Qualys TotalCloud Reviews

I have been using Qualys TotalCloud for two years.

My main use case for Qualys TotalCloud is vulnerability management.

As a specific example of how I use Qualys TotalCloud for vulnerability management, it creates a Jira ticket for any vulnerability that it finds in our containers, as well as in any of our platforms and other cloud resources.

The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances.

In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.

Qualys TotalCloud could be improved by enhancing the UI/UX experience; the console interface looks very outdated and should be more modern. Additionally, there should be direct developer remediation, as it lacks automated pull request generation for infrastructure fixes in GitHub, leaving manual patching work for the developers.

I have been using Qualys TotalCloud for two years.

Qualys TotalCloud is stable because we are very happy with the results. It has no downtime currently, so we have been scanning. It depends on whether we are using the back-end collection, but it has a lot of scanning mechanisms, which are agentless APIs, eBPF, and cloud agents, that are highly reliable.

Qualys TotalCloud's scalability is highly scalable because it has multi-cloud API connectors, and it does Kubernetes and container scaling. It reliably ingests and processes security telemetry for large multi-cloud environments. Though security teams operate at a massive scale, we expect occasional lag during heavy data indexing cycles.

Customer support with Qualys TotalCloud needs a little improvement with the response times. Other than that, they are technically capable, but occasionally they are slow on low-tier tickets.

I used a different solution previously, but I cannot disclose the name of it. Comparing it with TotalCloud, it allowed our team to shift from volume scanning to context-aware risk management. Qualys TotalCloud was a better solution for us.

I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, and it scales well with a stable infrastructure. I think it is highly dynamic.

I was not involved in the investment part of it, but I definitely know that it has delivered a high return on investment based on the drastically reduced triage labor and tool consolidation, rather than reducing the headcount outright.

I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, and it scales well with a stable infrastructure. I think it is highly dynamic.

My overall impression of the combination of detection and protection features in Qualys TotalCloud is that we were using another vulnerability management tool. The reason we changed was because Qualys has risk prioritization, CVE depth, and unified patch management. It is excellent at cutting down on false positives using runtime network context, and it focuses on pipeline prevention and guided workflow remediation.

TruRisk has fundamentally shifted our cloud security from reactive vulnerability management to targeted, business-context risk reduction. Instead of just flagging an isolated CVE, TruRisk tells us a narrative, such as, "This isn't just a CVSS flaw; it is a publicly accessible virtual machine running an actively exploited vulnerability with root privileges." TruRisk insights isolate 2% to 3% of workloads.

Using TruRisk to mitigate noise from raw CVEs has transformed our vulnerability management, shifting teams away from basic CVSS scores and toward risk-driven reduction. In practice, relying strictly on CVSS results in an overwhelming alert volume, with 40% to 50% of the environment labeled as critical. TruRisk typically reduces the actionable queue to the top 2% to 5% of assets that pose a real operational danger.

FlexScan has strong, multi-layered visibility across diverse environments by letting us blend agentless and agent-based assessment methods into a single view. Its overall comprehensiveness varies slightly depending on the specific tier of my stack. For us, it is mostly the container and Kubernetes environment, and the visibility is in-depth. Combining eBPF sensor technology allows for deep execution monitoring inside Kubernetes pods and hosts. It also scans container images, registries, and infrastructure as code before deployment, catching flaws upstream.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS environments. This is achieved by CSPM, CWP, and SSPM for a unified engine. For example, in IaaS, an S3 bucket or a GCP storage account might be restricted to internal access. However, if a user lacks MFA or has compromised credentials with wide-ranging read access to both SaaS and cloud infrastructure, TotalCloud will flag this combination as a risk factor. Seeing identity and infrastructure together prevents attackers from abusing over-privileged SaaS accounts to pivot to IaaS assets.

Automating the risk-based triage with Qualys TotalCloud has freed up significant engineering bandwidth every week. This lets the team focus on proactive security architecture, platform automation, and strategic initiatives rather than manual ticket triage. There were around 10,000 tickets, but we are now able to track them sooner and faster and assign them to the correct teams to fix.

Once it is set up, Qualys has proved to be one of our greatest assets. I rate this product an overall 8 out of 10.

At the moment, the organization where I work, Alior Bank, is using Qualys TotalCloud, although in the past we used Nessus Professional, which we dropped about two years ago. It was Professional, not the enterprise Tenable version, just Nessus.

