Qualys

What Is Qualys?

You don’t fix what you can’t see. In most orgs, that’s the core problem: a moving mix of laptops, servers, cloud workloads, and internet-facing assets—plus the constant backlog of vulnerabilities, missing patches, and compliance drift. Qualys is built to make that problem measurable and actionable: discover assets, assess risk, and drive remediation from one cloud platform.

Qualys is aimed squarely at security and IT operations teams that need continuous vulnerability and compliance coverage at enterprise scale—especially in hybrid environments (on‑prem + multiple clouds + remote endpoints). Instead of relying on a single scanning method, Qualys supports multiple “sensor” approaches: network scanners (physical/virtual), host-based agents, and passive network monitoring. That mix matters because real environments have blind spots (remote endpoints off VPN, segmented networks, ephemeral cloud instances, etc.).

What’s distinctive about Qualys (when it’s deployed well) is the consolidation model: one cloud backend (“Enterprise TruRisk Platform” branding in current materials) with multiple apps/modules for different security jobs—vulnerability management (VMDR), web app scanning (WAS), patch workflows, continuous monitoring/alerting, passive discovery, and more. In other words, it’s not a single-purpose “scanner,” it’s a platform you can expand across use cases if you buy into the ecosystem.

Qualys Features and Performance

Qualys’ core vulnerability workflow typically starts with asset discovery and assessment. For internal networks, that often means deploying a Scanner Appliance (hardware or virtual) that can scan internal and internet-facing assets for vulnerabilities and compliance issues. Qualys documents the scanner appliance concept explicitly and positions it as a central mechanism for network-based assessments.

For virtualized environments, Qualys provides a Virtual Scanner Appliance, and its docs describe it as delivering the same global scanning capabilities as the physical appliance—just deployed as a virtual image (for example, in VMware vSphere). If your environment is mostly virtual, this is the common starting point.

For external attack surface use cases, Qualys also documents a Cloud Perimeter Scanner (Internet Scanner) that is Qualys-hosted for external scanning/attack-surface assessment. That’s useful if you want coverage without deploying your own scanner in a DMZ, though your network and policy requirements may still push you toward self-hosted scanners.

On endpoints and servers where network scanning is disruptive, incomplete, or simply impractical, Qualys pushes its Cloud Agent model. In Qualys’ own documentation, the Cloud Agent is positioned as providing continuous monitoring/detection and even patch deployment/remediation workflows—reducing the need for disruptive network scans. It also supports “continuous scanning” behavior where the initial assessment takes time, but later assessments complete quickly when new host metadata is uploaded to the platform.

Qualys also supports a passive approach with Network Passive Sensor (NPS). Unlike active scanning, NPS observes mirrored traffic, extracts metadata, and sends it back to the Qualys platform for analysis. This is meant to reduce blind spots and discover/profile assets without actively probing them—useful in fragile environments or where scanning windows are politically hard to get.

For web applications, Qualys offers Web Application Scanning (WAS) features like web crawling/link discovery controls, exclusion lists, and multiple authentication types (including form-based and HTTP Basic/Digest). Qualys also provides a Qualys Browser Recorder (free extension) and supports replaying automation via Selenium scripts during scanning. That matters because unauthenticated scans miss entire classes of findings.

Performance reality check: Qualys doesn’t publish a simple “speed” metric because performance depends on the sensor type (scanner vs agent vs passive), your scan configuration, network distance, and target environment. What it does document is the operational characteristic of agent-based continuous scanning: the first assessment can take longer, and subsequent assessments can finish quickly after new host metadata arrives. That’s not a benchmark—but it’s a clear statement about how Qualys expects agent-based assessment to behave.

A final practical feature worth calling out: Qualys has ongoing product change/release mechanisms (release notes and notifications) and continues investing in agent fleet operations (for example, publishing tooling guidance around cloud-agent “health” checks). That’s not a feature in the scanning engine itself, but it matters for real-world operations at scale.

Known specs (VPNSpotter database): Qualys’ jurisdiction is the United States (incorporated in Delaware), and it’s a paid product. (These are provided by you as verified.)

Pricing and Plans

Qualys is not a simple “$X per month” SaaS. Pricing is modular and depends on what you buy.

On its official Subscriptions page, Qualys states that pricing depends on your selection of Cloud Platform apps and the quantity of what you’re protecting—explicitly calling out number of network addresses (IPs), web applications, and user licenses as pricing inputs. In other words, it’s a subscription model, but the unit of measure varies by module.

