Qualys CyberSecurity Asset Management Reviews

Qualys CyberSecurity Asset Management is definitely good for a big company. It really helps you keep an eye on your whole environment rather than little pieces here and there throughout your tech stack. It really lets you be able to manage everything in one location.

I use Qualys CyberSecurity Asset Management to pull up the end-of-life and end-of-support software to make sure that those that are expiring get remediated and remove any vulnerabilities that are there. I'm looking forward to being able to bring it on full-time to enable the Cloud Agent Passive Sensor to be able to turn all the cloud agents into passive sensors themselves. I also appreciate the EASM aspect of it to check out the external threats that are there and be able to remediate those before they become a problem.

The end-of-life and end-of-support features of Qualys CyberSecurity Asset Management have come in really handy. Our IT department isn't staying on top of that too much and so we've had some that have been end-of-support for quite a while and that just leaves us vulnerable.

The open ports and any certificates that are coming either coming at end-of-life or expired are factors that Qualys CyberSecurity Asset Management definitely identifies, so it definitely helps close that gap.

The TruRisk score helps me to identify and prioritize vulnerabilities and assets by giving me more than just one factor in determining what is most at risk and what is a lower priority. Just because a CVSS score is high doesn't necessarily mean it should be a high priority based on all the other factors that the TruRisk score takes into account.

The quality at times of the technical support or customer support for Qualys CyberSecurity Asset Management is not as fast as what you would it to be. If you have an issue out there, I don't really know if it's so much related to the support or if you're going through your account manager also for the remediation. But that can be a little slow at times.

There have been a couple of times where Qualys CyberSecurity Asset Management wasn't accessible and I'd reach out to our TAM and they'd say, 'Qualys is down.' They say, 'We'll let you know when it's back up.' Of course, they never let you know when it's back up. You just keep trying later on and then eventually it comes back up. It's probably gone down maybe about five or six times since I've had it.

Nothing can be identified offhand regarding improvements for Qualys CyberSecurity Asset Management. I've been pretty impressed with everything so far. There have been no problems as far as I can tell with the CMDB Sync feature.

As always with any product, you always want it to be as cheap as possible, but since I don't manage the purse strings, it doesn't really affect me too much, but Qualys CyberSecurity Asset Management works with you on the pricing and there are always incentives and discounts available depending on the time of the month or year.

Neutral

At my old job, we were just bringing on Tenable as an alternative to Qualys CyberSecurity Asset Management. I didn't get a whole lot of trial time with Tenable, but the biggest differences that come to mind are that Qualys CyberSecurity Asset Management is fairly easy and intuitive and if there are any questions while you're on something, there's generally a little icon you can hover on to get more information regarding it and then it helps you pick what you're looking for.

It was actually pretty easy to deploy Qualys CyberSecurity Asset Management. We got Qualys right after I started on the security team and I was the one for our side that rolled it out to all the sites and got it stood up.

After all the sessions with the onboarding team for Qualys CyberSecurity Asset Management, it took about a few months to fully set it up to a working condition.

I was the only person required for this type of deployment of Qualys CyberSecurity Asset Management.

The only advice I have for new users on how to start with Qualys CyberSecurity Asset Management is that the only way that you eat an elephant is one bite at a time. There's a lot of things that need configuring and a lot of things that can be done through the system, and it can seem overwhelming. Just do one thing at a time. Check out the best practices for setups and definitely utilize your account managers, especially when first onboarding, to set up those onboarding calls to make sure that the main priorities that you're looking for get set up. On a scale from 1 to 10, I would rate Qualys CyberSecurity Asset Management an eight overall.

We use Qualys CyberSecurity Asset Management to manage our cybersecurity asset count, to manage the count of our cloud assets, our on-prem assets, our data center assets, as well as our endpoints. 

We use it for CIS benchmarking. It helps us with security because it allows other security teams such as incident response to quickly view a workstation and look at some of the telemetry data. 

The TruRisk score helps us identify and prioritize things to fix first since you can't fix everything, so it's really important to prioritize the tasks that will make a difference.

The comprehensive view that Qualys CyberSecurity Asset Management gives us on our assets enables us to go to a single screen and get a good idea of our holistic asset count. This was a problem before. In cybersecurity for us on the vulnerability management team, we couldn't patch what we couldn't see. Qualys CyberSecurity Asset Management provides us with the ability to see everything. 

It de-duplicates findings and helps you understand what the vulnerabilities from your external scans and your external attack surface management are and how they connect to the vulnerabilities on your internal scans. 

It gives us a holistic asset view, a very comprehensive asset inventory, and a cybersecurity-owned asset view, eliminating the need to connect to other teams or ask IT teams for information.

We're only licensed for CSAM, VMDR, and FCA. So it also does help us with configuration assessments. So we use it for CIS benchmarking. In general, it does help us overall with security as it allows other security teams like incident response to quickly view, for example, a workstation and look at some of the telemetry data. We have the Qualys agents deployed. So we can see a lot of information about the machine, the user, the IP, disk size, and installed software, all of that useful information can be used in many different aspects of our security team.