I have been familiar with Qualys TotalCloud from the beginning of the implementation in our bank, which was in 2024 when we purchased it and started implementing it. I am part of the implementation and current management of Qualys TotalCloud.

Regarding Kubernetes and containers, I don't recall if it's part of Qualys TotalCloud or a different component.

We are utilizing Azure and GCP with Qualys TotalCloud.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS.

This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score.

The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified.

Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.

Improvements in Qualys TotalCloud could include technologies to cover compliance scanning, such as CIS benchmark scanning. It is somewhat difficult to set up Qualys TotalCloud properly for certain technologies. Additionally, while they moved to UI4, which is nicer, some parts of Qualys TotalCloud dashboards still look very old. You can switch between those interfaces and adopt them because some things are better in the new one, while others are not.

Overall, Qualys TotalCloud is a stable solution. I remember encountering a problem once, which was an issue for the whole EU2 platform and affected tenants on Qualys TotalCloud placed in EU2 areas. As I saw on the status page, it was only a problem in Europe, not in America or Asia.

Regarding technical support from Qualys, they respond, but the response time can be too long. Sometimes we need to wait weeks for solutions to simple questions.

If I had to rate Qualys support based on my experience from one to ten, I would say around six or weak seven, perhaps six plus.

It is difficult to compare the helpfulness of written explanations with other solutions as we used Nessus for a few years. We only had two or three years of experience with that support, and it was simply Nessus Professional and not Tenable Enterprise, so I could not make a comparison. However, currently we have very good support from our integrator, plus the support from Qualys itself.

Regarding deployment of Qualys TotalCloud, the installation of Cloud agents was given to administrators from each team who manage servers and workstations, including components in Azure or GCP cloud. This was not handled by me or my team, as I work in the cybersecurity department. We manage the use of Qualys TotalCloud, but installation is up to the administrators, and we provide them support.

Currently, in the cybersecurity department, we have two people involved in the deployment of Qualys TotalCloud, along with over one hundred administrators involved in implementing and installing agents on the machines.

The deployment of Qualys TotalCloud within our organization was a continuous process. However, the installation of Cloud agents on the machines took place within two to three months, about a quarter.

The benefits we see are related to cost reductions.

For a mid-size bank like ours, the licensing cost for Qualys TotalCloud is cheap. Tenable Enterprise costs double that of Qualys TotalCloud and Rapid7. We explored those three solutions and decided to go with Qualys TotalCloud.

Qualys TotalCloud provides written explanations to help guide remediation paths and eliminate cyber risks in our organization. I would rate this review an eight overall.

Our main use case for Qualys TotalCloud is to secure our multi-cloud environment containers and workloads across AWS, Azure, GCP, and OCI as a single control plane.

Having a single control plane helps my team manage those multi-cloud environments more efficiently because it allows us to consolidate multiple cloud assets, configurations, and security postures into a single dashboard.

We also use Qualys TotalCloud to automate remediation plans, which offers one-click fixes and workflows that automate the resolution of misconfigurations quickly.

The FlexScan feature has benefited our environment because we recently found a vulnerability rated high to medium risk in our assets, which we were able to discover and fix using Qualys TotalCloud.

Qualys TotalCloud positively impacts our organization by helping to minimize downtime in relation to asset scanning and by improving the overall cyber inputs in the enterprise.

Since using Qualys TotalCloud, we have noticed faster remediation times and improved compliance because the single scanning dashboard allows us to see all our assets in multi-cloud as well as on-premises deployment, which helps the cyber team quickly remediate any open vulnerabilities across different assets.

I chose a rating of nine out of ten because there is a complex interface that sometimes overwhelms new engineers. One would need additional training and learning to cope with day-to-day activities, and I feel they can improve the overall layout of the console for initializing scans across different assets.

Qualys TotalCloud is deployed on-premises in our physical data centers.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS, and this unified view has helped our overall cloud security posture management by reducing false positives in our scanning results. Qualys has made the scanning and performance of all assets quite effective.

The TrueRisk Insights feature has helped in unified risk prioritization by consolidating vulnerabilities, misconfigurations, and threat intelligence into a single risk score, allowing our team to fix critical issues first.

I assess the comprehensiveness of FlexScan in providing visibility across our on-premises, multi-cloud, and container environments as excellent because it allows our organization to combine agentless scanning for quick setup with agent-based scanning for deep continuous operating system inspections.

