Qualys Enterprise TruRisk Platform Reviews

Our main use case for Qualys Enterprise TruRisk Platform is to search and remediate vulnerabilities and to patch our endpoints.

We use Qualys Enterprise TruRisk Platform to search for vulnerabilities by having Linux-based virtual machines scanning in our AWS and our on-prem environments.

The best features are granularity for scanning IPs for vulnerabilities and reporting, which is incredibly advanced for the space they operate in.

The reporting helps us understand what vulnerabilities exist in our environment, which ones are patchable, and which ones require additional remediation.

I appreciate the granularity where I can add in additional credentials to scan for items that otherwise other systems would not be able to scan for.

We have been able to reduce our vulnerabilities by nearly 90%.

It is a combination of visibility, automation, and reducing our vulnerabilities by having proper reporting, by having graphs and charts showing us where we can reduce our vulnerabilities, and having the patch management tool patch our endpoints and matching the endpoints, matching the vulnerabilities to a patch, and then applying the remediation.

I have been using Qualys Enterprise TruRisk Platform for five years.

You should ensure that you have a dedicated person who can manage their time and dedicate themselves fully to Qualys Enterprise TruRisk Platform. I would rate this product a 10 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

We are using Qualys Enterprise TruRisk Platform for scanning both Windows and Linux environments. We produce reports for vulnerability management. The main focus is on vulnerability scanning.

The platform scans the entire environment and IP range, providing comprehensive vulnerability reports along with solutions to address these vulnerabilities. Its features are extensive and it produces proper results, although there may be occasional false positives. It also categorizes risks based on severity, though further evaluation is necessary for our specific environment.

The report sometimes inaccurately identifies the corresponding operating system version. It would be beneficial if the solution could correctly identify the exact OS version, potentially requiring code adjustments. Additionally, the possibility of Qualys Enterprise TruRisk Platform handling remediation tasks and re-scanning the environment would be advantageous.

I have been working with Qualys Enterprise TruRisk Platform for over four years.

We have not faced any issues with scalability. I would rate it as high scalability with a value of ten.

The setup is moderate. It is neither very simple nor very complex.

The cost is medium to high.

Qualys Enterprise TruRisk Platform is considered a good leader in its field. If anything comparable were found, it would be considered.

I would give Qualys Enterprise TruRisk Platform an overall rating of eight to nine out of ten. Deployment is mostly on-premises with very little use of cloud for this particular account. We are integrating different technologies with Qualys Enterprise TruRisk Platform, many things are in the pipeline.

On-premises

I am using all the modules on Qualys. It is a vulnerability and risk management platform. Additionally, we are using it for quality compliance. Currently, we are managing overall projects and supporting some initiatives. We access the check systems for this purpose. While Tenable sometimes misses vulnerabilities, Qualys consistently identifies potential vulnerabilities.

Qualys offers versatility. It can function both with and without agents, offering flexibility in deployment. Furthermore, it provides comprehensive support for various systems such as Windows Server, Unix servers, and databases, including SQL, Oracle, and others for development. 

Additionally, it extends its functionality to network devices like Cisco and Palo Alto firewalls, switches, routers, and Wi-Fi, making it a comprehensive solution for enterprise needs. With its enhanced support, Qualys minimizes the need for additional tools, providing a comprehensive solution for enterprise security.

Support could be improved. Contacting support is a lengthy process for raising a case. 

Recently, while attempting to set up a customized CI checklist, I faced difficulties updating parameters and obtaining results. Each Control ID in the checklist required a separate case, which presented a significant challenge given the number of checks involved. If issues arise with these checks, we must raise cases. Despite providing documentation and evidence, we receive standard instructions to follow rules we've already adhered to, making the process repetitive.

I have been using Qualys Enterprise TruRisk Platform for four to five years.

Policies are essential for ensuring security and compliance, covering all necessary aspects and being user-friendly. Setting up policies is easy with the guides available on the Qualys portal and the Internet. Testing parameters after setup is straightforward, allowing us to verify outputs. 

However, one limitation is the inability to access saved logs directly. Requesting logs requires involvement from the Qualys team, preventing us from analyzing them independently. This lack of access raises concerns about data privacy, as organizations prefer to keep their data internal. While Qualys undoubtedly has access to our data during scans and responses, ensuring transparency and control over this access remains a priority."

I rate the solution’s stability a seven out of ten.

Our current setup is straightforward. Setting up the scanners and configuring settings is not complex. When using agent-based scanning, installing agents on servers is manageable with the assistance of our managed work. Qualys can discover all assets in our environment and install agents online, eliminating the need for manual installations. Connectivity issues were resolved using the QVS proxy, which our organization readily embraced. Since we already had internal proxy access, configuring the setup was easy. We created and deployed a package across all console workstations and computers.

We opt for an IT-based approach, paying for Qualys via subscription.

If I communicate with admin users responsible for modifying settings, I interact with around 14-16 of them. However, in terms of managing access and overseeing the health of Qualys, I handle close to 20,000-30,000, including network and server devices.

Although we have specialized personnel, we lack visibility into logs to analyze and identify root causes. During screen sharing sessions, when troubleshooting, I actively participate and resolve issues most of the time. So, if we had additional specialists, they could also analyze logs, potentially leading to quicker resolutions.

Overall, I rate the solution an eight-point five out of ten.