Qualys Patch Management Reviews

Our primary use case is to try to reduce our time to remediate. One of our sister teams, the attack surface team, uses the scanning piece. Therefore, we thought it would be best to close the ecosystem and use the patching piece. The feedback from the PoC made it evident that making a shift was necessary.

By implementing Qualys Patch Management, we wanted to reduce the meantime to remediate and have the ability to weigh our threats so that we are not just patching everything; we are patching what is most critical to our environment.

The automation capability that it has to create jobs, set them, and forget them was very intriguing to our business.

The risk-based approach is beneficial because not everything that requires a patch poses a true risk. It makes much more sense because everything that requires a patch may not necessarily be an exposure or true risk. As a leader, it allows me to make sure that I am directing our efforts into something that means. We are not chasing things around because that does not produce a lot of value in the end. 

We were able to realize its benefits immediately. We configured it and used it in the test and a few production machines. It was easy to build jobs and associate the tags that were being used. With the full knowledge base that Qualys has, we did not have to decipher what scanning is saying versus what the actual resolution is. Having all that built into one solution is just great.

Qualys Patch Management gives us a single source of truth for assets and vulnerabilities that need to be assessed, prioritized, and remediated. That is why we purchased it.

The most valuable features are the ease of managing both first-party and third-party patching, the generation of dashboards, and the provision of real-time information. It provides real-time information, with the agent checking in every four hours, offering nearly up-to-date information at any time of the day. This is in contrast to our previous tool, where we did not have this capability.

There is room for improvement in the detection logic. It sometimes detects open vulnerabilities that are not truly there, such as orphan files that are not really exploitable. It would be helpful if they were classified as information-only rather than Sev 4 or Sev 5.

I have been using Qualys Patch Management for a couple of months. We are a new customer for Qualys Patch Management. We are just onboarding it.

We have done a couple of PoCs for two to three months.

We have not experienced any downtime, glitches, or bugs, so I would rate its stability very high.

Qualys Patch Management appears to be dynamic. It should be able to scale with our needs as the organization grows.

I am still investigating this aspect. I have not had a need to open any tickets or cases.

Neutral

We previously used Ivanti. We switched to Qualys to simplify our toolset because we faced challenges bridging the gaps between what Qualys was identifying and what Ivanti was reporting. This change was made to reduce confusion and the effort involved in aligning two systems.

We already had the vulnerability management piece from Qualys, and we just added Patch Management.

The scanning piece has definitely reduced risks, and now, with Patch Management, we will be able to bridge the gap and see further reductions in risks.

Qualys vulnerability management is in the cloud, but with us turning on the Patch Management piece, it is probably going to be a hybrid setup. We will have a piece in the cloud and then some data collector pieces that will allow us to locally deploy patches versus having the machines go out on the Internet.

It is pretty straightforward. We are still in the process of onboarding. We are not done yet.

Seven people are currently involved in the implementation phase. Its usage will be global. Phase one is just our server management. We have about 2,100 servers. Our IT group has about 45 to 50 people.

Qualys Patch Management is expensive.

When we did our PoC, we already had the VMDR piece. We enabled the patch piece and brought the right hand and the left hand together. This integration automatically should include all the relevant patches and configuration changes required to remediate vulnerabilities detected by VMDR. It will be crucial. That is still to be determined, but when two of our critical service delivery organizations are using the same sheet of music or the same tool, it makes us more agile and more responsive to the threats we are trying to protect our business against.

I would rate Qualys Patch Management a nine out of ten.

Initially, we were using Qualys Patch Management for TruRisk vulnerability detections. I am on the risk operations side, so I also used it to determine ways to fix a particular vulnerability and address it.

I used Patch Management with Qualys VMDR when I was doing a proof of concept with Patch management. It works well. To me, it was just a shortcut or another way to patch a system versus doing it with the job, but it was straightforward.

