Qualys TotalCloud

I have been using Qualys TotalCloud for the last eight months to scan the hardware and the virtual devices in our infrastructure.

Our main use case for Qualys TotalCloud is to secure our multi-cloud environment containers and workloads across AWS, Azure, GCP, and OCI as a single control plane.

Having a single control plane helps my team manage those multi-cloud environments more efficiently because it allows us to consolidate multiple cloud assets, configurations, and security postures into a single dashboard.

We also use Qualys TotalCloud to automate remediation plans, which offers one-click fixes and workflows that automate the resolution of misconfigurations quickly.

In my experience, the best feature Qualys TotalCloud offers is the FlexScan feature, which delivers multi-modal asset discovery using agentless and agent-based network and pipeline scanning.

The FlexScan feature has benefited our environment because we recently found a vulnerability rated high to medium risk in our assets, which we were able to discover and fix using Qualys TotalCloud.

Qualys TotalCloud positively impacts our organization by helping to minimize downtime in relation to asset scanning and by improving the overall cyber inputs in the enterprise.

Since using Qualys TotalCloud, we have noticed faster remediation times and improved compliance because the single scanning dashboard allows us to see all our assets in multi-cloud as well as on-premises deployment, which helps the cyber team quickly remediate any open vulnerabilities across different assets.

In terms of improvements, the features we are using in Qualys TotalCloud are working in the best optimal way, and I do not have any suggestions for them.

I chose a rating of nine out of ten because there is a complex interface that sometimes overwhelms new engineers. One would need additional training and learning to cope with day-to-day activities, and I feel they can improve the overall layout of the console for initializing scans across different assets.

I have been working in the network domain for the last twelve years.

Qualys TotalCloud is stable in my experience.

Qualys TotalCloud's scalability is high because it allows us to scale agent-based probing and scanning of our assets in a multi-vendor environment whenever we want, and it can be deployed on hypervisors, public and private clouds as well as hardware infrastructure.

I have not had any interaction with customer support, but from what I have heard, it is good.

I was not involved in the pricing, setup cost, or licensing of Qualys TotalCloud, as I am the administrator of this tool.

We have seen a return on investment since using Qualys TotalCloud, as we are able to scan all our assets with less human intervention and achieve overall effective outcomes.

Regarding Qualys TotalCloud's AI capabilities, I have not noticed any reliability issues or anything worth mentioning; it is overall the best tool available in the market for scanning purposes.

Qualys TotalCloud is deployed on-premises in our physical data centers.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS, and this unified view has helped our overall cloud security posture management by reducing false positives in our scanning results. Qualys has made the scanning and performance of all assets quite effective.

The TrueRisk Insights feature has helped in unified risk prioritization by consolidating vulnerabilities, misconfigurations, and threat intelligence into a single risk score, allowing our team to fix critical issues first.

I assess the comprehensiveness of FlexScan in providing visibility across our on-premises, multi-cloud, and container environments as excellent because it allows our organization to combine agentless scanning for quick setup with agent-based scanning for deep continuous operating system inspections.

Qualys TotalCloud has helped my team identify hidden cloud, runtime, data, identity, SaaS, application, or Shadow AI exposures before they became exploitable risks by providing a single control plane that reduces the need for separate security tools for different cloud vendors.

We are using Qualys TotalCloud's flexible scanning options, specifically agent-based scanning, to improve coverage across long-lived and ephemeral cloud workloads.

My advice for others looking into using Qualys TotalCloud is to be vigilant about the vulnerabilities that emerge and to have a remediation plan in place, as Qualys TotalCloud may trigger a lot of risks and vulnerabilities across many different assets in a multi-cloud environment. I provide this product with a rating of nine out of ten.

I have been using Qualys TotalCloud for two years.

My main use case for Qualys TotalCloud is vulnerability management.

As a specific example of how I use Qualys TotalCloud for vulnerability management, it creates a Jira ticket for any vulnerability that it finds in our containers, as well as in any of our platforms and other cloud resources.

The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances.

In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.

Qualys TotalCloud could be improved by enhancing the UI/UX experience; the console interface looks very outdated and should be more modern. Additionally, there should be direct developer remediation, as it lacks automated pull request generation for infrastructure fixes in GitHub, leaving manual patching work for the developers.

I have been using Qualys TotalCloud for two years.

