Oracle released its August edition of Critical Patch Update. The update received patches for 943 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, includi…
Q
Qualys
Qualys · Vulnerability Management
Cloud-based vulnerability management and compliance
Overview
Qualys is a cloud-based security and compliance platform providing continuous vulnerability management, web application scanning, policy compliance, and asset inventory. Its agentless scanning approach and continuous monitoring make it popular for large, complex environments.
UK Pricing
Qualys VMDR from ~£15/asset/yr. Full platform enterprise pricing on request.
Target Size
200+ assets
Why Use It
Qualys is the enterprise choice for organisations that need continuous, cloud-based vulnerability management with strong compliance reporting. Its VMDR (Vulnerability Management, Detection, and Response) module closes the loop from detection to remediation.
Why Not
For SMBs under 200 seats, Nessus Professional or Defender Vulnerability Management is better value. Qualys becomes compelling when you need continuous monitoring rather than periodic scanning.
Pros & Cons
Pros
- Continuous cloud-based scanning — no scanner appliance maintenance
- Asset inventory and categorisation built in
- Strong compliance reporting (PCI DSS, ISO 27001, GDPR)
- Web Application Scanning (WAS) built into platform
- Patch management module enables direct remediation from scan results
Cons
- Complex platform with a steep learning curve
- More expensive than Nessus for smaller environments
- Results dashboards can be overwhelming without dedicated VM analyst
- Agent deployment required for complete coverage
- UK data residency availability requires verification for compliance
How to Get the Most Out of It
- Enable the Qualys Cloud Agent for continuous endpoint coverage between network scans
- Use TruRisk scoring to prioritise remediation based on real-world exploitability, not raw CVSS
- Use the Patch Management module to deploy patches directly from Qualys after identifying vulnerabilities
- Configure dashboards for your CISO/board — Qualys has strong executive reporting templates
- Integrate with Jira or ServiceNow to create automated remediation tickets at severity thresholds
AI: What's New
Claude AI# What's New with Qualys for Daily Users
• **Real-Time CSPM now live** – Qualys has launched real-time Cloud Security Posture Management, meaning you'll get faster risk detection and remediation alerts for your cloud infrastructure instead of waiting for scheduled scans. This directly speeds up your ability to patch misconfigurations before they become incidents.
• **Agent Val expanded to full attack surface coverage** – The validation agent now covers network-to-host visibility in one tool, so you can confirm vulnerabilities across your entire infrastructure without jumping between separate scanners. This reduces false positives and gives you more confidence in remediation priorities.
• **API discovery integration for AppSec** – Qualys is emphasizing API discovery as part of modern application security programs, which means you'll have better visibility into undocumented APIs in your environment—critical for catching shadow IT and exposed endpoints before attackers find them.
Latest News
All →Executive Summary CVE-2026-68820 is an actively exploited Windows vulnerability listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog, with a remediation deadline as suggested by CISA BOD 26-04. CISA BOD 26-04 introduces risk-based remediation timelines ranging from 3 to 14 days, increasing…
Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure, and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pull fr…
Key Takeaways Cloud environments change continuously, while security still relies on periodic scans, leaving gaps where risks go undetected. That gap becomes exposure. Qualys Real-Time CSPM monitors cloud changes as they happen, while still supporting periodic scans for environments that require the…
The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services. As attackers continue to exploit unpatched vulnerabilities, timely patching remains critical for reducing exposure and strengthen…
Key Takeaways Human-speed compliance is dead. Attackers utilizing modern, autonomous AI tools can chain enterprise misconfigurations and weaponize vulnerabilities in under 25 minutes, rendering manual, periodic audit cycles completely obsolete. The “Configuration Gap” is your biggest bli…
Executive Summary In the Frontier AI era, the number of CISA-known exploited vulnerabilities has increased by 6.5x over the past four years, and time-to-exploitation has collapsed to -7 days. Traditional monthly patch cycles cannot keep up. Organizations need a new operating model that detects at AI…
Powered by TruConfirm — Exploit Validation That Now Runs on the Network and the Host Executive Summary Qualys TruConfirm now validates exploitability across the entire attack surface, not just the network. Cloud Agent-Based TruConfirm brings the same proof-based validation model to the endpoint, clo…