Qualys Patch Management Reviews

I am using Qualys Patch Management for two years, and everything is satisfactory from my side.

Before purchasing Qualys Patch Management, we were already using Qualys VMDR and the cloud agent model. At that time, we were generating reports and facing issues with patching vulnerabilities. Large vulnerabilities, such as Google Chrome and browser-related issues, were appearing every two weeks, making it difficult to patch. Similarly, we were getting browser vulnerabilities and software-related vulnerabilities. It became very easy to automate this process and showcase the management of vulnerability remediation cost.

Initially, we were doing it manually, so we implemented Qualys Patch Management as a solution. The management was ready to take the initiative. We purchased around 2000 licenses and started patching approximately 1600 servers. We initially only patched the server and focused on some vulnerabilities as zero-day vulnerabilities for preventive methods. The preventive method gave us the capability to run scripts and make registry changes through Qualys Patch Management. We patched more than 1000 assets in one go, which was a significant initiative for us.

The main feature that is helpful for us in Qualys Patch Management is that we can make registry changes and run scripts through this particular module. We can either run specific scripts, update software, or remove specific software versions. For example, in the case of 7-Zip, when we update it, it installs the latest version but does not remove the older version.

Therefore, we use scripts, PowerShell scripts, and we bypass PowerShell execution policies through this module, allowing us to achieve the removal of that folder version of 7-Zip. This feature is very helpful, and it allows us to take preventive measures for zero-day vulnerabilities.

Additionally, the risk-based approach for creating automation to address risks is used mainly through dashboards. The dashboards give us a true risk dashboard. They show us what assets we can prioritize for patching and what critical patches we are pending for those machines. Accordingly, we create patch jobs and execute them, and initiate the reboot on priority. Additionally, we initiate some of the machines to reboot for creating another job as we have implemented these actions.

The primary use case for Qualys Patch Management is to provide a proactive, automated, and data-driven approach for discovering vulnerabilities, prioritizing patching, and ensuring that patches are applied correctly to minimize security risk.

We switched to Qualys Patch Management because it simplifies patch deployment by requiring only an internet connection. Previously, we used an on-premises server with HSCM, which proved challenging for managing remote endpoints. To address this, we deployed cloud agents on all endpoints and servers, allowing Qualys to push patches remotely without needing VPN connectivity.

We have prioritized products for automated patching. This means that whenever a vendor releases a patch, it is seamlessly and robustly applied.

Qualys VMDR detects vulnerabilities and correlates them with relevant patches in the Qualys Patch Management module. Although separate databases, they work together to provide a comprehensive solution for identifying and remediating vulnerabilities. When VMDR detects a vulnerability, it identifies corresponding patches released in the Patch Management module, streamlining the patching process.

Before the pandemic in 2020, we relied on remote scanning, which limited our ability to deploy and manage patches effectively. Our on-premises SCCM server struggled to push patches to remote users relying on VPN. To address this, we deployed the Qualys Cloud Agent on all 360,000 assets in our infrastructure. This provided comprehensive vulnerability detection, unlike the limited results from remote scans. However, the sheer volume of vulnerabilities overwhelmed our SCCM server. Consequently, we collaborated with Qualys to develop a backend solution integrated with the Cloud Agent for seamless patch management. After successful testing and implementation, Qualys Patch Management now efficiently handles patching for Windows, Linux, and macOS devices.

Qualys Patch Management provides a centralized platform for managing assets and vulnerabilities, enabling assessment, prioritization, and remediation. We rely on Qualys for both vulnerability detection and patch deployment.

We initially faced challenges as the IT team was hesitant about Qualys Patch Management, and the deployment of cloud agents revealed millions of vulnerabilities. However, Qualys Patch Management significantly reduced these vulnerabilities, particularly on our Windows machines, which comprise 70 percent of our systems. The team observed a 70 percent remediation rate through scheduled patching, establishing Qualys as a reliable source of truth. Consequently, they shifted from relying on SCCM or Intune to Qualys Patch Management for scheduling patching jobs to meet our five-day SLA. With Qualys publishing QIDs the day after vendor patch releases, automated jobs promptly deploy patches to all machines upon vulnerability detection.

Qualys Patch Management helps lower operational costs and enhances our security posture by reducing vulnerabilities and streamlining compliance efforts.