Qualys TotalCloud is stable because we are very happy with the results. It has no downtime currently, so we have been scanning. It depends on whether we are using the back-end collection, but it has a lot of scanning mechanisms, which are agentless APIs, eBPF, and cloud agents, that are highly reliable.

Qualys TotalCloud's scalability is highly scalable because it has multi-cloud API connectors, and it does Kubernetes and container scaling. It reliably ingests and processes security telemetry for large multi-cloud environments. Though security teams operate at a massive scale, we expect occasional lag during heavy data indexing cycles.

Customer support with Qualys TotalCloud needs a little improvement with the response times. Other than that, they are technically capable, but occasionally they are slow on low-tier tickets.

I used a different solution previously, but I cannot disclose the name of it. Comparing it with TotalCloud, it allowed our team to shift from volume scanning to context-aware risk management. Qualys TotalCloud was a better solution for us.

I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, and it scales well with a stable infrastructure. I think it is highly dynamic.

I was not involved in the investment part of it, but I definitely know that it has delivered a high return on investment based on the drastically reduced triage labor and tool consolidation, rather than reducing the headcount outright.

I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, and it scales well with a stable infrastructure. I think it is highly dynamic.

My overall impression of the combination of detection and protection features in Qualys TotalCloud is that we were using another vulnerability management tool. The reason we changed was because Qualys has risk prioritization, CVE depth, and unified patch management. It is excellent at cutting down on false positives using runtime network context, and it focuses on pipeline prevention and guided workflow remediation.

TruRisk has fundamentally shifted our cloud security from reactive vulnerability management to targeted, business-context risk reduction. Instead of just flagging an isolated CVE, TruRisk tells us a narrative, such as, "This isn't just a CVSS flaw; it is a publicly accessible virtual machine running an actively exploited vulnerability with root privileges." TruRisk insights isolate 2% to 3% of workloads.

Using TruRisk to mitigate noise from raw CVEs has transformed our vulnerability management, shifting teams away from basic CVSS scores and toward risk-driven reduction. In practice, relying strictly on CVSS results in an overwhelming alert volume, with 40% to 50% of the environment labeled as critical. TruRisk typically reduces the actionable queue to the top 2% to 5% of assets that pose a real operational danger.

FlexScan has strong, multi-layered visibility across diverse environments by letting us blend agentless and agent-based assessment methods into a single view. Its overall comprehensiveness varies slightly depending on the specific tier of my stack. For us, it is mostly the container and Kubernetes environment, and the visibility is in-depth. Combining eBPF sensor technology allows for deep execution monitoring inside Kubernetes pods and hosts. It also scans container images, registries, and infrastructure as code before deployment, catching flaws upstream.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS environments. This is achieved by CSPM, CWP, and SSPM for a unified engine. For example, in IaaS, an S3 bucket or a GCP storage account might be restricted to internal access. However, if a user lacks MFA or has compromised credentials with wide-ranging read access to both SaaS and cloud infrastructure, TotalCloud will flag this combination as a risk factor. Seeing identity and infrastructure together prevents attackers from abusing over-privileged SaaS accounts to pivot to IaaS assets.

Automating the risk-based triage with Qualys TotalCloud has freed up significant engineering bandwidth every week. This lets the team focus on proactive security architecture, platform automation, and strategic initiatives rather than manual ticket triage. There were around 10,000 tickets, but we are now able to track them sooner and faster and assign them to the correct teams to fix.

Once it is set up, Qualys has proved to be one of our greatest assets. I rate this product an overall 8 out of 10.

I mainly use Qualys TotalCloud for vulnerability management and cloud security to identify vulnerabilities in cloud assets, assess their severity, prioritize remediation, and track the overall security posture.

When reviewing cloud assets for newly identified vulnerabilities, I check the vulnerability details and severity in Qualys TotalCloud, prioritize the high-risk findings, and share the remediation requirements with the relevant team while following up on progress.

I found the visibility provided across cloud assets useful in Qualys TotalCloud as it made it easier to identify high-risk vulnerabilities, prioritize them based on severity, and track the remediation with the relevant teams.

The AI governance and security capabilities of Qualys TotalCloud are useful, especially for visibility and risk control. From my experience, I primarily value having visibility into AI-related assets and configurations and being able to identify security or compliance risks. The risk-based approach also helped me prioritize the issues that needed attention first.