The main benefits that we have seen from using CSAM in our environment include a holistic asset view, a very comprehensive asset inventory, and a cybersecurity-owned asset view. We don't need to connect to other teams or ask IT teams for. It's something that we can see on our own that we can manage and maintain on our own, and we can also help enrich the CMDB data that our IT team may own.

The solution's true risk scoring help prioritize vulnerabilities and assets. We're not chasing CVE scores. Often, the CVE could be higher critical, however, depending on where it is, what machine it's on, it may not be that important. So the TruRisk score helps us identify and prioritize things to fix first. You can't fix everything. So it's really important to to prioritize the stuff that really will make a difference. 

The UI and menu navigation has improved significantly, however, the menus could still be clunky, making navigation within the assets challenging.

We have been using Qualys CyberSecurity Asset Management product for about three or four months.

We haven't had any stability issues.

We have not faced any scalability issues.

Qualys's customer service stood apart based on their responsiveness, customer support, ability to address pain points, and their approach during the negotiation process. It was very impressive, and they were on top of everything.

Positive

We didn't have anything similar to Qualys CyberSecurity Asset Management.

The initial setup was straightforward. The deployment process went very well. We actually utilize a newly formed deployment team. We had someone from Qualys and had three calls a week during the deployment phase where we met with that person and kinda of went through the steps, went through how we're deploying, and went through any pain points. So it was excellent.

We're using the endpoint agents for all of our end-user devices, and we're using scanners or appliance scanners for all of our data centers, and then we're using the cloud connector for all of our cloud environments, like Azure and AWS.

Someone from Qualys's newly formed deployment team helped us with the implementation.

We purchased it through a reseller and the pricing was reasonable. We received Qualys CyberSecurity Asset Management included in our licensing at no cost for the first year.

We conducted a POC with Qualys and Tenable. From a product standpoint, they were pretty evenly matched, however, Qualys stood out because of their customer service and responsiveness.

We do have Qualys scanners deployed in our data centers, however, since this is a fresh deployment, we haven't had to convert anything. Everything's being deployed net new.

We don't use any of the passive network sensors yet. We have plans to deploy them. Currently, all we have deployed are the endpoint agents. We have the data center scanning appliances deployed, and then we also have the cloud connectors deployed. So we don't have any of the network passive sensors deployed yet.

Here's what I would say to someone a colleague at another company who says that they only need to add external attack surface management for their vulnerability management detection, but they don't need to to go the full depths, you know, the system offering: first of all, I don't even think you can add external attack surface management without CSAM. They're a hand-in-hand product. Second of all, you can't correlate your internal scan assets with your external tech service assets if you don't have CSAM. So it really helps deduplicate findings. It helps you understand what the vulnerabilities from your external scans and your external attack surface management are and how they connect to the vulnerabilities on your internal scans.

I'd advise others to deploy endpoint agents or cloud agents to get the most comprehensive view. Take your time with the deployment for accuracy. The deployment effort directly correlates to its effectiveness. 

Qualys CyberSecurity Asset Management is a Ferrari. If not configured properly, it performs as a Ford engine. 

I rate Qualys CyberSecurity Asset Management ten out of ten.

Hybrid Cloud

Other

I have been working on Qualys CyberSecurity Asset Management for the last four years. I used Qualys CyberSecurity Asset Management for multiple purposes, working in both infrastructure security and application security. The inventory was huge because the client I was working for is one of the biggest mining industries in the world, with an inventory count of almost 300,000 to 400,000 applications and more than 10,000 to 12,000 infrastructure assets. The infrastructure was quite large and very systematically organized.

I was working for a company whose client was this mining industry, so I am a third party to the end client.

Qualys CyberSecurity Asset Management is good enough to differentiate different kinds of assets, whether applications, computers, or servers. There are categories to differentiate all of them, making it easier to manage this kind of infrastructure.

One thing that I particularly liked about Qualys CyberSecurity Asset Management is that it has a very broad classification of different kinds of assets, which is very helpful to manage. The ticketing functionality that it has to manage all these kinds of infrastructure makes it easier to work on different kinds of problems that these large inventories face. It is mostly scalable and quite a good option.

The inventory count was really huge, and doing it manually or using other options would have been difficult. We considered ServiceNow at that time, which was a good option. However, having real-time scanning and all those things in one single solution makes Qualys always the best option. Getting different kinds of modules and inventory in one solution is good enough.

TruRisk scoring was enabled, and we had integrated ServiceNow with Qualys. All findings from Qualys used to go into ServiceNow, where we had our own scoring system. For example, if an asset is critical to the organization and has a risk scoring as critical but is also exposed to the internet, we would have two different kinds of risk scores. We did not consider directly using the Qualys TruRisk score but instead used custom scores of our own, which worked well enough.

I deployed a few Cloud Agents on both Linux and Windows machines for scanning purposes. It was a cloud-based SaaS solution.

Qualys CyberSecurity Asset Management has been satisfactory to me as of now. However, if the user interface might be changed, that would be better.

I have been working on Qualys CyberSecurity Asset Management for the last four years.

ServiceNow was one solution that we were trying at that time, and it was a good option.

