Qualys Enterprise TruRisk Platform Reviews

My main use case for Qualys Enterprise TruRisk Platform is to expedite remediation, understand true risk in our environment, and fix true risk.

With the overall score functionality, I am able to identify vulnerabilities and risk based on CVEs or QIDs that allow us to eliminate potential risk that would have impacted us.

We patch based on severity, so whatever the highest severity is, that's how we make our decisions regarding how Qualys Enterprise TruRisk Platform's Patch Management integration with TruRisk influences our prioritization of patches from known exploited vulnerabilities or CISA catalog items.

Qualys Enterprise TruRisk Platform has positively impacted my organization by allowing us to operate using agents as an organization with minimal waste.

Using agents has helped my organization by saving time and reducing manual work.

The best features Qualys Enterprise TruRisk Platform offers are the dashboard for the metrics and the reporting capabilities.

I appreciate everything overall; the platform just needs to be able to create the metrics and provide them.

Qualys Enterprise TruRisk Platform can be improved by having faster QID times or faster vulnerability identification.

Everything is fine regarding what could be improved with the user experience.

I have been using Qualys Enterprise TruRisk Platform for one year.

I rate Qualys Enterprise TruRisk Platform an eight out of ten because nothing is perfect.

Regarding Qualys Enterprise TruRisk Platform's AI capabilities, I think its governance and security are pretty decent, and currently for what it is used for, it works fine.

My advice to others looking into using Qualys Enterprise TruRisk Platform is to buy based on your environment.

My main use case for Qualys Enterprise TruRisk Platform is to provide a view of the exposure management risk of the company for vulnerabilities and other capabilities including cloud solutions. I scan the environment to identify vulnerabilities present and provide a risk view of how the company is exposed to vulnerabilities in the environment.

The agent itself is the only thing that benefits my organization because all functionalities are tied to one agent. Having everything integrated into a unique agent is beneficial because there is no need to install multiple agents, which addresses one of the main complaints from the infrastructure team regarding the number of agents being installed to the assets.

Qualys Enterprise TruRisk Platform does not have good qualities, and we are struggling to use this tool to achieve what we are looking for in terms of exposure management in our environment. The reports are outdated and appear to come from an outdated version of Excel. The tool experiences significant performance degradations that lead to poor usage and a bad user experience.

During specific periods of the month or a couple of weeks when we make massive data requests, it takes considerable time to execute and acquire the information. When we attempt to retrieve information, the system frequently provides timeouts. The report format is outdated and appears to use a 2003 Excel format, which is really poor UX in terms of reports and the way we can customize reports in the tool itself.

Regarding improvements, the support team lacks experience and seems only focused on pushing and selling things rather than answering simple questions about tool usage or security knowledge. The support team does not have senior experience when handling issues, and they repeatedly ask the same basic questions when we open a ticket, even if we provide all details regarding the issue we are facing.

The reports should not resemble a 2003 Excel format and need significant improvement. The reports in the tool are not very customizable, and we lack views that would help us in our journey of exposure management.

Regarding Qualys Enterprise TruRisk Platform's AI capabilities, it seems that I am talking with a chatbot instead of an AI that would help me and give insights on actions I could take to lower or review the risks in my environment. It is not being very helpful in that regard.

The license itself seems comparable to other tools, but what we pay for the license does not deliver what we expected given how much money we pay for this tool.

Time saved is not one of the benefits because instead of using Qualys Enterprise TruRisk Platform to deliver what we need in terms of exposure management, we use external tools to compare the data and build dashboards. We need to export data to external tools to perform the work that is supposed to be done in the tool itself, so we do not have any real return on investment using this tool.

Depending on usage itself, sometimes when we are trying to pull data, some widgets give timeouts, and we do not have the data fidelity that we expect from a tool at this level.

I have been using Qualys Enterprise TruRisk Platform for around six or seven years.

I have limited experience with the customer service team. We have a technical account manager dedicated to support us, but when we reach out, they do not provide reasonable answers to our questions and simply tell us to open a ticket, which is not expected behavior from a technical account manager who should serve as a go-to person to clarify questions and doubts about issues with the tool itself. This is unacceptable because I previously held that role in my company and we always provided that kind of support when requested.

