Qualys CyberSecurity Asset Management Reviews

My use cases involve using Qualys CyberSecurity Asset Management to detect vulnerabilities and then passing on the information to our IT team that has to fix the vulnerabilities.

The External Attack Surface Management covers my entire attack surface, but the majority of it doesn't apply to us because our external assets are not owned by us. We just have the external assets that are hosting our web pages.

The dashboards are my favorite feature.

I can pull up information and create my own dashboards specifically for what I'm looking for.

In addition to vulnerabilities, Qualys CyberSecurity Asset Management identifies all other risk factors for my assets.

The TruRisk feature could help prioritize vulnerabilities and assets, but our issue currently is that we weren't provided with adequate information to set things up correctly. We have many configurations to fix, and if we get to that point, it could be useful, but currently it's not because of inaccurate data.

The downsides of this solution include needing more knowledgeable account managers, and there needs to be more guidance on how to use their solution because there's so much to it. We've received very poor guidance from them, especially after learning several things we need to fix during the Qualys conference. Additionally, we need a solution to be able to do application deployment, which they sold us on a year ago, saying it was coming, and we still keep hearing it's coming.

I have been using Qualys CyberSecurity Asset Management for approximately a year.

I have seen some lagging, crashing, and downtime, but it doesn't happen very often.

It seems to be suitable for scalability. We're considered more of a medium-sized company, and it seems to be working out fine.

Their technical support is pretty good. The tickets I've sent in, they've been able to help me. We have issues with our account manager who does more than he should be doing and should be referring us to somebody else instead of trying to fix everything for us when he clearly doesn't know as much as he thinks he does.

I used Endpoint Central through ManageEngine before Qualys CyberSecurity Asset Management. It didn't detect as much as Qualys CyberSecurity Asset Management did, but the ability for our IT people to easily find the vulnerabilities and set up jobs was beneficial because it also had a fully application management and patching solution, including all third-party apps. It made it easier for our IT to fix vulnerabilities. Currently with Qualys CyberSecurity Asset Management, the majority of it is manual installs, and when you have a small IT team with over 5,000 assets, that becomes difficult.

From what I was told, the initial deployment was difficult, but I wasn't involved in that as I was in a different role when we deployed it.

I need to talk with my architecture team because after the Qualys conference, we've discovered there are things that aren't configured correctly. This could possibly mean we might need to get with Qualys CyberSecurity Asset Management to get things in shape so that we're adequately detecting vulnerabilities.

On a scale from one to ten for support, I would give them a nine.

We're just a customer and do not have any partnerships with Qualys CyberSecurity Asset Management.

I rate Qualys CyberSecurity Asset Management a six out of ten.

I have been working with Qualys for approximately two and a half years. I have used this module to manage security postures in cloud environments, and it is essentially used for hybrid management systems. This allows me to adhere to security practices across cloud environments.

I appreciate the feature that simplifies cloud security posture, offering insights into vulnerabilities, and reducing the complexity of managing the security program. It provides a proactive security posture, identifying risks before attempts are made. It is also scalable in hybrid management, offering dynamic capabilities in cloud environments, providing visibility to thousands of assets. Additionally, it is beneficial in discovering what's occurring in the cloud environment and provides visibility in asset discovery. It helps monitor assets continuously, granting real-time visibility, which aids the IT environment in maintaining these assets. External attack surface management allows me to consider things from an attacker's perspective. I've improved on faster remediation and reduced risk breaches, as the module enables me to quickly identify vulnerabilities and take necessary actions. Decision-making is straightforward, allowing risk prioritization and action accordingly.

Qualys is continually developing, adding new features each year. Previously, there was no on-demand scan feature in a cloud agent, but multiple features have since been added to my cloud agent module. In CSAM as well, I expect features that make security and IT team tasks easier, eliminating manual efforts. Features enhancing the interaction with IT or security teams should be added, such as a ticketing feature that, if an issue arises in the CSAM module, enables direct ticket creation in systems like ServiceNow. This would streamline assigning tickets to appropriate teams.

I have used the solution for two and a half years.

I do not think there are any issues.

It's scalable. I do not face any limitations.

I would rate the technical support nine out of ten. They are effective; if I raise a ticket, they directly contact me and solve my problems, whether related to deployment or unresolved vulnerabilities.

