Qualys TotalCloud Reviews

I have been using Qualys TotalCloud for two years.

My main use case for Qualys TotalCloud is vulnerability management.

As a specific example of how I use Qualys TotalCloud for vulnerability management, it creates a Jira ticket for any vulnerability that it finds in our containers, as well as in any of our platforms and other cloud resources.

The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances.

In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.

Qualys TotalCloud could be improved by enhancing the UI/UX experience; the console interface looks very outdated and should be more modern. Additionally, there should be direct developer remediation, as it lacks automated pull request generation for infrastructure fixes in GitHub, leaving manual patching work for the developers.

I have been using Qualys TotalCloud for two years.

Qualys TotalCloud is stable because we are very happy with the results. It has no downtime currently, so we have been scanning. It depends on whether we are using the back-end collection, but it has a lot of scanning mechanisms, which are agentless APIs, eBPF, and cloud agents, that are highly reliable.

Qualys TotalCloud's scalability is highly scalable because it has multi-cloud API connectors, and it does Kubernetes and container scaling. It reliably ingests and processes security telemetry for large multi-cloud environments. Though security teams operate at a massive scale, we expect occasional lag during heavy data indexing cycles.

Customer support with Qualys TotalCloud needs a little improvement with the response times. Other than that, they are technically capable, but occasionally they are slow on low-tier tickets.

I used a different solution previously, but I cannot disclose the name of it. Comparing it with TotalCloud, it allowed our team to shift from volume scanning to context-aware risk management. Qualys TotalCloud was a better solution for us.

I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, and it scales well with a stable infrastructure. I think it is highly dynamic.

I was not involved in the investment part of it, but I definitely know that it has delivered a high return on investment based on the drastically reduced triage labor and tool consolidation, rather than reducing the headcount outright.

I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, and it scales well with a stable infrastructure. I think it is highly dynamic.

My overall impression of the combination of detection and protection features in Qualys TotalCloud is that we were using another vulnerability management tool. The reason we changed was because Qualys has risk prioritization, CVE depth, and unified patch management. It is excellent at cutting down on false positives using runtime network context, and it focuses on pipeline prevention and guided workflow remediation.

TruRisk has fundamentally shifted our cloud security from reactive vulnerability management to targeted, business-context risk reduction. Instead of just flagging an isolated CVE, TruRisk tells us a narrative, such as, "This isn't just a CVSS flaw; it is a publicly accessible virtual machine running an actively exploited vulnerability with root privileges." TruRisk insights isolate 2% to 3% of workloads.

Using TruRisk to mitigate noise from raw CVEs has transformed our vulnerability management, shifting teams away from basic CVSS scores and toward risk-driven reduction. In practice, relying strictly on CVSS results in an overwhelming alert volume, with 40% to 50% of the environment labeled as critical. TruRisk typically reduces the actionable queue to the top 2% to 5% of assets that pose a real operational danger.

FlexScan has strong, multi-layered visibility across diverse environments by letting us blend agentless and agent-based assessment methods into a single view. Its overall comprehensiveness varies slightly depending on the specific tier of my stack. For us, it is mostly the container and Kubernetes environment, and the visibility is in-depth. Combining eBPF sensor technology allows for deep execution monitoring inside Kubernetes pods and hosts. It also scans container images, registries, and infrastructure as code before deployment, catching flaws upstream.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS environments. This is achieved by CSPM, CWP, and SSPM for a unified engine. For example, in IaaS, an S3 bucket or a GCP storage account might be restricted to internal access. However, if a user lacks MFA or has compromised credentials with wide-ranging read access to both SaaS and cloud infrastructure, TotalCloud will flag this combination as a risk factor. Seeing identity and infrastructure together prevents attackers from abusing over-privileged SaaS accounts to pivot to IaaS assets.

Automating the risk-based triage with Qualys TotalCloud has freed up significant engineering bandwidth every week. This lets the team focus on proactive security architecture, platform automation, and strategic initiatives rather than manual ticket triage. There were around 10,000 tickets, but we are now able to track them sooner and faster and assign them to the correct teams to fix.

