Qualys CyberSecurity Asset Management (CSAM) Reviews

Name: Qualys CyberSecurity Asset Management (CSAM)
Brand: Qualys
Rating: 5 (7 reviews)

4.6 out of 5

7 reviews
100% willing to recommend

What is Qualys CyberSecurity Asset Management (CSAM)?

Qualys CyberSecurity Asset Management (CSAM) provides industry-leading coverage of the internal and external attack surface (EASM), along with comprehensive cyber risk assessment, natively-integrated with Qualys Vulnerability Management, Detection, and Response (VMDR).

Get the Qualys CyberSecurity Asset Management (CSAM) Buyer's Guide and find out what your peers are saying about Qualys CyberSecurity Asset Management (CSAM), CrowdStrike Falcon, Tanium and more!

Qualys CyberSecurity Asset Management (CSAM) is the #4 ranked solution in top Cyber Asset Attack Surface Management (CAASM) solutions, #5 ranked solution in top Attack Surface Management (ASM) solutions, #7 ranked solution in top Software Supply Chain Security solutions, #9 ranked solution in top Patch Management solutions, and #14 ranked solution in top Vulnerability Management solutions. PeerSpot users give Qualys CyberSecurity Asset Management (CSAM) an average rating of 9.2 out of 10. Based on the analysis of the 7 most recent Qualys CyberSecurity Asset Management (CSAM) reviews, the overall sentiment is positive, with a sentiment score of 7.4. (The highest in the category). Qualys CyberSecurity Asset Management (CSAM) is most commonly compared to CrowdStrike Falcon: Qualys CyberSecurity Asset Management (CSAM) vs CrowdStrike Falcon. Qualys CyberSecurity Asset Management (CSAM) is popular among the large enterprise segment, accounting for 58% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 25% of all views.

Buyer's Guide

Qualys CyberSecurity Asset Management (CSAM)

October 2024

Get the report

Helped 814,763 peers since 2012

Featured reviews

Brad Mathis

Employee-Owner, Senior Consultant, Information Security at Keller Schroeder

The external attack surface management identified unexpected assets, suggesting some exist outside our known inventory. While these may not be directly managed by us, the process has brought valuable awareness to the fact that our core servers are externally hosted, prompting a review of similar situations. An external attack surface management scan revealed several outsourced name services, along with one unexpected third-party-linked IP. It's unclear if this was due to past consulting work or a registration error, but since it wasn't relevant to our company, it was easily excluded from future scans. The benefits of Qualys CyberSecurity Asset Management are immediate. We already had the cloud agents installed. They were already on all the servers and workstations. Once we upgraded from the VMDR included GAV (Global AssetView) to CSAM, it was no time before I could see the end-of-life, end-of-service software, and hardware. In addition to vulnerabilities, CSAM provides a better view of other risk factors, but VMDR is very powerful. VMDR was already seeing our limitations in hardening our vulnerabilities. CSAM enhanced our view by adding more visibility and insight into what we have. TruRisk scoring goes beyond traditional vulnerability scoring like CVSS to prioritize both vulnerabilities and assets based on real-world exploitability and industry targeting. This provides a clearer picture of our actual risk by considering factors like published exploits and what attackers are currently focusing on, allowing us to quickly identify critical issues and avoid wasting time on vulnerabilities with a high theoretical risk but low real-world threat. Qualys Cloud Agents can now be configured as passive sensors to discover all devices on our network in real-time, eliminating the requirement for separate virtual or physical passive sensor appliances. These cloud agent sensors monitor network broadcasts instead of egress traffic, and they can even designate a secondary sensor to take over if the primary becomes unavailable, ensuring continuous asset discovery and populating our CSAM platform with managed and unmanaged devices.

Read full review

Kakarla Saikrishna

Senior Cyber Security Analyst at a financial services firm with 10,001+ employees

Qualys CSAM improves my organization's asset posture by providing visibility on cybersecurity assets and streamlining asset management and inventory. It can detect every asset in our network. It is able to detect network devices such as switches, printers, and servers. However, it may provide information that is not useful, and sometimes, tagging might also be incorrect. We were able to realize its benefits within six months. It took us around two to three months to get a good understanding of it. We spent some time fine-tuning it based on our needs and understanding false positives. Overall, in about six months, we could properly see its benefits. Qualys CSAM helps me prioritize vulnerabilities through Qualys Vulnerability Score (QVS), which combines various threat and impact factors. It enables me to prioritize vulnerabilities based on the criticality and risk posed to my organization. This is beneficial for efficiently managing vulnerabilities. Qualys TruRisk Scoring helps prioritize vulnerabilities and assets. It helps understand what could be prioritized for further remediation and what could be kept on hold for some time based on the manpower availability and the needs of the business.