Positive

I have been using Qualys from the beginning and have not used any other solution extensively. However, I have some familiarity with Rapid7, but it lacked the level of detail found in Qualys.

The initial setup was smooth, particularly with the cloud agent installation and sensor deployment. After the initial stage and the licensing part were completed, I became involved in creating user IDs and as an administrator, I managed user access, including giving privileges to admins. I coordinated with the Linux, Windows, and Mac teams to download and install the agent and conduct testing.

I received assistance from the Qualys support team, specifically from the ACCPL team provided by Qualys. It was a third-party team.

As mentioned earlier, it saves time and facilitates direct communication with real issues I have faced.

At present, I do not think so; however, I may consider CrowdStrike as it has some features, though not as detailed.

The CSAM module is great and continually improving with updates. I would rate it nine out of ten. However, based on the company's budget, Qualys offers limited features, which can also be utilized in other environments. I rate the overall solution nine out of ten.

We primarily use it to collect asset information. Our primary value from it is in collecting on-premises assets, as well as the ability to tag those assets with custom tags. We are also using the external attack surface management portion a little bit. We have not fully operationalized it yet, but it looks intriguing.

Additionally, we are leveraging Qualys CSAM's capability to detect software and applications, as well as to identify unauthorized and authorized software in the environment.

From an inventory point of view, Qualys CSAM gets everything very well. We augment that with Qualys TotalCloud, so we get better insights into our cloud platform, but for our internal data centers, this is our source of truth for asset information.

Our favorite features are the tagging and the ability to quickly find assets in the portal. 

Additionally, I do like the fact that Qualys CSAM is integrated with the rest of our vulnerability scanning utilities. We use the full suite from Qualys. The fact that it is integrated makes it very easy to understand. It shares tagging information with VMDR. That is very nice.

Qualys CSAM has discovered assets not previously covered by our vulnerability management program. Primarily, if we have assets without vulnerabilities, they become less visible, but Qualys CSAM alerts us to them because they have IP addresses and are attached to our network. It could discover everything from printers to servers to endpoints. It could discover UPSs, network devices, and across all operating systems. It discovers our security badge readers and digital signage. We have to feed that the IP address ranges, but beyond that, it finds everything in our internal network.

We were able to realize its benefits within the first quarter of installing it. We did have to take some time to learn it and understand how to operationally leverage what it was telling us, but it was very quick.

In addition to vulnerabilities, Qualys CSAM helps identify other risk factors to a degree. For instance, we can see if servers or assets have incorrect naming standards. We have our network segmented into development model, test, and production, and we have server naming standards that identify which management they should be in. If a production server has the naming standard of a development model server, we can find that. That is one area we have used it for.

We are not fully using TruRisk, but we are using the Qualys detection score that is central to our corporate risk prioritization approach. It has completely replaced our homegrown one.

Some areas that would be helpful are more comprehensive tagging and the ability to set up better dynamic rules. 

Also, in the area of software categorization, having only three categories (approved, unapproved, unknown) is limiting. We would prefer more options, such as 'approved only for pilot' or 'approved for this line of business,' allowing for better granularity in categorizing software.

They do not yet have a built-in integration with the service management tool that we use. We do not use ServiceNow. We use a different one. We are using a product called Symphony Summit.

We started using it probably about a year and a half ago. It became operational around mid-2023.

We have encountered very little instability. I have subscribed to their update notifications, and I love getting the release notes because there is always something new in there that is exciting. They are constantly adding capabilities. I love that. It is a bit challenging to keep up at times, but if you want to maximize the value of the tool, you have to stay on top of release notes. As far as stability goes, there is almost nothing. Overall, there are almost no issues. If there are any issues, they usually affect the entire pod. It is not specific to CSAM.

With roughly 10,000 assets under management. We have not encountered any issues with scalability at all.

I have not personally contacted technical support, but I know we get a very good response. We have an excellent technical company who will escalate and support us. We have had a pretty good experience with technical support.

Positive

I used to have some involvement with a CMDB product from BMC called ADDM. It was similar to Qualys CSAM, but due to a lack of organizational appetite to support it, it was replaced. That is the closest thing to Qualys CSAM that I have ever played with.

