Qualys TotalCloud

My main use case for Qualys TotalCloud  is security posture management and vulnerability management. Day-to-day, we use it to continuously discover and assess cloud assets, identify misconfiguration and vulnerabilities against security policies, and prioritize remediation based on risk.

A recent example was when we used Qualys TotalCloud  to assess our Google Cloud , and it identified several misconfigured resources and vulnerabilities that could have increased our security exposure.

Beyond vulnerability management, we also use Qualys TotalCloud for continuous cloud asset visibility, security posture monitoring, compliance assessment, and prioritizing remediation based on risk.

We have been using Qualys TotalCloud for approximately two years to manage cloud security posture.

Qualys TotalCloud helped us identify vulnerabilities and misconfigurations earlier, prioritize the most critical issues, and improve collaboration between security and IT teams. One example was during a cloud security assessment where Qualys TotalCloud identified a set of high-risk vulnerabilities and misconfigurations. Because the findings were prioritized and assigned to the right teams, we were able to reduce the remediation cycle from roughly two to three weeks to about five to seven business days for high-priority issues. Overall, it helps us respond faster and made the remediation process more structured and measurable.

Qualys TotalCloud provides a more unified view of security posture across infrastructure, cloud-based services including IaaS  and SaaS-related environments where supported. We have seen better risk visibility, faster identification of high-risk issues, more consistent remediation processes, and improved compliance reporting.

The True Risk insights capability helped us identify a relatively small number of assets with high vulnerability and risk scores. With these insights, we were able to prioritize critical assets for immediate remediation, assign actions to the appropriate IT and security teams, apply patches or configuration changes, and track the remediation progress.

Overall, True Risk insights has had a positive impact on our security posture. It has helped us move from a broad vulnerability management approach to a more risk-based prioritization model. This has helped us reduce exposure more efficiently, improve remediation timelines, and make better use of security resources.

Our experience with True Risk has been positive in reducing the noise from raw CVEs. Instead of treating every vulnerability as equally important, it helps us prioritize findings based on overall risk and asset context, allowing the security team to focus on vulnerabilities that are more likely to have a meaningful business impact.

Qualys TotalCloud could be improved by making the user interface and dashboard more intuitive, especially for quickly understanding the most critical cloud risks. It would also be helpful to have more advanced automation for remediation, stronger out-of-the-box integration with cloud-native tools, and more detailed, real-time reporting.

As cloud environments grow, it would be helpful to have a more streamlined workflow for prioritizing findings, assigning remediation tasks, and tracking them across multiple teams. More customizable dashboards would also be helpful.

A few areas where Qualys TotalCloud could improve are a simpler user interface and navigation for faster access to critical findings, better integration with cloud-native security tools, DevOps platforms, and improved AI-driven recommendations with more context-specific remediation guidance.

I have worked in the current field for eight years or more.

Qualys TotalCloud is stable.

I rate Qualys TotalCloud's scalability as very good.

Our experience with Qualys customer support has been generally positive. The support team is responsive and knowledgeable.

I did not previously use a different solution.

We have seen a positive return on investment. The main benefits have been time-saving and improved operational efficiency rather than a direct reduction in headcount. We estimated that the security team saved roughly fifteen to twenty percent of time previously spent on vulnerability triage and reporting.

Our experience with Qualys TotalCloud pricing, setup cost, and licensing has been generally positive.

I did not evaluate other options before choosing Qualys TotalCloud.

The accuracy and reliability of Qualys TotalCloud AI-driven insights are generally good. We typically validate high-risk findings and recommendations against our environment and security policies before taking action. Overall, I would rate the AI reliable for day-to-day security operations and risk prioritization, but with human validation still important for complex or high-impact cases.

My advice would be to clearly define cloud security requirements and asset scope before deploying Qualys TotalCloud. Take advantage of risk-based prioritization and centralized visibility rather than focusing only on the volume of raw vulnerabilities.

I rate this product an eight out of ten overall.

My main use case for Qualys TotalCloud  is vulnerability management and exposure management. I use this tool to evaluate the exposure risk of the environment and identify all the weaknesses present in the environment.

I depend heavily on the reports that I have from this tool. In fact, this is the main tool that I use for reporting in the environment across most of the customer environments. However, I encounter a lot of false positives that require extensive testing to ensure the tool is reporting accurately. This process takes a significant amount of time. Additionally, the number of possible vulnerabilities that the tool identifies is not comparable to other players on the market. This impacts my ability to deliver the exact exposure view or risk that I am looking for.

To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially regarding vulnerability management and exposure management.

Getting all the information together in the tool is challenging. When I try to reach out to the support teams to get help and feedback to understand how the tool works in greater depth, the quality of support and knowledge of the people who work on the support team, as well as the supposed senior engineers, has not been satisfactory.

I spend a lot of time doing reviews because I perform a mix of agent scans and authenticated scans. Sometimes the merge of data between those two scans does not work properly, resulting in a lot of false positives that require manual validation. I spend considerable time reviewing the content that comes from the tool. I do not have one hundred percent confidence that I am getting the real output from the tool.

First of all, I believe that the support team needs to be more senior and not engage in robotic interactions with customers. Additionally, regarding feature requests and issues that I am working on with the support team, I see a lack of care from the support team in dealing with those issues.

To be honest, I would move out from this tool because it does not give a full view of vulnerability. It does not provide a full perspective of the risk to my environment or the possible ways that I would be exploited by a hacker. It does not give me a full perspective of the exposure view for vulnerability management. If I consider the cloud aspects, I also need to get insights from other modules from the tool to give me a full perspective of my risk in the environment.

I have been using Qualys TotalCloud  for four years.

