Manager, Information Technology Risk & Chief Information Security Officer at a financial services firm with 1,001-5,000 employees
Real User
Top 10
Oct 14, 2026
My main use case for Qualys Enterprise TruRisk Platform is to integrate it with different cybersecurity solutions and other solutions and to identify the main findings and be able to prioritize when selecting where we are going to dedicate human resources and what the main problems are in the technology infrastructure. A specific example of how I have recently used the platform to prioritize a finding or manage a security incident is that it helps us locate those that are truly exploitable, and those are the kinds of findings we prioritize. When using Qualys Patch Management to cover diverse environments, my patching workflows for Windows and Linux mainly differ because they are very fast and they are the ones we use the most. When deciding to use the capabilities of Qualys TruRisk Eliminate to remediate vulnerabilities without available patches, I mainly consider applying mitigations.
My main use case for Qualys Enterprise TruRisk Platform is for patching and remediation. I specifically address Patch Tuesday updates when using Qualys Enterprise TruRisk Platform for patching and remediation. In addition to patching, I also remove unauthorized software with Qualys Enterprise TruRisk Platform. I only deal with Windows patching when using Qualys Patch Management; we have a different team for the others. We target all of them for deploying Qualys Cloud Agent for patching, particularly across workstations, servers, and other devices. We're still exploring the criteria for leveraging Qualys Patch Management's zero-touch patching feature to automatically apply patches based on risk.
Senior Analyst of Vulnerability Management at a tech vendor with 10,001+ employees
Real User
Top 20
Oct 14, 2026
My main use case for Qualys Enterprise TruRisk Platform is to expedite remediation, understand true risk in our environment, and fix true risk. With the overall score functionality, I am able to identify vulnerabilities and risk based on CVEs or QIDs that allow us to eliminate potential risk that would have impacted us. We patch based on severity, so whatever the highest severity is, that's how we make our decisions regarding how Qualys Enterprise TruRisk Platform's Patch Management integration with TruRisk influences our prioritization of patches from known exploited vulnerabilities or CISA catalog items.
Chairman e-Safer Cibersecurity at a tech services company with 51-200 employees
Real User
Top 20
Oct 14, 2026
My principal case for using Qualys Enterprise TruRisk Platform is my customer Postal Health, a company related to the Brazil post office, which implemented the solution for monitoring digital risk in their environment with E-Taver support. One sample of how I use Qualys Enterprise TruRisk Platform in this environment is regarding the monitoring of risk concerning the credentials and sensitive information of VIP persons associated with my customer. Qualys supports me with many alerts, following the risk, suspect risk, and the principal regarding the alert, and this alert is very good for us because it anticipates the potential risk. I consider isolation of the device rather than waiting for a traditional patch when using Qualys Enterprise TruRisk Platform eliminates capabilities for fixing vulnerabilities without available patches. That is really useful, and Qualys Enterprise TruRisk Platform helped me detect or respond to threats effectively.
The use cases include a cloud environment, so we want to secure the cloud, cloud workloads and cloud payloads, and complete private cloud. We obtained this product to secure and run our scans and provide us with the risk rating and vulnerabilities, combining them to provide Qualys Enterprise TruRisk Platform. We use it for that purpose.
Security Consultant at a tech vendor with 10,001+ employees
Real User
Top 5
Jul 20, 2026
My main use case for Qualys Enterprise TruRisk Platform is to provide a view of the exposure management risk of the company for vulnerabilities and other capabilities including cloud solutions. I scan the environment to identify vulnerabilities present and provide a risk view of how the company is exposed to vulnerabilities in the environment.
Learn what your peers think about Qualys Enterprise TruRisk Platform. Get advice and tips from experienced pros sharing their opinions. Updated: October 2026.
My main use case for Qualys Enterprise TruRisk Platform is to manage responses to vulnerabilities and whatever is detected as threats. I primarily use it for responses to vulnerabilities and whatever is detected as threats on a day-to-day basis. In my daily work, I use Qualys Enterprise TruRisk Platform in terms of reviewing risks and incidents with my team and for management of various security controls across various platforms, including cloud, on-premise, and third-party applications which also need to be secure. Qualys Enterprise TruRisk Platform serves its purpose in my organization, and I have been happy to utilize it over the last five years.