We were able to realize its benefits immediately. Patch Management gave my side and the security side a single pane of glass and the ability to better coordinate the delivery of patches. After using it, I felt a lot more comfortable with it. 

TruRisk gives the confidence that we are attacking the major issues, but we do leverage our security team to make the final decision. It does help.

Patch Management gives us a single source of truth for assets and vulnerabilities that need to be assessed, prioritized, and remediated.

Currently, we are in a hybrid environment until we fully transition over. We have Ivanti and Qualys. They are two separate agents, two separate infrastructures. Moving to Qualys Patch Management gives us instant access to all of the systems we have. We do not have to worry about building up new infrastructure. We just go and start patching. It streamlines everything a lot, especially the dialogue between our teams, that is, the risk side versus the security side. It reduces confusion over patches.

Patch Management has definitely given us the opportunity to do more hands-off patching. Some in my team are manually pushing the patches out. We click a button, schedule it, and shoot it out. We are going to take advantage of zero-touch patching for browsers. We are going to do a lot more scheduled or agent-based patching. It will be hands-off. It will free us up to do more analytical things and spread ourselves out to other tasks.

Patch Management will help us reduce our organization's risk. We have not had the opportunity to start using it the way we want to. We are still early on, but just from what I see, I expect that it would have a significant impact on our ability to patch. Personally, I think the impact will be significant.

We recently got their Patch Management solution, which is the most important thing for me at this time. Previously, vulnerability detection was most valuable.

Patch Management's risk-based approach to creating automation to address risks is very important. I just came from the conference, and I understand it a lot more. It definitely is important. I like it a lot.

I would like a more clear distinction in terms of something I call a patch contract. A patch contract is a bundle of patches that we are going to roll out. I would like to reference those patches from separate jobs. They explained at a conference that it cannot be done, but that is my main complaint. I wish that the whole schema was a little bit clearer because there is a little bit of cloudiness around it. Everything else seems to be fairly straightforward.

Additionally, I know there is a cost associated with this, but it would be nice if instead of us having to roll and host our own custom files on AWS or something like that, Qualys could provide some space, even if just a gigabyte or 500 megabytes.

I have been using it for about a year or two.

Overall, I have not experienced any issues with Qualys as a whole, although the security team once mentioned something about the system being down. I will learn more as I get more and more into patching with it.

I have not yet contacted their support.

Neutral

Right now, we are using a mixture of security controls and endpoint management. I have used solutions like Ivanti, Altiris, Intune, and WSUS, among others. I have seen a lot of patch management solutions.

Ivanti is closest to Qualys. Both of them are built on the same Shavlik engine. Qualys is better for my situation because it is cloud-based. I do not have to worry about on-prem things I do right now. I am familiar with Patch Management because underneath it is the same Shavlik engine that is used by Ivanti. I am familiar with the log files and things like that.

That was the easiest thing to do. All the hard work had already been done. After the security team has the agents installed, we start working our magic. It does not get easier than that.

We have not yet fully deployed it, so I cannot say how long it takes to fully deploy it, but getting it established and started was quick.

From what I have heard, Qualys Patch Management is pricey, which is a main barrier to entry. Another aspect that I do not like about Qualys is that they do not add new patch management functionalities to the existing package. It is a separate SKU, so you have to pay more money.

I would rate Qualys Patch Management a nine out of ten.

Qualys has a scanning tool for viruses, vulnerability, and malware detections. They recently launched Qualys Patch Management for patching applications or server sites. We previously used tools like SCCM or Microsoft Intune. Qualys Patch Management is a replacement for all those kinds of tools, but we mainly use it for patching the applications, not the servers.

If a server has two applications, and one has a patch and the other one does not have a patch, you do not need to worry. You just select the server and the patches you want to deploy. If you have selected four patches but only two are applicable, it will only deploy the ones that are applicable. The other two are skipped so that there are no issues or errors with the existing image. That is an advantage of this solution.

There is no automation. You have to manually create a job. There is a scanned report, and based on that, you can select a patch or server. You can select multiple servers or multiple patches. 