Once it is set up, Qualys has proved to be one of our greatest assets. I rate this product an overall 8 out of 10.

We are cloud providers and cloud partners that provide services to customers, so we monitor cloud assets, vulnerabilities, and security misconfigurations of instances using Qualys TotalCloud. We also host multiple websites and monitor website vulnerabilities.

We use Qualys TotalCloud on a weekly basis to generate reports and check for misconfigurations or vulnerabilities.

We also use Qualys TotalCloud for website vulnerabilities such as cross-site scripting and SQL injection, as well as TLS version inspection to determine if old versions are supported, and for SSL security and SSL scans.

For more accurate information, we are using the agent among Qualys TotalCloud's flexible scanning options.

We have achieved timely patching of vulnerabilities with Qualys TotalCloud and are increasing our security scorecard, which is beneficial for customers to monitor. Our scorecard is above 90.

Previously, our security scorecard was around 75, and after using Qualys TotalCloud, we are maintaining it at 90, which represents an increase of about 17 points and varies between 92 and 93 sometimes.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS, and this unified view has positively affected our overall cloud security posture management, as previously our security scorecard was 75 and has been increased to around 90 to 93 after vulnerability remediation and applying all patches.

Qualys TotalCloud has helped my team identify hidden exposures related to cloud, runtime, data, identity, SaaS, application, or Shadow AI before they become exploitable risks through our weekly reports from Qualys and timely patching, along with scheduling patch updates.

The best feature Qualys TotalCloud offers is its multi-cloud visibility, allowing us to view all three clouds at a time in a single console.

Multi-cloud visibility saves time and makes things easier, as we can also have comparability to see what configuration differences have been made from cloud to cloud.

Some features such as remediation for vulnerabilities and recommendations stand out regarding Qualys TotalCloud.

Qualys TotalCloud's AI capabilities are good in terms of governance and security, as it is following governance requirements.

For assets with high vulnerability scores such as older OS versions or older application versions such as Apache or Tomcat, we patch them step-by-step based on TrueRisk information, planning the steps one by one and taking a backup of everything.

TrueRisk is helpful for prioritizing vulnerabilities based on risk instead of raw CVEs, allowing us to remediate high-risk issues first by comparing the risk, making it very helpful.

FlexScan provides comprehensive visibility across our on-premises, multi-cloud, and container environments, ensuring there are no gaps.

Qualys TotalCloud can be improved in terms of initial configuration, as it would be somewhat complex.

It should increase the risk prioritization accuracy in AI regarding Qualys TotalCloud's AI capabilities, especially in terms of accuracy and reliability of output.

In my opinion, the combination of detection and protection features in Qualys TotalCloud cannot protect but can only detect.

We have been using Qualys TotalCloud for four years.

Qualys TotalCloud is stable.

Qualys TotalCloud is scalable and can support cloud environments across multiple platforms, but performance and ease of reporting on cost and optimization could be improved as the number of cloud assets and workloads increases.

Customer support for Qualys TotalCloud is good.

I would rate the customer support an eight out of ten.

We have seen a return on investment in terms of our security posture, which has been increased, alongside a good reputation with customers.

We purchased Qualys TotalCloud for GCP and Azure as well.

It is comparatively better than others regarding pricing.

The pricing is reasonable for Qualys TotalCloud without facing any challenges.

Before choosing Qualys TotalCloud, we evaluated options such as Microsoft Security, Palo Alto Prisma Cloud, and Check Point CloudGuard.

I would rate Qualys TotalCloud a nine out of ten. I chose nine because it has better features, better visibility, a better console, and centralized monitoring, along with all the multi-cloud visibility capabilities, and the vulnerabilities shown are accurate with accurate recommendations. Qualys TotalCloud is deployed as a SaaS-based product in our organization.