Earlier, we were four team members, and later on, mostly two to three of us used to be engaged in the kind of work that was needed on a regular basis. Otherwise, almost 70 to 80 percent of the time is saved using this solution.

Qualys CyberSecurity Asset Management is moderately good, while Rapid7 is slightly much better. However, if you are asking about multiple kinds of services and which vendor offers the best in terms of multiple services, Qualys CyberSecurity Asset Management is better in that regard. For accessibility, Rapid7 is better.

If companies implement it, it is always good. I am satisfied with the current offering.

My overall review rating for this solution is 8 out of 10.

Public Cloud

Other

I use Qualys CyberSecurity Asset Management for management, cycle life, analysis, cataloging, enumeration, classification, and remediation.

I am using Qualys CyberSecurity Asset Management for managing assets with Qualys and CMDB, along with business intelligence for classification and extraction for information classification. I analyze this data with TruRisk score to understand the impact on business and risk classification.

I use Qualys CyberSecurity Asset Management for looking at the network with a focus on Shadow IT. I examine network devices across the network using TruRisk score for criticality, classification, risk assessment, and cycle life in remediation.

I use Qualys CyberSecurity Asset Management for metrics to check the timeline for resolution of problems. With RSC and classification of IT and devices, this represents the best practice of business. I use the metrics for resolutions to prioritize risk score for remediation, mitigation, classification, and reporting to the CISO and the board members.

I manage the cycle life with Qualys CyberSecurity Asset Management to make the work easier in practice.

Qualys CyberSecurity Asset Management has excellent resources for asset management, and the C-SAM module is complete and powerful. It manages assets and their roles on the network, access, and classification.

The solution provides analysis and criticality with TruRisk score for management and Shadow IT detection. It creates visualization in the network for the business.

Qualys CyberSecurity Asset Management delivers positive impact through organization management visualization and control for statistics on cycle life and remediation and mitigation in application standards and business rules, such as PCI DSS, and other filters with the PC module and classification in Qualys patch for remediation cycle life.

In the best practice for categorizing assets with the C-SAM module in Qualys CyberSecurity Asset Management, I see potential for improvement with integration of other CMDB systems in creating a relationship with Qualys and other solutions. I would like to see improvements in the criticality score and TruRisk, along with KDS and those classifications for analyzing the real risk impact for business, and in the periodic checking of devices and networking.

I have been using Qualys CyberSecurity Asset Management for three years.

Qualys CyberSecurity Asset Management is stable.

The scalability of Qualys CyberSecurity Asset Management is acceptable and working well.

There are no problems with the customer support of Qualys CyberSecurity Asset Management.

Positive

Qualys CyberSecurity Asset Management is the principal solution I use currently. However, in other organizations, I have used other solutions based on different CISO perspectives and administrative cultures.

Regarding return on investment, I first look at the reality of the environment and the decrease in critical vulnerabilities with Qualys CyberSecurity Asset Management, which equals a positive return on investment.

Qualys CyberSecurity Asset Management is a perfect tool at a nine out of ten rating. A perfect tool does not exist, but I rate it a nine for its recurring increase in capability and the increase in expertise among Qualys specialists. The more expert the team, the better the results.

I work more in the organization in the on-premises environment with Qualys CyberSecurity Asset Management. I do not have difficulty, but it requires more organization for successful results. I am using only integration with AWS and Azure.

With specialists, I do not have concerns regarding price with Qualys CyberSecurity Asset Management. For me, it is only a matter of organization and the architecture implementation. My experience with Qualys is excellent. I would rate Qualys CyberSecurity Asset Management a nine on a scale of one to ten.

On-premises

Amazon Web Services (AWS)

My current use cases for Qualys CyberSecurity Asset Management involve hunting for software that is end of sale or end of life. I also use it to identify where prohibited software is installed on a device. For example, I identify if software that shouldn't be on an endpoint exists. That includes the vulnerabilities associated with certain software.

Improve software inventory capabilities

What I appreciate most about Qualys CyberSecurity Asset Management is the inventory feature, where I can look up assets, software, applications, open ports, and similar items because it's very useful. For example, with assets, I can see all the devices that have the protection installed and access one of these endpoints to see all the information about it. On the software side, I can see a list of all software installed on all my platforms, referring to all my endpoints that have the client installed.

The comprehensive approach that Qualys offers is beneficial because it includes the TruRisk score, which summarizes all vectors influencing the risk of an asset. For example, it highlights exploitations for certain vulnerabilities and provides all the links if they are available or public. Furthermore, the integrated Threat Intelligence platform within the interface allows me to see if there's a trend for certain vulnerabilities and check if I have that vulnerability on my platform.

One downside of Qualys CyberSecurity Asset Management is that I would prefer to see a more interactive dashboard. For example, when I see unknown software in the inventory and try to get a list of assets with certain software, I have to go inside the software menu. If I could have something more interactive that doesn't require going inside multiple categories, it would help. Also, I think the filters should accept three or more queries together to get broader results. However, this could also be an issue stemming from my knowledge or lack thereof.

I have been using Qualys CyberSecurity Asset Management in this company for at least one to two years, but the implementation has been around for three years.

