceNow CMDB and we have mentioned the asset criticality. Based upon that, it gets fed into Qualys Enterprise TruRisk Platform, and then we get the final quantified risk. Then it gives us these are the things that we need to handle, these are the top ones in the business technology risk, and then we need to take care of those first. Of course, there are some positives or false positives, but something which the tool says is something, but then for us, it may not be that big of a deal because we may have some compensatory control. This tool is mandatory if we are looking for a holistic, enterprise-wide solid risk governance and anything that has a GRC. They would absolutely need the content that this tool spits out. Else, it is a nightmare to deal with everything.

It is all continuous. The continuous monitoring feature of Qualys Enterprise TruRisk Platform is a continuous threat and exposure management kind of essential CTEM that is built in it. It is not the tool that does it. It is the feeds that it gets from other tools that enriches it, and then we get various metrics. We have foundational metrics, CVSS scores, severity and all of those. Then it takes care of all of those, consolidates them, checks all the vulnerability signatures. Again, not every vulnerability leads to a risk. A couple of them have not been exploited. That is how it works.

I think the CTEM part of Qualys Enterprise TruRisk Platform can get better, not that anyone else is doing, but continuous threat and exposure management. We are now going beyond the risk, especially in areas where AI is involved. For example, we have all these AI models, and then there are new products coming in, for example, AI runtime security and others. I think it is high time that we start feeding those things from those platforms into something like TruRisk. That gives us again, it is very difficult I understand, to attach a particular value or a score to that particular risk because with AI, we have all these new things for which there is no signature or there is no vulnerability known, and that thing is very dynamic, but it has to be done. So that is one of those things. Integration with AI runtime security tools, I guess that is crucial. Feeding Qualys may develop or have its own database of vulnerabilities which are AI specific or not, I do not know, but it should have the capability to get the feeds from all the other sources. So I think that is crucial.

That one about AI runtime security, I think it is high time that everyone starts thinking about that and bringing integrating all the risks that come along with AI runtime. For example, we use ChatGPT, and then there are all the tech teams which have API integrations with OpenAI, Claude, Anthropic and others. Then there are all these prompts or prompt injection attacks or model poisoning and others. If there is something and then we do use a Palo Alto, for example, for AI runtime security. Now, if something happens, someone is trying to poison the model, or if the runtime system itself has some vulnerabilities, it is crucial that every single risk prioritization tool also has the ability to integrate with that tool and then ingest and then figure out what is the risk level of that particular event or that particular system. Everyone needs to inherit that. It is not a Qualys thing. Of course, it is very difficult to do it without the risk of bringing in a lot of false positives. But that must be done.

I have been dealing with Qualys Enterprise TruRisk Platform for about two, two and a half, three years, I guess. I do not think it is a very old product either. It has been around quite recently, and that is how I have been working with it.

If it is not stable, then it does not make any difference to us, to be frank, because this is more a scoresheet. We have so many things coming in, and then we have a final scorecard, which is this particular platform. We do not use it on a day-to-day basis, to be really frank. This is a periodic drill. So it matches with our vulnerability scans and all of that. For high-critical assets, yes, and there is a dedicated team, especially the senior architect, someone the me, we usually look at very closely. But it is not a 24/7 thing. It is not critical in the way that we have for Cortex XDR where if it fails, then the organization basically ceases to function.

All we do is purchase the license and it just scales out. Qualys is fairly elastic. When purchasing a tenant, if we have a fair understanding of our landscape, we can just tell the SE, the account executive, and then they can provision a tenant based upon that. I have never faced any challenges. Qualys is very elastic in their cloud. So that does not create any challenges.

The technical support from Qualys is the same as VMDR, the one that we checked earlier. The only technical challenges that we had so far were with integrations, and then they just fixed it. Maybe we were doing certain areas not correctly. There was one instance where there was not enough documentation, or it was there, but it was not that detailed. So that was one instance, but apart from that, we never faced any challenges.

I would rate that a nine. They are always available, so I would say nine. Nine is great. The tool that I was thinking about earlier was RiskSense. That is the competitor we had in mind when we brought in TruRisk. Then I think we also ran a couple of evaluations, but because of our VMDR, we preferred the risk prioritization tool as TruRisk as well.

It is a cloud tenant. We do not have to do anything for the deployment procedure. We just have a cloud tenant and we just have integration. So we just put in our API keys and do the same on the other side. It takes about less than a minute sometimes. Maybe three minutes for integration.

