Qualys CyberSecurity Asset Management Reviews

This is the main product that we are using for managing assets, including  hardware assets and software assets.

There are multiple features that are very useful. The first one would be the inventory that allows us to actually manage those assets and see the assets based on the cloud agents and based on the scanning that is performed periodically. 

Another useful feature would be the tags. Tags are very useful for us since we can tag virus applications in infrastructure types such as databases, operating systems, or web platforms. 

On top of that, there are software rules that we can define. Some of those rules can outline which mandatory agents need to be on an asset before going into production, for example. Some emphasize potential software that can potentially cause cyber security challenges. Having those rules in place is very useful.

The external attack surface management covers the entire attack surface. This is one of the newest features, and this is extremely useful. It allows us to see the external posture from an attacker's perspective, and we are broadly using that. We have been able to find domains that were previously not covered. We did find a few domains that were supposed to be shut down. We can better keep track of these now to validate that the domains that are listed for us are the correct ones. We can go over the newly discovered assets to validate which belong to us and which do not. 

It identifies all other risk factors for our assets. Now, it identifies the assets. It also identifies the end-of-life and end-of-life support software, and that allows us to plan ahead in terms of what needs to be upgraded or if we have to budget for a software change. That's both from an operating system perspective and also from a third-party software perspective.

This more thorough identification of risk factors has positively affected our security. Qualys is one of the main pillars that we use for monitoring our cybersecurity posture. Being on top of inventory-related operating systems or types of clients has been very helpful. The inventory features also allow us to monitor any new asset. We use this together with another platform from Qualys for network passive sensors. We can see in the inventory, including new assets identified that were connected to the network anywhere in the network. This includes workstations, laptops, cell phones, et cetera.

We leverage the solution's ability to convert already deployed Qualys Cloud agents into passive sensors that may be detected and connected to the network in real time.

Most of the assets, the ones that the ones that have CloudAgent, we monitor that. They are also discovered by the passive sensor. On top of that, they are periodically IP scanned. The cloud agent and the IP scanners complement each other and discover different types of vulnerabilities. The inventory shows up from one of three main sources: the CloudAgent, the passive sensor, and the IP scanner.

The passive sensors affected our ability to identify potential risks in real time. They dramatically improve our ability to monitor risk in real time as they show the assets connected to the network in real time. We are validating those findings with the appropriate teams in order to address issues accordingly.

We use the CMDB sync feature. That is one of the features that allows us to reconcile the inventory between Qualys and CMDB. This is also the feature that actually showed us some of the discrepancies between our two platforms. The integration allows us to automatically assign vulnerabilities and monitor the SLA. That integration is one of the main operational integrations that we are using in order to make sure that the vulnerabilities are remediated in a timely manner.

It's a superior solution as we can monitor both on-prem and on the cloud. Having the ability to manage the inventory, the hybrid inventory, in one platform, is very, very important.

It is automatically exporting the vulnerabilities and the assets. However, it would be useful to have the ability to select or filter which we would like to export. As of now, anything and everything is automatically exported. We cannot choose. 

I've used the solution for the last five years. 

It's usually very stable. However, sometimes some of the queries crash. I have opened a few support cases. Some of those support cases were solved right away. Some of those were pending a new release. Generally, it's working most of the time.

I've never had issues with scalability. You do have to choose the right sizing, however, it can scale out of the box. 

Most of the time, the technical support is very effective and responsive. They have a nice feature that allow you give feedback after a case was opened. The knowledge of the team is good. They also have the appropriate documentation to they can direct you to when needed.

Positive

We did previously use a different solution. However, there were a number of drawbacks. We were not able to both monitor and discover. After CSAM, we were able to access a full inventory and a fuller understanding.

The deployment is straightforward. You can use add-on features of cloud agents or passive sensors, once it's deployed and assets are IP-scanned, the system can automatically share the asset details. The modules are automatically activated for the agent. The cloud agents are deployed by the infrastructure teams. They are responsible for deploying the cloud agent. The network passive sensors are deployed together with the network team. Activating the modules and monitoring is handled by Qualys.