We have used the solution's Risk Reduction Recommendation Report. After the remediation, we run the scan again. It is simple.

Using Patch Management, we have not seen any improvement in our patch rates.

For a few applications, you do not need to go and download the patches from the network or somewhere else. They have the patches or the latest updates in the directory. You can just select a patch and deploy it to a server. You can create a patch job and select the patch. Everything is within the interface. You do not need to go out of it.

It is user-friendly. It is not complex.

The Qualys Scanning tool is one of the best tools for scanning purposes, virus detection, and vulnerability detection, whereas Qualys Patch Management is helpful only in a few cases, not in all cases.

There are multiple tools for patching, such as SCCM, Intune, or Ivanti. One of the challenges that we have faced with the Patch Management tool is that you cannot patch all the things. There are some limitations, whereas, in SCCM, we can create a package and just deploy that through it. Anything is deployable through SCCM, whereas Patch Management is very selective. They should support more applications. For example, you cannot push a patch on Oracle.

There is not much automation. For example, with SCCM, you can push anything, but that is not the case with Qualys.

We have faced a few corruptions while patching. Even though a patch is feasible through Qualys Patch Management, when we try to push it to our servers, we face some errors or interruptions. When we push the patch, something gets blocked and the patch fails. Even if the patch is within the directory of Qualys, we cannot push it. There are some errors.

The Qualys support team can be more communicative. Just sharing a knowledge-based article does not help all the clients or all people. A knowledge-based article might be useful for a technical person, but it does not help someone who is not very technical. They should have a call-based approach. Even companies like Microsoft provide an option for a call for a support case, which allows you to discuss the issue and troubleshoot it quickly. Qualys should improve their support. 

I have been using this solution from the beginning or since it was launched. It was launched recently. It has been one to two years.

It is stable. I would rate it a nine out of ten for stability.

I would rate it a ten out of ten for scalability. Its scalability is very good. It can be expanded, but it also depends on the licensing part.

It is being used for the whole organization for patch management. We have 70 to 80 users using this solution.

We faced challenges with their support for the issues that we raised. When you raise a case, they just share a knowledge-based article with you. It is very tough to catch them over a call and have a live troubleshooting session to understand the issue. You cannot just be dependent on the knowledge base articles. Sometimes, you have to go in-depth and do research to understand the cause of the issue. Their support team was not very helpful or communicative.

The experience might vary based on the priority of the case. It might be different when you have a high-priority case. The cases that we raise are at P3 or P4 levels because we are not completely dependent on Qualys Patch Management. For a P1 or P2 case, they might have a different approach.

Neutral

Previously, we were using Ivanti and SCCM. They are more comprehensive, and you can push anything. You can even create a script or a package and push it through them, and it will be deployed on all the servers. Qualys Patch Management is very limited compared to SCCM, Intune, or Ivanti. Having said that, it is quite new. It was launched one or two years ago. They need some time to improve their services.

Its deployment is straightforward.

We have both cloud and on-prem servers. We do patch deployment on both. We can do an immediate deployment or a scheduled deployment. It takes time based on the application size, server count, etc. If the file is of a few MBs, it does not take more than one or two minutes. If it is a huge file, then it will take longer, but everything is reasonable. I have not seen any delays. The run time is good. It is not an issue. The only issue is that a few blockers need to be corrected.

It does not require much maintenance, but the support should be better from their side.

Once you have deployed a job, it runs automatically. You need to go and check it only if there is a failure. You do not need to manually manage anything. Once a job is created, it runs automatically at a scheduled time. All that is automatically done at the backend.

It is affordable, but they should provide features as per the rate they are charging. We have a big infrastructure with about 80,000 licenses. We expect better support from the Qualys team. So, it is affordable, but more features should be there, and the support should be better.

At this time, I would not recommend Qualys Patch Management because there are multiple features that need to be developed from their end. You cannot deploy everything through it. I might recommend it in the future. It needs some time to be fully developed.

