Information Security Analyst at a tech services company with 11-50 employees
Real User
Top 20
Nov 17, 2025
Regarding improvements I would like to see in Qualys Policy Compliance, there are a couple of vulnerabilities where the metrics that are already there and the way Qualys measures those metrics and labels them as critical, high, or low does not align with my understanding from a user standpoint. Every time, I have to put in a false positive. Since I have been doing that for the past one year, the same vulnerability tends to pop up and they mark it as critical. Qualys needs to update and rediscover those weaknesses and re-label them. I understand what the company design and what the tool does, but it takes some time for us to manage those things. In terms of missing features that I would like to see included in Qualys Policy Compliance, I do not think there are any. The feature does what we require and does the job. If there were some sort of reporting that fulfills auditor's requirements, particularly if there is an external audit and they ask us for any historical data like how long we have been compliant to the PCI framework, that would be valuable. Having reporting that shows historical data that we have been compliant from the date of inception, for example, from 2023 to 2025 onwards, would bring value to what we are reporting.
I would appreciate improvements in our wrapper certificates and the policy compliance aligning better with automation scripting languages such as Python or Ansible. They need to improve the reporting part of the CI/CD pipelines and the ability to download scans from pods.
Information Security Engineer at a university with 1,001-5,000 employees
Real User
Top 10
Feb 11, 2025
Some sort of education or knowledge base about the product would be beneficial for beginners. They could offer more training sessions for beginners who are new to the solution, as learning would be great for them.
Cyber Security Analyst at a tech vendor with 10,001+ employees
Real User
Top 20
Oct 10, 2024
The policy creation aspect needs improvement. Our team has limited knowledge about creating policies, and I need to focus on this area more. I should study more about creating and handling policies efficiently.
Policy implementation is sometimes a little bit different than, for example, the CIS standards. If you are using a CIS type of standard, controls will be differently implemented, and that implementation is not straightforward. There is no clear mapping for the CIS controls in terms of how they should be implemented into Qualys, so the implementation stage might be a little bit challenging for the customer. That means that the customer will end up opening support cases, which will overload their support team to explain those. If they are somehow published somewhere, it would save time and effort for both sides.
It would be good if the solution’s technical support could be faster. I would like to improve the solution's detection feature whereby any vulnerability can be detected and immediately put in the sandbox.
The reporting needs improvement. While the tool is really good at doing the assessment, it's not as good at reporting various compliance states. Maybe management reporting could be improved as well. They really need to improve the versioning of the policies. You can create basically your own policy based on the industry practice. However, if that industry practice changes, for example, maybe there's a new version from Microsoft, you basically need to start from scratch. That kind of migration from the old best practice to the new best practice and retaining all those customizations that have been done for the old one that has not been actually done. That's something to improve. However, we typically do it as we work with it. We do it programmatically. We do it through the API.
Qualys Policy Compliance (PC) automates the collection of technical controls from information assets within the enterprise, and maps this information to policies to fix and document compliance with regulations and business mandates. It provides compliance reporting by leveraging a comprehensive knowledge-base that is mapped to prevalent security regulations, industry standards and compliance frameworks.
Regarding improvements I would like to see in Qualys Policy Compliance, there are a couple of vulnerabilities where the metrics that are already there and the way Qualys measures those metrics and labels them as critical, high, or low does not align with my understanding from a user standpoint. Every time, I have to put in a false positive. Since I have been doing that for the past one year, the same vulnerability tends to pop up and they mark it as critical. Qualys needs to update and rediscover those weaknesses and re-label them. I understand what the company design and what the tool does, but it takes some time for us to manage those things. In terms of missing features that I would like to see included in Qualys Policy Compliance, I do not think there are any. The feature does what we require and does the job. If there were some sort of reporting that fulfills auditor's requirements, particularly if there is an external audit and they ask us for any historical data like how long we have been compliant to the PCI framework, that would be valuable. Having reporting that shows historical data that we have been compliant from the date of inception, for example, from 2023 to 2025 onwards, would bring value to what we are reporting.
I would appreciate improvements in our wrapper certificates and the policy compliance aligning better with automation scripting languages such as Python or Ansible. They need to improve the reporting part of the CI/CD pipelines and the ability to download scans from pods.
Some sort of education or knowledge base about the product would be beneficial for beginners. They could offer more training sessions for beginners who are new to the solution, as learning would be great for them.
The policy creation aspect needs improvement. Our team has limited knowledge about creating policies, and I need to focus on this area more. I should study more about creating and handling policies efficiently.
Policy implementation is sometimes a little bit different than, for example, the CIS standards. If you are using a CIS type of standard, controls will be differently implemented, and that implementation is not straightforward. There is no clear mapping for the CIS controls in terms of how they should be implemented into Qualys, so the implementation stage might be a little bit challenging for the customer. That means that the customer will end up opening support cases, which will overload their support team to explain those. If they are somehow published somewhere, it would save time and effort for both sides.
It would be good if the solution’s technical support could be faster. I would like to improve the solution's detection feature whereby any vulnerability can be detected and immediately put in the sandbox.
The reporting needs improvement. While the tool is really good at doing the assessment, it's not as good at reporting various compliance states. Maybe management reporting could be improved as well. They really need to improve the versioning of the policies. You can create basically your own policy based on the industry practice. However, if that industry practice changes, for example, maybe there's a new version from Microsoft, you basically need to start from scratch. That kind of migration from the old best practice to the new best practice and retaining all those customizations that have been done for the old one that has not been actually done. That's something to improve. However, we typically do it as we work with it. We do it programmatically. We do it through the API.