Qualys TotalCloud has helped my team identify hidden cloud, runtime, data, identity, SaaS, application, or Shadow AI exposures before they became exploitable risks by providing a single control plane that reduces the need for separate security tools for different cloud vendors.

We are using Qualys TotalCloud's flexible scanning options, specifically agent-based scanning, to improve coverage across long-lived and ephemeral cloud workloads.

My advice for others looking into using Qualys TotalCloud is to be vigilant about the vulnerabilities that emerge and to have a remediation plan in place, as Qualys TotalCloud may trigger a lot of risks and vulnerabilities across many different assets in a multi-cloud environment. I provide this product with a rating of nine out of ten.

I mainly use Qualys TotalCloud for vulnerability management and cloud security to identify vulnerabilities in cloud assets, assess their severity, prioritize remediation, and track the overall security posture.

When reviewing cloud assets for newly identified vulnerabilities, I check the vulnerability details and severity in Qualys TotalCloud, prioritize the high-risk findings, and share the remediation requirements with the relevant team while following up on progress.

I found the visibility provided across cloud assets useful in Qualys TotalCloud as it made it easier to identify high-risk vulnerabilities, prioritize them based on severity, and track the remediation with the relevant teams.

The AI governance and security capabilities of Qualys TotalCloud are useful, especially for visibility and risk control. From my experience, I primarily value having visibility into AI-related assets and configurations and being able to identify security or compliance risks. The risk-based approach also helped me prioritize the issues that needed attention first.

The best features Qualys TotalCloud offers are cloud asset visibility, vulnerability assessment, and risk prioritization. This risk-based prioritization helped me quickly identify high-risk vulnerabilities and focus on remediation instead of going through every finding. TrueRisk-based prioritization is useful for understanding which vulnerabilities need attention first.

It improved our workflow mainly by giving us a single view of cloud assets and their risk, so we could focus on the higher priority vulnerabilities instead of reviewing every finding manually. This helped us prioritize remediations more efficiently and reduce the time spent on vulnerability assessment and follow-up.

Qualys TotalCloud helped us identify exposures that might otherwise have been missed, especially across cloud assets, vulnerabilities, and identities. With the SaaS configuration, the unified inventory and risk view made it easier to connect vulnerabilities with asset criticality, exposure, and access permissions, allowing us to investigate high-risk exposures first and address them before they could become bigger security issues.

One thing that could be improved is the user experience and navigation. With the amount of information available, it can sometimes take a few extra steps to get to the exact vulnerability or asset details that I needed. I believe that is the only improvement needed.

I have used Qualys TotalCloud for one year.

Qualys TotalCloud is stable according to my experience, and I did not find any downtime or related issues.

I had a good experience with the scalability of Qualys TotalCloud because it scales very well as the number of assets or cloud workload increases.

We did not use a different solution before Qualys TotalCloud.

I recommend starting with a clear asset and inventory and properly configuring the cloud connector first. Once the environment is visible, it is important to spend time understanding TrueRisk prioritization instead of treating every severe finding equally. The initial setup and tuning of connectors, permissions, and policies is also important.

I do not have any relevant metrics available, but I can definitely say Qualys TotalCloud has saved our time by giving us better asset visibility and risk-based prioritization, as it has reduced the time spent manually reviewing CVEs and deciding what to address first.

I found the overall asset visibility with the unified risk view useful, as having vulnerabilities, cloud assets, and risk context in one place made investigation easier and reduced the need to switch between different tools.

It has helped me focus on the vulnerabilities that actually needed attention instead of treating every finding equally, as I used the risk score and asset context to identify higher risk issues first, making it easier to prioritize remediation and reduce the time spent manually reviewing lower risk findings.

I found the output generally reliable for identifying and prioritizing security risks, as the results were useful for deciding which findings needed attention first, although I would still validate the important findings before taking any remediation actions.

It helped identify a smaller set of assets with higher TrueRisk scores. I use that information to prioritize those assets for further investigation, review the vulnerabilities and exposures contributing to the score, and coordinate remediation with the relevant teams. This helped us focus on the assets with higher potential impact instead of treating all vulnerabilities equally.

TrueRisk helps reduce the noise from raw CVEs by putting them into business and threat context. Instead of treating every high severity CVE equally, we could focus on vulnerabilities that were actually more likely to be exploited or affect important assets, which made prioritization and remediation much more efficient.