We use Qualys TotalCloud across multiple products in our company environment, including our AWS environment, container environment, EC2 instances, and containerized workloads in Kubernetes. We have installed Qualys TotalCloud Agent for all of these. We perform only agent-based scanning, not scanner-based or agentless scanning. Agent-based scanning is very useful for us to get instant live vulnerabilities for our cloud environment.

We do not use any detection of malware, crypto mining, or suspicious communications.

Qualys TotalCloud has helped us identify vulnerabilities in our runtime environment, including normal OS vulnerabilities, application vulnerabilities, and kernel updates.

Qualys TotalCloud has significantly improved our visibility and control across Kubernetes because we were lagging in that area compared to our normal endpoints or VMs. Our teams were not able to go deep and perform vulnerability remediation of Kubernetes; they were only re-imaging their images and VMs but not Kubernetes.

We provided teams with reports from Qualys TotalCloud, and they can now remediate everything including container images, workloads, Kubernetes, and the entire OS landscape.

TruRisk and QDS score are very good and represent the best part about Qualys TotalCloud. We get asset and vulnerability scores combined with exploitable things, EPSS score, and CVSS score.

This scoring system eliminates the need for us to do any manual effort because the scores help us prioritize our remediation vulnerability strategy. Teams can prioritize scores from 900 to 1,000 first and then work through critical exploitation items automatically. It provides a single source of truth number.

Qualys TotalCloud has some features where reports have limitations for downloading. In Qualys VMDR, we can download reports with multiple options, but in Qualys TotalCloud, we have to use tags and only some IP addresses reports are available. The reporting strategy is a limitation.

When I compared Qualys TotalCloud with Upwind, I noticed that the visualization could be better. Attack pattern analysis is helpful, but the visualization capabilities could be improved.

I have been working with Qualys TotalCloud for two years.

No maintenance is required for Qualys TotalCloud. The agent is reliable and there are no loopholes or crashes with the agent data. I have not seen any lagging or crashing with Qualys TotalCloud.

Qualys TotalCloud appears scalable for our environment. Our environment is short in scale, so I cannot really speak to full scalability, but given our current environment, Qualys TotalCloud performs well.

I have contacted technical support or customer support once or twice, primarily when an agent was installed from their end but we were unable to verify it on our end. The quality and speed of the support was quite good.

Within one to two days they requested data, and once they gathered the data, we requested a call with them. Within three to four days they set up a call with my team and the Qualys team. On a scale from 1 to 10, I would give their support a score of 9.

The initial deployment and installation of Qualys TotalCloud is easy. Installation is straightforward. Once we share the YAML file or use one of two or three installation methods with commands, it is only one to two days' work for the team responsible for getting agents into their environment.

I have used Upwind as an alternative. Both solutions have different use cases. I have been using Upwind for only three months because we are on a trial.

Upwind has introduced new features such as continuous workflow visualization showing how attacks are performed. For any vulnerability such as recent PHP attacks, they show how attackers targeted it and the visualization is better in Upwind than Qualys TotalCloud.

I have 10 years of experience in my current field overall. I have not seen any problems with risky configurations or excessive access in Qualys TotalCloud. Overall, I would give Qualys TotalCloud a score of 9 out of 10.

I mainly use Qualys TotalCloud for vulnerability management and cloud security to identify vulnerabilities in cloud assets, assess their severity, prioritize remediation, and track the overall security posture.

When reviewing cloud assets for newly identified vulnerabilities, I check the vulnerability details and severity in Qualys TotalCloud, prioritize the high-risk findings, and share the remediation requirements with the relevant team while following up on progress.

I found the visibility provided across cloud assets useful in Qualys TotalCloud as it made it easier to identify high-risk vulnerabilities, prioritize them based on severity, and track the remediation with the relevant teams.

The AI governance and security capabilities of Qualys TotalCloud are useful, especially for visibility and risk control. From my experience, I primarily value having visibility into AI-related assets and configurations and being able to identify security or compliance risks. The risk-based approach also helped me prioritize the issues that needed attention first.