The best features Qualys TotalCloud offers are cloud asset visibility, vulnerability assessment, and risk prioritization. This risk-based prioritization helped me quickly identify high-risk vulnerabilities and focus on remediation instead of going through every finding. TrueRisk-based prioritization is useful for understanding which vulnerabilities need attention first.

It improved our workflow mainly by giving us a single view of cloud assets and their risk, so we could focus on the higher priority vulnerabilities instead of reviewing every finding manually. This helped us prioritize remediations more efficiently and reduce the time spent on vulnerability assessment and follow-up.

Qualys TotalCloud helped us identify exposures that might otherwise have been missed, especially across cloud assets, vulnerabilities, and identities. With the SaaS configuration, the unified inventory and risk view made it easier to connect vulnerabilities with asset criticality, exposure, and access permissions, allowing us to investigate high-risk exposures first and address them before they could become bigger security issues.

One thing that could be improved is the user experience and navigation. With the amount of information available, it can sometimes take a few extra steps to get to the exact vulnerability or asset details that I needed. I believe that is the only improvement needed.

I have used Qualys TotalCloud for one year.

Qualys TotalCloud is stable according to my experience, and I did not find any downtime or related issues.

I had a good experience with the scalability of Qualys TotalCloud because it scales very well as the number of assets or cloud workload increases.

We did not use a different solution before Qualys TotalCloud.

I recommend starting with a clear asset and inventory and properly configuring the cloud connector first. Once the environment is visible, it is important to spend time understanding TrueRisk prioritization instead of treating every severe finding equally. The initial setup and tuning of connectors, permissions, and policies is also important.

I do not have any relevant metrics available, but I can definitely say Qualys TotalCloud has saved our time by giving us better asset visibility and risk-based prioritization, as it has reduced the time spent manually reviewing CVEs and deciding what to address first.

I found the overall asset visibility with the unified risk view useful, as having vulnerabilities, cloud assets, and risk context in one place made investigation easier and reduced the need to switch between different tools.

It has helped me focus on the vulnerabilities that actually needed attention instead of treating every finding equally, as I used the risk score and asset context to identify higher risk issues first, making it easier to prioritize remediation and reduce the time spent manually reviewing lower risk findings.

I found the output generally reliable for identifying and prioritizing security risks, as the results were useful for deciding which findings needed attention first, although I would still validate the important findings before taking any remediation actions.

It helped identify a smaller set of assets with higher TrueRisk scores. I use that information to prioritize those assets for further investigation, review the vulnerabilities and exposures contributing to the score, and coordinate remediation with the relevant teams. This helped us focus on the assets with higher potential impact instead of treating all vulnerabilities equally.

TrueRisk helps reduce the noise from raw CVEs by putting them into business and threat context. Instead of treating every high severity CVE equally, we could focus on vulnerabilities that were actually more likely to be exploited or affect important assets, which made prioritization and remediation much more efficient.

Overall, I have a positive impression of the combination of detection and protection features in Qualys TotalCloud. The main advantage for me is having vulnerability assessment, cloud posture monitoring, and risk prioritization in one platform. Compared with more point-focused solutions, Qualys TotalCloud gives us a more unified view which makes it easier to prioritize risks and decide what needs attention first. I rate this review a 10 out of 10.

My main use case for Qualys TotalCloud is regarding the cloud visibility that we were not having previously.

Previously, we were just looking at critical vulnerabilities and patching them. Now with Qualys TotalCloud, we can distinguish between critical vulnerabilities and what is internet-facing, what is a sensitive workload, and excessive permissions that are given to unauthorized users in the cloud environment. This gives us more visibility towards what is happening in the cloud.

Another use case I have for Qualys TotalCloud is identifying misconfigurations within the cloud environment and how any configurations might impact the organization's cloud assets. Those were the two main use cases.

The integration with Qualys TotalCloud worked very well with tools such as Exonius and Splunk, wherein we were easily getting automated alerts and incidents that we could automate into emails and reach out to stakeholders without manual intervention.

Qualys TotalCloud is definitely helpful for our vulnerability management. It did help in CSPM and also in looking at cloud inventory, not just when a vulnerability or misconfiguration is happening, but I could look at what is happening in my cloud environment, who is really having any entitlements, what access exists, what unauthorized access anyone has, and so on.

Qualys TotalCloud does provide both IaaS and SaaS when it comes to threat assessment.