I have experienced a couple of instances with lagging, but nothing substantial that impacts reporting. There may be some delays on the dashboard, but nothing affects the functionality of reporting vulnerabilities from the endpoint.

The scalability of Qualys CyberSecurity Asset Management is significant because you can deploy it across physical endpoints, cloud enviroments and VDI using a configuration file. If someone uses Windows Server, they could use a GPO to deploy it. There are many options. I've seen large platforms with numerous endpoints and vulnerabilities, and that makes me think they have an impressive capability for handling large volumes, which is very scalable in my opinion.

I haven't contacted Qualys technical support or customer support because we have a team that possesses extensive information and they reach directly to the vendor.

Positive

In the past, I used some open-source solutions at another company, but I don't remember the name. I recalled using them occasionally, but they didn't have this kind of reach. The same principle applies; you install a client on the endpoint, and it reports to the server.

I find the initial deployment of Qualys CyberSecurity Asset Management overall easy, especially with support from the vendor and personnel who understand how to handle the integration and permissions with the firewall to allow traffic.

The initial deployment took around a month or possibly less to fully deploy Qualys CyberSecurity Asset Management for the first time, though I wasn't present during the implementation.

I don't have access to the pricing information, but I understand that Qualys CyberSecurity Asset Management is expensive compared to other brands or vendors, although the price is worth it.

I have the most experience with Qualys CyberSecurity Asset Management, VMDR, and CSAM, as well as CA. Besides VMDR, I also used the Threat Intelligence model extensively.

Regarding the CMDB Sync feature, I learned about it just a couple of weeks ago. Although we don't have the implementation, we would find it useful to share information from Qualys, such as vulnerabilities and all devices, and track the person in charge of a certain device by creating a ticket.

The TruRisk score is a very useful feature, as it summarizes all the factors influencing the importance of a vulnerability concerning an asset or an endpoint. It helps with the prioritization of remediation.

We have both the passive sensor and the cloud agent. We use the cloud agent by installing it on the devices, while the passive sensor allows us to detect devices that don't have the protection and can't have the protection, for example, the networking devices.

We don't manage maintenance for Qualys CyberSecurity Asset Management as it depends on the vendor because they sometimes deploy updates and upgrades, but nothing is required on our end.

On a scale of 1-10, I rate this solution a 7.

On-premises

Microsoft Azure

I primarily use it for a small, single-site, multi-source setup with multi-WAN inputs. I have a main fiber connection and a couple of failovers while managing different networks across different segments.

I really enjoy the flexibility of the interface setup configuration for my network VLANs, which makes it very easy to configure. When I'm doing multi-inputs with internet providers coming in, it's very easy to manage and set up with very little effort.

The technical support is super responsive; I generally get a response within an hour, two hours, or three hours. I've only had to contact them maybe two or three times for very minor issues, but there's no issue there. I think it's very responsive.

I think the one thing Qualys CyberSecurity Asset Management can do better is the package management and the updating process. Knowing that you can't update any of the packages until you've done the actual operating system update can be a bit confusing. Beyond that, I don't have any major issues. There are generally some user interface updates and tweaks here and there, but that's a lower priority in my opinion.

I've been using it for about eight years in my career.

For stability, I would give it a 10; I have no issues there.

Scalability works well; I would say it's probably going to be a nine.

The technical support is super responsive; I generally get a response within an hour, two hours, or three hours. I've only had to contact them maybe two or three times for very minor issues. I think it's very responsive.

Positive

I've used Unifi primarily in the last couple of years, probably three years now, at a separate site. It's nice, but it's not nearly as configurable. Qualys CyberSecurity Asset Management software's ability to do VPN, both with regard to Tailscale and OpenVPN, is really very easy to use, whereas Unifi is not ideal. Their security is open by default versus Qualys CyberSecurity Asset Management, which is closed, which is always going to be preferable.

For an entirely new site, the initial deployment would take some time to configure and set up. If you're coming from an existing setup or configuration, you effectively export the configuration, upload it, and make some minor updates. Even with the booting environments, it's easy in that if you make a mistake, you can go back or revert to an existing experience. It might take some time, but it's not overly complicated. I would say it requires minimal effort, especially if there's a plan in place ahead of what the structure will be.

One person can do this type of deployment, but you're going to need to be testing. Honestly, it's not nearly as complicated as a larger, more legacy offering, so I think it's very easy.

I'm not entirely sure about the pricing; I don't know.

Qualys CyberSecurity Asset Management does require some maintenance on my end, such as manual updates in terms of releases. Checking those out, doing some testing, and confirming it looks good in a non-prod environment is not that complicated. Even again, if you do the boot states, it's easy to manage. They come out about every 12 months, and I know that's one thing against Netgate—that they're a little bit slower on development—but honestly, that's probably preferable because it's not constantly updating. My review rating for this product is 9.

We use it to gain complete visibility into our assets and monitor our security posture.

Our overall experience has been very good. It gives us a 360-degree view of our assets. It gives us the complete data such as the types of services running or applications installed. If an asset or software is end-of-life or end-of-support, it provides the status related to that. Apart from that, we get to know the ports and services that are running.