I have observed an improvement in our patch rate using Qualys Patch Management. Qualys now facilitates over 80 percent compliance within five days, a task that previously required the IT team 12 days to accomplish.

By integrating Patch Management with VMDR, we gain immediate vulnerability detections and leverage TruRisk values to derive our own severity rankings for prioritization. These prioritized vulnerabilities are then addressed using the Qualys Patch Management Module, streamlining our remediation process.

Qualys Patch Management has helped reduce our organizational risk by providing current vulnerability data, including exploitability and active threat information. The platform's live threat feed and risk score enhance the standard CVSS rating by considering factors like active malware association and exploit availability, allowing us to prioritize patching efforts effectively.

We previously used native patch management tools like SCCM servers for Microsoft, Linux, and Mac OS. However, with the shift to remote work in 2020, we encountered issues pushing patches through these on-premise servers. To address this, we adopted Qualys Patch Management, leveraging their cloud agents that are already in place. This simplified patch deployment, allowing us to push patches directly from the Qualys cloud platform, eliminating the need for on-premise servers and VPN connections, which often caused bandwidth congestion and patch deployment failures. 

Qualys Patch Management only requires an internet connection, significantly improving our patching efficiency and overcoming previous challenges with large patch sizes and network limitations.

Qualys Patch Management employs a risk-based approach to automation, utilizing the TruRisk feature within the Qualys VMDR module. TruRisk assesses the security posture of infrastructure by considering asset criticality and assigning a Qualys detection score to each vulnerability. This combination generates a TruRisk score for each asset, enabling the identification of critical assets such as crown jewels or public-facing systems. By categorizing assets based on criticality, users can prioritize vulnerability remediation directly from the VMDR interface. This prioritization seamlessly integrates with Qualys Patch Management, allowing for efficient patch deployment by clicking the Patch Now option in VMDR.

Qualys Patch Management and VMDR are seamlessly integrated, enabling direct communication between them. Patch Management obtains necessary vulnerability and missing patch data directly from the VMDR interface. Both modules rely on the Qualys Cloud Agent to gather complete vulnerability information from VMDR. This integration allows for direct patch deployment through either VMDR or Patch Management.

The COVID-19 pandemic significantly increased cyberattacks on organizations due to the shift to remote work and the resulting expansion of vulnerable attack surfaces. Employees connecting to company networks from home created security gaps that cybercriminals exploited, particularly with ransomware. To mitigate this, organizations adopted proactive measures like using Qualys Patch Management to quickly deploy patches and updates, addressing vulnerabilities, and protecting against attacks without relying on scheduled downtime.

We use the TruRisk scoring mechanism, which ranges from zero to 1,000, to assess and prioritize vulnerabilities. This score is based on Qualys-defined ranges for severity levels, critical, high, medium, low, and our asset criticality scoring. We categorize assets by creating tags for groups belonging to different organizational entities and assign criticality scores to those tags. By combining the asset criticality score with the Qualys detection score provided on a QID basis for each vulnerability, we calculate the TruRisk score. This allows us to identify the number of assets with critical or high-severity vulnerabilities and prioritize remediation efforts.

We have used Qualys Patch Management for four years, but our organization has used Qualys for over 12 years. In that time, I've also used other leading scanning vendors like Tenable and Rapid7. Compared to those, Qualys more accurately detects vulnerabilities due to its cloud agent. This agent, installed on the end asset, reads complete metadata, including the registry and other areas, to identify vulnerable software versions. For example, if an application vulnerability is identified, we can check the asset's installed programs. Even if the software isn't found there, Qualys provides the path where the vulnerable version is detected, often revealing remnant files. These files, left behind even after uninstallation, can be exploited by attackers. Qualys detects these remnants, ensuring accurate vulnerability identification, even if the software appears to be absent from the endpoint.

Although Qualys may be more expensive than other vulnerability scanning tools, its accuracy and effectiveness justify the cost. While alternatives like Tenable Professional offer unlimited IP scanning at a lower price, Qualys provides superior vulnerability detection. This leads to a good return on investment by minimizing security breaches and associated costs, such as reputational damage and compromised client data. Ultimately, Qualys increases stakeholder confidence by providing a high level of protection against cyberattacks.