The customer support team lacks senior people to handle most of the questions we pose. When we reach the support team, they do not seem to have the skills to handle our questions and instead return with basic scripted questions rather than understanding what we are asking for and providing proper answers.

Before this tool, we used Nessus and Rapid7, but it was not my decision to change. This was something chosen by others and came as a top-down order to use Qualys Enterprise TruRisk Platform.

I did not have the time to make the decision for Qualys Enterprise TruRisk Platform, as it was chosen by another person who decided to go with this tool. If I had the opportunity, I would conduct a proof of value or proof of concept with other tools in the market to ensure they would meet everything we need to perform our day-to-day tasks.

I obtained Qualys Enterprise TruRisk Platform directly from a partner and not through the AWS Marketplace.

I would advise you to look into other tools in the market before committing to Qualys Enterprise TruRisk Platform, as other tools may offer different kinds of solutions and opportunities to provide the real results expected for exposure management views.

The customer support team lacks senior people to handle most of the questions we pose. When we reach the support team, they do not seem to have the skills to handle our questions and instead return with basic scripted questions rather than understanding what we are asking for and providing proper answers. I gave this review a rating of 6.

Hybrid Cloud

Other

My main use case for Qualys Enterprise TruRisk Platform is to manage responses to vulnerabilities and whatever is detected as threats. I primarily use it for responses to vulnerabilities and whatever is detected as threats on a day-to-day basis.

In my daily work, I use Qualys Enterprise TruRisk Platform in terms of reviewing risks and incidents with my team and for management of various security controls across various platforms, including cloud, on-premise, and third-party applications which also need to be secure.

Qualys Enterprise TruRisk Platform serves its purpose in my organization, and I have been happy to utilize it over the last five years.

The best features Qualys Enterprise TruRisk Platform offers, in my experience, would be the consolidated view or the individual view based on environment, as well as the interactive dashboards and customization of reports.

These features impact my daily work by making decisions faster and helping my team review what is important to look at on a day-to-day basis rather than everything every day.

The features are covered within the standard package itself, and APIs are available for integration. Qualys Enterprise TruRisk Platform has impacted my organization positively by helping us prioritize risks and mitigate them one after the other, classifying risks based on critical, high, and medium so we can look at them effectively.

I have nothing notable to add regarding how Qualys Enterprise TruRisk Platform can be improved; we have been using it for the last five years based on its capabilities, and we are quite happy with it. I am quite happy with it as is.

I have been using Qualys Enterprise TruRisk Platform for over five years.

Qualys Enterprise TruRisk Platform is quite stable and useful for my organization.

Qualys Enterprise TruRisk Platform is quite compatible with my organization's growth and changing needs, and we are able to customize it based on our growth.

Customer support for Qualys Enterprise TruRisk Platform is usually good; we have reached out in the past for downtime and it was fixed right away.

We did not use a different solution before Qualys Enterprise TruRisk Platform; to my knowledge, we have started with Qualys right from the beginning.

The pricing, setup cost, and licensing of Qualys Enterprise TruRisk Platform are as per our budgets, and we found it to be economical.

I have definitely seen a return on investment; we save a lot of time on a day-to-day basis, during audits, and we need fewer employees because the platform has a lot of capabilities that do not require manual effort.

The pricing, setup cost, and licensing of Qualys Enterprise TruRisk Platform are as per our budgets, and we found it to be economical.

The pricing is purely based on licensing cost and it is quite good, with no significant challenges or surprises.

We did evaluate Uptake and another option for vulnerability management before choosing Qualys Enterprise TruRisk Platform, but I cannot remember the name of the other one.

I would rate Qualys Enterprise TruRisk Platform a nine out of ten. I choose nine out of ten because it does not make sense to give a ten unless it is the best product out there.

Qualys Enterprise TruRisk Platform's AI capabilities are quite well-rounded and efficient; we are sure that the AI models do not use our data in unwanted ways and are used for their intended purpose.