The experience with pricing, setup cost, and licensing for Qualys Enterprise TruRisk Platform is expensive. It is definitely expensive. If I were to compare that with the one that we had, I do not recall the name exactly. It is taken over by Cisco now. I do not remember. I will update the notes once we publish it or send it out for review. So I think that was not on par with what TruRisk does. Qualys Enterprise TruRisk Platform is way better than the other one. It is taken over by Cisco now. RiskLens or something. That is the one.

If we compare Qualys to its competitors, it really helps if we are using the VMDR solution which is a risk prioritization tool that TruRisk of the same vendor which we deployed for VMDR. Because a lot of those things, most of those things, in fact, they come from VMDR. So I think that makes if we give Nessus or Tenable as one, and then we use TruRisk, then we may not get the same kind of output. So preferably, our VMDR solution and the risk prioritization tool, I would prefer them to be the same.

The metrics for real-time threat intelligence updates are fed in real time. We have configured it real time, and the effectiveness of those largely depends. So the existing ones, all the vulnerabilities that have been there, we that is usually understood by the individual vendors. Where it becomes most effective is where Qualys is capable of building a QID or a signature and all of that before others do. That is where it becomes super effective. Else it is again, all the vendors, they typically are on top of these things, so I do not think there is a significant lag, but of course, Qualys does do much better.

Qualys Enterprise TruRisk Platform is a fantastic tool. It is kind of expensive, but it is indispensable. It is not something that we can do away with. TruRisk, every single enterprise which is trying to reach a maturity level, especially with risk governance and all of those, this is crucial. It is kind of not thought of often, but it really makes life simple once we have got it. I would rate this review a nine overall.

My main use case for Qualys Enterprise TruRisk Platform is to detect vulnerabilities, scan assets with appliances, and manage all aspects involved with detecting, assessing, and managing vulnerabilities.

In a recent scenario, Qualys Enterprise TruRisk Platform helped us scan our assets and detect vulnerabilities so we could check and solve them as soon as possible.

What I most value about my organization regarding Qualys Enterprise TruRisk Platform is that they truly understand how important it is to analyze and detect vulnerabilities, improve their detections, and maintain a safer structure.

Qualys Enterprise TruRisk Platform positively impacts my organization significantly, as it is crucial to detect vulnerabilities as soon as possible, and Qualys makes that job easy.

I cannot provide a specific metric, but I can say that nowadays, with AI, there are more vulnerabilities emerging, and Qualys is doing a good job detecting them as quickly as possible.

The best features Qualys Enterprise TruRisk Platform offers include the interface and how easy it is to start using it because, despite other technologies, their tutorials and certifications are free, which is beneficial.

The free learning resources of Qualys Enterprise TruRisk Platform motivate people to obtain certificates, which helps improve their knowledge about Qualys.

The best feature of Qualys, I would say, is the Cloud Agent, as the idea of installing a personal agent on assets or machines that can perform different functions and retrieve data in almost real time is excellent.

Regarding Qualys Enterprise TruRisk Platform's AI capabilities, I think they are good; I have never seen any issue related to governance and security.

In terms of accuracy and reliability of output from Qualys Enterprise TruRisk Platform, I think it is very accurate, and I can rely on their data because they check everything.

I find the capabilities of Qualys Enterprise TruRisk Platform for fixing vulnerabilities without available patches to be very useful since most of our devices already have the Cloud Agent, eliminating the need for additional software from another vendor.

The interface of Qualys Enterprise TruRisk Platform is good, but it could be better; it could be easier and more modern, as there are some modules that have not been updated to the new interface.

I think Qualys could improve its AI capabilities because right now, it is not very useful even though they market it to you and say you can use it.

I have been using Qualys Enterprise TruRisk Platform for along these two years.

Qualys Enterprise TruRisk Platform really is stable.

The scalability of Qualys Enterprise TruRisk Platform is straightforward; you just have to buy more licenses and apply the agents or whatever you want.

From my perspective, the customer support for Qualys Enterprise TruRisk Platform is amazing, as they reply to you all the time and are very quick.

I would rate the customer support a ten out of ten.

The return on investment with Qualys Enterprise TruRisk Platform is significant, as it is ready for the challenges we face with high rates of vulnerabilities, and I think they are doing a great job.

I would rate Qualys Enterprise TruRisk Platform an eight out of ten.

I choose eight because it is one of the best platforms in their field; they do a good job, but they could be better.

Qualys Enterprise TruRisk Platform is deployed in my organization using a cloud-based approach, with all information stored on their cloud.

Regarding the cloud provider for Qualys Enterprise TruRisk Platform, it is not something we control; the information is on their side.