We previously used a native patch management solution, which resulted in consistently low patch compliance. Achieving even 80 percent compliance often took an entire month, by which time Microsoft would release new security patches. Despite the challenge of maintaining high patch compliance across our extensive infrastructure, with Qualys Patch Management, we now achieve 75 to 80 percent compliance within the first week and 90 to 95 percent within two weeks of patch release. Consequently, our monthly patch compliance consistently exceeds 95 percent.

We augmented our existing vulnerability management solution by adding Qualys Patch Management. Before 2020, we relied solely on Qualys VMDR and other modules. Subsequently, we transitioned to Qualys Patch Management for most patching tasks, although we still utilize Microsoft Intune and SCCM for Microsoft OS assets. Qualys Patch Management leverages vulnerability feeds from the VMDR module, allowing us to identify vulnerabilities missing Qualys patches. Using Qualys Query Language queries within the Qualys interface, we can pinpoint assets with missing patches by searching for Qualys missing patches. This capability enables us to prioritize vulnerability remediation through Patch Management, supplementing our broader vulnerability management strategy.

We primarily use Qualys Patch Management for deploying Microsoft's monthly security updates, released every second Tuesday. To mitigate vulnerabilities, we promptly create patch jobs for all endpoints and servers upon release and inform stakeholders of the urgent need for deployment. We adhere to strict SLAs, ensuring the entire patch cycle is completed within one to two weeks.

We implemented Qualys Patch Management to efficiently patch our endpoints, and servers.

Qualys' risk-based approach to automation is helpful for addressing vulnerabilities. We utilize TruRisk management for a comprehensive risk overview, employing a tag-based system to assign criticality scores. This allows us to prioritize patching through Qualys Vulnerability Management, Detection, and Response based on the severity of risks.

The integration of Qualys Patch Management and VMDR is critical for automating the deployment of relevant patches and configurations to remediate vulnerabilities. Within our organization's 343,000 assets, multiple entities and tags allow us to leverage VMDR to identify critical vulnerabilities and prioritize patching for high-value machines. This integration enables us to proactively push patches to all server and endpoint agents, effectively mitigating vulnerabilities.

The implementation of Qualys Patch Management has resulted in the remediation of nearly 25 million vulnerabilities within our organization, significantly reducing our overall vulnerability count.

TruRisk automation allows us to address vulnerabilities without involving our security team, as we can directly assess their criticality levels.

Qualys Patch Management provides a single source of truth for managing assets and vulnerabilities, enabling assessment, prioritization, and remediation. Its comprehensive view of each asset streamlines collaboration between security and IT teams, facilitating efficient vulnerability management.

The single source of truth helped reduce costs by 95 percent.

We have improved our patch rate to over 86 percent by implementing Qualys Patch Management. Previously, patches were managed through both Microsoft Intune and SCCM, which proved less effective.

The risk reduction report allows us to split the remediation based on criticality.

The risk reduction report provides recommendations on how to remediate vulnerabilities. Once a fix is available, the corresponding patch can be deployed to all assets based on the associated CVE identifier.

Qualys Patch Management has reduced our organizational risk by 99.9 percent.

We use Qualys Patch Management for patching Windows updates, deploying third-party and Microsoft patches, and other application updates to manage vulnerabilities and respond to threats.

If new vulnerabilities are found in the environment, we deploy patches or find solutions to remediate the problems. We implemented Qualys Patch Management for this purpose.

To enhance vulnerability management by upgrading or updating applications, we've implemented a recurring job in Qualys Patch Management. This job automatically scans for missing updates on a daily or weekly basis, ensuring all applications remain current. This automated process streamlines patch management and strengthens our overall security posture.

We use Patch Management with Qualys VMDR and find its integration capabilities helpful. This tool automatically identifies vulnerabilities and provides the necessary patches, configuration changes, or updates for remediation. Previously, we needed separate tools for vulnerability scanning, solution finding, and implementation. Qualys streamlines this process by not only identifying vulnerabilities but also recommending and implementing solutions, including patches, updates, and configuration changes, effectively helping us remediate vulnerabilities in our environment.

The machines connected to the environment and reporting to Qualys have a better patching system. It continuously monitors for missing updates daily through scheduled tasks. If any are found, they are automatically installed. This ongoing monitoring and automatic installation is an excellent benefit of Qualys Patch Management.

TruRisk automation allows us to address vulnerabilities without direct involvement from our security team. When we first implemented Qualys, we had a backlog of approximately 130,000 vulnerabilities, some dating back six months or more. By utilizing Qualys as a remediation tool to track, address, and resolve these vulnerabilities, we have successfully reduced the number to 15,000.