The best features Qualys TotalCloud offers are cloud asset visibility, vulnerability assessment, and risk prioritization. This risk-based prioritization helped me quickly identify high-risk vulnerabilities and focus on remediation instead of going through every finding. TrueRisk-based prioritization is useful for understanding which vulnerabilities need attention first.

It improved our workflow mainly by giving us a single view of cloud assets and their risk, so we could focus on the higher priority vulnerabilities instead of reviewing every finding manually. This helped us prioritize remediations more efficiently and reduce the time spent on vulnerability assessment and follow-up.

Qualys TotalCloud helped us identify exposures that might otherwise have been missed, especially across cloud assets, vulnerabilities, and identities. With the SaaS configuration, the unified inventory and risk view made it easier to connect vulnerabilities with asset criticality, exposure, and access permissions, allowing us to investigate high-risk exposures first and address them before they could become bigger security issues.

One thing that could be improved is the user experience and navigation. With the amount of information available, it can sometimes take a few extra steps to get to the exact vulnerability or asset details that I needed. I believe that is the only improvement needed.

I have used Qualys TotalCloud for one year.

Qualys TotalCloud is stable according to my experience, and I did not find any downtime or related issues.

I had a good experience with the scalability of Qualys TotalCloud because it scales very well as the number of assets or cloud workload increases.

We did not use a different solution before Qualys TotalCloud.

I recommend starting with a clear asset and inventory and properly configuring the cloud connector first. Once the environment is visible, it is important to spend time understanding TrueRisk prioritization instead of treating every severe finding equally. The initial setup and tuning of connectors, permissions, and policies is also important.

I do not have any relevant metrics available, but I can definitely say Qualys TotalCloud has saved our time by giving us better asset visibility and risk-based prioritization, as it has reduced the time spent manually reviewing CVEs and deciding what to address first.

I found the overall asset visibility with the unified risk view useful, as having vulnerabilities, cloud assets, and risk context in one place made investigation easier and reduced the need to switch between different tools.

It has helped me focus on the vulnerabilities that actually needed attention instead of treating every finding equally, as I used the risk score and asset context to identify higher risk issues first, making it easier to prioritize remediation and reduce the time spent manually reviewing lower risk findings.

I found the output generally reliable for identifying and prioritizing security risks, as the results were useful for deciding which findings needed attention first, although I would still validate the important findings before taking any remediation actions.

It helped identify a smaller set of assets with higher TrueRisk scores. I use that information to prioritize those assets for further investigation, review the vulnerabilities and exposures contributing to the score, and coordinate remediation with the relevant teams. This helped us focus on the assets with higher potential impact instead of treating all vulnerabilities equally.

TrueRisk helps reduce the noise from raw CVEs by putting them into business and threat context. Instead of treating every high severity CVE equally, we could focus on vulnerabilities that were actually more likely to be exploited or affect important assets, which made prioritization and remediation much more efficient.

Overall, I have a positive impression of the combination of detection and protection features in Qualys TotalCloud. The main advantage for me is having vulnerability assessment, cloud posture monitoring, and risk prioritization in one platform. Compared with more point-focused solutions, Qualys TotalCloud gives us a more unified view which makes it easier to prioritize risks and decide what needs attention first. I rate this review a 10 out of 10.

At the moment, the organization where I work, Alior Bank, is using Qualys TotalCloud, although in the past we used Nessus Professional, which we dropped about two years ago. It was Professional, not the enterprise Tenable version, just Nessus.

I have been familiar with Qualys TotalCloud from the beginning of the implementation in our bank, which was in 2024 when we purchased it and started implementing it. I am part of the implementation and current management of Qualys TotalCloud.

Regarding Kubernetes and containers, I don't recall if it's part of Qualys TotalCloud or a different component.

We are utilizing Azure and GCP with Qualys TotalCloud.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS.

This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score.

The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified.

Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.

