Qualys CyberSecurity Asset Management Reviews

We use it to collect all software-related information, including external attack surface information. All of this information is validated here.

We were facing issues with collecting information about external facing assets and getting vulnerabilities for assets not managed by us. We also wanted visibility into particular IP address configurations or domain-based information. Qualys CyberSecurity Asset Management helps us with visibility into the assets that we do not know about or that someone is misusing.

Other than that, we are using it for software inventory purposes. We can see whether any unauthorized software is registered on any machine or whether any required security tool is not installed on the machine. We can also see if any specific assets are critical and if there is anything we need to focus on from a network perspective. From the portal, we can get all this information as a report.

The visibility into all the assets is the main improvement. We are able to see any new external-facing assets, as well as the assets that we do not manage. For example, for the asset that we do not manage, we could get information about a particular port being open on an IP address or operating system. It helped us with about 20% of our assets.

Management of unmanaged assets enhances the organization's risk assessment capabilities.

The TruRisk mechanism helps us in some scenarios by giving an asset criticality score. It helps us focus on critical assets.

Qualys CyberSecurity Asset Management helps us identify any end-of-life software or unmanaged assets. With the CAPS mechanism, the Qualys agent can validate unmanaged assets and provide information.

Authorized and unauthorized software visibility is the best feature for me. It helps me understand security controls on our network and where we lack visibility. With a single security tool, we are able to get an extensive list. 

Additionally, I can verify version controls and port details for major applications.

There can be further simplification to reduce the overall noise and provide ESAM-related data. Some data modification might also be required, but that is not as critical as noise reduction.

I have used Qualys CyberSecurity Asset Management for over three years.

Its stability is good. I do not have an issue with it. I would rate it a ten out of ten for stability.

Its scalability is good. I would rate it a ten out of ten for scalability.

We are located in different countries. It is being used by our admin team with more than 50 people.

I would rate their support a nine out of ten. We might not always get a good solution. We might get only a workaround.

Positive

From the start, I have been using this solution in this organization.

It is very easy for me to deploy. There is no complexity. 

Its implementation takes about a week, but it can vary.  

Being a SaaS solution, it does not require much maintenance. It has an uptime of 99.9%. It is working perfectly with the scheduled information.

It has reduced resources and the time spent on gathering and combining data from different tools into a single tool. It used to be a tedious job, but it has now been reduced with the single software.

I would recommend this solution if you want a unique software to collect all the inventory data and have information about the attack surface.

I would rate Qualys CyberSecurity Asset Management a nine out of ten.

We use Qualys CSAM for information related to EOL and EOS applications. For the machines connected to Qualys CSAM, we have information about the serial number and hardware ID. We have some integration mechanisms with AD. All these helped us to make sure the agents and applications that we use are good enough to run in our infrastructure.

We have a mechanism called authorized and unauthorized applications inside our organization. Qualys CSAM helps us implement this by reporting unauthorized applications through pop-ups or alerts. This mechanism ensures that any unauthorized application is quickly identified, and appropriate measures are taken swiftly. The tool provides valuable insights into our infrastructure.

For external attack surface management, we have a configuration profile that we configure with the domain name. With this domain name, we get all the information from Qualys. They have integration with Shodan and their own scanning mechanism to get publicly exposed IPs or domains for our organization and its subsidiaries. 

It is a useful solution for us for IT-related or security-related activities. We get information about all the assets in our organization, and we also get to know if any ports are open or exposed to the Internet.

It helps us with risk prioritization. It highlights any vulnerabilities that are exploitable. We have various reports. We can see EOL or EOS software or any unauthorized applications. All these reports are triggered in a daily manner. We get the latest list every day. We can also use the dashboard.

In addition to the asset criticality score that we have configured, we have the TruRisk score. All this data helps us to prioritize the assets and vulnerabilities. 

The most valuable features of Qualys CSAM include the ability to manage authorized and unauthorized applications efficiently. This feature helps in validating applications and maintaining a secure environment. 

Additionally, Qualys CSAM offers comprehensive data, including serial numbers, BIOS information, and software details related to EOL and EOS. These capabilities are crucial for ensuring infrastructure readiness and security.