Qualys Patch Management provides a centralized platform to identify, prioritize, and address vulnerabilities across our assets. It uses a severity scoring system ranging from one to five, allowing us to assess and prioritize vulnerabilities accordingly.

Before using Qualys, we used SCCM, which gave us good results with over 95 percent compliance. Qualys achieves similar compliance rates if we maintain regular monthly patching. While the compliance numbers haven't changed significantly, Qualys offers greater automation, eliminating the need for manual checks on individual machines. This automation is a significant advantage over our previous system.

We are using Qualys Patch Management in parallel with our Vulnerability Management solution.

Qualys Patch Management has reduced our organization's risk by almost 90 percent.

Our primary use case for Qualys Patch Management is vulnerability remediation and running scripts. It helps us detect vulnerabilities in our environment and identify specific patches that are required. If we want to mitigate any vulnerabilities, we can run scripts. It is utilized on a very large scale in our organization.

Before Qualys Patch Management, the challenge that we faced was that we were able to detect the vulnerabilities using Qualys VMDR, but mitigation was not easy. Qualys Patch Management helped us to identify which specific patch is required and which patch is missing from our environment. Most of the time, we considered the most suited patches to make sure that all the vulnerabilities get remediated but that was not always the case. We also wanted to see the old patches that were missing. Qualys Patch Management helped us there.

Qualys Patch Management helped us to automate processes. We did not have to do anything manually. All we had to do was write a particular query command, and based on that, we could time or schedule our patches. If a patch is not properly installed or is crashing on the system, there is the ability to roll back that particular patch. We can see what caused the problem and fix the issue.

We have an improved vulnerability detection rate, and the remediation timelines have been reduced significantly. Earlier, if 100 vulnerabilities were detected, only 50 might be closed after several months. Now, with Qualys Patch Management, the number of vulnerabilities can drop from 100 to 20 in less than a month.

We have information about the severity of the vulnerability. QDS also gives us a score of the vulnerability severity. Accordingly, we also have the categorization of our assets. Qualys VMDR creates the scoring of the assets for us. It tells us what is the asset criticality and the risk score of the asset. Based on that entire calculation, it helps determine which asset to prioritize and fix. It helps us identify what needs to be prioritized.

We use Qualys VMDR with Qualys Patch Management. It is a combined package. Qualys VMDR helps with detection. The data about the vulnerabilities detected by the agents and the scanners is being fed into the Patch Management model which helps to know how to mitigate them. This integration saves a lot of time and makes business operations easy. As soon as we perform a scan, the data gets populated in the Patch Management module. We can see all the data in the Patch Management module. By entering the asset name or the IP address of the host, we can see all the information already over there. We do not have to sync anything or have to pull anything separately using the APIs.

Qualys Patch Management has removed the requirement of approval from the security team for patches because the patches recommended by Qualys are required from the security standpoint itself. They are not showing any patches for functionality improvement or something like that. That is why the security team's intervention is not required anymore. The patching team can schedule and deploy patches.

We now have a single source of truth. Previously, everyone was relying on their own inventory or reports, so the chances of errors were pretty high because there could be data mismatch. Now that we have a single source of truth, there is less chance of errors. All the teams are seeing the same data.

Qualys Patch Management has not reduced a lot of costs. There is about a 15% reduction. It has improved our patch rate by about 60% over the last one to two years.

We have integration with ServiceNow for ticket management. As soon as the patches have been deployed, tickets are getting resolved. When the rescans happen, there is again a revalidation of whether the vulnerabilities have been closed or not. The process of resolving or closing the tickets is 40% to 50% faster than before.

Qualys Patch Management has reduced our organization's risk by 40% to 50%. 

We use Qualys Patch Management to remediate vulnerabilities. Qualys synchronizes with both the Vulnerability Management, Detection, and Response module and the Patch Management module. This provides a unified view of which vulnerabilities can be patched through Qualys and allows patching to be initiated directly from the VMDR module.

Most Windows security patches are released on Patch Tuesdays and become available to us through Qualys the following day. Once available, we can initiate patching to reduce vulnerabilities within our infrastructure. This process primarily addresses critical security updates from Microsoft and other third-party applications, allowing us to mitigate vulnerabilities using Qualys proactively.