The major use cases from my side for Qualys Enterprise TruRisk Platform integrate with our VMDR, Qualys VMDR. Basically, what TruRisk does is it helps with risk prioritization. We do all the integrations with existing products, which again is Qualys VMDR for us. We also integrate with a couple of other products, next-gen antivirus and others. Then it helps us normalize the overall risk that we have, not just looking at vulnerabilities. Based on that, we just prioritize whether this patching process or putting in any security controls is worth an effort or not. If it is worth the effort, then how do we prioritize? Which ones should go at the top? Which one needs to be dealt with first, and then gradually, the non-critical ones can stay down the chain. The threat prioritization feature of Qualys Enterprise TruRisk Platform helps for resource allocation, especially for the crown jewel applications that we have. Of course, we feed that via CMDB into the tool. So we kind of prioritize what risks need to be taken care of, and then depending upon who owns it or we have a detailed RACI matrix which shows that hey, this particular thing or gap needs to be fixed by the network team, for example, or infrastructure team, server team, then we allocate those resources based upon priority. If it is a very high risk to the business, then we allocate resources based on that kind of risk prioritization, which is what the tool is meant to do. It is done on an ad-hoc basis, so on the process side, it needs to be taken care of from the process and cannot be automated, the resource allocation. But once we know that it is a high priority, then we allocate the resources within the span of time and that needs to be dealt with. The benefits of visibility from Qualys Enterprise TruRisk Platform is that it is the central tool. The first thing that we integrate with is our asset inventory or CMDB, and we do it via ServiceNow. So we have all the assets, and then a lot of it depends on or it is a prerequisite to have very clean and hygienic CMDB. So there we have got all the assets, we have got all the applications, the business owners, stakeholders, and all of those. Then there is asset criticality, which is the most important thing that gets fed into TruRisk, and that is something which creates a positive or a negative bias on the risk that comes in because it is us, the business owners who understand the criticality of it, and that is more a subjective thing. So that is fed and then that is the most central integration. Then we do integrate with Qualys VMDR and all the other platforms which spit out their own various versions of vulnerabilities and risk and all of that. The tool then quantifies it and then prioritizes which ones need to be handled at the top.
My main reasons to use Qualys Enterprise TruRisk Platform were vulnerability severity assessment for assets like server endpoints and cloud resources. We utilized it for asset scores, vulnerability scores, overall enterprise risk, security perimeter analysis, and zero-trust implementation.
Mediation Specialist III at a tech vendor with 201-500 employees
Real User
Top 20
Sep 26, 2025
I basically use Qualys Enterprise TruRisk Platform to scan my internal networks and the URLs we work on. These two are the test cases, and then we scan the clusters. If we have an IP hosted on the Kubernetes clusters, we just pick that IP address and scan it for vulnerabilities. That is one use case from that scanner. When we have an IP range from 0 to 32 in the ports, we try to scan it from there. If one IP has multiple applications, we try to scan it on that particular part where it is hosted as an external network and it scans all those things along with the web applications. It's a SAST thing which we do.
IT Consultant at a tech vendor with 10,001+ employees
Real User
Top 5
May 2, 2025
We are using Qualys Enterprise TruRisk Platform ( /products/qualys-enterprise-trurisk-platform-reviews ) for scanning both Windows and Linux environments. We produce reports for vulnerability management. The main focus is on vulnerability scanning.
I am using all the modules on Qualys. It is a vulnerability and risk management platform. Additionally, we are using it for quality compliance. Currently, we are managing overall projects and supporting some initiatives. We access the check systems for this purpose. While Tenable sometimes misses vulnerabilities, Qualys consistently identifies potential vulnerabilities.
Qualys Enterprise TruRisk Platform provides robust risk management, supporting both agent-based and agentless deployments, scanning environments, categorizing risks, and prioritizing threats with machine learning capabilities. Qualys Enterprise TruRisk Platform enhances vulnerability management across diverse systems, including Windows Server, databases, and network devices. It assigns CVE and CVSS scores, delivers detailed reports, and guides threat prioritization. Machine learning enables...
My main use case for Qualys Enterprise TruRisk Platform is to integrate it with different cybersecurity solutions and other solutions and to identify the main findings and be able to prioritize when selecting where we are going to dedicate human resources and what the main problems are in the technology infrastructure. A specific example of how I have recently used the platform to prioritize a finding or manage a security incident is that it helps us locate those that are truly exploitable, and those are the kinds of findings we prioritize. When using Qualys Patch Management to cover diverse environments, my patching workflows for Windows and Linux mainly differ because they are very fast and they are the ones we use the most. When deciding to use the capabilities of Qualys TruRisk Eliminate to remediate vulnerabilities without available patches, I mainly consider applying mitigations.
My main use case for Qualys Enterprise TruRisk Platform is for patching and remediation. I specifically address Patch Tuesday updates when using Qualys Enterprise TruRisk Platform for patching and remediation. In addition to patching, I also remove unauthorized software with Qualys Enterprise TruRisk Platform. I only deal with Windows patching when using Qualys Patch Management; we have a different team for the others. We target all of them for deploying Qualys Cloud Agent for patching, particularly across workstations, servers, and other devices. We're still exploring the criteria for leveraging Qualys Patch Management's zero-touch patching feature to automatically apply patches based on risk.
My main use case for Qualys Enterprise TruRisk Platform is to expedite remediation, understand true risk in our environment, and fix true risk. With the overall score functionality, I am able to identify vulnerabilities and risk based on CVEs or QIDs that allow us to eliminate potential risk that would have impacted us. We patch based on severity, so whatever the highest severity is, that's how we make our decisions regarding how Qualys Enterprise TruRisk Platform's Patch Management integration with TruRisk influences our prioritization of patches from known exploited vulnerabilities or CISA catalog items.