It is a cloud solution. We do have cloud agents that reside on our endpoints or assets. I do like the fact that Qualys CSAM uses the same agent on the assets as all the other Qualys products. That was a big plus over other things that we looked at.  They required another agent to be installed.

Its initial setup was fairly easy. It takes a little bit of time to get things fully operational and standardized, but Qualys CSAM was easy to install and get up and running. We had to sit back and think about how we best wanted to represent the tagging. That took some time. We are still playing with that. The biggest challenge has been coming up with the best way for us to represent the assets and software discovered by Qualys CSAM.

We had to consider the best way to represent tagging in our system and ensure everything was standardized, but the setup process itself was straightforward.

It did not take us long to fully deploy it. It took less than a week because we already had the cloud agents installed for VMDR. We or our account manager flipped the switch to turn the license on, and we started collecting data right away.

The deployment of Qualys CSAM was a one-person job. We had an additional person for backup reasons, but the job primarily required only one person.

Its maintenance is being taken care of by Qualys. The software tagging is manual, so we have to go in and manually say that product XYZ is no longer approved. That is the only maintenance we do on that platform. It is just whether or not the software is approved or not.

The pricing is fair. I would love to see the price come down a little bit, but we do get a lot of value out of it. We are squeezing every ounce of value we can out of the tool.

Like every product, there are nuances. You have to understand that there are different categories of software. When it detects software, it puts it into various categories. It took us a little while to understand their taxonomy for the software side, so my advice would be to spend a little time understanding that.

We have had good luck with the API. To automate things, we are leveraging their CSAM API, and it is working fine, but there is a little bit of a learning curve. In terms of the core product, you turn it on and it just starts. If you have VMDR already in place, it starts to collect data for you right away, within minutes.

I would rate Qualys CSAM a nine out of ten. If they had a connector for the service management tool that we use, it would be a ten.

Currently, we are using it for asset inventory to determine how many Windows machines and how many Linux machines there are. Accordingly, we categorize them. 

We prioritize the assets according to vulnerability and risk score, identifying the most critical and vulnerable assets. We obtain this information from Qualys CyberSecurity Asset Management and use it for vulnerability remediation and prioritization.

We have visibility into public-facing IPs and open ports. It helps us in covering the entire attack surface.

We are able to discover various assets such as servers, endpoints, and different operating systems. It is connected to the VMDR console, patch management module, and cloud agent. We can see all the information through the console. We are able to see any outdated versions of software or end-of-support devices. We can then take action accordingly.

We were able to see its benefits immediately. Previously, we used a formula, but now, CSAM enables vulnerability prioritization without spending time creating or applying formulas.

TruRisk Score provides insight into an asset, indicating its risk score and vulnerability. If the score exceeds a particular threshold, we focus on the asset and consider a risk exception. If vulnerabilities are not remediated, we attempt remediation by consulting the TruRisk dashboard. This dashboard is also used to showcase to management without needing customization.

It provides most of the information needed regarding the assets, including the operating system and whether the assets are network devices or servers. The device type is available as well. We can prioritize vulnerabilities and assign a risk score. 

The main aspect that needs improvement is the user interface, which should be more intuitive. It is not easy for a new user because it provides a lot of details. Capturing information quickly is difficult. The user interface should be improved to make information more accessible.

I have been using it for two years. We got it along with our VMDR.

There are no stability issues, and I would rate it a ten out of ten.

I would rate it a seven out of ten in scalability.

Sometimes, when I encounter challenges or discrepancies in the console data, I communicate with support and receive good responses. The technical support of Qualys is noteworthy, as I have not experienced delayed responses.

Positive

We have not used any other solution before.

Deployment is easy because we do not need to configure much on CSAM. It automatically populates data, requiring us to only focus on cloud agent deployment and scanning, which makes it very easy.

The full implementation took about a month. We had 2,500 assets. Initially, we only onboarded servers. That was easy. After that, we onboarded endpoints. Overall, it took three to four months to populate all the data.

It does not require any maintenance from our end because we are using the cloud version.

The entire team, consisting of four people, worked on the Qualys implementation.

The pricing is reasonable relative to the features provided, as it collects all module data and operates as a main, centralized inventory, making it a cost-effective solution.

Qualys offers an automated solution for asset inventory. I would recommend it to anyone looking for a similar solution.

