Qualys Web Application Scanning Reviews

We are using Qualys for vulnerability detection in our IDC (International Data Center) on our web pages and world-wide-web applications and services.  

The best thing about this product is that it is really easy to use.  

We are concerned with the frequency of their virus code updates and reporting that contains false positives. We do not think that the accuracy of the reporting is as good as it should be.  

It would be nice if Qualys would provide a solution after analyzing the data for us so we can understand what the cause of a vulnerability is and how to fix it. It would be good enough to provide something like just a download page that describes the problem and the steps to take to resolve the vulnerability.  

We are researching open source software because Qualys needs to improve their reports and the documentation for the end-users in resolving scanned issues.  

Sometimes the deployment is complicated. It is not so easy to deploy and that should be simplified. Something like Zap or other open-source software is often easier to deploy.  

I am in the IT department in our company and we have been using Qualys for three years.  

Qualys is a very stable solution for us. We have not had trouble with downtime.   

We get a license to use this application for up to a year and we file for a license every year to renew. We would need to renew this license in September of 2020, so we will need to make a decision whether we will be continuing to use Qualys as a solution.  

Sometimes the deployment is complicated. The deployment should be easier and more consistent.  

The cost of the solution should be lower. In our company now, we only have 200 employees. For us, the license fee is kind of expensive. The cost is $30,000 USD for one year to cover WAS (Web Application Security) and the VM (Virtual Machine) security. That price includes maintenance and any consulting with Qualys.  

I would recommend Qualys if the budget is not a problem. There may be other open-source solutions that could be used to perform a similar analysis.   

On a scale from one to ten (where one is the worst and ten is the best), I would rate this solution as an eight-out-of-ten.  

We use the platform for vulnerability management and website testing. It helps us identify and remediate web-based vulnerabilities in our applications, ensuring their security from potential attackers.

The solution offers several valuable features. It crawls through all pages quickly and provides fewer false positives than other tools. Additionally, the support team is highly responsive and supportive, addressing any issues promptly.

One area for improvement is the user interface. The new UI, which was recently upgraded, feels more complex and less user-friendly than the old version. However, as we continue to use it, we anticipate becoming more accustomed to it. 

Additionally, improved scan scheduling options are needed, which Qualys is working on implementing.

We have been using Qualys Web Application Scanning for five years.

Although we have encountered a few bugs over the past two years, they have been addressed effectively.

I rate the stability an eight. 

The product is scalable. 

The support team is very effective and responsive.

Positive

We previously used HCL AppScan. We switched to Qualys primarily because of its superior customer support and responsiveness.

The initial deployment was straightforward. Switching from HCL AppScan to the Qualys solution took approximately six to eight months, including the planning and actual migration.

It does not require significant maintenance. We typically raise two to three cases monthly with the support team, who promptly address them. Otherwise, there are no regular maintenance tasks.

While I cannot provide an exact number of hours saved, the automation has reduced the time required for scanning and scheduling tasks by about 70% compared to our previous process.

Over the past five years, we have observed a significant reduction in the failure rate of web applications, from 20% to 2%.

The product pricing is fair and reasonably priced.

We implemented the platform to identify web-based vulnerabilities in our applications, allowing us to address these issues proactively. It helps protect our web applications from potential attackers and secure them against loopholes.

Automated scanning has significantly improved our web application security management by reducing manual work. It has also streamlined the process, saving us considerable time. Previously, scheduling scans for many applications would take about a week, but automation makes this process much quicker and more efficient.

Regarding incident reduction, we have seen about a 20 % decrease. Cost-wise, there has been no significant difference compared to our previous tool. However, the speed of response and reduced false positives have been valuable.

I would recommend it to others for its excellent customer support, scanning efficiency, and scalability. It is a reliable tool for managing web application security.

Overall, I rate it an eight. 

I think we have the fastest version, and they always upgrade it. I think it's the $2 or $3-a-month version. They have multiple engines inside it, but it's a site-based service. It is not on-demand, so Qualys will host it. It's the pay as you go service that is on the software-as-a-service. 