In most cases, Qualys Enterprise TruRisk Platform has met my expectations regarding accuracy and reliability of output; the AI models are evolving over time, so it is expected to be even better in the future.

My advice to others looking into using Qualys Enterprise TruRisk Platform is to always do a POC or try a demo before buying. I gave this product a rating of nine out of ten based on my overall experience.

Private Cloud

Amazon Web Services (AWS)

Our main use case for Qualys Enterprise TruRisk Platform is to search and remediate vulnerabilities and to patch our endpoints.

We use Qualys Enterprise TruRisk Platform to search for vulnerabilities by having Linux-based virtual machines scanning in our AWS and our on-prem environments.

The best features are granularity for scanning IPs for vulnerabilities and reporting, which is incredibly advanced for the space they operate in.

The reporting helps us understand what vulnerabilities exist in our environment, which ones are patchable, and which ones require additional remediation.

I appreciate the granularity where I can add in additional credentials to scan for items that otherwise other systems would not be able to scan for.

We have been able to reduce our vulnerabilities by nearly 90%.

It is a combination of visibility, automation, and reducing our vulnerabilities by having proper reporting, by having graphs and charts showing us where we can reduce our vulnerabilities, and having the patch management tool patch our endpoints and matching the endpoints, matching the vulnerabilities to a patch, and then applying the remediation.

I have been using Qualys Enterprise TruRisk Platform for five years.

You should ensure that you have a dedicated person who can manage their time and dedicate themselves fully to Qualys Enterprise TruRisk Platform. I would rate this product a 10 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

My principal case for using Qualys Enterprise TruRisk Platform is my customer Postal Health, a company related to the Brazil post office, which implemented the solution for monitoring digital risk in their environment with E-Taver support.

One sample of how I use Qualys Enterprise TruRisk Platform in this environment is regarding the monitoring of risk concerning the credentials and sensitive information of VIP persons associated with my customer.

Qualys supports me with many alerts, following the risk, suspect risk, and the principal regarding the alert, and this alert is very good for us because it anticipates the potential risk.

I consider isolation of the device rather than waiting for a traditional patch when using Qualys Enterprise TruRisk Platform eliminates capabilities for fixing vulnerabilities without available patches.

That is really useful, and Qualys Enterprise TruRisk Platform helped me detect or respond to threats effectively.

Qualys Enterprise TruRisk Platform impacted my organization positively regarding the information and the quality of information, showing that privileged information is very important for us to anticipate threats.

This report has reduced bad information or risk in my company by more than fifteen percent, and we have reduced fraud regarding VIP information in our organization by twenty percent.

The reports are the best features of Qualys Enterprise TruRisk Platform, and they represent the best feature we have.

The detailed report is very important for my team, and this feature is excellent. In my opinion, it is the best feature of the solution.

The AI capabilities of Qualys Enterprise TruRisk Platform are very good. I love this part.

The output is very accurate for me, and I like it very much.

My opinion regarding patching workflows using Qualys Patch Management is that the integrated information concentrating all this information regarding all these platforms in Qualys allows for a unique vision about all the risks. For us, this is very valuable.

In my opinion, if it is possible to have other reports regarding VIP persons for more detail, that would be good. For now, it completely meets our expectations in my company.

I chose a nine out of ten because of the reports, specifically more detail regarding VIP information.

About three years ago, we started using Qualys solutions in my company.

The simplicity of implementation is good, and the platform is very fluid, having no problems in implementation. During the use of the platform, we receive total help from Qualys.

In my case, Qualys Enterprise TruRisk Platform is deployed in a public cloud, specifically OCI.

I did not purchase Qualys Enterprise TruRisk Platform through the Oracle marketplace. I purchased it with my partner, who has an account in the OCI.

AI acts as a superpower for defenders.

I rate Qualys Enterprise TruRisk Platform a nine out of ten.

Public Cloud

Other

We are using Qualys Enterprise TruRisk Platform for scanning both Windows and Linux environments. We produce reports for vulnerability management. The main focus is on vulnerability scanning.