I would rate the solution an eight out of ten.

We use it to collect all software-related information, including external attack surface information. All of this information is validated here.

We were facing issues with collecting information about external facing assets and getting vulnerabilities for assets not managed by us. We also wanted visibility into particular IP address configurations or domain-based information. Qualys CyberSecurity Asset Management helps us with visibility into the assets that we do not know about or that someone is misusing.

Other than that, we are using it for software inventory purposes. We can see whether any unauthorized software is registered on any machine or whether any required security tool is not installed on the machine. We can also see if any specific assets are critical and if there is anything we need to focus on from a network perspective. From the portal, we can get all this information as a report.

The visibility into all the assets is the main improvement. We are able to see any new external-facing assets, as well as the assets that we do not manage. For example, for the asset that we do not manage, we could get information about a particular port being open on an IP address or operating system. It helped us with about 20% of our assets.

Management of unmanaged assets enhances the organization's risk assessment capabilities.

The TruRisk mechanism helps us in some scenarios by giving an asset criticality score. It helps us focus on critical assets.

Qualys CyberSecurity Asset Management helps us identify any end-of-life software or unmanaged assets. With the CAPS mechanism, the Qualys agent can validate unmanaged assets and provide information.

Authorized and unauthorized software visibility is the best feature for me. It helps me understand security controls on our network and where we lack visibility. With a single security tool, we are able to get an extensive list. 

Additionally, I can verify version controls and port details for major applications.

There can be further simplification to reduce the overall noise and provide ESAM-related data. Some data modification might also be required, but that is not as critical as noise reduction.

I have used Qualys CyberSecurity Asset Management for over three years.

Its stability is good. I do not have an issue with it. I would rate it a ten out of ten for stability.

Its scalability is good. I would rate it a ten out of ten for scalability.

We are located in different countries. It is being used by our admin team with more than 50 people.

I would rate their support a nine out of ten. We might not always get a good solution. We might get only a workaround.

Positive

From the start, I have been using this solution in this organization.

It is very easy for me to deploy. There is no complexity. 

Its implementation takes about a week, but it can vary.  

Being a SaaS solution, it does not require much maintenance. It has an uptime of 99.9%. It is working perfectly with the scheduled information.

It has reduced resources and the time spent on gathering and combining data from different tools into a single tool. It used to be a tedious job, but it has now been reduced with the single software.

I would recommend this solution if you want a unique software to collect all the inventory data and have information about the attack surface.

I would rate Qualys CyberSecurity Asset Management a nine out of ten.

We use Qualys CSAM for information related to EOL and EOS applications. For the machines connected to Qualys CSAM, we have information about the serial number and hardware ID. We have some integration mechanisms with AD. All these helped us to make sure the agents and applications that we use are good enough to run in our infrastructure.

We have a mechanism called authorized and unauthorized applications inside our organization. Qualys CSAM helps us implement this by reporting unauthorized applications through pop-ups or alerts. This mechanism ensures that any unauthorized application is quickly identified, and appropriate measures are taken swiftly. The tool provides valuable insights into our infrastructure.

For external attack surface management, we have a configuration profile that we configure with the domain name. With this domain name, we get all the information from Qualys. They have integration with Shodan and their own scanning mechanism to get publicly exposed IPs or domains for our organization and its subsidiaries. 

It is a useful solution for us for IT-related or security-related activities. We get information about all the assets in our organization, and we also get to know if any ports are open or exposed to the Internet.

It helps us with risk prioritization. It highlights any vulnerabilities that are exploitable. We have various reports. We can see EOL or EOS software or any unauthorized applications. All these reports are triggered in a daily manner. We get the latest list every day. We can also use the dashboard.

In addition to the asset criticality score that we have configured, we have the TruRisk score. All this data helps us to prioritize the assets and vulnerabilities. 

The most valuable features of Qualys CSAM include the ability to manage authorized and unauthorized applications efficiently. This feature helps in validating applications and maintaining a secure environment. 

Additionally, Qualys CSAM offers comprehensive data, including serial numbers, BIOS information, and software details related to EOL and EOS. These capabilities are crucial for ensuring infrastructure readiness and security.

In my opinion, the area that needs improvement is the role-based access control (RBAC). The access privilege management needs to be more robust and streamlined to enhance user access management. Additionally, improvements to the user interface could be beneficial.