Overall, I have a positive impression of the combination of detection and protection features in Qualys TotalCloud. The main advantage for me is having vulnerability assessment, cloud posture monitoring, and risk prioritization in one platform. Compared with more point-focused solutions, Qualys TotalCloud gives us a more unified view which makes it easier to prioritize risks and decide what needs attention first. I rate this review a 10 out of 10.

I use Qualys TotalCloud for cloud security posture management across AWS and Google Cloud. I use this tool for compliance and other purposes. I scan AWS and Azure for S3 buckets, security groups, unencrypted databases, and generally for IAM roles. It helps in terms of securing the data. I also use CIS benchmarks as a standard for hardening cloud posture management. Qualys TotalCloud helps to ensure I am enforcing the CIS benchmarks automatically.

For the TrueRisk insights, it provides context-aware prioritization of findings, asset criticality, risk trends, and real-time exposures of risk parameters. It ensures I can make informed decisions with higher management.

FlexScan helps me run targeted, on-demand cloud security checks instead of waiting for full scheduled scans. It allows for immediate results on risky configurations or vulnerabilities after major configuration changes. I use it to validate checks post-scan.

TrueRisk Eliminates helps in lowering risks from the organization's context by comparing with global standards. Though not used extensively, it aids in reducing exposure ratings or ensuring compliance.

One of the valuable features of Qualys TotalCloud is its recurring scanning patterns, which detect misconfigurations, risky configurations, and weak IAM policies. The tool automates the maintenance of CIS benchmarks at scale, which is very useful. Qualys TotalCloud serves as a single-point tool integrating various modules such as VM and policy compliance and security, providing a holistic view of my security posture.

Qualys TotalCloud provides threat intelligence feeds or threat integration, enabling me to mix data with other modules to identify recurring vulnerabilities or threats I face in my organization.

From a downside perspective, the UI is not user-friendly and feels dated compared to other tools like Prisma Cloud. The navigation is difficult in terms of understanding risk relationships. Attack path analysis is another area needing improvement. It struggles to predict how attackers may move through phases. Automating remediation could also be improved, as many tasks remain manual. The lack of data load speed sometimes leads to system lags. Customizing reports based on business standards is cumbersome. Pricing is high compared to competitors.

Installation could be simplified with fewer integration issues. Documentation focused on detailed user cases with if and else scenarios would be beneficial.

I have been using Qualys TotalCloud for the past four years with different organizations. I have been with two organizations in the past four years and have been using it at both.

It happens not very often, but sometimes it does occur. In terms of stability, I could say Qualys TotalCloud operates at 95% of the time, and the rest 5% depends on how I manage it.

From a scalability standpoint, I could say it is 90% scalable. The remaining 10% presents a challenge that Qualys could address.

From a technical support perspective, those individuals are competent enough to provide information regarding the product. They offer level one support initially, escalating as needed. I rate them four out of five because they respond quickly if issues are marked as high priority. I would give them 8.5.

Positive

I used Prisma Cloud previously. Prisma Cloud has better navigation and UI compared to Qualys TotalCloud. However, I have taken a whole package of Qualys and tend to use it.

In terms of installation, it could be simplified compared to other tools due to its packaging and tooling. A lack of specific help articles and integration issues are present. From a security standpoint, it is good but requires time.

For one of the organizations, I partnered with Qualys as a team since I have large projects. They assisted with a global rollout.

Pricing compared to competitor tools is high. My costs depend on asset subscriptions. Pricing remains constant regardless of asset utilization, whereas other tools employ a credit system.

Prisma Cloud and similar tools have slight variations in flow but follow the same frameworks. Prisma Cloud offers user-friendly navigation that is better than Qualys TotalCloud.

From a technical support perspective, those individuals are competent enough to provide information regarding the product feel. They provide level one support first to understand better. If they cannot resolve the issue, they can escalate it to the next level and come on a call. However, it does not make sense for them to escalate if it is a medium or low priority issue; they address those according to their SLAs. From another perspective, there could be some downsides. In my opinion, this is the best tool. My overall review rating for Qualys TotalCloud is 8.

My main use case for Qualys TotalCloud is regarding the cloud visibility that we were not having previously.