Read full review

Vaibhav_Kumar

Analyst III - Information Security and Compliance at a financial services firm with 201-500 employees

The external attack surface refers to the externally visible endpoints hosted by any company. External scanning can be performed to identify the number of publicly-facing assets. CSM provides functionality to scan these external assets, and based on the scanning results, patching can be performed to address any identified vulnerabilities. The best part about Qualys CSAM is that it continuously pulls data. We can either install a cloud agent on all our machines or use IP wave scanning to identify the IP subnet. Qualys CSAM will identify any machine that spins up within that IT subnet during its scheduled scans. Once it finds a new machine within the subnet, it will register it as a new asset and populate it on the dashboard. Qualys CyberSecurity Asset Management was able to identify an additional 50 to 100 assets that were not part of our vulnerability management program. The key functionality of CSAM is a new feature update that Qualys releases periodically. It provides organizations and IT professionals with key metrics to understand how assets behave within their infrastructure, addressing the issue of unfamiliarity. CSAM focuses on efficacy, efficiency, and improved asset tracking. Better asset tracking enhances security posture, enabling timely patching and streamlining the entire vulnerability management lifecccccycle. Asset management is the first phase, and when asset tracking is simplified, the entire vulnerability management cycle becomes easier. When discussing additional risk factors, CSAM provides crucial insights into the nature of the host, including basic information like hostname, IP address, operating system, installed applications, initial discovery date by Qualys, and current online/offline status. Leveraging risk factors like initial discovery date and the presence of malicious or outdated applications allows for collaboration with patch management teams to assess machine compliance. Effective asset management lifecycle practices empower organizations to comprehensively address many risk factors. The True Risk Scoring was accurate. While false positives are always possible, they were minimal in Qualys, making it nearly perfect. I have leveraged active and passive sensors, such as Qualys Cloud Agent models, to gain better visibility into our assets. Qualys will send a probe whenever we have passive sensors and an established IP connection. This probing timeline indicates how frequently the network needs to be probed—for example, every 30 minutes. Based on the timeline, the sensor will probe the entire IP range and detect any new machines that appear, improving our visibility.

Read full review

Qualys CyberSecurity Asset Management (CSAM) mindshare

Product category:

As of November 2024, the mindshare of Qualys CyberSecurity Asset Management (CSAM) in the Cyber Asset Attack Surface Management (CAASM) category stands at 4.9%, up from 0.3% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Cyber Asset Attack Surface Management (CAASM)

Key learnings from peers

Last updated Nov 1, 2024

Valuable Features

Key features of Qualys CyberSecurity Asset Management include end-of-life software identification, asset inventory management, dynamic tagging, and external attack surface management. Users appreciate its seamless integration with cloud agents and IP-based scanning, providing comprehensive asset visibility and real-time risk assessment. The platform's ability to automate asset purging and reconcile inventory with CMDB enhances operational efficiency. Users find its detailed remediation guidance crucial for maintaining cybersecurity posture and appreciate its hybrid inventory management capabilities.

"Qualys CSAM is valuable for providing end-of-life and end-of-sale information. It gives me visibility into the number of products or hardware items that are end-of-life."
"Qualys CSAM helps find all the assets. It categorizes information based on various criteria such as host and tenant version. It provides in-depth visibility into both hardware and software."
"The best feature is asset discovery through their cloud agent or IP-based scanning."

Room for Improvement

Qualys CyberSecurity Asset Management faces challenges with CMDB integration beyond ServiceNow, pricing concerns, and the need for more pre-built reports. Users report issues with scan frequency in EASM, high CPU usage, and asset tracking difficulties. Misleading data, false positives, complex interfaces, and suboptimal user experience hinder effectiveness. Slow asset discovery and integration limitations are frequent complaints. Enhanced tagging, timely updated resources, and specific remediation recommendations are required to streamline user understanding and increase efficiency.