I have been using Qualys CSAM for one and a half years.

I would rate the stability of Qualys CSAM a ten out of ten. The agent-related stability is excellent, and we have not experienced any lags.

The scalability of Qualys CSAM is good. It is a SaaS platform. I would rate it a nine out of ten for scalability.

We have it at multiple locations and countries. We have multiple networks and subsidiaries. We have about 300k users.

The customer service is excellent. I would rate them a nine out of ten. Although there have been occasional delays in response time, the support generally addresses issues promptly and effectively.

Positive

I have only used Qualys CSAM in this organization and have not switched from any previous solutions.

We have a hybrid setup. The initial setup is straightforward, requiring a single code within an agent file, making the deployment process very easy.

Other than the upgrades, it does not require any maintenance from our side.

I would strongly recommend Qualys CSAM to other users because of its reliable detection logic and high level of support. We have not seen any glitches with it. In the case of any issues, we can get them resolved promptly, maintaining efficiency. 

I would rate the Qualys CSAM a ten out of ten for its overall performance.

Our primary tool for asset inventory is Qualys CyberSecurity Asset Management, which our software asset management team also utilizes to check our software library.

We deploy Qualys Cloud agents as passive sensors to gain comprehensive asset visibility and identify gaps in policy agent coverage. Additionally, we are collaborating with our cyber defense center team to enhance external service management.

Our cyber defense center team effectively utilizes Qualys CSAM, an external service management tool, to cover the entire attack surface.

The external service management tool has helped discover over 6,000 assets that were previously discovered.

We immediately saw the benefits of Qualys CyberSecurity Asset Management. As platform owners, we collaborate with the validation and cyber defense center teams to ensure asset availability and address any discrepancies.

Qualys CyberSecurity Asset Management helps identify all risk factors using the TruRisk score.

TruRisk Insights assists in identifying vulnerabilities and prioritizing them from highest to lowest risk.

We have begun utilizing Qualys Cloud agents as passive sensors and are currently investigating the necessary protocols to maximize the effectiveness of this feature. 

Our cybersecurity, IT, and cloud software teams effectively use Qualys to gain comprehensive visibility into our software environment, aided by excellent support. This visibility enables us to integrate Qualys into various facets of our operations, including our internal tools, allowing us to efficiently share updates with both the IT team and end-users, thus streamlining our workflow.

The most valuable feature is the Management sensor, which helps identify gaps in policy agent availability, thereby improving agent utilization. Additionally, the tool's code aids in risk identification and mitigation.

The Qualys CAPS service requires further exploration and improvement, particularly in its handling of protocols and reactivity with MAC and IP addresses for CAP agents. Enhanced functionality in these areas would increase the service's effectiveness and efficiency. We anticipate updates that will address these issues and optimize our use of the service.

We have been using CSAM for more than two years. 

We have not encountered significant stability issues with Qualys CyberSecurity Asset Management. The design appears robust, and we have not experienced any latency problems.

Qualys Cybersecurity Asset Management has proven to be a highly scalable solution for us over the past couple of years, seamlessly integrating new features as we have expanded from a few licenses to a much larger deployment.

We receive excellent support from Qualys. Our Technical Account Manager is very responsive and helpful in addressing any concerns that arise.

Positive

The initial deployment was straightforward. We integrate CSAM with other Qualys modules including VMDR.

The Qualys Cybersecurity Asset Management pricing is well-aligned with our usage.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

Qualys CyberSecurity Asset Management does not require maintenance on our end.

To gain comprehensive visibility and reporting within the policy, new users should deploy the agent. This action provides a complete overview of vulnerabilities and support statuses, offering valuable insights for both IT management and cybersecurity purposes.

We use Qualys CyberSecurity Asset Management to improve asset tracking and manage our security posture, thereby minimizing security risk. Enhanced visibility into our asset inventory enables us to implement appropriate security measures to protect against potential incidents and threats.

The major challenge in security today is that many organizations still have an extreme problem: they are not aware of how many assets they have. As businesses grow, their assets grow as well. However, asset tracking has traditionally been a manual and cumbersome process. Due to this, many assets were mismanaged. Nobody tracked them properly, and assets were not updated with OS patching or application patching. This was particularly problematic for data sets, as many people across the organization were unfamiliar with those assets, which led to security issues. This is why we implemented Qualys CyberSecurity Asset Management.