Previously, we were just looking at critical vulnerabilities and patching them. Now with Qualys TotalCloud, we can distinguish between critical vulnerabilities and what is internet-facing, what is a sensitive workload, and excessive permissions that are given to unauthorized users in the cloud environment. This gives us more visibility towards what is happening in the cloud.

Another use case I have for Qualys TotalCloud is identifying misconfigurations within the cloud environment and how any configurations might impact the organization's cloud assets. Those were the two main use cases.

The integration with Qualys TotalCloud worked very well with tools such as Exonius and Splunk, wherein we were easily getting automated alerts and incidents that we could automate into emails and reach out to stakeholders without manual intervention.

Qualys TotalCloud is definitely helpful for our vulnerability management. It did help in CSPM and also in looking at cloud inventory, not just when a vulnerability or misconfiguration is happening, but I could look at what is happening in my cloud environment, who is really having any entitlements, what access exists, what unauthorized access anyone has, and so on.

Qualys TotalCloud does provide both IaaS and SaaS when it comes to threat assessment.

EASM finds assets that are exposed to the internet such as domains, IPs, applications, and services. When it comes to SaaS, it assesses the SaaS applications and their security posture. We could also look at what SaaS services we are using and what risks they introduce.

We were narrowing the risk and threat down to a much smaller group of assets where multiple factors came together. For example, a highly vulnerable asset that was internet-facing and business-critical had additional exposure of configuration issues. We used those insights to prioritize the assets for immediate remediation.

Qualys TotalCloud is a one security platform where we could leverage the existing Qualys platform and not any other different agent or different platform for cloud visibility and cloud security. We had multi-cloud visibility where both AWS and Azure could be controlled and monitored for misconfigurations and security issues.

We had better integration with tools, which is where Qualys TotalCloud was useful.

TruRisk insights have been useful in helping us move from a traditional vulnerability counting approach to a risk-based approach.

In terms of improvement, remediation still belongs to the cloud team, which is one of the issues we faced with Qualys TotalCloud. Qualys TotalCloud can identify the problem, but changing an AWS security group still requires the appropriate cloud owner or process. If there was also a response capability within Qualys TotalCloud in addition to detection, that would have been better.

The CNAPP capability is a major feature of Qualys TotalCloud, but when you drill down, there are a lot of modules that you need to enable. I think organizations need to know which modules they need for their use case and for their cloud environment usage. This gives the exact implementation strategy as well.

I have been using Qualys TotalCloud for one year.

Qualys TotalCloud is stable.

It is pretty scalable in our organization.

From what I have experienced, I have had interactions with them a couple of times and it turned out to be good. I would give a nine out of ten.

I would give Qualys TotalCloud an eight out of ten rating. The remaining two points I would take out due to the improvements I have mentioned.

The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility.

I would probably do a traditional CVE-based approach otherwise. A large number of vulnerabilities can be classified as critical or high, but treating all of them with the same priority is not practical.

Qualys TotalCloud compares well because it combines breadth and integration. I am pretty sure VMDR gives strong vulnerability visibility. But when we want visibility for the cloud environment, that is where Qualys TotalCloud comes into the picture. The biggest advantage is correlating the findings that we receive from these security tools and through the risk prioritization and managing the entire cloud ecosystem.

Qualys TotalCloud helps with aggregating assets and provides visibility around cloud assets. It also helps with integrating internal on-premises assets, giving you that view. You are able to see vulnerabilities across cloud infrastructure, whether it is AWS or Azure. Qualys TotalCloud can correlate and give you a bird's-eye view of your cloud infrastructure or environment.

Qualys TotalCloud helps you not just to identify misconfigurations, but you can actually also fix issues. You can see issues, identify misconfigurations within your cloud infrastructure, and be able to timely fix these issues.

Some other features I enjoy with Qualys TotalCloud include its integration with Qualys TruRisk, which allows you not just to identify vulnerabilities but to match them to specific use cases, specific signatures, and tell you what to prioritize when fixing them. Qualys TruRisk helps you prioritize issues. It does not just read one vulnerability database; it actually looks at multiple, including Qualys's specific database, and provides you risk prioritization. That is one very fantastic feature that I enjoy with working with Qualys TotalCloud.

I think the compliance frameworks could be enhanced. I am in Nigeria and most of my customers are within this region, and one of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue. If the alerting can be tuned more effectively out of the box, that would help end users not take so much time to redefine policies.