In my opinion, the area that needs improvement is the role-based access control (RBAC). The access privilege management needs to be more robust and streamlined to enhance user access management. Additionally, improvements to the user interface could be beneficial.

I have been using Qualys CSAM for one and a half years.

I would rate the stability of Qualys CSAM a ten out of ten. The agent-related stability is excellent, and we have not experienced any lags.

The scalability of Qualys CSAM is good. It is a SaaS platform. I would rate it a nine out of ten for scalability.

We have it at multiple locations and countries. We have multiple networks and subsidiaries. We have about 300k users.

The customer service is excellent. I would rate them a nine out of ten. Although there have been occasional delays in response time, the support generally addresses issues promptly and effectively.

Positive

I have only used Qualys CSAM in this organization and have not switched from any previous solutions.

We have a hybrid setup. The initial setup is straightforward, requiring a single code within an agent file, making the deployment process very easy.

Other than the upgrades, it does not require any maintenance from our side.

I would strongly recommend Qualys CSAM to other users because of its reliable detection logic and high level of support. We have not seen any glitches with it. In the case of any issues, we can get them resolved promptly, maintaining efficiency. 

I would rate the Qualys CSAM a ten out of ten for its overall performance.

Our primary tool for asset inventory is Qualys CyberSecurity Asset Management, which our software asset management team also utilizes to check our software library.

We deploy Qualys Cloud agents as passive sensors to gain comprehensive asset visibility and identify gaps in policy agent coverage. Additionally, we are collaborating with our cyber defense center team to enhance external service management.

Our cyber defense center team effectively utilizes Qualys CSAM, an external service management tool, to cover the entire attack surface.

The external service management tool has helped discover over 6,000 assets that were previously discovered.

We immediately saw the benefits of Qualys CyberSecurity Asset Management. As platform owners, we collaborate with the validation and cyber defense center teams to ensure asset availability and address any discrepancies.

Qualys CyberSecurity Asset Management helps identify all risk factors using the TruRisk score.

TruRisk Insights assists in identifying vulnerabilities and prioritizing them from highest to lowest risk.

We have begun utilizing Qualys Cloud agents as passive sensors and are currently investigating the necessary protocols to maximize the effectiveness of this feature. 

Our cybersecurity, IT, and cloud software teams effectively use Qualys to gain comprehensive visibility into our software environment, aided by excellent support. This visibility enables us to integrate Qualys into various facets of our operations, including our internal tools, allowing us to efficiently share updates with both the IT team and end-users, thus streamlining our workflow.

The most valuable feature is the Management sensor, which helps identify gaps in policy agent availability, thereby improving agent utilization. Additionally, the tool's code aids in risk identification and mitigation.

The Qualys CAPS service requires further exploration and improvement, particularly in its handling of protocols and reactivity with MAC and IP addresses for CAP agents. Enhanced functionality in these areas would increase the service's effectiveness and efficiency. We anticipate updates that will address these issues and optimize our use of the service.

We have been using CSAM for more than two years. 

We have not encountered significant stability issues with Qualys CyberSecurity Asset Management. The design appears robust, and we have not experienced any latency problems.

Qualys Cybersecurity Asset Management has proven to be a highly scalable solution for us over the past couple of years, seamlessly integrating new features as we have expanded from a few licenses to a much larger deployment.

We receive excellent support from Qualys. Our Technical Account Manager is very responsive and helpful in addressing any concerns that arise.

Positive

The initial deployment was straightforward. We integrate CSAM with other Qualys modules including VMDR.

The Qualys Cybersecurity Asset Management pricing is well-aligned with our usage.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

Qualys CyberSecurity Asset Management does not require maintenance on our end.

To gain comprehensive visibility and reporting within the policy, new users should deploy the agent. This action provides a complete overview of vulnerabilities and support statuses, offering valuable insights for both IT management and cybersecurity purposes.

My current use cases for Qualys CyberSecurity Asset Management involve hunting for software that is end of sale or end of life. I also use it to identify where prohibited software is installed on a device. For example, I identify if software that shouldn't be on an endpoint exists. That includes the vulnerabilities associated with certain software.