Improvements in Qualys TotalCloud could include technologies to cover compliance scanning, such as CIS benchmark scanning. It is somewhat difficult to set up Qualys TotalCloud properly for certain technologies. Additionally, while they moved to UI4, which is nicer, some parts of Qualys TotalCloud dashboards still look very old. You can switch between those interfaces and adopt them because some things are better in the new one, while others are not.

Overall, Qualys TotalCloud is a stable solution. I remember encountering a problem once, which was an issue for the whole EU2 platform and affected tenants on Qualys TotalCloud placed in EU2 areas. As I saw on the status page, it was only a problem in Europe, not in America or Asia.

Regarding technical support from Qualys, they respond, but the response time can be too long. Sometimes we need to wait weeks for solutions to simple questions.

If I had to rate Qualys support based on my experience from one to ten, I would say around six or weak seven, perhaps six plus.

It is difficult to compare the helpfulness of written explanations with other solutions as we used Nessus for a few years. We only had two or three years of experience with that support, and it was simply Nessus Professional and not Tenable Enterprise, so I could not make a comparison. However, currently we have very good support from our integrator, plus the support from Qualys itself.

Regarding deployment of Qualys TotalCloud, the installation of Cloud agents was given to administrators from each team who manage servers and workstations, including components in Azure or GCP cloud. This was not handled by me or my team, as I work in the cybersecurity department. We manage the use of Qualys TotalCloud, but installation is up to the administrators, and we provide them support.

Currently, in the cybersecurity department, we have two people involved in the deployment of Qualys TotalCloud, along with over one hundred administrators involved in implementing and installing agents on the machines.

The deployment of Qualys TotalCloud within our organization was a continuous process. However, the installation of Cloud agents on the machines took place within two to three months, about a quarter.

The benefits we see are related to cost reductions.

For a mid-size bank like ours, the licensing cost for Qualys TotalCloud is cheap. Tenable Enterprise costs double that of Qualys TotalCloud and Rapid7. We explored those three solutions and decided to go with Qualys TotalCloud.

Qualys TotalCloud provides written explanations to help guide remediation paths and eliminate cyber risks in our organization. I would rate this review an eight overall.

A specific example of how I use Qualys TotalCloud with my Azure assets is that we installed the Azure connector to monitor our accounts and registration apps that we have in place.

Since having that single pane of glass view, it has helped us save time and money when giving full reports to management and leadership.

This unified view has affected our overall cloud security posture management by putting it all in one spot, making it very easy to provide all the information needed to our stakeholders, leadership, and management.

Based on the TruRisk information, I was able to patch those critical vulnerabilities with high reliability.

Qualys TotalCloud has helped my team identify hidden cloud, runtime, data, identity, SaaS, application, or shadow AI exposures before they became exploitable risks.

Regarding full reliability, I value seeing what is out there and having it verified with what I can see from my side in the portal view for Azure. For product support, I value the support regarding what products are available to sync with the product.

Qualys TotalCloud's AI capabilities are well designed and I do not see any problems with the use case for using the agents.

I find Qualys TotalCloud's AI capabilities to be completely accurate and completely reliable.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS.

The solution's TruRisk Insights feature has found a small number of assets with high vulnerability scores.

My experience with using TruRisk to mitigate noise from raw CVEs has been extremely effective. I find it beneficial to use the QIDs over the CVEs, and the descriptions of those provide more information on the CVEs that are combined in the QID.

I assess the comprehensiveness of FlexScan in providing visibility across our on-premises, multi-cloud, and container environments as very convenient.

What made me switch from Tenable to Qualys TotalCloud was the ability to have everything shown in one area and to generate tickets for everything we need.

Our main use case for Qualys TotalCloud is to secure our multi-cloud environment containers and workloads across AWS, Azure, GCP, and OCI as a single control plane.

Having a single control plane helps my team manage those multi-cloud environments more efficiently because it allows us to consolidate multiple cloud assets, configurations, and security postures into a single dashboard.

