

Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
The AI features that they have and with which we can rewrite the pipeline and troubleshoot issues significantly saved time.
By adopting templates and various different pipelines across our own IDP platform, we have saved upwards of 30 to 40% of development time.
With Harness, the release process decreased from three or four hours to one or two hours, making deployments much quicker.
We have rarely faced issues with Harness tech support.
We have not faced any customer support issues, with tickets resolved in less than a four-day SLA.
There was an instance when I faced issues with third-party plugins, and after raising a support ticket, they responded in a few hours with a documentation link that resolved my issue.
They have various options in the vulnerability management process, and when we initially bought our license, we didn't realize we needed PCI for better results, which isn't included in the default configurations.
Once we purchase the license, we have access to top-notch support.
I have dealt with Qualys's technical support, and any enhancements are challenging.
Our entire organization uses it with hundreds of applications, and it supports this scale effectively.
It is able to work on our infrastructure side, which is EKS, and we are able to handle our organization growth effectively for an enterprise use case.
When I integrated Harness to more than 20 applications in one place, it becomes less stable.
My concern remains the lack of deep dive analysis and that it produces similar vulnerability results as other tools such as Nessus based on version checks instead of real impact checks.
It is licensed for assets, so we just contact the team for additional licenses if needed.
At one point, there was a limitation on reporting for 100,000 assets at a time.
Harness is completely stable, and we are using it in production without facing any stability issues at all.
We have rarely faced issues with Harness tech support.
Harness is decently stable.
There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code.
Improved documentation and onboarding tutorials would help accelerate adoption.
Harness can be improved by providing more clarity on the credits it issues for Harness Cloud, as it has a tiered pricing structure involving license and credit costs, which can get confusing.
With the growing reliance on AI, Qualys Web Application Scanning should be updated to handle AI-based applications and LLM-based attacks.
Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities.
I would like it to be cheaper because it is a bit expensive compared to competitors like Tenable Nessus.
From what I understand with respect to Harness, licensing and setup costs were relatively low for an enterprise, and the pricing was more catered toward enterprises who would invest in the technology.
The licensing cost is a little bit too high.
They offer discounts on bulk licenses, making it cheaper compared to competitors like Veracode DAST.
I find it a bit expensive compared to other competitors.
Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.
Harness uses AI to suggest errors in case of deployment failures.
The platform also supports cloud-native environments and Kubernetes deployments, making pipeline management easier, and its automation capabilities significantly improve speed and reliability.
If something goes wrong, I can use AI troubleshooting to build or test my fails and analyze the logs, suggesting the fixes.
It effectively detects vulnerabilities like the OWASP Top 10 without any issues in reporting.
Credential scanning is very effective because it goes in-depth into the system, crawling the pages, and reporting on vulnerabilities.
Qualys Web Application Scanning is accurate and provides minimal false positives.
| Product | Mindshare (%) |
|---|---|
| Harness | 0.7% |
| Qualys Web Application Scanning | 1.9% |
| Other | 97.4% |

| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 1 |
| Large Enterprise | 10 |
| Company Size | Count |
|---|---|
| Small Business | 8 |
| Midsize Enterprise | 6 |
| Large Enterprise | 27 |
Harness offers a comprehensive toolset for automating deployment processes and enhancing software update efficiency. It's lauded for its CI/CD capabilities, feature flagging, and real-time deployment monitoring. Key features include an intuitive UI, secret management, and robust rollback functionalities, all contributing to improved productivity and reduced errors in DevOps environments.
Qualys Web Application Scanning offers advanced vulnerability management, progressive scheduling, and seamless integration with DevOps environments. Its user-friendly design enables enterprises to enhance security with comprehensive scanning and detailed forensic insights.
Qualys Web Application Scanning addresses enterprise-level security challenges by providing robust solutions for vulnerability management, penetration testing, and compliance checks. While easing the navigation process, it supports risk mitigation with precise risk ratings, minimal false positives, and detailed reporting. However, it faces challenges with its complex interface, authenticated scanning, and automation features. Integrating smoothly with CI/CD pipelines, it is suitable for continuous and automated scanning, adapting to diverse company requirements.
What are the standout features of Qualys Web Application Scanning?Organizations across sectors like education, banking, and international data centers leverage Qualys Web Application Scanning for conducting penetration testing, scanning web applications, and managing vulnerabilities. It aids in audit security and compliance, identifying threats, and generating user-friendly reports, making it a valuable asset for maintaining strong security postures.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.