Improve software inventory capabilities

What I appreciate most about Qualys CyberSecurity Asset Management is the inventory feature, where I can look up assets, software, applications, open ports, and similar items because it's very useful. For example, with assets, I can see all the devices that have the protection installed and access one of these endpoints to see all the information about it. On the software side, I can see a list of all software installed on all my platforms, referring to all my endpoints that have the client installed.

The comprehensive approach that Qualys offers is beneficial because it includes the TruRisk score, which summarizes all vectors influencing the risk of an asset. For example, it highlights exploitations for certain vulnerabilities and provides all the links if they are available or public. Furthermore, the integrated Threat Intelligence platform within the interface allows me to see if there's a trend for certain vulnerabilities and check if I have that vulnerability on my platform.

One downside of Qualys CyberSecurity Asset Management is that I would prefer to see a more interactive dashboard. For example, when I see unknown software in the inventory and try to get a list of assets with certain software, I have to go inside the software menu. If I could have something more interactive that doesn't require going inside multiple categories, it would help. Also, I think the filters should accept three or more queries together to get broader results. However, this could also be an issue stemming from my knowledge or lack thereof.

I have been using Qualys CyberSecurity Asset Management in this company for at least one to two years, but the implementation has been around for three years.

I have experienced a couple of instances with lagging, but nothing substantial that impacts reporting. There may be some delays on the dashboard, but nothing affects the functionality of reporting vulnerabilities from the endpoint.

The scalability of Qualys CyberSecurity Asset Management is significant because you can deploy it across physical endpoints, cloud enviroments and VDI using a configuration file. If someone uses Windows Server, they could use a GPO to deploy it. There are many options. I've seen large platforms with numerous endpoints and vulnerabilities, and that makes me think they have an impressive capability for handling large volumes, which is very scalable in my opinion.

I haven't contacted Qualys technical support or customer support because we have a team that possesses extensive information and they reach directly to the vendor.

Positive

In the past, I used some open-source solutions at another company, but I don't remember the name. I recalled using them occasionally, but they didn't have this kind of reach. The same principle applies; you install a client on the endpoint, and it reports to the server.

I find the initial deployment of Qualys CyberSecurity Asset Management overall easy, especially with support from the vendor and personnel who understand how to handle the integration and permissions with the firewall to allow traffic.

The initial deployment took around a month or possibly less to fully deploy Qualys CyberSecurity Asset Management for the first time, though I wasn't present during the implementation.

I don't have access to the pricing information, but I understand that Qualys CyberSecurity Asset Management is expensive compared to other brands or vendors, although the price is worth it.

I have the most experience with Qualys CyberSecurity Asset Management, VMDR, and CSAM, as well as CA. Besides VMDR, I also used the Threat Intelligence model extensively.

Regarding the CMDB Sync feature, I learned about it just a couple of weeks ago. Although we don't have the implementation, we would find it useful to share information from Qualys, such as vulnerabilities and all devices, and track the person in charge of a certain device by creating a ticket.

The TruRisk score is a very useful feature, as it summarizes all the factors influencing the importance of a vulnerability concerning an asset or an endpoint. It helps with the prioritization of remediation.

We have both the passive sensor and the cloud agent. We use the cloud agent by installing it on the devices, while the passive sensor allows us to detect devices that don't have the protection and can't have the protection, for example, the networking devices.

We don't manage maintenance for Qualys CyberSecurity Asset Management as it depends on the vendor because they sometimes deploy updates and upgrades, but nothing is required on our end.

On a scale of 1-10, I rate this solution a 7.

My use cases involve using Qualys CyberSecurity Asset Management to detect vulnerabilities and then passing on the information to our IT team that has to fix the vulnerabilities.

The External Attack Surface Management covers my entire attack surface, but the majority of it doesn't apply to us because our external assets are not owned by us. We just have the external assets that are hosting our web pages.

The dashboards are my favorite feature.

I can pull up information and create my own dashboards specifically for what I'm looking for.

In addition to vulnerabilities, Qualys CyberSecurity Asset Management identifies all other risk factors for my assets.