I would rate Qualys Patch Management a six out of ten because of the support quality and lack of features.

By implementing this solution, we wanted to fix vulnerabilities as soon as possible in both software and operating systems. Qualys Patch Management gives us the power to solve vulnerabilities quickly and keep our environment safe.

We have not yet seen many benefits because we are still deploying patch policies. We are doing that first with a test group. We have not done 100% patch management. By next month, we will have 100% management through Qualys Patch Management. We expect to see about 99.9% of assets updated all the time. We have great expectations.

We can create rules based on risk. We do not make it 100% automatic for servers because there is a higher chance of issues, but for PCs, we can do 100% automation. Based on the risk for an operation, we can create some sort of policies.

We are deploying both Qualys Vulnerability Management and Qualys Patch Management. Qualys Vulnerability Management was deployed one month ago. For the last month, we have been working to deploy Qualys Patch Management. They are being deployed side by side. The benefit of this is that Qualys Patch Management can solve all the vulnerabilities found by Qualys Vulnerability Management. One part of the tool detects the vulnerabilities and then the other part fixes them. They work together.

Patch Management will help reduce our organization's risk, but it is hard to say how much it will reduce the risks.

Policy enforcement requires less time for my team because users cannot avoid applying updates. The user can skip two or three times or for a maximum of eight hours. After that, there is no way to avoid it. It helps us keep the environment safe.

Its implementation is too recent to make any judgments about areas needing improvement. In terms of pricing, of course, it is not free. Cheaper is always better. If possible in the future, it would be good if it is cheaper.

It has been deployed very recently and we are still in the process of deploying it throughout our organization.

So far, stability has been good with no issues.

I know that as a cloud solution, it would be easy to scale, but I do not have any experience with it. We just deployed it, so there is no need to scale at this time.

I have not had to contact support, so I cannot comment on customer service.

Neutral

We previously used Microsoft WSUS. However, it did not offer the same level of management and enforcement as Qualys Patch Management.

Qualys Patch Management gives me all kinds of management options. I have good visibility into vulnerabilities on each asset. Microsoft WSUS does not give me this sort of management level. We also could not meet the expectation of a 99.9% patch rate with Microsoft WSUS.

It is too early to determine the return on investment.

The licensing cost is more than 2,000 for the whole Americas region.

We have not integrated Qualys Patch Management with CMDB or ITSM tools for ticket management. This Qualys Patch Management deployment is done at the Americas region level, and the ITSM that we have in place is only in South America. Companies in the Americas region do not have ITSM, so there is no integration yet.

I would rate Qualys Patch Management an eight out of ten.

Qualys Patch Management is used to address and remediate server vulnerabilities. It provides a dashboard with information on remediation steps, vulnerability severity, impact, and other relevant details. This tool effectively manages and mitigates security vulnerabilities, ensuring the security of our infrastructure.

Qualys Patch Management provides visibility into our infrastructure's security vulnerabilities, enabling us to demonstrate to external auditors that our infrastructure is secure and vulnerabilities are mitigated. This has strengthened our security posture and significantly improved our overall security.

The TrueRisk automation helps us remediate vulnerabilities without involving our security team.

Qualys Patch Management provides a single source for asset and vulnerability monitoring, allowing us to view remediation status and severity levels from a centralized dashboard.

It is user-friendly and easy to learn, even for someone without experience, enabling them to master the tool within four days.

Qualys Patch Management has helped reduce our organization's risk by 70 to 80 percent.

The most valuable feature is the ability to search for vulnerabilities using their QID. This provides comprehensive information, including severity, CVE, and impact, in an informative dashboard. This allows for a clear understanding of the scope of the infrastructure affected and the specific servers impacted.

The Qualys agent sometimes encounters authorization issues, leading to inaccurate vulnerability reports. Additionally, server updates cause duplicate assets to appear, hindering accurate asset identification.