We also use Qualys TotalCloud to automate remediation plans, which offers one-click fixes and workflows that automate the resolution of misconfigurations quickly.

The FlexScan feature has benefited our environment because we recently found a vulnerability rated high to medium risk in our assets, which we were able to discover and fix using Qualys TotalCloud.

Qualys TotalCloud positively impacts our organization by helping to minimize downtime in relation to asset scanning and by improving the overall cyber inputs in the enterprise.

Since using Qualys TotalCloud, we have noticed faster remediation times and improved compliance because the single scanning dashboard allows us to see all our assets in multi-cloud as well as on-premises deployment, which helps the cyber team quickly remediate any open vulnerabilities across different assets.

I chose a rating of nine out of ten because there is a complex interface that sometimes overwhelms new engineers. One would need additional training and learning to cope with day-to-day activities, and I feel they can improve the overall layout of the console for initializing scans across different assets.

Qualys TotalCloud is deployed on-premises in our physical data centers.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS, and this unified view has helped our overall cloud security posture management by reducing false positives in our scanning results. Qualys has made the scanning and performance of all assets quite effective.

The TrueRisk Insights feature has helped in unified risk prioritization by consolidating vulnerabilities, misconfigurations, and threat intelligence into a single risk score, allowing our team to fix critical issues first.

I assess the comprehensiveness of FlexScan in providing visibility across our on-premises, multi-cloud, and container environments as excellent because it allows our organization to combine agentless scanning for quick setup with agent-based scanning for deep continuous operating system inspections.

Qualys TotalCloud has helped my team identify hidden cloud, runtime, data, identity, SaaS, application, or Shadow AI exposures before they became exploitable risks by providing a single control plane that reduces the need for separate security tools for different cloud vendors.

We are using Qualys TotalCloud's flexible scanning options, specifically agent-based scanning, to improve coverage across long-lived and ephemeral cloud workloads.

My advice for others looking into using Qualys TotalCloud is to be vigilant about the vulnerabilities that emerge and to have a remediation plan in place, as Qualys TotalCloud may trigger a lot of risks and vulnerabilities across many different assets in a multi-cloud environment. I provide this product with a rating of nine out of ten.

I use Qualys TotalCloud for cloud security posture management across AWS and Google Cloud. I use this tool for compliance and other purposes. I scan AWS and Azure for S3 buckets, security groups, unencrypted databases, and generally for IAM roles. It helps in terms of securing the data. I also use CIS benchmarks as a standard for hardening cloud posture management. Qualys TotalCloud helps to ensure I am enforcing the CIS benchmarks automatically.

For the TrueRisk insights, it provides context-aware prioritization of findings, asset criticality, risk trends, and real-time exposures of risk parameters. It ensures I can make informed decisions with higher management.

FlexScan helps me run targeted, on-demand cloud security checks instead of waiting for full scheduled scans. It allows for immediate results on risky configurations or vulnerabilities after major configuration changes. I use it to validate checks post-scan.

TrueRisk Eliminates helps in lowering risks from the organization's context by comparing with global standards. Though not used extensively, it aids in reducing exposure ratings or ensuring compliance.

One of the valuable features of Qualys TotalCloud is its recurring scanning patterns, which detect misconfigurations, risky configurations, and weak IAM policies. The tool automates the maintenance of CIS benchmarks at scale, which is very useful. Qualys TotalCloud serves as a single-point tool integrating various modules such as VM and policy compliance and security, providing a holistic view of my security posture.

Qualys TotalCloud provides threat intelligence feeds or threat integration, enabling me to mix data with other modules to identify recurring vulnerabilities or threats I face in my organization.

From a downside perspective, the UI is not user-friendly and feels dated compared to other tools like Prisma Cloud. The navigation is difficult in terms of understanding risk relationships. Attack path analysis is another area needing improvement. It struggles to predict how attackers may move through phases. Automating remediation could also be improved, as many tasks remain manual. The lack of data load speed sometimes leads to system lags. Customizing reports based on business standards is cumbersome. Pricing is high compared to competitors.