The TruRisk feature could help prioritize vulnerabilities and assets, but our issue currently is that we weren't provided with adequate information to set things up correctly. We have many configurations to fix, and if we get to that point, it could be useful, but currently it's not because of inaccurate data.

The downsides of this solution include needing more knowledgeable account managers, and there needs to be more guidance on how to use their solution because there's so much to it. We've received very poor guidance from them, especially after learning several things we need to fix during the Qualys conference. Additionally, we need a solution to be able to do application deployment, which they sold us on a year ago, saying it was coming, and we still keep hearing it's coming.

I have been using Qualys CyberSecurity Asset Management for approximately a year.

I have seen some lagging, crashing, and downtime, but it doesn't happen very often.

It seems to be suitable for scalability. We're considered more of a medium-sized company, and it seems to be working out fine.

Their technical support is pretty good. The tickets I've sent in, they've been able to help me. We have issues with our account manager who does more than he should be doing and should be referring us to somebody else instead of trying to fix everything for us when he clearly doesn't know as much as he thinks he does.

Positive

I used Endpoint Central through ManageEngine before Qualys CyberSecurity Asset Management. It didn't detect as much as Qualys CyberSecurity Asset Management did, but the ability for our IT people to easily find the vulnerabilities and set up jobs was beneficial because it also had a fully application management and patching solution, including all third-party apps. It made it easier for our IT to fix vulnerabilities. Currently with Qualys CyberSecurity Asset Management, the majority of it is manual installs, and when you have a small IT team with over 5,000 assets, that becomes difficult.

From what I was told, the initial deployment was difficult, but I wasn't involved in that as I was in a different role when we deployed it.

I need to talk with my architecture team because after the Qualys conference, we've discovered there are things that aren't configured correctly. This could possibly mean we might need to get with Qualys CyberSecurity Asset Management to get things in shape so that we're adequately detecting vulnerabilities.

On a scale from one to ten for support, I would give them a nine.

We're just a customer and do not have any partnerships with Qualys CyberSecurity Asset Management.

I rate Qualys CyberSecurity Asset Management a six out of ten.

I have been working with Qualys for approximately two and a half years. I have used this module to manage security postures in cloud environments, and it is essentially used for hybrid management systems. This allows me to adhere to security practices across cloud environments.

I appreciate the feature that simplifies cloud security posture, offering insights into vulnerabilities, and reducing the complexity of managing the security program. It provides a proactive security posture, identifying risks before attempts are made. It is also scalable in hybrid management, offering dynamic capabilities in cloud environments, providing visibility to thousands of assets. Additionally, it is beneficial in discovering what's occurring in the cloud environment and provides visibility in asset discovery. It helps monitor assets continuously, granting real-time visibility, which aids the IT environment in maintaining these assets. External attack surface management allows me to consider things from an attacker's perspective. I've improved on faster remediation and reduced risk breaches, as the module enables me to quickly identify vulnerabilities and take necessary actions. Decision-making is straightforward, allowing risk prioritization and action accordingly.

Qualys is continually developing, adding new features each year. Previously, there was no on-demand scan feature in a cloud agent, but multiple features have since been added to my cloud agent module. In CSAM as well, I expect features that make security and IT team tasks easier, eliminating manual efforts. Features enhancing the interaction with IT or security teams should be added, such as a ticketing feature that, if an issue arises in the CSAM module, enables direct ticket creation in systems like ServiceNow. This would streamline assigning tickets to appropriate teams.

I have used the solution for two and a half years.

I do not think there are any issues.

It's scalable. I do not face any limitations.

I would rate the technical support nine out of ten. They are effective; if I raise a ticket, they directly contact me and solve my problems, whether related to deployment or unresolved vulnerabilities.

Positive

I have been using Qualys from the beginning and have not used any other solution extensively. However, I have some familiarity with Rapid7, but it lacked the level of detail found in Qualys.

The initial setup was smooth, particularly with the cloud agent installation and sensor deployment. After the initial stage and the licensing part were completed, I became involved in creating user IDs and as an administrator, I managed user access, including giving privileges to admins. I coordinated with the Linux, Windows, and Mac teams to download and install the agent and conduct testing.