My advice for others looking into using Qualys Enterprise TruRisk Platform is that it is a very good idea, as its scalability and compatibility with devices are amazing, simplifying various cybersecurity needs in one platform.

My main reasons to use Qualys Enterprise TruRisk Platform were vulnerability severity assessment for assets like server endpoints and cloud resources. We utilized it for asset scores, vulnerability scores, overall enterprise risk, security perimeter analysis, and zero-trust implementation.

Qualys Enterprise TruRisk Platform was helpful for managing potential threats in my case because we had defenders and this tool alongside them. The amount of information and data it generated was really beneficial for us to analyze and work upon.

The product was helpful to assess risks with machine learning algorithms. The machine learning platform learns the behavior, learns the patterns, learns the tactics, and then creates results for you depending on your enterprise.

Qualys Enterprise TruRisk Platform was helpful with threat prioritization features for resource allocation, and it played a good role in our analysis and day-to-day monitoring.

The solution was beneficial in identifying true risk scores, where we were lacking and where we were performing well. It identified trust distributions amongst our assets, what are high risk items, what are critical things, vulnerabilities that can be exploited, and what are critical priorities for us. The remediation action it suggested was helpful as well.

I have not been working with real-time threat intelligence updates.

Back then, AI integration was not there with the product, but I am uncertain about how the tool has upgraded itself now. If it is still not there, then AI integration could be a helpful addition.

Compared to Microsoft, there were already advanced tools, so I had seen some drawbacks compared to licensing or technical side.

I am uncertain about the product now, but if AI is not there, then it is good to have AI because when I was using Qualys Enterprise TruRisk Platform, AI was not that much developed.

So far, only AI integration is the only area for improvement with Qualys Enterprise TruRisk Platform.

I used Qualys Enterprise TruRisk Platform for eight to nine months.

I would describe Qualys Enterprise TruRisk Platform as stable regarding crashes or downtimes ever happening.

Qualys Enterprise TruRisk Platform is scalable and easily scalable in the product.

The customer service was cooperative and readily available for technical support. I would give them a rating of nine out of ten for their support.

Positive

Qualys Enterprise TruRisk Platform was advanced because it had tagging features, really good analytical features, and it used to give details that are required rather than giving a surplus of information.

I would choose Qualys Enterprise TruRisk Platform if I had to choose between Microsoft and Qualys Enterprise TruRisk Platform because it is that good.

Integration-wise, Qualys Enterprise TruRisk Platform was smooth, and we had support. We did not have to spend excessive time figuring out how to proceed, so the integration capability and visibility across various digital environments was smooth.

The initial setup of Qualys Enterprise TruRisk Platform was not complex and not straightforward; it was somewhere in the middle.

We had a pilot test before we did the final deployment, so everything was well-scoped regarding challenges with installation.

The installation of Qualys Enterprise TruRisk Platform is somewhat tricky compared to Cisco, and it depends on the end-user knowledge.

The learning curve documentation is perfect. They keep on updating their resources, so they are not lacking behind in that.

Qualys Enterprise TruRisk Platform was not expensive regarding the pricing point. We made a purchase choice that was within our budget.

The pricing was up to the mark at that time regarding pricing, interface, documentation, and all of it.

I have not considered anything apart from the products we discussed, such as Palo Alto, Fortinet, or Splunk.

We discussed Check Point Harmony SaaS and Web Gateway, and there is also one more product like CloudGuard Network Security. I have worked with the Check Point firewall, SmartConsole, and Check Point Firewall.

We also discussed Qualys Enterprise TruRisk Platform and VMDR. I have worked on Qualys VMDR, which is not the same as Qualys Enterprise TruRisk Platform or Qualys TotalCloud. The TruRisk factor and TotalCloud are different products that I have not worked with, only VMDR.

I am not still using Qualys Enterprise TruRisk Platform. I had used it in the past with the TruRisk platform. I have had no problems, no problems at all with potential minor problems.

My overall rating for this review is nine.

My main use case for Qualys Enterprise TruRisk Platform is as an automated vulnerability management tool, and particularly, we have obtained this tool as part of a single license for our compliance part in our organization.

A specific example of how I'm using it for compliance is that all our servers are integrated, meaning they install their agent in our servers or session. If it is compliant or non-compliant, we can determine that from the platform automatically. It provided me with the risk score, and from that, we can make our assumption and fetch a report or data that shows which server is most vulnerable to mitigate. That is helping because we have so many servers. It gave me a dashboard of a scenario that highlights which action I have to take on the server that shows most vulnerability, such as mismatched compliance.