The UI has a lot of data and could use a cleaner dashboard with proper visualization. While you can customize your dashboard, if the out-of-the-box dashboards are more intelligent and updated with visualizations that management can use to assess the health of the infrastructure, that would improve the solution.

I observe that Qualys TotalCloud has improvements to make. From the last time I worked with Qualys TotalCloud, there were some issues concerning agents and no agents.

I have been working with Qualys TotalCloud for three years.

In my opinion, Qualys TotalCloud is cost-efficient.

When looking at Qualys TotalCloud and Prisma Cloud, I believe Prisma does a better job with scanning for infrastructure as code, enabling organizations using the infrastructure as code cloud model to identify vulnerabilities even at the code level. Overall, Qualys TotalCloud is a good solution, and it is catching up. Initially, I knew Qualys as just an on-premises vulnerability management solution, but now they keep upgrading their features, solutions, and dashboards. They are working on minimizing alert fatigue and offering broader compliance coverage, though I believe their compliance coverage is somewhat limited. Currently, I cannot generate compliance reports for some specific frameworks relevant to my region, and if Qualys can enhance that, it will be a significant improvement.

I have Qualys TotalCloud deployed in a hybrid model, running it mostly on-premises but also integrating cloud assets. I would definitely recommend Qualys TotalCloud. Qualys keeps improving and is one platform that continually tests and enhances its offerings. They are doing really well. I give this review a rating of 8.

My use case is for cloud security posture management and for getting alerts as we have onboarded most of our accounts in Qualys. Qualys provides the cloud and identifies misconfigurations in our cloud security module, providing us alerts, and we have integrated many tools into that solution. This helps us maintain our cloud security.

Qualys TotalCloud helps with my cloud security posture management by identifying vulnerabilities at a better early stage because we have deployed it into a CI/CD pipeline. This helps us detect vulnerabilities at the development level only. Before moving into production, it helps us detect the vulnerabilities, close them, remediate them, and then move the code into production. We have integrated that into our CI/CD pipeline.

The best features of Qualys TotalCloud include good threat intelligence and segregation of cloud accounts. Since we have multiple cloud accounts, it provides a segregation overview of all of our cloud accounts. It also has workload protection which identifies vulnerabilities in the Kubernetes environment and in our Docker images.

Qualys TotalCloud provides written explanations to help guide remediation paths and eliminate cyber risks with recommendations. Whenever any alerts or vulnerabilities have been detected by the solution, it provides the resource name, the asset name, and the solution on how to remediate that with all the steps included.

Qualys TotalCloud provides unified vulnerability and threat assessment for both IaaS and SaaS software.

Qualys TotalCloud provides a single prioritized view of risk through the dashboard, which displays all the risks that are identified in our images, Docker images, Kubernetes environment, and cloud security.

I use the TruRisk Insights feature, which is built into that solution. I assess the comprehensiveness of the risks found by the insights to be good due to its threat intelligence, as it identifies most risks whenever they are detected in the wild. It almost detects all the risks that are well-known in the industry. It has also some capabilities of artificial intelligence but not enough to detect any zero-day vulnerabilities.

The areas in the solution that have room for improvement include the UI/UX design, which should be improved, and they should integrate more artificial intelligence into the product.

I have been using Qualys TotalCloud for around three years.

I would rate stability around eight out of ten.

For scalability, I would rate it nine out of ten.

Qualys TotalCloud requires maintenance, but it is managed by the Qualys team.

I would rate the technical support around eight out of ten.

Positive

The deployment was not easy, but with the help of the support team, we completed it.

It took about a week because we had many accounts we needed to migrate, and we needed to check the policies and define our policies. It took time because everything cannot go in one go, so we did it in a phase-wise manner.

It helps us because we have monthly meetings with our leadership team. These graphs help us give the return on investment of the product to the leadership team and also give us an overview of how this product is working, what the thresholds are, and how the configurations are working or not. This helps us determine that.

I would recommend Qualys TotalCloud to other users because it is cost-efficient and has a good return on investment. We can recommend it over other tools available in the market that are more costly.

I find the pricing of Qualys TotalCloud to be cost-efficient as of now. We evaluated three other tools that were more costly than this.

My comparison of Qualys with other vendors is based on the different features we tested. Based on the reports, we implemented the tools into our environment. We conducted proof of concept testing and checked that every tool provides the CSPM feature, the CWP feature, and the IaC feature. Qualys also provides those features. We tested those features with the default policies by running scans. We created some misconfigurations and checked whether they were detected by the tool. We conducted thorough POCs for each solution.