The platform scans the entire environment and IP range, providing comprehensive vulnerability reports along with solutions to address these vulnerabilities. Its features are extensive and it produces proper results, although there may be occasional false positives. It also categorizes risks based on severity, though further evaluation is necessary for our specific environment.

The report sometimes inaccurately identifies the corresponding operating system version. It would be beneficial if the solution could correctly identify the exact OS version, potentially requiring code adjustments. Additionally, the possibility of Qualys Enterprise TruRisk Platform handling remediation tasks and re-scanning the environment would be advantageous.

I have been working with Qualys Enterprise TruRisk Platform for over four years.

We have not faced any issues with scalability. I would rate it as high scalability with a value of ten.

The setup is moderate. It is neither very simple nor very complex.

The cost is medium to high.

Qualys Enterprise TruRisk Platform is considered a good leader in its field. If anything comparable were found, it would be considered.

I would give Qualys Enterprise TruRisk Platform an overall rating of eight to nine out of ten. Deployment is mostly on-premises with very little use of cloud for this particular account. We are integrating different technologies with Qualys Enterprise TruRisk Platform, many things are in the pipeline.

On-premises

I am using all the modules on Qualys. It is a vulnerability and risk management platform. Additionally, we are using it for quality compliance. Currently, we are managing overall projects and supporting some initiatives. We access the check systems for this purpose. While Tenable sometimes misses vulnerabilities, Qualys consistently identifies potential vulnerabilities.

Qualys offers versatility. It can function both with and without agents, offering flexibility in deployment. Furthermore, it provides comprehensive support for various systems such as Windows Server, Unix servers, and databases, including SQL, Oracle, and others for development. 

Additionally, it extends its functionality to network devices like Cisco and Palo Alto firewalls, switches, routers, and Wi-Fi, making it a comprehensive solution for enterprise needs. With its enhanced support, Qualys minimizes the need for additional tools, providing a comprehensive solution for enterprise security.

Support could be improved. Contacting support is a lengthy process for raising a case. 

Recently, while attempting to set up a customized CI checklist, I faced difficulties updating parameters and obtaining results. Each Control ID in the checklist required a separate case, which presented a significant challenge given the number of checks involved. If issues arise with these checks, we must raise cases. Despite providing documentation and evidence, we receive standard instructions to follow rules we've already adhered to, making the process repetitive.

I have been using Qualys Enterprise TruRisk Platform for four to five years.

Policies are essential for ensuring security and compliance, covering all necessary aspects and being user-friendly. Setting up policies is easy with the guides available on the Qualys portal and the Internet. Testing parameters after setup is straightforward, allowing us to verify outputs. 

However, one limitation is the inability to access saved logs directly. Requesting logs requires involvement from the Qualys team, preventing us from analyzing them independently. This lack of access raises concerns about data privacy, as organizations prefer to keep their data internal. While Qualys undoubtedly has access to our data during scans and responses, ensuring transparency and control over this access remains a priority."

I rate the solution’s stability a seven out of ten.

Our current setup is straightforward. Setting up the scanners and configuring settings is not complex. When using agent-based scanning, installing agents on servers is manageable with the assistance of our managed work. Qualys can discover all assets in our environment and install agents online, eliminating the need for manual installations. Connectivity issues were resolved using the QVS proxy, which our organization readily embraced. Since we already had internal proxy access, configuring the setup was easy. We created and deployed a package across all console workstations and computers.

We opt for an IT-based approach, paying for Qualys via subscription.

If I communicate with admin users responsible for modifying settings, I interact with around 14-16 of them. However, in terms of managing access and overseeing the health of Qualys, I handle close to 20,000-30,000, including network and server devices.

Although we have specialized personnel, we lack visibility into logs to analyze and identify root causes. During screen sharing sessions, when troubleshooting, I actively participate and resolve issues most of the time. So, if we had additional specialists, they could also analyze logs, potentially leading to quicker resolutions.

Overall, I rate the solution an eight-point five out of ten.