We use the DAST, dynamic application scan test.

The feature that I have found most valuable is the progressive scan. It is good. It's done in 24 hours.

One area that could be improved is the a data server. That's probably what I most noticed in comparison with the Rapid7. Also, the UI is not user-friendly and you don't have a yearly reporting facility where you can slice and dice in different jobs. This is not good. 

Additionally, you don't have a recording feature, where you can record your screen navigation. Like a macro, you want to create the full screen, and they don't provide a tool which can record your navigation and then do a replay.

In terms of what should be included in the next release, like I mentioned, just the UI, the user interface screen. Also, it would be good If they could improve and enrich the reports. These are the fundamental differences with Rapid7.

I have been using Qualys Web Application Scanning for five years.

Qualys Web Application Scanning is very stable and reliable. But the reporting does not look that great.

In terms of scalability, it is very easy to expand. It's very fast and visible.

We don't have many people working on the solution. But our applications are big applications. We are using six components in different applications.

Support is very good.

Because of tasking, the initial setup is very straightforward. We didn't have to purchase any hardware for the installation. It is task-based. The cloud provision is there. It is good. I think nowadays everyone is going with the cloud provisioning. That way you can subscribe for any number of years to use the software. 

I think the initial setup took a couple of hours because there were no plugins and nothing to be installed.

We implemented it ourselves and there was no installation expert here.

Yes, we are still comparing it with Rapid7. We want to first make assessments of what advantages we can get with Rapid7.

My advice for anyone considering this solution is, "Go for it." 

On a scale of one to ten, I would give Qualys Web Application Scanning a seven.

Our customers use the solution to audit their web-application before releasing them to the Internet.

Licensing is the most valuable. Qualys provides the best licensing for companies. It is the best product for the development purposes of web applications. The product has a lot of integrations.

The product should allow users to upload their payloads.

I have been using the solution for three years.

I rate the product’s stability an eight out of ten.

I rate the product’s scalability a nine out of ten. 

We did not face any issues while deploying the solution. The product provides good documentation for deployment.

The product has a very good licensing model.

I am using the latest version of the solution.

Tenable makes us wait 90 days to delete the test web application, and Rapid7 does not allow us to delete it as well as  Acunetix (once a year).
I will recommend the solution to others. Overall, I rate the solution an eight out of ten.

The demo was mainly centered around vulnerability management. We were looking to find a tool which is able to do vulnerability management for internal assets and web applications which face the Internet and are exposed on it. We want a platform which can do vulnerability assessment for internal assets and also for assets which are published on the internet.

I did this demo for three to six months.

It gave us an idea of what lay in our network, and the vulnerabilities in it. Most IT admins are not aware of what is happening on the network. It was able to advise them of what's happening on the network. They could see the web-based applications and where attacks on the outside were coming from.

On the dashboard, you can see vulnerabilities that you have, as they are increasing or reducing over periods of time.

It combines both web application vulnerability management and internal vulnerability management on one platform and dashboard. Usually, you have to purchase separate tools.

The area of false positives could be improved. There are quite a number of false positives as compared to other solutions. They could probably fine tune the algorithm to be able to reduce the number of false positives being detected.

Going forward, I would like it to scan for given vulnerabilities and add-ons, then confirm whether it is an actual threat or not without the false positives.

It is a stable product, once it is implemented. 

We haven't had any major errors or bugs. It runs quite well.

The plans can be installed internally on the infrastructure or be used with a cloud-base scenario. If you have a cloud structure, the scalability is almost unlimited because it all depends on the number of assets that you want to manage. This can be done without any major configuration changes. In terms of scalability, Qualys has handled it quite well.

Technical support was quite responsive and effective. If engaged on email, they got back to us on time. 

When setting up the solution, it was quite a challenge when trying to set up the internal VM. The guides were not able to give all the scenarios one might encounter when installing the product. At some point, we became stuck, not knowing what to do next.

Work closely with your network administrator. The challenge for us was when trying to connect the virtual machine to the cloud on Qualys, ensuring the firewall policy and rules are in line with the communication passing through without being dropped anywhere. 