Qualys also advertises a free trial path. Its “free trial” page describes tailored trial bundles, and explicitly mentions “Try These Product Trials for 30 Days.” This is the clearest, confirmed trial length I found from an official Qualys source.

One important detail: Qualys marketing also has at least one page advertising a free 60-day trial for a specific offering (Remote Endpoint Protection). That doesn’t mean every Qualys product has a 60-day trial; it means some campaigns/products may. If you’re evaluating Qualys, assume trial length can vary by offering unless your specific trial terms say otherwise.

Refunds: I did not find a clear, official, globally-applicable refund window in the sources reviewed (and Qualys commonly sells via quotes/contracts). If refunds or cancellation terms matter to you, you should require the terms in writing in the order form/MSA for your exact purchase.

Privacy and Security Assessment

Jurisdiction (United States): You provided verified data that Qualys is under U.S. jurisdiction (incorporated in Delaware). For privacy-minded buyers, the direct implication is that U.S. legal process can apply to the company. Qualys is an enterprise security vendor (not a consumer privacy tool), so the relevant question isn’t “no-logs” in the VPN sense—it’s what customer telemetry and scan results Qualys stores, how it encrypts it, and what contractual controls exist (DPA/MSA, region selection, etc.).

Encryption / platform controls: Qualys documentation materials describe encryption practices for data in transit and at rest (for example, using TLS/HTTPS for data in transit), and Qualys provides a formal DPA document that includes security commitments like MFA and encryption-at-rest expectations. These are higher-signal documents than generic marketing copy because they’re meant to be referenced in customer/vendor governance processes.

Compliance posture: Qualys’ ESG report states it has achieved certifications to multiple ISO standards, including ISO/IEC 27001:2013, ISO/IEC 27017:2015, and ISO/IEC 27018:2019. That’s not a guarantee of perfection, but it’s a concrete baseline that many enterprise procurement teams require.

Security research and vulnerability handling: Qualys publishes security advisories for issues affecting its own components (for example, advisories related to Qualys Cloud Agent). It also has a public research/advisory program and actively discloses vulnerabilities through its research arm (Qualys TRU/VMRL), including high-profile discoveries and ongoing technical writeups.

Open-source posture: I did not find evidence in the reviewed sources that Qualys is open-source. Practically, you should treat it as a proprietary platform.

Known incidents: I did not find a definitive, well-sourced public account in the reviewed sources of a major Qualys customer-data breach with confirmed scope/impact. Qualys does publish advisories (which is good operational hygiene), but advisories are not the same thing as a platform compromise. If you need breach history at audit-level rigor, require vendor disclosure under NDA and verify via your third-party risk process.

Strengths and Limitations

Strengths

• Multiple sensor options: network scanner appliances, host agents, and passive sensors—so you can cover different network realities (segmentation, remote endpoints, fragile systems).
• Agent-based continuous workflow: Qualys documents continuous scanning behavior where subsequent assessments can complete quickly once new metadata is uploaded.
• Web app scanning supports authenticated workflows: multiple auth types and Selenium script replay support—critical for finding real issues behind login.
• Modular platform: VMDR plus optional patch/remediation and monitoring capabilities built around one backend platform.

Limitations

• Pricing transparency is limited: Qualys describes pricing drivers, but most real deployments are quote-based and module-dependent, making apples-to-apples comparisons harder.
• Not a consumer privacy tool: If you’re coming from a “VPN/no-logs” mindset, Qualys is the opposite category—it collects security telemetry by design.
• Operational complexity: You’re choosing sensors, scan scopes, auth records, and modules. That flexibility is power, but it increases admin overhead.

Who Should Use Qualys?

Good fit

1. Security teams running enterprise vulnerability management at scale (hybrid on‑prem + cloud + remote endpoints) who need multiple ways to gather asset/vuln data (scanner + agent + passive).

2. Organizations with web apps that require authenticated scanning and want a built-in path for scripted login flows (Browser Recorder / Selenium replay) as part of the scanning workflow.

3. Environments where active scanning is constrained (sensitive systems, limited maintenance windows, political resistance), where passive discovery/profiling can reduce blind spots without probing endpoints.

Poor fit

1. Small teams wanting simple, transparent “one price, one agent” vulnerability scanning. Qualys is modular and quote-driven; that’s rarely the lowest-friction option.

2. Buyers expecting open-source transparency. I found no evidence Qualys is open-source.

3. Use cases centered on personal privacy (VPN-style). Qualys is built for enterprise security assessment and will necessarily store and process security telemetry.