Previously, I did not have visibility over the complete inventory. Qualys CSAM gives me the complete inventory with the number of assets connected to the network. Based on the cloud agents that were deployed and remote scans, we can see the whole inventory in a single module. The CSAM module allows us to track the end-of-life or end-of-support status of the software on our assets. We get to know in advance that particular software is going to be end-of-life or end-of-support. Such a feature helps us to take action proactively.

It gives visibility into the domains or subdomains managed by my organization. I can track those very effectively. I can even perform lightweight scans which are completely managed or controlled by Qualys, unlike remote scans that are performed by the end user. It gives visibility into the vulnerabilities related to applications or assets on a real-time basis because these scans are performed once a day on a daily basis. With one click, the EASM module provides the domain names related to my organization. Qualys directly performs the scan and if any applications or assets are not in my CMDB because I missed updating the details, it highlights them, so I have complete visibility over my publicly exposed assets or applications.

It is able to discover different kinds of assets, such as web servers, DB servers, or application servers. It can identify network devices. I even have visibility over the devices managed by ISPs, and I am able to take action appropriately.

Asset tagging is one of the main features of the CSAM module. While creating asset tags or after creating asset tags, we can set the asset criticality. Based on the vulnerabilities identified in the assets, Qualys provides a detection or TruRisk scoring.

TruRisk scoring helps prioritize vulnerabilities and assets. This prioritization is very helpful for me. In an infrastructure with 300,000 assets, we might see millions of vulnerabilities in the assets. We need to prioritize vulnerability remediation because we cannot focus on remediating all the vulnerabilities at the same time. We can start with the assets that are critical in our organization. TruRisk scoring helps with that.

It makes us more secure and also helps us with our KPIs or KRI. We have had zero attacks since we enabled all the features in Qualys CSAM.

It fetches the asset details based on remote scans or the cloud agents that are deployed. With passive sensors, I am able to see the rogue assets that are passing through a particular switch wherever passive sensors are deployed. I can see what other assets are connected to the network. One of my goals is to identify the assets that are missing with the cloud agents so that I can get the cloud agents deployed and get them added to my asset inventory. Network devices obviously cannot be installed with the cloud agents, but at least I have visibility that these are the network devices, or these are the endpoints, or these are the servers, whereas rogue assets are a threat to the organization. They may even compromise other assets in the network, so with these passive sensors, I am getting complete visibility.

Even IoT devices can be scanned through these passive sensors. The passive sensors can read the configuration of the devices passing through a particular switch. Previously, I used to perform remote scans on IoT devices. This effort of performing the remote scan is minimized because these passive sensors are able to find the vulnerabilities related to any of the IoT devices by reading their configuration. This is another feature that is helping me as part of our operations.

The External Attack Surface Management (EASM) module, available within CSAM, is valuable. It helps track all the domains and subdomains related to our organization. It performs the discovery scans and provides the results of the domains or subdomains related to my organization. It also performs scans to identify any vulnerabilities, which helps to take proactive measures before those vulnerabilities are identified by any attacker.

The IoT or OT asset discovery feature is valuable. We can analyze the traffic that is passing through at the L2 switch level with the passive sensors. It provides information about any rogue asset connected to a switch or a network. We can see all the unmanaged or managed assets.

The ability to define a list of unauthorized software and create a rule to define software authorization is helpful. We have a diverse organization with a robust infrastructure of more than 300,000 assets. By creating unauthorized lists and rules in the Qualys CSAM module, I can block certain software from being used in the organization. When I create such a rule, I can see all the assets having unauthorized software installed. I can then immediately take action by blocking that asset or remotely uninstalling that particular software. Such actions can be taken directly from its interface when I have unauthorized software rules in place. This is an important and helpful feature for my organization.

The scanning function could be improved. Currently, in the EASM module, the scan frequency is limited to once daily, but allowing end users control over scan scheduling would be advantageous. Publicly exposed assets are very critical. If a remediation action is taken by the end-user or the auditor working on a vulnerability management program, that person must be given access to run the scan as and when required. This way they can immediately check whether that particular vulnerability is present or not.

Also, allowing more comprehensive scan configurations could be beneficial. The lightweight scan that it does is only based on the ports or services that are identified through the Discovery Scan. It would be helpful for the auditors to be able to run a more comprehensive scan.

Additionally, while downloadable asset information is available in the CSAM module, it lacks mapping of software to assets in a consolidated report format. For instance, if I want to download information about 100,000 assets along with the software mapped to those assets, this option is currently not available. If I download the SH details, it will have only the BIOS information, the serial number of the device, the hostname, the MAC address, and the IP address. Only these details are available. It does not give information about the software installed on those assets. The software mapping with assets is not given in a consolidated report. Enhancing this capability would elevate its usefulness.

I have been using the CSAM module for about four to five years. It was previously known as AssetView. We used AssetView for over 12 years and then shifted to using CSAM when it was introduced four to five years ago.

The platform is quite stable as it is able to handle data from various sources, such as cloud agents or the VMDR module. It has the EASM capability. It is pretty stable even though it holds a lot of data related to our assets or applications. I would rate it a ten out of ten for stability.