Qualys Patch Management effectively mitigates risks through its risk-based automation, enabling rapid vulnerability remediation.

The integration of Qualys Patch Management with Qualys VMDR allows us to use the same device identification ID for both patch management and vulnerability identification. This enables us to easily determine which vulnerability a patch addresses, access CVE information, and validate patches based on product or product family. For instance, if we have Google applications with vulnerabilities, we can efficiently identify and patch them without searching for specific versions or missions. By selecting assets in Patch Management, we can automatically patch QID-based or family-based vulnerabilities identified by VMDR. This integration streamlines the patching process and provides clear visibility into the vulnerability status of our assets.

Our previous patch management products had communication issues with their agents. Qualys Patch Management utilizes the same agent as their vulnerability management system, streamlining the process. Security agents are more reliable than standard IT solutions, and because our IT team prioritizes agent uptime, patching is more accessible, and risk is reduced within our infrastructure. Qualys Patch Management offers immediate benefits. If a patch requires a reboot, Qualys allows users to initiate one within a specified timeframe automatically. Upon rebooting, the machine reports to the Qualys console and is automatically scanned. If the patch is successfully installed, the console reflects the update within 20 to 30 minutes. This streamlined process ensures efficient patch management and reduces vulnerabilities.

Qualys Patch Management's TruRisk automation allows us to prioritize patching vulnerabilities with available patches. This prioritization helps us focus on critical vulnerabilities and quickly remediate them, improving our security posture. The TruRisk score provides a clear metric to demonstrate the effectiveness of our remediation efforts to leadership, showing how quickly we address critical vulnerabilities and enhance our security.

TruRisk automation enhances data accuracy across business units. Leveraging the Vulnerability Management Tool for Remediation within TruRisk, patching can be initiated based on a risk score mechanism query, which provides the TruRisk score for a specific business unit. A subsequent query determines patch dispatchability, triggering a patch job if applicable. This process can be streamlined using Patch Query Language to efficiently retrieve data and execute accurate patching, reducing risk based on TruRisk scores.

Initially, the IT team resisted using Qualys Patch Management for vulnerability remediation due to its critical importance. However, after we demonstrated how integrating Patch Management with Vulnerability Management provides a single report and effectively reduces vulnerabilities, we convinced them to adopt it. This consolidated approach enhances efficiency and streamlines patch management throughout our organization.

Qualys Patch Management significantly improved our patching rates. Qualys provides access to exclusive security patches and boasts a comprehensive knowledge base covering a wide range of applications, including third-party software like Google Chrome, Edge browsers, and SQL. As Qualys expands its knowledge base, our patch management rates continue to improve. Furthermore, the Qualys support team has been instrumental in helping us resolve patching issues, such as installation failures, by efficiently identifying the root cause, whether it stemmed from network problems or the Qualys platform itself. With their assistance and the robust Qualys product, we have successfully mitigated these challenges.

Qualys Patch Management has significantly reduced our organizational risks. Previously, when using other solutions, our patch percentage was low, resulting in high risk. Qualys Patch Management, integrated with VMDR, immediately improved our patch percentage. Features like patch initiation, recurring patches, scheduling, and randomized patch downloading have been crucial in mitigating risk, especially for employees working from home with network issues. The randomized download option ensures patches are successfully downloaded even with interruptions, resuming automatically when the network connection is restored. These capabilities ensure Qualys Patch Management effectively reduced our organizational risk by 88 percent.

We use Qualys Patch Management to patch our servers, which run on both Linux and Windows operating systems.

We implemented Qualys Patch Management to identify and address operating system vulnerabilities.

A risk-based approach to automation prioritizes addressing vulnerabilities according to their criticality, ensuring that the most significant risks are mitigated first.

The integration of Qualys Patch Management and VMDR is crucial because it automates the process of identifying and deploying necessary patches and configuration changes to address vulnerabilities. This automation minimizes manual intervention, streamlining both patching and vulnerability scanning. The integrated system automatically generates reports that include vulnerability details and their corresponding Software Development Lifecycle phase, along with patching status and the number of systems patched across production, DMZ, and VOD environments.

We used to do manual patching, which took more time to complete. With Qualys Patch Management, we have reduced the time it takes to patch. We can now perform patching with a single click and obtain a report of the patch application. We saw the benefits of Qualys Patch Management within seven months.