I received assistance from the Qualys support team, specifically from the ACCPL team provided by Qualys. It was a third-party team.

As mentioned earlier, it saves time and facilitates direct communication with real issues I have faced.

At present, I do not think so; however, I may consider CrowdStrike as it has some features, though not as detailed.

The CSAM module is great and continually improving with updates. I would rate it nine out of ten. However, based on the company's budget, Qualys offers limited features, which can also be utilized in other environments. I rate the overall solution nine out of ten.

Currently, we are using it for asset inventory to determine how many Windows machines and how many Linux machines there are. Accordingly, we categorize them. 

We prioritize the assets according to vulnerability and risk score, identifying the most critical and vulnerable assets. We obtain this information from Qualys CyberSecurity Asset Management and use it for vulnerability remediation and prioritization.

We have visibility into public-facing IPs and open ports. It helps us in covering the entire attack surface.

We are able to discover various assets such as servers, endpoints, and different operating systems. It is connected to the VMDR console, patch management module, and cloud agent. We can see all the information through the console. We are able to see any outdated versions of software or end-of-support devices. We can then take action accordingly.

We were able to see its benefits immediately. Previously, we used a formula, but now, CSAM enables vulnerability prioritization without spending time creating or applying formulas.

TruRisk Score provides insight into an asset, indicating its risk score and vulnerability. If the score exceeds a particular threshold, we focus on the asset and consider a risk exception. If vulnerabilities are not remediated, we attempt remediation by consulting the TruRisk dashboard. This dashboard is also used to showcase to management without needing customization.

It provides most of the information needed regarding the assets, including the operating system and whether the assets are network devices or servers. The device type is available as well. We can prioritize vulnerabilities and assign a risk score. 

The main aspect that needs improvement is the user interface, which should be more intuitive. It is not easy for a new user because it provides a lot of details. Capturing information quickly is difficult. The user interface should be improved to make information more accessible.

I have been using it for two years. We got it along with our VMDR.

There are no stability issues, and I would rate it a ten out of ten.

I would rate it a seven out of ten in scalability.

Sometimes, when I encounter challenges or discrepancies in the console data, I communicate with support and receive good responses. The technical support of Qualys is noteworthy, as I have not experienced delayed responses.

Positive

We have not used any other solution before.

Deployment is easy because we do not need to configure much on CSAM. It automatically populates data, requiring us to only focus on cloud agent deployment and scanning, which makes it very easy.

The full implementation took about a month. We had 2,500 assets. Initially, we only onboarded servers. That was easy. After that, we onboarded endpoints. Overall, it took three to four months to populate all the data.

It does not require any maintenance from our end because we are using the cloud version.

The entire team, consisting of four people, worked on the Qualys implementation.

The pricing is reasonable relative to the features provided, as it collects all module data and operates as a main, centralized inventory, making it a cost-effective solution.

Qualys offers an automated solution for asset inventory. I would recommend it to anyone looking for a similar solution.

I would rate the solution an eight out of ten.

I am working as a senior security analyst. I provide enterprise vulnerability management solutions. CyberSecurity Asset Management helps us categorize all the assets and products. We can see the current software assets and the software or product lifecycle. We can see details about the end-of-life or the end-of-support in CyberSecurity Asset Management.

We create customized tags for the assets. In my environment, there are IT servers and OT servers, so we need to customize the tags based on the servers. 

We can deep dive into asset inventory and check the external attack surface. We do attack surface management for the servers that are external or public-facing servers. We need deep investigations of assets to see if there is any vulnerability or suspicious activity in the server. For that purpose, I utilize the Qualys CSAM module.

It is able to discover assets or servers that are public-facing. For example, if there is a domain in the organization with a lot of external or public IPs, and these IPs are being used for an e-commerce website or any kind of website, hackers would want to hack these websites using ransomware. They might also do a DDoS attack to take down these websites. For such websites or web servers, we need such a module so that we can proactively gather any vulnerabilities that can be exploited and take the required steps to mitigate them before exploitation.