Scalability is impressive, supporting a myriad of features and substantial data from diverse modules. It offers a comprehensive view of asset management and is equipped to handle an extensive array of data efficiently.

Our organization has its presence in different geographical locations. We have about 300,000 assets installed with agents worldwide.

There are 50 to 60 people from the IT team and the information security team working with Qualys CSAM.

I am satisfied with their support. I would rate their customer support a ten out of ten.

Positive

I was using the AssetView module before migrating to Qualys CSAM. AssetView has very basic features. Other than the asset tagging feature, AssetView does not have other features available in Qualys CSAM, such as EOL detection and software version detection. 

Knowing the software version is very useful for me when any zero-day vulnerability is published. I can check the version of the software that is vulnerable to a zero-day CVE, and then with the Qualys CSAM module, I can see the assets that are using that particular vulnerable version. Without even performing the active scan, I can get visibility over the assets having vulnerable versions. I can then take the remediation action. This is the most important feature in the CSAM module as compared to AssetView. 

The initial setup was straightforward. Although I was not a part of the implementation team, I understand it did not take much time due to an efficient cloud agent deployment and network connectivity setup.

It does not require any maintenance from our side. There is almost zero-touch maintenance because it is a SaaS platform managed by Qualys itself. We might have to modify or create asset tags or dashboards. These are operational tasks that we might have to do on a regular basis. Other than that, no maintenance is required from our side.

The implementation involved a small team of about five to six members who collaborated with the Qualys vendor.

Though the solution is considered expensive, if bundled with other services such as VMDR or cloud agents, its value would significantly increase. It is currently a bit costly, but with bundling, it could become attractive to more customers.

I would highly recommend this solution to other users looking to enhance their asset inventory visibility. Asset inventory is the primary source of truth for any IT team or information security team. Qualys CSAM provides that visibility. With the integration of CMDB, you get even better visibility over the asset inventory. You also get EOL information about the assets and applications. These are the main reasons for recommending it. I am pretty happy with it.

I would rate Qualys CSAM a ten out of ten.

Public Cloud

Other

At our Android development company, Qualys CyberSecurity Asset Management safeguards our development environment and digital assets, including sensitive codebases, APIs, databases, and cloud-based infrastructure. By continuously monitoring these assets, Qualys helps us detect vulnerabilities, misconfigurations, and potential malware, protecting both our proprietary technology and client projects from threats like ransomware and malicious activity. Furthermore, it ensures compliance with industry standards through real-time insights and automated security patches, fostering trust between us and our valued customers.

Qualys Cybersecurity Asset Management offers comprehensive features to cover our entire attack surface. Its cloud-based platform provides full compliance management, ensuring infrastructures align with databases and standards. Cloud storage enables easy data retrieval and recovery. Additionally, it utilizes AI-powered features to monitor and manage security patches, enhancing overall security posture.

Qualys Cybersecurity Asset Management utilizes advanced deep neural networks and AI to identify previously undiscovered assets and threats, crucial to our company's security. We discovered an additional 120 assets with Qualys CSAM.

It has significantly enhanced our company's security by providing real-time visibility into all access points across our development ecosystems, improving vulnerability detection and risk management. This allows us to address security gaps quickly before they escalate into critical threats. The automated discovery of misconfigurations ensures continuous compliance with industry and government standards, reducing manual efforts and freeing our team to focus on innovation. This comprehensive approach has fortified our infrastructure, protecting sensitive code, client data, and cloud management from cyberattacks. Consequently, we have faced fewer security threats, allowing us to focus on other areas for improvement within the company.

The Asset Management helps us identify all risk factors, including vulnerabilities and malicious attacks, along with various other aspects of asset management.

This advanced cloud system utilizes APIs to connect and retrieve data, while passive sensors track the code bases of our applications.

Passive sensors hinder the real-time identification of potential risks, as they transmit real-time data and additional information with a delay. However, the system's speed, combined with AI, deep learning, and robotic process automation, enables efficient risk identification despite this limitation.

The most valuable feature is the real-time visibility Qualys CyberSecurity Asset Management provides into all assets across our development and operational environments. As an app development company dealing with multiple platforms, servers, APIs, and mobile data, each becomes a significant target for cyber threats. 

Qualys CyberSecurity Asset Management ensures a comprehensive inventory of all assets, regardless of their distribution. This allows us to detect vulnerabilities, misconfigurations, and outdated systems before they become security issues. The automated vulnerability scanning and patch management features, with automatic risk identification and remediation, are also invaluable. By reducing manual intervention, these features increase efficiency and allow our team to focus on other priorities.

There are a few areas Qualys CyberSecurity Asset Management can improve. First, the UI needs improvement as it can become overwhelming after prolonged use. A more intuitive design with simplified navigation would be beneficial for all team members, especially beginners. 

Second, the reporting feature could offer more customizable templates and easier-to-digest visualizations. This would help in creating targeted reports for different stakeholders, such as technical teams and executives. 

Lastly, integration capabilities with third-party tools and platforms should be expanded. While some integrations are supported, more options like CI/CD pipelines, which are integral for app deployment, would be advantageous.

I have been using Qualys CyberSecurity Asset Management for one year.