The external attack surface refers to the externally visible endpoints hosted by any company. External scanning can be performed to identify the number of publicly-facing assets. CSM provides functionality to scan these external assets, and based on the scanning results, patching can be performed to address any identified vulnerabilities.

The best part about Qualys CSAM is that it continuously pulls data. We can either install a cloud agent on all our machines or use IP wave scanning to identify the IP subnet. Qualys CSAM will identify any machine that spins up within that IT subnet during its scheduled scans. Once it finds a new machine within the subnet, it will register it as a new asset and populate it on the dashboard.

Qualys CyberSecurity Asset Management was able to identify an additional 50 to 100 assets that were not part of our vulnerability management program.

The key functionality of CSAM is a new feature update that Qualys releases periodically. It provides organizations and IT professionals with key metrics to understand how assets behave within their infrastructure, addressing the issue of unfamiliarity. CSAM focuses on efficacy, efficiency, and improved asset tracking. Better asset tracking enhances security posture, enabling timely patching and streamlining the entire vulnerability management lifecccccycle. Asset management is the first phase, and when asset tracking is simplified, the entire vulnerability management cycle becomes easier.

When discussing additional risk factors, CSAM provides crucial insights into the nature of the host, including basic information like hostname, IP address, operating system, installed applications, initial discovery date by Qualys, and current online/offline status. Leveraging risk factors like initial discovery date and the presence of malicious or outdated applications allows for collaboration with patch management teams to assess machine compliance. Effective asset management lifecycle practices empower organizations to comprehensively address many risk factors.

The True Risk Scoring was accurate. While false positives are always possible, they were minimal in Qualys, making it nearly perfect.

I have leveraged active and passive sensors, such as Qualys Cloud Agent models, to gain better visibility into our assets.

Qualys will send a probe whenever we have passive sensors and an established IP connection. This probing timeline indicates how frequently the network needs to be probed—for example, every 30 minutes. Based on the timeline, the sensor will probe the entire IP range and detect any new machines that appear, improving our visibility.

The best feature is asset discovery through their cloud agent or IP-based scanning. It provides detailed information about each asset, including its operating system, applications, power status, and improved asset polling. These are some key metrics provided by Qualys CyberSecurity Asset Management.

In our reporting, we faced a challenge syncing with cloud devices. The issue arose because, let's say, we have 250 licenses and use AWS cloud with its auto-scaling feature. As the load increases, the server count automatically scales up. The cloud agent was installed on the new devices, but when the old devices were decommissioned, it wasn't uninstalling from the asset as it should have been. This made asset tracking with cloud auto-scaling quite challenging, as we had difficulty uninstalling the sensor.

I have been using Qualys CyberSecurity Asset Management for five years.

I would rate the stability of Qualys CyberSecurity Asset Management nine out of ten.

I would rate the scalability of Qualys CyberSecurity Asset Management nine out of ten.

I have used Tenable Nessus, Greenbone, and Rapid7, but my confidence in Qualys is far greater than that in the others.

Some of the reasons we chose Qualys were its user interface, ease of problem-solving, and straightforward explanations of use cases. The deployment facility, deployment guidelines, post-deployment management, and Qualys support team assistance we receive after purchasing the product are excellent. These factors influenced me to choose Qualys over other products.

The deployment is straightforward, and Qualys is easy to understand. The transition from on-premises to the cloud was smooth, and overall, it was a positive experience.

The transition from on-premises to the cloud, including around 5,000 devices, took me one month to complete.

We have observed a return on investment of approximately 95 percent, and Qualys CyberSecurity Asset Management has also reduced our costs by 35 percent.

Qualys CyberSecurity Asset Management provided an excellent return on investment. It offered comprehensive visibility into the security lifecycle across our organization, providing clarity on the state of our security infrastructure. Furthermore, it stands out as one of the top vulnerability management tools currently available.

Qualys offers excellent value for money. Its pricing model is transparent and fair, with no hidden fees. It provides flexible options tailored to our specific needs. Its pricing structure is easy to understand, and its team will work with us to find the best solution. It's open to discussions and committed to offering competitive pricing. Compared to similar products on the market, Qualys is priced competitively.