EASM finds assets that are exposed to the internet such as domains, IPs, applications, and services. When it comes to SaaS, it assesses the SaaS applications and their security posture. We could also look at what SaaS services we are using and what risks they introduce.

We were narrowing the risk and threat down to a much smaller group of assets where multiple factors came together. For example, a highly vulnerable asset that was internet-facing and business-critical had additional exposure of configuration issues. We used those insights to prioritize the assets for immediate remediation.

Qualys TotalCloud is a one security platform where we could leverage the existing Qualys platform and not any other different agent or different platform for cloud visibility and cloud security. We had multi-cloud visibility where both AWS and Azure could be controlled and monitored for misconfigurations and security issues.

We had better integration with tools, which is where Qualys TotalCloud was useful.

TruRisk insights have been useful in helping us move from a traditional vulnerability counting approach to a risk-based approach.

In terms of improvement, remediation still belongs to the cloud team, which is one of the issues we faced with Qualys TotalCloud. Qualys TotalCloud can identify the problem, but changing an AWS security group still requires the appropriate cloud owner or process. If there was also a response capability within Qualys TotalCloud in addition to detection, that would have been better.

The CNAPP capability is a major feature of Qualys TotalCloud, but when you drill down, there are a lot of modules that you need to enable. I think organizations need to know which modules they need for their use case and for their cloud environment usage. This gives the exact implementation strategy as well.

I have been using Qualys TotalCloud for one year.

Qualys TotalCloud is stable.

It is pretty scalable in our organization.

From what I have experienced, I have had interactions with them a couple of times and it turned out to be good. I would give a nine out of ten.

I would give Qualys TotalCloud an eight out of ten rating. The remaining two points I would take out due to the improvements I have mentioned.

The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility.

I would probably do a traditional CVE-based approach otherwise. A large number of vulnerabilities can be classified as critical or high, but treating all of them with the same priority is not practical.

Qualys TotalCloud compares well because it combines breadth and integration. I am pretty sure VMDR gives strong vulnerability visibility. But when we want visibility for the cloud environment, that is where Qualys TotalCloud comes into the picture. The biggest advantage is correlating the findings that we receive from these security tools and through the risk prioritization and managing the entire cloud ecosystem.

I primarily use Qualys TotalCloud for Cloud Security Posture Management, vulnerability management, asset visibility, and continual monitoring of cloud assets, maintaining the cloud resources that we use.

One of the main advantages for us is having multiple security capabilities available through this tool, instead of maintaining several completely separate tools for each one of them, such as vulnerability management, audit asset visibility, and cloud security management.

During our security rehearsal or weekly customer meetings, we need to check about site compliance, and Qualys TotalCloud was very helpful because instead of using other tools where we had to pull reports from different sources, we could check compliance all in one place.

When one hundred fifty vulnerabilities were identified on cloud, production, or any endpoint, it was useful for us to identify which asset was affected and to look at the details and share the findings with the customer and the remediation infrastructure team.

Qualys TotalCloud offers several valuable features, including monitoring visibility as an EDR tool and cloud asset inventory capabilities, which help in centralized asset management and prioritizing risk.

It is particularly useful because it gives us visibility across cloud resources from different environments in one place, making it easy for organizations to understand their security postures without manual checking with cloud consoles.

The vulnerability management capabilities are another strong point where we can review security risks for vulnerabilities on cloud workloads and prioritize issues based on CVSS scores.

When we were using different cloud solutions, it was tedious to find compliance for assets, especially during monthly meetings.

Qualys TotalCloud is very useful in day-to-day security operations, particularly at monthly review meetings. It was helpful to maintain all the assets in one place, and when investigating vulnerabilities, we can first identify affected cloud assets from the inventory and look at their release details and security findings which helps in understanding the actual scope of an issue and identifying which team needs to take action.

I believe it saves us more time because we do not have to gather asset information from different sources and tools. We can search and filter inventory, group assets, and use asset context to move quickly from understanding what an asset is to identifying required security patches.

Qualys TotalCloud has positively impacted our organization by helping us save time and manage all assets and remediation, allowing us to achieve quarterly and half-yearly goals.

It has improved our visibility and made vulnerability management more structured, helping us reach our remediation goals while reducing manual effort from security reporting and patch management.