Qualys TotalCloud can be mentioned as a total cloud platform because it has the CWP model and CSPM model.

It has affected my security posture by integrating tools like Jira into that solution, which helps to generate tickets on the development team dashboard and the DevOps team's dashboard. This helps them remediate the findings. We also create weekly reports from the tool, and with the help of the DevOps team, we try to mitigate the risks which helps us manage our security posture.

Currently, there are around fifteen users who are using the solution. I would rate this solution an overall eight out of ten.

Our use case involves the assets that we have under cloud, the assets exposed to the internet, and the internal applications that we create for our organization purposes, where we perform application security testing.

Qualys TotalCloud is an excellent platform. The beauty of the platform is that we can get all the vulnerabilities. For example, if we test multiple IPs or multiple applications via Qualys TotalCloud, we can get all the reports in a single dashboard, and we can also see them segregated. Anybody can check that platform and easily learn about critical, high, and medium findings. They also provide remediation steps in a very appropriate manner.

The main part I love about Qualys TotalCloud is the continuous monitoring and providing legitimate insights. If our management allows, we will document our technical evaluation and provide it to the purchase team for costing. This decision will depend on how expensive the solution is.

Areas that need improvement in every solution include the remediation part. The remediation steps should be simple enough for everyone to understand. For example, if we find a critical or high vulnerability on an IP or server, the remediation steps should be communicated clearly so that different departments, such as marketing and sales, can remediate their servers using simple steps.

This evaluation is under POC and started about 15 to 20 days ago.

Regarding stability, I have tested a few servers, and I believe stability is good right now, so I rate it a nine.

For scalability, I would give it an eight.

Based on our evaluation, I would rate the support a nine.

There is a team of four to five members involved in this testing and evaluation.

Right now, we are using Tenable, specifically Tenable Nessus, as our VAPT tool, and we are seeking different options, which is why we have started the evaluation for Qualys TotalCloud.

You can review the Radware DDoS and Radware WAF. We are evaluating Qualys TotalCloud solution for our VAPT, which deals with vulnerability assessment and penetration testing. This evaluation is under POC and started about 15 to 20 days ago, focusing on our number of assets, servers, and IPs for the VAPT part, as well as the application security part.

It does not exactly provide unified vulnerability and threat assessment for SaaS. We are working under the guidelines of ISO 27001. We generally give the critical IPs and server names to test, and they provide us with the findings which we patch accordingly, as per the remediations.

I have not yet tried the TruRisk Insights feature, but I would love to get those insights.

In terms of detection, they are doing very well. I am more concerned about the detection feature because if anybody detects vulnerabilities effectively, that will benefit our organization. The findings they provide are legitimate vulnerabilities, and regarding prevention, that is on our side. They recommend steps for prevention on particular IPs, and we can only take actions after multiple approvals.

I consider Qualys TotalCloud a premium product, and I have no issues with that. If a product is premium, it typically offers better findings and opportunities. However, if the pricing is excessively high, we need to consider alternatives. A normal price or slightly more expensive is acceptable, but they should also provide good services.

I recommend this product because it supports both on-premises and cloud environments. The report format they provide after VAPT is very accessible, easy to learn, and beautifully presented. This is the best feature of the product. While I think Qualys TotalCloud is premium, I am concerned about the pricing details, particularly the cost per license.

I rate this product a nine overall.

We use Qualys TotalCloud to assess the security posture of our cloud-hosted environment. This tool allows us to access real-time data, categorize assets, prioritize critical vulnerabilities, and establish regular patching policies to mitigate our overall vulnerability risk.

We are eager to utilize Qualys TotalCloud to create a ticketing system integrated with our SecOps module, such as ServiceNow or a similar tool. This integration will enable automated ticket creation following assessments and vulnerability identification within our environments. The system should assign tickets to respective team members, prioritize fixes, and provide comprehensive dashboards for tracking progress and visualizing generated reports.

Qualys TotalCloud provides written explanations to help with remediation paths and eliminate cyber risk, significantly reducing our time spent on these tasks. It ensures that we can minimize manual efforts and prioritize security issues identified by the platform, allowing us to focus on critical areas and improve overall efficiency.