Support was helpful during implementation. They also referred us to a third-party vendor who we could work with as a partner. 

Licensing was based on the number of assets that you want to scan on your network. You can also do licensing on subscription. On subscription, it is easier and more flexible. You tell Qualys that you want to move from the 1000 to 2000 band or the 3000 or 5000 band, then they will give you the quotation for it. Once you pay for it, applying the licensing is quite easy and effective.

Pricing was reasonable and competitive. It was not too far above the other products.

We have been evaluating the following: Rapid7, Tenable.io, Tenable SecurityCenter, and Acunetix for web applications. 

My company works for another company called Ecolab here in Bangalore. We are an Ecolab digital center, we develop mobile application. We use Vericode and this solution for testing these web applications before going live. This includes the full testing periods and the production phase. Once it has been tested, we then get them ready to go live.

I have found the detection of vulnerabilities tool thorough with good results and the graphical display output to be wonderful and full of colors. It allows many types of outputs, such as bar and chart previews.

When comparing this solution to Veracode, Veracode has good interactive features and gives a clear understanding of what the vulnerabilities are, which error line of the vulnerability is on and what can be done. It gives interactive features, whereas this solution does not give a clear understanding of where or how to fix the problem.

In the future, customer support could improve and the output report needs to be simplified for better understanding.

I have been using the solution for the last 12 months.

We have expanded the solution in a few areas and it was scalable. We have approximately 50 people using the solution in my organization.

There is some improvement needed for the technical support.

We have used Veracode previously and we are currently still using it.

The installation is complex and it took approximately one month which included the customization.

We are on an annual license for the solution and the pricing could be more affordable.

We are planning on moving to Veracode because we are getting better results and is easier to use than this solution.

My advice to those wanting to implement this solution is if you have experience and knowledge with vulnerability management and reading through all the threats, this could be a good platform for you. If you are a new starter this solution is not a good place to start.

I rate Qualys Web Application Scanning an eight out of ten.

We have been using Qualys Web Application Scanning for automated web architecture scanning in an enterprise environment.

The solution integrates well with our database and asset management, providing a detailed framework that connects products and shares knowledge across them.

The most valuable features are the scheduled scanning, detailed reports, asset management, the knowledge database, and the overall product framework. The integration with other tools is also a significant advantage.

The authenticated scanning feature could be improved by adding support for real-time scanning tokens and authorization tokens. For example, after sessions, having tokens valid for applications allowing automated authenticated scanning, similar to what Burp offers with proxy support, would be beneficial.

The enterprise-level deployment was scalable and supported our business growth well.

We were looking at alternatives like Burp and Acunetix, particularly from the security research side, for better results and accuracy.

Pricing is a significant consideration. Although the product is good for certain details and automated processes, it may not be as cost-effective for some tasks.

We evaluated other solutions like Burp and Acunetix.

For specific web applications, Burp may provide better results, however, for integration of tools, Qualys Web Application Scanning is a good choice.

I'd rate the solution eight out of ten.

The primary use case includes scanning the web applications that are public facing.

The Qualys Web Application Scanning solution offers a single comprehensive console and consolidated reporting, covering all aspects from on-prem to cloud and compliance, etcetera.

There should be better visibility into the application.

Our customers have been using this solution for more than three years now.

It is a stable solution.

It is a cloud-based solution, so it is easy to scale.

We work with enterprise-level clients with over 2500 endpoints.

The customer service and support are good.

Positive

I would say Qualys is on the better side. It's more about the performance and the quality of the product because it's been around for a long time.

The initial setup is relatively easy. The installation process is quite straightforward, making it user-friendly.

The duration of deployment varies depending on the complexity of the customer's environment and their implementation status. We ensure to accommodate the customer's preferred implementation pace.

We normally purchase an annual license. There are additional costs. From Qualys, it's for the license and maintenance, which includes patches and stuff like that. Additionally, we have our own service delivery costs.

Qualys is a stable and reliable solution. It has been around for a long time.

Overall, I would rate the solution an eight out of ten. There is scope for improvement. It is still an early technology.