Before implementing Qualys TotalCloud, we used to have around ten thousand vulnerabilities on critical servers, and after using it, we reduced the vulnerabilities by thirty to forty percent in just two months.

We could identify vulnerabilities and their affected assets within five to ten minutes. This has also improved our investigation efficiency, allowing the team to spend more time on actual remediation rather than data collection.

Regarding improvements to Qualys TotalCloud, I suggest that user navigation can be enhanced because initially, many users found it complicated and had trouble understanding the platform due to information being spread across multiple tabs.

Making some dashboards and reports customizable would also help, as different teams have their own requirements.

I have covered most of the necessary improvements regarding navigation and customizable dashboards, which would help make work easier.

I have been working as a SOC analyst for almost three years.

Most recommendations and findings are accurate and reliable. While the AI output is helpful, it is crucial to validate actions against actual safety configurations, as human intelligence is still necessary in decision-making.

My advice for others considering using Qualys TotalCloud is that if you want all vulnerability management and cloud asset management in one place, then it is the best solution. Good configuration makes finding vulnerabilities and managing alerts much easier.

My overall rating for this product is nine out of ten.

My main use case for Qualys TotalCloud is vulnerability management and exposure management. I use this tool to evaluate the exposure risk of the environment and identify all the weaknesses present in the environment.

I depend heavily on the reports that I have from this tool. In fact, this is the main tool that I use for reporting in the environment across most of the customer environments. However, I encounter a lot of false positives that require extensive testing to ensure the tool is reporting accurately. This process takes a significant amount of time. Additionally, the number of possible vulnerabilities that the tool identifies is not comparable to other players on the market. This impacts my ability to deliver the exact exposure view or risk that I am looking for.

To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially regarding vulnerability management and exposure management.

Getting all the information together in the tool is challenging. When I try to reach out to the support teams to get help and feedback to understand how the tool works in greater depth, the quality of support and knowledge of the people who work on the support team, as well as the supposed senior engineers, has not been satisfactory.

I spend a lot of time doing reviews because I perform a mix of agent scans and authenticated scans. Sometimes the merge of data between those two scans does not work properly, resulting in a lot of false positives that require manual validation. I spend considerable time reviewing the content that comes from the tool. I do not have one hundred percent confidence that I am getting the real output from the tool.

First of all, I believe that the support team needs to be more senior and not engage in robotic interactions with customers. Additionally, regarding feature requests and issues that I am working on with the support team, I see a lack of care from the support team in dealing with those issues.

To be honest, I would move out from this tool because it does not give a full view of vulnerability. It does not provide a full perspective of the risk to my environment or the possible ways that I would be exploited by a hacker. It does not give me a full perspective of the exposure view for vulnerability management. If I consider the cloud aspects, I also need to get insights from other modules from the tool to give me a full perspective of my risk in the environment.

I have been using Qualys TotalCloud for four years.

To me and my perspective, it is too hard to get what I am looking for and build reports from the tool to get the visibility and view that I need. Most of the time I need to export the data and use it in another third-party tool, such as Power BI, to get the visibility and view that I am looking for.

Regarding Qualys TotalCloud's AI capabilities, I do see that it is not true AI. It feels to me that I am working with a chat that does not give insights based on the findings or the information that I get from the tool. It is not a real agentic AI. It is more a chatbot.

Qualys TotalCloud is deployed in my organization as a public cloud.

My overall review rating for Qualys TotalCloud is seven out of ten.

At the moment, the organization where I work, Alior Bank, is using Qualys TotalCloud, although in the past we used Nessus Professional, which we dropped about two years ago. It was Professional, not the enterprise Tenable version, just Nessus.

I have been familiar with Qualys TotalCloud from the beginning of the implementation in our bank, which was in 2024 when we purchased it and started implementing it. I am part of the implementation and current management of Qualys TotalCloud.

Regarding Kubernetes and containers, I don't recall if it's part of Qualys TotalCloud or a different component.

We are utilizing Azure and GCP with Qualys TotalCloud.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS.

This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score.

The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified.

Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.

Improvements in Qualys TotalCloud could include technologies to cover compliance scanning, such as CIS benchmark scanning. It is somewhat difficult to set up Qualys TotalCloud properly for certain technologies. Additionally, while they moved to UI4, which is nicer, some parts of Qualys TotalCloud dashboards still look very old. You can switch between those interfaces and adopt them because some things are better in the new one, while others are not.