I would rate Qualys CyberSecurity Asset Management nine out of ten.

We hosted Qualys CyberSecurity Asset Management in a single location, not multiple locations. From a security perspective, we utilized availability zones, but there was only one physical location. I served as the administrator, and in addition to me, there were four to five other individuals who used Qualys for enhanced monitoring.

From a maintenance perspective, if the Qualys platform requires maintenance, customers will receive prior notification. This ensures that customers are aware of any potential service interruptions. Every software system needs maintenance, whether for an upgrade or to implement significant changes.

I highly recommend Qualys to others.

Qualys Cybersecurity Asset Management helps us manage our technical debt by identifying end-of-life and end-of-service software and hardware within our IT infrastructure.

Qualys CSAM is primarily a cloud-based solution. The only optional on-premise component is a passive sensor that monitors network traffic at our egress point. This sensor collects data and sends it to the Qualys Cloud interface for analysis, but it's not essential for using CSAM.

The external attack surface management identified unexpected assets, suggesting some exist outside our known inventory. While these may not be directly managed by us, the process has brought valuable awareness to the fact that our core servers are externally hosted, prompting a review of similar situations.

An external attack surface management scan revealed several outsourced name services, along with one unexpected third-party-linked IP. It's unclear if this was due to past consulting work or a registration error, but since it wasn't relevant to our company, it was easily excluded from future scans.

The benefits of Qualys CyberSecurity Asset Management are immediate. We already had the cloud agents installed. They were already on all the servers and workstations. Once we upgraded from the VMDR included GAV (Global AssetView) to CSAM, it was no time before I could see the end-of-life, end-of-service software, and hardware.

In addition to vulnerabilities, CSAM provides a better view of other risk factors, but VMDR is very powerful. VMDR was already seeing our limitations in hardening our vulnerabilities. CSAM enhanced our view by adding more visibility and insight into what we have.

TruRisk scoring goes beyond traditional vulnerability scoring like CVSS to prioritize both vulnerabilities and assets based on real-world exploitability and industry targeting. This provides a clearer picture of our actual risk by considering factors like published exploits and what attackers are currently focusing on, allowing us to quickly identify critical issues and avoid wasting time on vulnerabilities with a high theoretical risk but low real-world threat.

Qualys Cloud Agents can now be configured as passive sensors to discover all devices on our network in real-time, eliminating the requirement for separate virtual or physical passive sensor appliances. These cloud agent sensors monitor network broadcasts instead of egress traffic, and they can even designate a secondary sensor to take over if the primary becomes unavailable, ensuring continuous asset discovery and populating our CSAM platform with managed and unmanaged devices.

The end-of-life and end-of-service software and hardware are some of my favorite features. The insight into the endpoints with the cloud agent is also valuable. We get more value than we do with the global asset view that comes with VMDR.

The CMDB Sync feature currently only works with ServiceNow, which is common in larger organizations. If the feature could integrate with other, more affordable CMDB options, like those used by smaller businesses, we would be more likely to use it.

Qualys CyberSecurity Asset Management could be more cost-effective by offering a much lower price point or including it with existing VMDR subscriptions. Additionally, providing more pre-built reports would improve accessibility for organizations by reducing the need for custom report creation.

I have been using Qualys CyberSecurity Asset Management for one year.  however, I have been using Qualys solutions for over 20 years.

Qualys CyberSecurity Asset Management has been very reliable, with only occasional syncing issues following major updates, which is common for cloud-based software. Overall, I've been impressed with its stability.

Qualys CyberSecurity Asset Management is designed to scale effectively for environments of all sizes. While our environment may be on the smaller side, the solution is proven to handle deployments ranging from just a hundred devices to well over ten thousand, ensuring smooth operation regardless of our specific needs.

I've been a long-time Qualys user, so my technical support interactions tend to involve complex issues. For example, when the CSAM component was new and I encountered a bug, their team promptly cleared the back-end database, resolving the problem. Their expertise and willingness to help have been consistently impressive.

Positive

The initial deployment is easy, especially if a client is already on VMDR, to enable CSAM we only need a license.