Qualys CSAM has saved a huge amount of time and manual effort. Features like Asset Purge Rule and dynamic tags have reduced a lot of time and manual effort of the team. In Qualys CSAM, we can get the EASM module. We can integrate CSAM or ESAM with any kind of ticketing tool, such as ServiceNow. When integrated with a ticketing tool such as ServiceNow, a vulnerability incident is created in ServiceNow for any critical or high-severity vulnerability. The incident is assigned a remediation owner. We just need to investigate whether the vulnerability is a true positive or a false positive and if remediation has been done or not. Previously, these all things had to be done manually, but now, we have automated them using Qualys CSAM. It has saved a lot of time and improved vulnerability discovery and asset segmentation in our estate.

We are able to identify two things. The first one is the vulnerability level or risk factors. The second one is the product life cycle, which is also important, so we can determine if a product is end-of-life or end-of-support. If it comes under the end-of-life or end-of-support category, we need to check with the vendor team, and we need to ask for possible workarounds. Otherwise, we can go to the project team and tell them to upgrade the product or operating system. There is a risk factor when a product is end-of-life or end-of-support. It becomes a vulnerable product. This is an additional benefit that we get, and we can ask the vendor or the project team to mitigate the issues.

When I need to prioritize external or internal facing servers, I use TruRisk Scoring. It is very effective. When I need to prioritize vulnerabilities, there are a lot of attributes that I need to keep in mind such as CVSS score, severity, etc. There are a lot of factors, so when I need to determine the top ten vulnerable servers, I use TruRisk Scoring. It is very helpful.

We have implemented cloud agents and deployed specific sensors. In our environment, we have on-premises servers and Azure and AWS clouds. We have implemented cloud agents and designed the configuration profile for those cloud agents. In Qualys CSAM, we can visualize if the cloud agent is active or not and if the scan frequency is working fine or not. We can monitor these from the Qualys CSAM module. When we implement the Asset Purge Rule on-premises or on cloud servers, there should be two sources in Qualys CSAM. One is the IP-based source, and the second one is the agent-based source. They are also monitored by Qualys CSAM. We can generate a report in Excel or CSV format, and by using the report, we can do the risk assessment and prioritize things.

I have four years of experience in cybersecurity, and I have used a lot of tools. Qualys CyberSecurity Asset Management has some advantages over others.

The first one is a feature called dynamic tag. When you implement a dynamic tag using a query, you do not need to manually tag all the servers. It categorizes all the servers that come under that query. The tagging part is automatically done within a few minutes. It reduces the effort.

The second feature is a feature called Asset Purge Rule. For example, there might be some servers or products that have not been used for the last 90 or 120 days. If they are still being reported in Qualys, it will be difficult to prioritize the servers or products to determine the top ten vulnerable servers or products. Previously, if we wanted to purge those assets or remove them from scanning, we had to do that manually, whereas Qualys CyberSecurity Asset Management provides a feature for that. We do not need to do anything from our side. A server older than the last 90 days will automatically get purged or removed from the account or scanning scope. Whenever we generate the scan report, there will be only assets or servers that are reporting in Qualys. The ones that are not reporting are automatically purged. This is known as data sanitization or vulnerability report sanitization. This is done by Qualys CSAM through the Asset Purge Rule feature. These are its core features for me.

In Qualys CSAM, there is a module called EASM. One improvement that they can make in the EASM module is the scan frequency. After EASM is configured the first time, it allows you to do the complete configuration, but if you want to reconfigure it, it will not ask or provide any option for scan frequency. For that, you need to raise a case with Qualys and talk to the Qualys team.

It only allows us to add the domain. There are only certain criteria that we can use to create a new profile inside EASM. I know that EASM is a new module in Qualys, and it is improving day by day, but it currently does not have the same configuration area that CSAM has. In the future, I hope it will be improved so that we are able to handle the configuration of EASM on our own. We do not have to raise any kind of vendor ticket or Qualys support ticket for that. Mainly, the configuration area needs improvement. Currently, we do not have all the rights to do the configuration. For any critical change, we cannot wait for the vendor to resolve the ticket. Just like CSAM, we should be able to do the configuration on our own in EASM.