Once everything is up and running, no maintenance is needed. It's just monitoring and reporting once it's implemented. 

The pricing is fair. We don't have any objection to the current pricing model.

I'm an end-user.

When we first started using the solution it had fewer features than it has today. That said, it still was the platform that allowed us to manage hardware and software assets on-prem and in the cloud.

I'd rate the solution nine out of ten. 

It's a good idea to start with Qualys training, and I have to say their training is outstanding. Their training provides the best way for a new user to learn how to work with the platform. The platform itself can be very complex and there are many features that might affect one another. 

I use Qualys CSAM to gain better visibility into all my endpoints. It is easier to find devices through Qualys CSAM rather than using our other asset inventories, as it gives me access to a single pane of glass.

Qualys CSAM helps manage external attack surfaces. I get daily emails about our external endpoints and potential vulnerabilities or ports that can be used for attacks. We work on securing them or hardening their configurations.

We do not have a lot of external-facing assets, but it gives us everything that we need to know. We have a developers team that works on the web pages on our new domain. Recently, they entered a new subdomain. Qualys CSAM found that and reported it as vulnerable because of the certificates. I reported that to upper management, and it is now taken care of.

Qualys CSAM's risk tools prioritize risks. Qualys CSAM in conjunction with patch management and vulnerability management helps to mitigate those vulnerabilities.

There is a good logic behind TruRisk. When we add things, we can rely on it. That is what is going to be important.

We have a network passive sensor. Some of our endpoints are work-from-home stations, and some of them are in the office. The network passive sensor finds everything that is connected to the office, and then it merges with the cloud agent.

Qualys CSAM is valuable for providing end-of-life and end-of-sale information. It gives me visibility into the number of products or hardware items that are end-of-life. This is a beneficial feature. I like that about it. That is a very good thing.

Qualys CSAM is not super responsive, and there can be delays sometimes, especially with the network passive sensor. You might see duplicate objects which eventually disappear but it takes time. If that can be done faster, it will be great.

I have been using Qualys CSAM for approximately one and a half years.

Qualys CSAM appears to be scalable. We do not have a lot of endpoints, but I know of a company with 60,000 endpoints. They seem to be doing fine. We have 500 to 600 endpoints, and it is working well.

Most of the time, they are fast. We submitted some bugs, and they seem to have been resolved.

Positive

I used Manage Engine before. It is not very similar, but it can give you some details about the endpoints, such as if they are end-of-life. They also pull the database from somewhere to compare our hardware or software, but Qualys CSAM gives a lot more information than that product. Qualys CSAM does a lot more.

Its deployment is modular. Everything that we have is in the cloud. The cloud agent is installed on the endpoint, and there we have everything. The cloud agent collects all the information, drops it into the cloud, and syncs it in the database. Patch management and vulnerability management all do their work together.

The initial setup was seamless. It is at their back end. We paid for it, and they just turned it on. We saw results immediately once the module was turned on. Things in the cloud are done faster than on-prem, and this is not an on-prem solution. It is a cloud solution.

Its maintenance is taken care of by Qualys. We get the product 100% working and operational. We only have to work on the information in it. If we see something wrong, we try to do something. If it is easily fixable, we do it. If it is not, we get support.

When I went to a Qualys conference, I understood the value of it, and I asked our management to get hold of it and purchase it. We were able to realize its benefits immediately.

To a colleague at another company who says they only need to add External Attack Surface Management to their vulnerability management detection/response program but they don’t need the full depth of the CSAM offering, I would recommend going for the whole CSAM. Only the external attack service management will not be enough. If they have visibility into their external stuff, they should also have visibility into their internal stuff. Otherwise, they will only see the external stuff. They will not see how it links to internal stuff in terms of hardware, IP, and port.

New users need to spend a lot of time in order to understand it well. My advice would be to try searching, finding assets, and uploading tags to get accustomed to it.

I would rate Qualys CSAM a ten out of ten. It is a great product.