I would rate the stability of Qualys CyberSecurity Asset Management eight out of ten.

I would rate the scalability of Qualys CyberSecurity Asset Management ten out of ten.

Once we needed to contact their customer support, we received timely assistance. The support team was knowledgeable and offered a variety of quick resolution options. They also provided extensive documentation and access to community forums, allowing us to find solutions independently.

Positive

I previously evaluated Nessus, but while it offers effective vulnerability scanning, it lacked the comprehensive asset management and continuous monitoring capabilities necessary for expanding our application management system. We needed a solution that provided deeper visibility into our digital assets, including cloud infrastructure and mobile applications. 

Qualys offered a more integrated approach by combining vulnerability management, compliance checks, and real-time inventory in a single platform, simplifying processes, improving collaboration between development and security teams, and offering greater scalability.

The initial setup was smooth and easy to follow, aided by guidance from the Qualys team.

The deployment took three to four hours.

The implementation was performed with assistance from the Qualys team, who helped with platform configuration and integration into existing systems.

Our return on investment includes a significant reduction in security incidents, decreasing potential costs related to data breaches, system downtime, and compliance fines. This was achieved through streamlined vulnerability management, which reduced labor costs by approximately $109,000 annually. Additionally, enhanced client and company trust led to approximately $99,000 in new contracts. These improvements to our security infrastructure contributed to overall business growth of approximately 150 percent over the past year.

The pricing for Qualys Cybersecurity Asset Management is reasonable, with an annual subscription costing around $1,000 per year or a monthly subscription starting at approximately $72 per month, depending on the specific package and features included.

I would rate Qualys CyberSecurity Asset Management eight out of ten.

We use Qualys CyberSecurity Asset Management in six locations across the country.

Qualys CyberSecurity Asset Management does not require any maintenance.

I would advise fostering security awareness through regular review and updates to security policies and protocols. Staying informed about other platforms is important, but Qualys CyberSecurity Asset Management is a fit for our company due to its reasonable cost, scalability, stability, and excellent integration and deployment features.

Public Cloud

The asset management part is very simple and essential. When examining vulnerabilities on assets, having information about those assets is crucial. It is very difficult to see remediation options without knowing details about the asset, such as whether the operating system is end of life. The detections are excellent at finding Windows 11, Windows 10, and Windows Server, but they are not very effective with other systems. While you can have a CMDB, Qualys CyberSecurity Asset Management was particularly effective because the information was available exactly where needed. This enables automation and quick access to necessary answers.

One of the significant challenges Qualys is discovery, which I know Microsoft excels at. I can't recall how well Qualys performs this function; it seems I might be missing some details. However, if there's one key aspect to focus on, it's discovery—the ability to identify assets that you are not aware of, even when you can see they are present. Understanding what those assets are is crucial.

With Qualys CyberSecurity Asset Management, it was very difficult to extract detections from the system. The features within Qualys are limited to what they have developed. Sometimes a complete overview is needed to push to a Power BI dashboard, Splunk, ServiceNow, or other platforms. The export process is incredibly challenging. We needed a developer to write a hundred-line Python script that would loop over certain assets due to export limitations.

Qualys CyberSecurity Asset Management could improve its integration capabilities. While it generates substantial data, correlating it with other data sources can be challenging. The export process is difficult, and pre-built integrations with other tools could be enhanced for better process implementation.

As a consultant, my usage varied depending on the client, but I worked with it for approximately two years. I changed companies three months ago, and at my current workplace, we are not using Qualys CyberSecurity Asset Management.

It is stable.

The solution is highly scalable, almost limitless. Being a cloud solution, it simply requires pointing to IPs for scanning.

The alternative solution I used was Tenable. I used to prefer Tenable, thinking of Qualys as the underdog. However, after working more with Qualys, I’ve come to appreciate it more. It's not because it’s more powerful or because it doesn’t have any issues or better features, but because it is more transparent.

Tenable is very easy to use, but it doesn’t provide a clear understanding of its inner workings. In contrast, Qualys can be more complex to use due to its numerous settings and the need for additional training, but at least it gives you a clearer idea of what it does. Comparing the two is challenging. Tenable is more powerful, but whether that power is necessary depends on your specific needs. I acknowledge that Tenable is more expensive, as it requires purchasing additional modules. Overall, Qualys is a great option.

I haven't been a part of the deployment. I've only been part of existing setups because I came in as a consultant for companies that already had it set up.

Learning it was quite straightforward due to the availability of free training materials, which Tenable does not offer as their training is very expensive. The learning curve was manageable as all necessary materials were provided to learn the required functionality.

At one client, there was an entire team dedicated to vulnerability management and Qualys CyberSecurity Asset Management maintenance. While I focused on vulnerability management, implementing results, creating processes, and organizational implementation, they handled the tool maintenance. Based on this experience, I would estimate it requires significant maintenance, though my role was different from the maintenance team.

We are currently using a cheaper solution, and I sometimes get the feeling that our solution is less stable. When things go wrong and you don't get the expected results, it becomes very difficult to figure out why or what happened. I believe that the stability and reliability of Qualys offer great value for the money.

