I am using all the modules on Qualys. It is a vulnerability and risk management platform. Additionally, we are using it for quality compliance. Currently, we are managing overall projects and supporting some initiatives. We access the check systems for this purpose. While Tenable sometimes misses vulnerabilities, Qualys consistently identifies potential vulnerabilities.
Qualys offers versatility. It can function both with and without agents, offering flexibility in deployment. Furthermore, it provides comprehensive support for various systems such as Windows Server, Unix servers, and databases, including SQL, Oracle, and others for development.
Additionally, it extends its functionality to network devices like Cisco and Palo Alto firewalls, switches, routers, and Wi-Fi, making it a comprehensive solution for enterprise needs. With its enhanced support, Qualys minimizes the need for additional tools, providing a comprehensive solution for enterprise security.
Support could be improved. Contacting support is a lengthy process for raising a case.
Recently, while attempting to set up a customized CI checklist, I faced difficulties updating parameters and obtaining results. Each Control ID in the checklist required a separate case, which presented a significant challenge given the number of checks involved. If issues arise with these checks, we must raise cases. Despite providing documentation and evidence, we receive standard instructions to follow rules we've already adhered to, making the process repetitive.
I have been using Qualys Enterprise TruRisk Platform for four to five years.
Policies are essential for ensuring security and compliance, covering all necessary aspects and being user-friendly. Setting up policies is easy with the guides available on the Qualys portal and the Internet. Testing parameters after setup is straightforward, allowing us to verify outputs.
However, one limitation is the inability to access saved logs directly. Requesting logs requires involvement from the Qualys team, preventing us from analyzing them independently. This lack of access raises concerns about data privacy, as organizations prefer to keep their data internal. While Qualys undoubtedly has access to our data during scans and responses, ensuring transparency and control over this access remains a priority."
I rate the solution’s stability a seven out of ten.
Our current setup is straightforward. Setting up the scanners and configuring settings is not complex. When using agent-based scanning, installing agents on servers is manageable with the assistance of our managed work. Qualys can discover all assets in our environment and install agents online, eliminating the need for manual installations. Connectivity issues were resolved using the QVS proxy, which our organization readily embraced. Since we already had internal proxy access, configuring the setup was easy. We created and deployed a package across all console workstations and computers.
We opt for an IT-based approach, paying for Qualys via subscription.
If I communicate with admin users responsible for modifying settings, I interact with around 14-16 of them. However, in terms of managing access and overseeing the health of Qualys, I handle close to 20,000-30,000, including network and server devices.
Although we have specialized personnel, we lack visibility into logs to analyze and identify root causes. During screen sharing sessions, when troubleshooting, I actively participate and resolve issues most of the time. So, if we had additional specialists, they could also analyze logs, potentially leading to quicker resolutions.
Overall, I rate the solution an eight-point five out of ten.