Qualys TotalCloud has significantly improved our organization by automating our reporting processes, reducing the time spent on report creation from two hours to less than fifteen to twenty minutes. It offers complete visibility of our cloud environment, which aids in prioritizing vulnerabilities and security risks effectively.

It provides unified vulnerability and threat assessments across both Infrastructure as a Service and Software as a Service, significantly improving our overall cloud security posture management. Compared to our previous Managed Cloud environment, even within this organization, we have made substantial progress. Previously, we relied on different tools with limited features for vulnerability posture management. However, with Qualys TotalCloud, we have implemented new policies and processes for remediation, resulting in a 70 to 90 percent improvement in our security standards.

Qualys TotalCloud offers a consolidated, prioritized view of risk across our chosen scope, allowing us to focus on specific vulnerabilities and security threats within a single dashboard. This streamlined approach eliminates the need to collate data from multiple sources, improving efficiency and providing comprehensive visibility into our cloud environment.

TruRisk Insights considers multiple factors, including Qualys detection score, asset scoring, risk, and CVSS scoring, to generate a comprehensive priority rating. Additionally, customization options allow for incorporating factors like internet exposure, public accessibility, or intranet presence, further refining the risk scoring and prioritization process.

Vulnerability identification is inconsistent, especially for assets with high vulnerability scores. This is influenced by the environment and project of the asset, and potential oversight during migration between versions. This may lead to a few individuals discovering significant vulnerabilities. However, Qualys' TruRisk Insights can identify the post-migration version of an asset, enabling us to determine the specific vulnerability and appropriate remediation actions, such as patching.

TruRisk Insights has significantly improved our security posture by automating our reporting process. Previously, creating reports required manually identifying assets, categorizing their environment, and calculating scores in Excel, which was time-consuming. Now, with TruRisk Insights, we can generate reports in less than 20 minutes by simply using the Qualys TotalCloud console to download the desired information. 

One of Qualys' best features is its categorization, which allows us to see the types of assets, their security postures, and the AI-powered version of the tool. The AI enhancements simplify vulnerability management by eliminating the need for SQL queries to create policies. Now, we can simply input our requirements, such as critical vulnerabilities in the production environment or specific operating systems, and the tool generates the results accordingly. Additionally, we can create custom dashboards to monitor specific areas of interest, like vulnerabilities affecting a particular OS, exposed ports, majorly targeted vulnerabilities, or the most exploited vulnerabilities in the environment.

Two areas for improvement in Qualys TotalCloud are the speed of the public cloud platform and vulnerability detection. While the public cloud platform is necessary due to the lack of a private cloud infrastructure, page load speeds could be faster. Additionally, vulnerability detection needs improvement, as it currently takes several days for new vulnerabilities to be added to the knowledge base, hindering prompt detection and remediation. Ideally, updates should be more immediate, enabling quicker implementation of solutions.

I have been using Qualys TotalCloud for two to three years.

The stability is excellent, with well-planned maintenance schedules communicated in advance by Qualys. This ensures business continuity and preparedness for any planned downtime.

I would rate the scalability of Qualys TotalCloud nine out of ten.

The Qualys customer support is exceptional.

Positive

The deployment was straightforward, taking less than a day.

The implementation involved four or five team members on our side. It's unclear how many were involved from the Qualys side.

Regarding return on investment, it is going well, although we are yet to complete year-end assessments. Qualys TotalCloud has saved us approximately 15 to 20 percent of our efforts.

Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly.

We evaluated other solutions such as Rapid7 and Falcon CrowdStrike. However, Qualys provides more comprehensive features.

I would rate Qualys TotalCloud a nine out of ten.

We recommend and provide Qualys TotalCloud to our clients in various locations. We also utilize it internally across our global organization, spanning multiple countries in Asia, Europe, the US, and other regions. Therefore, Qualys TotalCloud is deployed globally. We have approximately 850 users with varying levels of access. Many have read-only access to view reports and the status of their environment. However, only a limited number of users have the necessary permissions to perform scans and make changes. The majority of users have read-only access.

Qualys TotalCloud, while generally reliable, occasionally requires maintenance and may experience downtime. Qualys performs its quarterly maintenance, but infrequent issues can arise, perhaps once or twice a year, causing crashes or slowdowns within the system. These rare instances may result in limited or delayed portal access, hindering report generation and dashboard viewing.

As a satisfied user, I recommend Qualys TotalCloud to other organizations or clients. I see myself as biased because I am a fan of the product and extensively use it.