I don’t know the exact pricing. From what I understand, Qualys is a bit cheaper than Tenable but more expensive than some other solutions available. Overall, I think it’s one of the best options out there, although it is on the pricier side. Nevertheless, I believe its pricing is fair given the value it provides.

The vulnerability management aspect differs from penetration testing, which focuses on configurations rather than vulnerabilities. From a hacker's perspective, 'living off the land' involves exploiting existing configurations without utilizing vulnerabilities. This might include users having inappropriate access to files and folders, violating least privilege principles. Vulnerability scanners can detect CVEs but struggle with identifying misconfigurations or IT hygiene issues, which attackers can exploit.

Regarding CMDB and CSAM, they serve different purposes. External attack surface management focuses on domains and URLs owned by a company, while CSAM handles internal asset management. The EASM module can be valuable independently.

I would rate Qualys CyberSecurity Asset Management an eight out of ten.

Public Cloud

Microsoft Azure

We use Qualys CyberSecurity Asset Management mainly to build up our inventory so we can ensure we have all our scans in place for all our assets. We use it for remediation, dashboarding, and reporting on how effectively we are remediating across the enterprise. Additionally, we use it to determine whether there are assets we are scanning that don't have our agents on them, which helps us true up our agent distribution.

We're using EASM, though our implementation isn't optimal. We're currently working with Qualys to reconfigure it because we're seeing too many assets on the attack surface, more assets than we actually have.

For example, EASM indicates we have 700,000 assets on our attack surface. We know this isn't accurate because we only have 22,000 assets in total. There's a configuration problem creating too much noise, and we're working with Qualys to get that sorted to filter out the noise and focus on the real data.

We use this feature to convert already deployed Qualys Cloud Agents into passive sensors that detect assets connected to the network in real time. I don't have a way to measure its effectiveness. I have it enabled but cannot determine its value. This might be valuable feedback for Qualys regarding how clients can measure the value they're getting from this feature.

The CMDB Sync affects our mean time to remediation. Using the VMDR module with the CMDB, we sync our vulnerabilities to the CMDB and asset information. We receive asset owner information and application owner information, which helps us understand who we need to work with to remediate vulnerabilities. When we can pull that information from the CMDB, it's very helpful.

The TruRisk score helps me prioritize vulnerabilities and assets. The TruRisk score allows us to show where we have our highest risk. When an asset has a very high TruRisk score, it's easy to demonstrate to partners that an asset needs immediate remediation. However, when a TruRisk score is moderate or low and has vulnerabilities on the attack surface, it appears healthier than it is. Our partners might delay addressing these assets due to the lower score, despite their presence on the attack surface making them more vulnerable.

Qualys CyberSecurity Asset Management enables us to identify end-of-life and end-of-support software.

Qualys CyberSecurity Asset Management has Qualys Query Language that works within itself. However, when switching to other modules the QQL either doesn't work or requires a different query to access the information, including in dashboards. They need to make their query language universal across the entire product so when using one module and making a query, it doesn't require changing the query to work in another module.

The stability has decreased significantly on the product in the last couple of months. It takes considerable time to log into the product, and sometimes access is denied. Screens take long to load and occasionally crash. The product stability has notably declined over the last two months, and the performance to fulfill a page request is very slow compared to its previous performance.

I've been using Qualys CyberSecurity Asset Management for approximately 10 months.

The stability has decreased significantly on the product in the last couple of months. Other clients and customers have similar complaints, and Qualys is aware. It takes considerable time to log into the product, and sometimes access is denied. Screens take long to load and occasionally crash. The product stability has notably declined over the last two months, and the performance to fulfill a page request is very slow compared to its previous performance.

Since it's a SaaS app for us, we don't see the scalability on our end, except through our user base using it. When they moved to their new instances, it doesn't seem to be scaling effectively, which manifests as performance issues.

The support has been excellent. They are responsive and effectively bring in the appropriate resources to help solve problems.

Neutral

We use alternatives to Qualys CyberSecurity Asset Management. We have a CMDB with ServiceNow and a tool called Axonius. Axonius is an asset aggregation tool with numerous connectors. It can connect to systems such as Active Directory and various other systems, then aggregates the data it sees from these different systems. We're doing extensive tagging to identify our asset owners and classify our assets. Axonius has a different view than Qualys. Qualys CyberSecurity Asset Management scans everything in the network, but we haven't set up the AD connector yet, though it's available.

The initial deployment of Qualys CyberSecurity Asset Management was relatively easy. It required some time to complete, but the deployment process was straightforward.

One person was required for this deployment.

It took approximately one month to set up Qualys CyberSecurity Asset Management, configure it, and have it providing value.

We're paying a premium for Qualys CyberSecurity Asset Management. It's an expensive tool. We had to pay significant additional money to buy CSAM. It's a foundational item that should have been included in our base subscription with VMDR. It's a major concern for my CISO. We purchased it because it adds substantial value, but it should be included with the base product.

We use alternatives to Qualys CyberSecurity Asset Management. We have a CMDB with ServiceNow and a tool called Axonius.

We use tagging extensively in Qualys CyberSecurity Asset Management. Based on my experience with this solution, I rate it 8 out of 10.

Public Cloud

Other