One person can deploy VMDR and CSAM if they have the necessary access and permissions. For complex deployments with separate network management duties, involving the right personnel for whitelisting is crucial. Deployment time varies: for existing VMDR users, it's nearly immediate; for new implementations, it can take a bit longer, depending on team size and experience. Working with experienced professionals can expedite the process.

Qualys CyberSecurity Asset Management can be expensive since it is an add-on to VMDR. The cost seems to be a barrier to entry for some organizations, and a lower price point might lead to more automatic adoption of CSAM.

I would rate Qualys CyberSecurity Asset Management ten out of ten.

Qualys Cybersecurity Asset Management seems to offer a more comprehensive solution than what I've seen from competitors like Tenable and Rapid7. While I haven't reviewed their offerings recently, in the past they primarily focused on vulnerability scanning, which isn't as extensive as Qualys CSAM's asset management capabilities.

No maintenance is required. Everything is self-updating from Qualys. From cloud agents to sensors, all of those are automatically updated.

Organizations that rely solely on external attack surface management for vulnerability management are making a dangerous assumption. This approach presumes complete knowledge of their assets, which is unrealistic without full visibility into internal and external environments. Companies with a 'we're secure' attitude often have poor security, while those welcoming security assessments tend to have a strong security posture.

CSAM's tagging features, especially dynamic tagging with its easy-to-use rules, can significantly improve your efficiency across various tasks like patch and vulnerability management. By automating manual work, dynamic tags free up your time. Take advantage of the free CSAM training and consider consulting a trusted partner to accelerate your learning and implementation – their experience can save you weeks of effort.

We use it to identify all our assets, including those on our premises, cloud, and remote environments. It continuously monitors our assets, collects details like installed software, configurations, and vulnerabilities, and also assesses asset criticality and risk level. It prioritizes our vulnerabilities based on the business impact.

Qualys CyberSecurity Asset Management has given us a view into all portions of our assets, including printers and others, enabling us to uncover many previously unknown assets. Some of the assets were not shown by other solutions. There were some assets that were not registered in our CMDB. Teams had some assets that were connected to the network but were not registered. With the help of Qualys CyberSecurity Asset Management, we got a view of our complete posture. We were able to view all the assets.

We were able to see its benefits within a few weeks of deployment. We uncovered many assets that were previously unknown. It gives an overview of assets daily. 

It does its job of covering the attack surface, but we also use other solutions.

In addition to vulnerabilities, it also identifies all the other risk factors for our assets.

TruRisk Scoring helps prioritize vulnerabilities and assets, but its effectiveness varies from organization to organization. For us, it works, but sometimes, we have to manually prioritize assets.

We have leveraged the solution's ability to convert already-deployed Qualys Cloud Agents into passive sensors that detect assets connected to the network in real-time. It is pretty good in terms of insights or visibility.

The CMDB Sync feature has reduced our mean time to remediation by 15% to 20%.

The integration with different third-party tools, such as cloud providers like Azure and AWS, and asset management tools like CMDB systems, is valuable. 

It also helps detect shadow IT groups and enforce policies and compliance, ensuring that assets adhere to regulatory and internal security policies. It helps our team to maintain an accurate and up-to-date asset inventory.

The deployment is somewhat complicated and could be made more user-friendly for most users. It is currently not user-friendly for all users. It is good but can be improved. It is a new product, and they are working on it.

There is limited coverage for non-IT assets; although effective for IT assets, it may struggle with OT technologies, IoTs, and some non-traditional assets without proper integrations. 

It is dependent on the Qualys ecosystem. It works only with Qualys VMDR and other Qualys modules. If an organization relies on multiple security vendors, integration would require additional customization. Improving the integration part would be beneficial.

I have used the solution for two years.

It is stable. I would rate it an eight out of ten for stability.

It is scalable. I would rate its scalability a nine out of ten.

They are good.

Positive

For us, it was easy because we had experienced professionals. They did not face any issues. If it was done by someone with two, three, or four years of prior experience, they would struggle a bit. 

We already had other Qualys subscriptions, such as patch management, so we just bought the CSAM solution and started activating CABS. Though it is never fully done, as we develop it every day, after purchasing, it was mostly done within two weeks.

We had a team of five, consisting of two senior and three junior members.

Overall, I would give Qualys CyberSecurity Asset Management a nine out of ten.