I have been using Qualys Patch Management for approximately two and a half years.

I would rate the stability of Qualys Patch Management as nine out of ten.

I would rate the scalability of Qualys Patch Management as eight out of ten.

Qualys' technical support is good. We raised some issues, and their response was quick and effective, resolving everything on time.

Positive

The initial setup for one or two servers was straightforward and did not take much time. It was set up before I joined the organization, so my direct experience with a larger-scale setup is limited.

I would rate Qualys Patch Management eight out of ten.

We have three environments: production, development, and QA. To perform patching, we must coordinate with the application team and schedule downtime. Due to the critical nature of the business application running on the production servers, we cannot automate patching; instead, we use satellite servers.

Our organization has between 20 and 30 people who use Qualys Patch Management.

In the two and a half years I've used Qualys Patch Management, I haven't observed any need for maintenance on the tool.

Qualys Patch Management is a valuable tool for large organizations seeking to maintain a secure infrastructure.

Our use cases for Qualys vary depending on the client. I work for a Paris-based French company that provides cybersecurity and metadata services to multiple clients. We primarily use Qualys to check the core infrastructure that hosts everything, scanning and remediating vulnerabilities.

We work with multiple teams, so if we identify a patching issue using Qualys, we might need to escalate it to another department. For example, if we identify a vulnerability in a CI/CD tool the DevOps team uses in Terraform, we're not supposed to touch it. We recommend a time frame for the DevOps team to apply the patch. If the issue is high-severity, they may need to address it as soon as possible. We run the scans, get the reports, and create recommendations.

We have integrated Qualys with our homegrown ticketing tool, but we plan to migrate to ServiceNow. It's a gradual process. Microsoft Sentinel, our SIEM solution, sends alerts to our internal detection and monitoring tool, which ServiceNow will soon replace. Our SIEM tool is responsible for monitoring the overall risk, while we use Qualys to report vulnerabilities that need to be patched.

Qualys improved productivity and efficiency after we became certified and familiar with the tool. However, our efficiency ultimately doesn't rely on us. We're not free to do whatever we want because we need to wait for the approval of our bosses or clients. We only note everything on our customized reports inspired by Qualys' core reporting. 

Our clients typically have a 30 percent security score, and we aim to raise that to at least 90 percent through patch management and vulnerability monitoring and detection so their infrastructure security improves daily.  

Qualys' best feature is its reporting. At first, it may seem a little complicated to a beginning user, but it's helpful once you get used to it. Most of these scans run automatically. We set the scans up for the client to run at daily, weekly, or monthly intervals, depending on how critical the server or other hardware is.

According to the scan target, we adopt a risk-based or patch-based approach. Our company has a large SOC team that covers more than just the scanning aspect. Qualys is one tool we use. Regarding the managerial component, we have documentation and a set of steps to follow. We must also follow all the protocols, regulations, and standards, such as ISO-27000 or GDPR if you are in Europe.  

Qualys could improve its capacity to fix vulnerabilities on VMware and other virtualized environments. The reporting could also be enhanced to make it more user-friendly. It's difficult for beginners to learn.  

I have used Qualys for two and a half years.

We've had no stability issues with Qualys because most clients use high-speed fiber optic connections. 

I rate Qualys support nine out of 10. I've contacted Qualys support four or five times. They're highly efficient. There were some delays and technical issues the first time I called them, but the rest of my experiences went smoothly.

Positive

We used Nessus, but we switched. It was a company decision because it has a partnership with Qualys' parent company. Before that, we used Metasploit

Deploying Qualys was initially overwhelming, but after a lot of tutorials and testing, we got used to it. Three people were involved in the first six months, but now I'm the only one using it. We had some help from Qualys in the first few months.  

I'm unaware of Qualys' exact price, but it's more expensive than Nessus. With technological products, you need to pay to get the best. 

I rate Qualys eight out of 10. It's a great tool, and if I consulted for a client, I would recommend it.