Installation could be simplified with fewer integration issues. Documentation focused on detailed user cases with if and else scenarios would be beneficial.

I have been using Qualys TotalCloud for the past four years with different organizations. I have been with two organizations in the past four years and have been using it at both.

It happens not very often, but sometimes it does occur. In terms of stability, I could say Qualys TotalCloud operates at 95% of the time, and the rest 5% depends on how I manage it.

From a scalability standpoint, I could say it is 90% scalable. The remaining 10% presents a challenge that Qualys could address.

From a technical support perspective, those individuals are competent enough to provide information regarding the product. They offer level one support initially, escalating as needed. They respond quickly if issues are marked as high priority. I would give them 8.5.

I used Prisma Cloud previously. Prisma Cloud has better navigation and UI compared to Qualys TotalCloud. However, I have taken a whole package of Qualys and tend to use it.

In terms of installation, it could be simplified compared to other tools due to its packaging and tooling. A lack of specific help articles and integration issues are present. From a security standpoint, it is good but requires time.

For one of the organizations, I partnered with Qualys as a team since I have large projects. They assisted with a global rollout.

Pricing compared to competitor tools is high. My costs depend on asset subscriptions. Pricing remains constant regardless of asset utilization, whereas other tools employ a credit system.

Prisma Cloud and similar tools have slight variations in flow but follow the same frameworks. Prisma Cloud offers user-friendly navigation that is better than Qualys TotalCloud.

From a technical support perspective, those individuals are competent enough to provide information regarding the product feel. They provide level one support first to understand better. If they cannot resolve the issue, they can escalate it to the next level and come on a call. However, it does not make sense for them to escalate if it is a medium or low priority issue; they address those according to their SLAs. From another perspective, there could be some downsides. In my opinion, this is the best tool. My overall review rating for Qualys TotalCloud is 8.

My main use case for Qualys TotalCloud involves using modules such as VMDR, CSAM, and the Cloud agent module.

A specific example of how I use one of those modules in my day-to-day work is that we scan our assets in our environment, and we have the inventory management in CSAM that tags the assets with the owners, and then that's how we leverage findings for remediation.

We are using Qualys TotalCloud's flexible scanning options, specifically doing IP scanning and the cloud agent scanning for workstations.

Qualys TotalCloud has positively impacted my organization, and it has been amazing.

The positive impact includes that the cloud agent will reduce most of the administrative work where we currently perform a lot of administrative work in terms of network scanning for our percentage in place, and it will remove all the burdens.

The best feature I appreciate about Qualys TotalCloud is the cloud agent merging feature, which is very good.

The cloud agent merging feature benefits my work by ensuring that if an asset has been scanned by a scanner, then once the agent is installed, the UUID, which had the information from the scanner, merges all the information with the cloud agent findings.

Qualys TotalCloud's TruRisk insights feature has found a small number of assets with high vulnerability scores, and once we have the QDS score more than 80 or 90, we start our remediation plans.

When we see those high QDS scores, we typically engage the different lines of business and businesses for remediation actions as we have different LOBs remediation teams and a patch team.

My experience with using TruRisk to mitigate noise from raw CVEs has been great.

Qualys TotalCloud can be improved in the integration piece, especially with ServiceNow, where there's a bidirectional sync integrated, as there is no native capability from Qualys that can give monitoring metrics of how many assets came in and how many failed or were not properly reconciled or combined.

I have been using Qualys TotalCloud for one year.

Qualys TotalCloud is stable.

Qualys TotalCloud's scalability is great.

The customer support is great, but I would rate it 8 out of 10 for the customer service.

We were using Tripwire, and before I joined the team, it was already planned to migrate from Tripwire to Qualys TotalCloud.

Before choosing Qualys TotalCloud, I think we were looking at Tenable, but I am not certain.