I have been using it for two years. I have been using it since 2022.

It is stable. I would rate it an eight out of ten for stability.

It is scalable. I would rate it a ten out of ten for scalability.

It is being used in multiple locations such as India, Germany, and the UK. As of now, there are 15 users. In the future, we will onboard more.

I was previously working on other projects where I used Tenable Nessus and Rapid7.

I joined this project about two years ago. It was a new project, but I knew the advantages of Qualys. I have done certification in Qualys. It was the VMDR or Vulnerability Management Detection and Response certification. At that time, I got to know that Qualys has a lot of advantages. I knew that if we could implement this solution, it would be helpful to prioritize the vulnerabilities and vulnerable servers and products in our overall estate. That is why we switched and started implementing Qualys in the organization.

Overall, with Qualys as a tool, not only CSAM, we can do everything. We can do on-premises vulnerability scanning and cloud agent scanning. If we want to do security policy compliance, that also comes under Qualys. Qualys CSAM has various features for assets and custom tagging. There are lots of features.

It is a hybrid deployment currently, but in the future, it will completely be on the cloud.

Its deployment is straightforward. Everything is mentioned in Qualys documentation. We can find information about all the states and configurations. Even if we have a basic license, we can raise a case with the vendor. They are helpful. They can help us to resolve any issues or problems. They help to solve the problem as soon as possible. It has been a great experience.

If we start from the documentation part, it takes us more than one week because there are some client approvals we need. To cover everything, it takes almost 12 to 13 days to complete the overall process and start working with the tool.

Two people are fine for its deployment. If there are three, that will be an advantage, but it does not require more than three people.

It has saved time and resources. Previously, tagging took a lot of our time. We also needed more project members. When there are 5,000 servers, doing it manually takes a lot of time. It has reduced the time and resources required. It is cost-effective. It has saved about 45% of the time.

It is cost-effective because, in a single tool, we are getting everything. All the solutions come in a single license or price. In my opinion, Qualys is one of the best solutions available in the market for vulnerability management, policy compliance, and security compliance.

I would recommend this solution because by using a single solution, we can cover the three main pillars of CyberSecurity: vulnerability management, asset and product lifecycle management, and compliance management. It is the best product. In a single product, we can do all these things. These are the three pillars of cybersecurity.

Nowadays, cyber threats are increasing. As vulnerability analysts and managers, our prime focus is to gather all the servers and categorize the servers based on the operating system technology. It can be an IT or OT server. It can be public-facing or private-facing. Our main focus is to gather vulnerabilities, and based on the severity of the vulnerabilities, we have to prioritize the servers. We can shortlist the top ten vulnerable servers. The remediation team can then focus on them to mitigate vulnerabilities. To implement that solution, we need to categorize everything. The categorization part has to be done as per the CSAM model. If we want to do external server categorization, we have to go for external attack surface management or EASM, or we can use CSAM for internal servers.

When you get the product license, external attack surface management is not available. It is not activated. You need to activate it from CSS and configure it. It asks for domain details and the domain you want to focus on. Based on the domain details, it configures external attack surface management. You also need to consider the scan schedule, such as, after how much time, it will launch a discovery scan. You need to provide information about how many servers or products are managed by Qualys or how many are unmanaged but still detected in Qualys. After the configuration, you have to wait for the first discovery scan. When that is completed, Qualys looks for the domain name mentioned in the configuration area and pulls out details related to that domain. It shows the status and any vulnerabilities, and whether an asset is managed or unmanaged. You have the overall data, and you can also define or prioritize based on TruRisk Score, which is generated by external attack surface management.

We are not using the CMDB Sync feature. We have integrated Qualys CSAM with ServiceNow CMDB, so all the onboarded servers or products are directly reflected in ServiceNow CMDB. When any high-severity vulnerability is detected by Qualys CSAM through discovery scans, it automatically raises a ServiceNow incident, which is automatically assigned to the asset owner or product owner. This automation has been implemented by our team.

Overall, I would rate Qualys CSAM a ten out of ten.