To me and my perspective, it is too hard to get what I am looking for and build reports from the tool to get the visibility and view that I need. Most of the time I need to export the data and use it in another third-party tool, such as Power BI, to get the visibility and view that I am looking for.

Regarding Qualys TotalCloud's AI capabilities, I do see that it is not true AI. It feels to me that I am working with a chat that does not give insights based on the findings or the information that I get from the tool. It is not a real agentic AI. It is more a chatbot.

Qualys TotalCloud is deployed in my organization as a public cloud.

My overall review rating for Qualys TotalCloud is seven out of ten.

At the moment, the organization where I work, Alior Bank, is using Qualys TotalCloud , although in the past we used Nessus Professional , which we dropped about two years ago. It was Professional , not the enterprise Tenable version, just Nessus.

I have been familiar with Qualys TotalCloud  from the beginning of the implementation in our bank, which was in 2024 when we purchased it and started implementing it. I am part of the implementation and current management of Qualys TotalCloud.

Regarding Kubernetes  and containers, I don't recall if it's part of Qualys TotalCloud or a different component.

We are utilizing Azure  and GCP with Qualys TotalCloud.

Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS.

This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score.

The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified.

Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.

Improvements in Qualys TotalCloud could include technologies to cover compliance scanning, such as CIS benchmark scanning. It is somewhat difficult to set up Qualys TotalCloud properly for certain technologies. Additionally, while they moved to UI4, which is nicer, some parts of Qualys TotalCloud dashboards still look very old. You can switch between those interfaces and adopt them because some things are better in the new one, while others are not.

Overall, Qualys TotalCloud is a stable solution. I remember encountering a problem once, which was an issue for the whole EU2 platform and affected tenants on Qualys TotalCloud placed in EU2 areas. As I saw on the status page, it was only a problem in Europe, not in America or Asia.

Regarding technical support from Qualys, they respond, but the response time can be too long. Sometimes we need to wait weeks for solutions to simple questions.

If I had to rate Qualys support based on my experience from one to ten, I would say around six or weak seven, perhaps six plus.

It is difficult to compare the helpfulness of written explanations with other solutions as we used Nessus for a few years. We only had two or three years of experience with that support, and it was simply Nessus Professional and not Tenable Enterprise, so I could not make a comparison. However, currently we have very good support from our integrator, plus the support from Qualys itself.

Regarding deployment of Qualys TotalCloud, the installation of Cloud agents was given to administrators from each team who manage servers and workstations, including components in Azure  or GCP cloud. This was not handled by me or my team, as I work in the cybersecurity department. We manage the use of Qualys TotalCloud, but installation is up to the administrators, and we provide them support.

Currently, in the cybersecurity department, we have two people involved in the deployment of Qualys TotalCloud, along with over one hundred administrators involved in implementing and installing agents on the machines.

The deployment of Qualys TotalCloud within our organization was a continuous process. However, the installation of Cloud agents on the machines took place within two to three months, about a quarter.

The benefits we see are related to cost reductions.

For a mid-size bank like ours, the licensing cost for Qualys TotalCloud is cheap. Tenable Enterprise costs double that of Qualys TotalCloud and Rapid7. We explored those three solutions and decided to go with Qualys TotalCloud.

Qualys TotalCloud provides written explanations to help guide remediation paths and eliminate cyber risks in our organization. I would rate this review an eight overall.

I am working with Qualys TotalCloud  for vulnerability management, and the major use cases are patch management and scanning.

If I had to say something positive about the product that brings me the biggest benefit, I would say it has accurate reports, gets new update CVEs, zero-day attack detection, and is easy to manage with its GUI. Qualys TotalCloud  does provide written explanations to help guide remediation paths and thus eliminate cyber risk. When it provides written explanations with guidance to remediate a path and eliminate cyber risk, it helps in general and helps a lot. The product does have a so-called TruRisk Insights feature, but I do not have experience with it. Qualys TotalCloud for vulnerability management provides unified vulnerability and threat assessment across both IaaS  and SaaS, and I think overall it helps with security posture management. It is very good for patching vulnerabilities and getting zero-day attacks with accurate reports, not like Nessus. With Nessus, if you start to scan, it gives you many vulnerabilities, but it is not accurate and shows old vulnerabilities. If you compare it with Qualys TotalCloud, it is accurate and has updated CVEs. It saves a lot of time.

If Qualys could add some new features to Qualys TotalCloud in future releases, the results for the report and remediation should be more clear and very straightforward. Once we export the report, sometimes we do not get the correct path to patching the vulnerability.

I have been working with the product for around two years, and in general, I have been in this domain with security products for around 12 or 13 years.

Qualys TotalCloud is stable.

Regarding scalability, I would rate it seven out of ten. The reason I rate it seven points, not ten points, is that it is not that easy to manage. The problem when I manage it basically is that you need someone who has some experience to manage it, as it is not user-friendly.

The technical support from Qualys is good, to be honest.

Apart from Tenable and Qualys, I did not work with any other competitors. I only worked with these two and OpenVAS, which is an open-source solution for vulnerability assessment.

The installation of Qualys TotalCloud is very straightforward, and you can easily install the agent for Windows, Linux, and Mac.

I cannot provide information about seeing ROI with Qualys TotalCloud.

The price is very expensive, actually.

If I compare Qualys TotalCloud with other vendors, I compare it with Nessus and Tenable. If I compare Qualys TotalCloud and Tenable, I would say Qualys TotalCloud is better in terms of functionality, and Tenable is better in terms of price.

We are using Qualys TotalCloud Vulnerability Management  and web applications, enterprise solutions, plus Nessus also. For vulnerability management, we installed an agent for each machine and servers and start scanning to get the vulnerabilities.

If I speak about some negative sides of Qualys TotalCloud, I think the negative side is the license. It accounts for approximately 30 percent of the concerns.