Overall, Qualys TotalCloud is a stable solution. I remember encountering a problem once, which was an issue for the whole EU2 platform and affected tenants on Qualys TotalCloud placed in EU2 areas. As I saw on the status page, it was only a problem in Europe, not in America or Asia.

Regarding technical support from Qualys, they respond, but the response time can be too long. Sometimes we need to wait weeks for solutions to simple questions.

If I had to rate Qualys support based on my experience from one to ten, I would say around six or weak seven, perhaps six plus.

It is difficult to compare the helpfulness of written explanations with other solutions as we used Nessus for a few years. We only had two or three years of experience with that support, and it was simply Nessus Professional and not Tenable Enterprise, so I could not make a comparison. However, currently we have very good support from our integrator, plus the support from Qualys itself.

Regarding deployment of Qualys TotalCloud, the installation of Cloud agents was given to administrators from each team who manage servers and workstations, including components in Azure or GCP cloud. This was not handled by me or my team, as I work in the cybersecurity department. We manage the use of Qualys TotalCloud, but installation is up to the administrators, and we provide them support.

Currently, in the cybersecurity department, we have two people involved in the deployment of Qualys TotalCloud, along with over one hundred administrators involved in implementing and installing agents on the machines.

The deployment of Qualys TotalCloud within our organization was a continuous process. However, the installation of Cloud agents on the machines took place within two to three months, about a quarter.

The benefits we see are related to cost reductions.

For a mid-size bank like ours, the licensing cost for Qualys TotalCloud is cheap. Tenable Enterprise costs double that of Qualys TotalCloud and Rapid7. We explored those three solutions and decided to go with Qualys TotalCloud.

Qualys TotalCloud provides written explanations to help guide remediation paths and eliminate cyber risks in our organization. I would rate this review an eight overall.

I am working with Qualys TotalCloud for vulnerability management, and the major use cases are patch management and scanning.

If I had to say something positive about the product that brings me the biggest benefit, I would say it has accurate reports, gets new update CVEs, zero-day attack detection, and is easy to manage with its GUI. Qualys TotalCloud does provide written explanations to help guide remediation paths and thus eliminate cyber risk. When it provides written explanations with guidance to remediate a path and eliminate cyber risk, it helps in general and helps a lot. The product does have a so-called TruRisk Insights feature, but I do not have experience with it. Qualys TotalCloud for vulnerability management provides unified vulnerability and threat assessment across both IaaS and SaaS, and I think overall it helps with security posture management. It is very good for patching vulnerabilities and getting zero-day attacks with accurate reports, not like Nessus. With Nessus, if you start to scan, it gives you many vulnerabilities, but it is not accurate and shows old vulnerabilities. If you compare it with Qualys TotalCloud, it is accurate and has updated CVEs. It saves a lot of time.

If Qualys could add some new features to Qualys TotalCloud in future releases, the results for the report and remediation should be more clear and very straightforward. Once we export the report, sometimes we do not get the correct path to patching the vulnerability.

I have been working with the product for around two years, and in general, I have been in this domain with security products for around 12 or 13 years.

Qualys TotalCloud is stable.

Regarding scalability, I would rate it seven out of ten. The reason I rate it seven points, not ten points, is that it is not that easy to manage. The problem when I manage it basically is that you need someone who has some experience to manage it, as it is not user-friendly.

The technical support from Qualys is good, to be honest.

Apart from Tenable and Qualys, I did not work with any other competitors. I only worked with these two and OpenVAS, which is an open-source solution for vulnerability assessment.

The installation of Qualys TotalCloud is very straightforward, and you can easily install the agent for Windows, Linux, and Mac.

I cannot provide information about seeing ROI with Qualys TotalCloud.

The price is very expensive, actually.

If I compare Qualys TotalCloud with other vendors, I compare it with Nessus and Tenable. If I compare Qualys TotalCloud and Tenable, I would say Qualys TotalCloud is better in terms of functionality, and Tenable is better in terms of price.

We are using Qualys TotalCloud Vulnerability Management and web applications, enterprise solutions, plus Nessus also. For vulnerability management, we installed an agent for each machine and servers and start scanning to get the vulnerabilities.

If I speak about some negative sides of Qualys TotalCloud, I think the negative side is the license. It accounts for approximately 30 percent of the concerns.