The use case is that we have to make our servers and everything compliant to meet client requirements. We have to comply with GDPR and everything, and for US compliance, we have to maintain this with the tool giving us the feasibility to identify gaps and provide an assessment of gap analysis. We can do that from this tool.

Qualys Enterprise TruRisk Platform positively impacts our organization by saving time and reducing the need for more employees for operations, with notable money saved.

The best features that Qualys Enterprise TruRisk Platform offers are cost-effectiveness and broader coverage compared to two other well-known tools, but it provides us with additional features with that license, such as SOC and CIA compliance. All the features they have in their system can be done manually as well. Other tools are pretty much automated, leading to a dependency on them, but here we can manually add some features to this license, which helps us to monitor, and the dashboard is also very compact.

Out of all those features mentioned, such as broader coverage, manual addition of features, and compliance tools, the most valuable feature for my team is that it allows us to run all the scans with just one click. It is not RAM consuming or time-taking. We receive a good report in a short period of time, and typically one to three people are enough to monitor this for server administration for our compliance needs. If there is anything else, such as a high risk score, we can identify it there, and they can automatically mitigate it from their end if we forget to do it manually on ours. That is a great feature.

Qualys Enterprise TruRisk Platform positively impacts our organization by saving time. We can save our time and have a good report to present to our customer.

We experience some initial challenges with integration, as the response from the SME is too slow. Some features we do not have, and we have to ask them manually to integrate. There are some features they are unable to fine-tune very well, and I think it should be better to have a faster response from their end, whether from the developer or the SME.

If they provide us all the basics available with other licenses, that would be great for us.

I have worked with Qualys Enterprise TruRisk Platform for five years.

Qualys Enterprise TruRisk Platform is pretty much stable.

Its scalability has some dependencies, but overall, it is good.

Customer support for Qualys Enterprise TruRisk Platform is good, though a bit slow.

We previously used Tenable; Rapid7 was also there, but mostly we used Tenable, and the reason for switching is that it is high cost now.

My experience with pricing, setup cost, and licensing has been pretty good.

I have seen a return on investment, as we need fewer employees for operations, and money saved is also notable.

Before choosing Qualys Enterprise TruRisk Platform, I already evaluated other options, namely Tenable, and I should not name the other.

My advice to others looking into using Qualys Enterprise TruRisk Platform is to please review all the licenses, features, and support you can get from the SME based on your environment. I have rated this product an 8 out of 10.

Qualys Enterprise TruRisk Platform is used primarily for vulnerability management and compliance policy, and we use QDS as a standard of risk management. The continuous monitoring feature is not utilized; our license is mainly focused on VMDR, policy compliance, and risk management. For threat prioritization, we work differently by checking critical and high vulnerabilities, and then this information is directly pushed to administrators who address them. Every IT team in our organization has access to Qualys and monitors themselves.

We check on a quarterly basis how it works and how many critical and high vulnerabilities have been fixed, primarily controlling them, but we do not use the module in VMDR even though we have the feature.

Regarding pricing for Qualys Enterprise TruRisk Platform, I find it reasonable. When we compare it with other products, it is on the same level as Rapid7, but Tenable costs twice as much as Qualys.

The best feature in Qualys Enterprise TruRisk Platform is TruRisk, which includes the calculation of risk of any kind. Previously, as an organization, we used CVSS as a base, but when we installed Qualys, we redefined the risk management based only on Qualys Enterprise TruRisk Platform's TruRisk score.

The technical support of Qualys Enterprise TruRisk Platform can be improved because sometimes we are waiting too long for responses from them. We face delays with their responses; in fact, some cases are waiting for weeks. Based on my experience, I would rate Qualys Enterprise TruRisk Platform's technical support a six.

I have been working with Qualys Enterprise TruRisk Platform for three years.

I have a view of machines in the cloud, but how long it takes varies. Qualys agents are included in the golden image, so when new machines are created, the agent communicates with the proxy and Qualys Enterprise TruRisk Platform. I can see that there is a new machine, but how long it takes is not on my side; I am only concerned with Qualys Enterprise TruRisk Platform itself.

We checked three solutions three years ago and decided to buy Qualys Enterprise TruRisk Platform instead of Rapid7.

Deploying Qualys Enterprise TruRisk Platform is very quick. Activating servers is very quick for Qualys Enterprise TruRisk Platform.

I do not do it all by myself without any assistance; the administrators handle the implementation. I work with Qualys Enterprise TruRisk Platform, but establishing and creating new servers on the cloud is the job of IT. I am not working in IT, so IT handles that.