My principal case for using Qualys Enterprise TruRisk Platform is my customer Postal Health, a company related to the Brazil post office, which implemented the solution for monitoring digital risk in their environment with E-Taver support. One sample of how I use Qualys Enterprise TruRisk Platform in this environment is regarding the monitoring of risk concerning the credentials and sensitive information of VIP persons associated with my customer. Qualys supports me with many alerts, following the risk, suspect risk, and the principal regarding the alert, and this alert is very good for us because it anticipates the potential risk. I consider isolation of the device rather than waiting for a traditional patch when using Qualys Enterprise TruRisk Platform eliminates capabilities for fixing vulnerabilities without available patches. That is really useful, and Qualys Enterprise TruRisk Platform helped me detect or respond to threats effectively.
The use cases include a cloud environment, so we want to secure the cloud, cloud workloads and cloud payloads, and complete private cloud. We obtained this product to secure and run our scans and provide us with the risk rating and vulnerabilities, combining them to provide Qualys Enterprise TruRisk Platform. We use it for that purpose.
My main use case for Qualys Enterprise TruRisk Platform is to provide a view of the exposure management risk of the company for vulnerabilities and other capabilities including cloud solutions. I scan the environment to identify vulnerabilities present and provide a risk view of how the company is exposed to vulnerabilities in the environment.
My main use case for Qualys Enterprise TruRisk Platform is to manage responses to vulnerabilities and whatever is detected as threats. I primarily use it for responses to vulnerabilities and whatever is detected as threats on a day-to-day basis. In my daily work, I use Qualys Enterprise TruRisk Platform in terms of reviewing risks and incidents with my team and for management of various security controls across various platforms, including cloud, on-premise, and third-party applications which also need to be secure. Qualys Enterprise TruRisk Platform serves its purpose in my organization, and I have been happy to utilize it over the last five years.
The major use cases from my side for Qualys Enterprise TruRisk Platform integrate with our VMDR, Qualys VMDR. Basically, what TruRisk does is it helps with risk prioritization. We do all the integrations with existing products, which again is Qualys VMDR for us. We also integrate with a couple of other products, next-gen antivirus and others. Then it helps us normalize the overall risk that we have, not just looking at vulnerabilities. Based on that, we just prioritize whether this patching process or putting in any security controls is worth an effort or not. If it is worth the effort, then how do we prioritize? Which ones should go at the top? Which one needs to be dealt with first, and then gradually, the non-critical ones can stay down the chain. The threat prioritization feature of Qualys Enterprise TruRisk Platform helps for resource allocation, especially for the crown jewel applications that we have. Of course, we feed that via CMDB into the tool. So we kind of prioritize what risks need to be taken care of, and then depending upon who owns it or we have a detailed RACI matrix which shows that hey, this particular thing or gap needs to be fixed by the network team, for example, or infrastructure team, server team, then we allocate those resources based upon priority. If it is a very high risk to the business, then we allocate resources based on that kind of risk prioritization, which is what the tool is meant to do. It is done on an ad-hoc basis, so on the process side, it needs to be taken care of from the process and cannot be automated, the resource allocation. But once we know that it is a high priority, then we allocate the resources within the span of time and that needs to be dealt with. The benefits of visibility from Qualys Enterprise TruRisk Platform is that it is the central tool. The first thing that we integrate with is our asset inventory or CMDB, and we do it via ServiceNow. So we have all the assets, and then a lot of it depends on or it is a prerequisite to have very clean and hygienic CMDB. So there we have got all the assets, we have got all the applications, the business owners, stakeholders, and all of those. Then there is asset criticality, which is the most important thing that gets fed into TruRisk, and that is something which creates a positive or a negative bias on the risk that comes in because it is us, the business owners who understand the criticality of it, and that is more a subjective thing. So that is fed and then that is the most central integration. Then we do integrate with Qualys VMDR and all the other platforms which spit out their own various versions of vulnerabilities and risk and all of that. The tool then quantifies it and then prioritizes which ones need to be handled at the top.
My main reasons to use Qualys Enterprise TruRisk Platform were vulnerability severity assessment for assets like server endpoints and cloud resources. We utilized it for asset scores, vulnerability scores, overall enterprise risk, security perimeter analysis, and zero-trust implementation.
I basically use Qualys Enterprise TruRisk Platform to scan my internal networks and the URLs we work on. These two are the test cases, and then we scan the clusters. If we have an IP hosted on the Kubernetes clusters, we just pick that IP address and scan it for vulnerabilities. That is one use case from that scanner. When we have an IP range from 0 to 32 in the ports, we try to scan it from there. If one IP has multiple applications, we try to scan it on that particular part where it is hosted as an external network and it scans all those things along with the web applications. It's a SAST thing which we do.
We are using Qualys Enterprise TruRisk Platform ( /products/qualys-enterprise-trurisk-platform-reviews ) for scanning both Windows and Linux environments. We produce reports for vulnerability management. The main focus is on vulnerability scanning.
I am using all the modules on Qualys. It is a vulnerability and risk management platform. Additionally, we are using it for quality compliance. Currently, we are managing overall projects and supporting some initiatives. We access the check systems for this purpose. While Tenable sometimes misses vulnerabilities, Qualys consistently identifies potential vulnerabilities.