I rate Qualys TotalCloud overall as 8.5 out of 10 because of the integration issue we have right now with ServiceNow and CMDB, as there are no monitoring metrics available for us to monitor the integration flow.

Regarding Qualys TotalCloud's AI capabilities, I think it uses some of the open-source LLMs, so I have to take a closer look at what guardrails are present on the Qualys side before we get that agent in our environment.

I would advise others looking into using Qualys TotalCloud to use the cloud agent and the items.

Qualys TotalCloud is our main tool for replacing our entire SOC. Our primary objective is to start working on handling the network vulnerabilities we have identified in a more practical way, trying to identify what is most important for us, considering that currently in our network we have many alerts.

Qualys TotalCloud has had a positive impact on our organization so far, even while it is still in the implementation phase, as I believe that Qualys' tools will optimize what we currently have. We use a competitor that has been meeting our needs, but when we identified this possibility of change, we believed it would serve us better through the use of artificial intelligence together with the prioritization in addressing some vulnerabilities.

At this moment, we have experienced a motivational impact on my team. Qualys TotalCloud has not yet identified hidden exposures in cloud, runtime, data, identity, SaaS, applications or shadow AI risks because it has not been implemented. We will implement it in December, and in the tests, it worked very well and generated high expectations.

The best features that Qualys TotalCloud offers are the use of artificial intelligence in vulnerability handling to identify what is most important, which is my main focus and objective.

Qualys TotalCloud helps to prioritize vulnerabilities primarily through prioritization in the handling of vulnerabilities, which I consider to be the most important feature.

Regarding the AI features of Qualys TotalCloud, I found it quite interesting because it gives autonomy to manage and govern security in a more centralized way, bringing good results for the institution.

The accuracy and reliability of the results from the AI features of Qualys TotalCloud, based on the tests we carried out, were very advantageous and very satisfactory, which is why we are moving forward with migrating to the tool to use all Qualys tools.

I rate the breadth of FlexScan in providing visibility into on-premises, multicloud, and container environments as fantastic. I found it to have enormous coverage, currently much better than what we have available in our environment.

Although we have not yet implemented the tool, in the tests we are very hopeful and believe Qualys TotalCloud's flexible scanning options, such as agent, agentless, API, network, runtime, serverless, snapshot or eBPF-supported approaches will be very comprehensive for the services we currently use and will improve coverage of cloud workloads.

I believe Qualys TotalCloud can be improved by allowing the customer to create their own intelligence agent to meet their specific demands, instead of using only the agents already created in the tool.

The improvement needed in Qualys TotalCloud is mainly in the artificial intelligence automation agents, where we can customize and create what meets our needs, not necessarily having to use those provided in the tool. I rate it a nine because the possibility of creating my own intelligence agents is what is missing for it to be a ten.

We are currently in the implementation process of Qualys TotalCloud and should start using it at the end of the year.

I believe that Qualys TotalCloud is stable, but we have not yet completed the implementation.

According to the tests and analyses we have already carried out, the scalability of Qualys TotalCloud apparently will meet all our expectations. We are looking at coverage throughout Brazil since our company currently operates in all Brazilian states, so it will meet our current needs.

Qualys' customer support so far has been satisfactory. On a scale from one to ten, I would rate customer support a ten.

We currently use Sophos in our solutions, and we were introduced to Qualys by one of your partners in Brazil, e-Safer, and we are going to migrate.

Qualys TotalCloud is implemented in our organization through a public cloud.

I have not obtained any return on investment yet because, as I mentioned earlier, it has not yet been implemented in the institution.

My experience with pricing, setup costs, and licensing for Qualys TotalCloud is that the costs are very competitive. In our case, replacing the tool will give us better functionalities without increasing the cost compared to what we pay today for the competitor.

Before choosing Qualys TotalCloud, I did not necessarily evaluate other options. We already use Sophos in our environment and that is why we are changing.

We currently use Oracle Cloud as our cloud provider. I would rate Qualys TotalCloud a nine on a scale from one to ten.