"Qualys CSAM is not super responsive, and there can be delays sometimes, especially with the network passive sensor. You might see duplicate objects which eventually disappear but it takes time. If that can be done faster, it will be great."
"From the user experience perspective, we need a simpler interface and reduced complexity in certain features, particularly with the Qualys Query Language."
"In our reporting, we faced a challenge syncing with cloud devices."

ROI

Users experienced a significant return on investment in terms of improved security, enhanced visibility and control over assets, and effective risk mitigation.

The solution proved to be highly valuable in identifying vulnerabilities, implementing necessary patches, and ensuring compliance. It streamlined processes, saved time, and provided actionable insights for informed decision-making.

Pricing

Qualys CyberSecurity Asset Management is perceived as expensive by some organizations due to it being an add-on to VMDR, potentially limiting adoption. However, other users find it cost-effective, providing comprehensive solutions under a single license. The pricing model is viewed as transparent, fair, and competitive for large organizations, with no hidden fees and flexible options. For smaller entities, the high cost might be a concern, suggesting a need for more tailored packages.

"Qualys is competitively priced for its features. Its pricing is suitable for large organizations with more than 4,000 assets, but for smaller organizations with few assets, such as banks, the costs might be high. They should come up with packages that are suitable for small organizations."
"Qualys offers excellent value for money."
"The cost for Qualys CyberSecurity Asset Management is high."

Popular Use Cases

Organizations use Qualys CyberSecurity Asset Management (CSAM) to manage technical debt by identifying end-of-life software and hardware, improving asset tracking, and managing security posture. CSAM provides enhanced visibility into asset inventory, categorizes assets, and addresses zero-day vulnerabilities. It facilitates asset and license management, deep dives into asset inventory, monitors external attack surfaces, and ensures devices are managed effectively. Users implement CSAM for comprehensive enterprise vulnerability management and tracking of IT and OT server assets.

Service and Support

Qualys CyberSecurity Asset Management customer service and support demonstrate expertise and responsiveness. Teams address complex issues effectively, clearing problems swiftly. Users appreciate the knowledgeable, prompt assistance and the structured feedback feature after cases. Technical support exhibits strong capabilities with a good knowledge base and resources, although resolution times for intricate cases may vary. Community and forum support provide additional value. Generally, issues like bugs are resolved quickly.

Deployment

Qualys CyberSecurity Asset Management's initial setup is generally easy, especially for existing VMDR users. Deployment varies in complexity and can be handled by one person with access rights. The hybrid deployment will move entirely to the cloud in the future. Users find Qualys documentation comprehensive and support helpful for resolving issues. Deployment time ranges from immediate to several weeks, depending on the environment. Maintenance is minimal and involves monitoring and reporting.

Scalability

Qualys CyberSecurity Asset Management scales effectively across environments of varying sizes, from a few devices to many thousands. Users report high scalability ratings, confirming successful deployments across multiple locations. The system works well in locales like India, Germany, and the UK. Although some environments have few endpoints, instances with up to 60,000 endpoints demonstrate its capacity to handle larger demands without issues.

Stability

Users find Qualys CyberSecurity Asset Management mostly reliable with occasional syncing issues after updates. Stability ratings vary between 7.5 and 9 out of 10. Some crashes occur during queries, with support cases often resolved. Minor delays might happen due to agent slowness or network issues. Majority of users view it as stable, acknowledging common hiccups typical of cloud-based software. Despite some challenges, it generally works effectively most of the time.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Qualys CyberSecurity Asset Management (CSAM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

25%

Government

11%

Financial Services Firm

10%

Retailer

Manufacturing Company

Non Profit

Comms Service Provider

Insurance Company

Healthcare Company

Construction Company

Wholesaler/Distributor

Real Estate/Law Firm

Energy/Utilities Company

Educational Organization

Legal Firm

Pharma/Biotech Company

Leisure / Travel Company

Performing Arts

Logistics Company

Hospitality Company

Marketing Services Firm

Media Company

Compare Qualys CyberSecurity Asset Management (CSAM) with alternative products

Learn more about Qualys CyberSecurity Asset Management (CSAM)

CSAM solidifies attack surface coverage and turbocharges vulnerability management with:

Comprehensive discovery of IT, IoT/OT, and rogue assets, internet-facing assets from mergers and subsidiaries, and business context from third-party connectors
Risk factors such as EoL/EoS software, missing security controls, unsanctioned ports, and expired SSL certs to show the TruRisk of every asset
Bi-directional CMDB sync to push cyber risk context to IT’s source of truth and pull business context into your security program