Sold by: Qualys
Deployed on AWS
Risk-Based Vulnerability Management, Patch Management & end point protection
4.2
Overview
Industry leading risk-based vulnerability management solution (VMDR) & Patch Management, with Multi-Vector EDR with Antimalware
Highlights
- Comprehensive risk-based vulnerability management solution - Automate patching for cloud and on-prem assets (operating systems & 100+ 3rd party applications) - Consolidate IT and Security Tools for vulnerability assessment, remediation and ransomware protection
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
VMDR ProtectIT (64) | Package of 64 Hosts for VMDR ProtectIT | $880.00 |
VMDR ProtectIT (128) | Package of 128 Hosts for VMDR ProtectIT | $1,540.00 |
VMDR ProtectIT (256) | Package of 256 Hosts for VMDR ProtectIT | $2,750.00 |
VMDR ProtectIT (512) | Package of 512 Hosts for VMDR ProtectIT | $4,946.00 |
VMDR ProtectIT (1024) | Package of 1024 Hosts for VMDR ProtectIT | $8,381.00 |
VMDR ProtectIT (1536) | Package of 1536 Hosts for VMDR ProtectIT | $11,399.00 |
VMDR ProtectIT (2048) | Package of 2048 Hosts for VMDR ProtectIT | $14,168.00 |
VMDR ProtectIT (2560) | Package of 2560 Hosts for VMDR ProtectIT | $16,763.00 |
Dimensions summary
You buy Qualys VMDR ProtectIT as a contract based on host packages. Each dimension covers a set number of hosts: 64, 128, 256, 512, 1024, 1536, 2048, or 2560. The dimensions differ only by host count, so you pick the package that matches how many hosts you need to protect. Pricing scales with the size of the package you choose. ProtectIT combines risk-based vulnerability management, remediation and patching, and behavior-based anti-virus and anti-malware protection in one contract.
Top-of-mind questions for buyers
A host is any asset you protect, such as a workstation, server, or database, whether on-premises or in the cloud. You classify assets by operating system, application, and other attributes. Each package covers a fixed number of these hosts, and each virtual machine counts as a separate host.
You select the package that matches your host count from 64 up to 2,560. If you exceed your chosen package, you move to a larger package rather than paying overage on your current one. Each package is a fixed host count, so pick the size that fits your environment.
ProtectIT bundles risk-based vulnerability management with remediation and patching for operating systems and third-party applications. It adds behavior-based anti-virus and anti-malware protection, plus incident investigation through integrated endpoint detection. These capabilities are included in every host package; only the host count changes between dimensions.
www.qualys.com
Helpful?
Vendor refund policy
Licensed Qualys customers should refer to their Service User Agreement (SUA) or contact their Qualys Technical Account Manager if they have questions about refund or cancellation policies which would apply to them.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
https://www.qualys.com/support/ || US/Canada: +1 (866) 801-6161 (toll free) or +1 (650) 801-6161 || UK/Europe/International: +44 (0)1753 872102 || France: +33 1 41 97 35 81
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Qualys
By Rapid7
By Sophos
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Risk-Based Vulnerability Management
Automated vulnerability assessment and prioritization based on risk scoring across cloud and on-premises infrastructure
Automated Patch Management
Automated patching capabilities for operating systems and over 100 third-party applications across cloud and on-premises environments
Multi-Vector Endpoint Detection and Response
Multi-vector EDR technology with integrated antimalware capabilities for endpoint protection
Ransomware Protection
Ransomware detection and protection mechanisms integrated within the vulnerability management framework
Consolidated Security Operations
Unified platform consolidating vulnerability assessment, remediation, and endpoint protection tools into a single solution
Attack Surface Visibility
Provides complete internal and external views of attack surface with asset enrichment from first-party and third-party data sources
Risk Prioritization and Scoring
Delivers risk scoring and threat-aware risk context to identify toxic combinations and prioritize remediation based on business impact
Compliance Monitoring and Enforcement
Discovers assets missing required controls or permissions and enforces organizational policies with automated alerts upon configuration drift detection
Multi-Layer Exposure Detection
Aggregates findings from native exposure detection capabilities combined with on-premises VM, cloud security, and application testing assessments
Native Automation and Integration
Supports no-code automation with more than 450 out-of-the-box integrations to popular security and ITOps tools for automated remediation and ticketing
Threat Detection and Response
Automatic threat detection and neutralization with 99.98% threat interception rate, supported by 24/7 managed detection and response service with threat hunting and neutralization experts
Cloud Security Posture Management
Continuous scanning of cloud environments to identify assets, assess security and compliance settings, detect malicious activity, and identify misconfigurations with agentless malware scanning for S3 storage and integration with AWS GuardDuty and SecurityHub
Endpoint and Workload Protection
Agent-based protection for Windows and Linux hosts against modern threats including ransomware, fileless attacks, and advanced malware
Network and Firewall Protection
Cloud-native, virtual, and physical firewall appliances providing network visibility, protection, and response across public, private, and hybrid cloud environments
Unified Management and Orchestration
Cloud-based centralized management platform enabling configuration, reporting, and real-time threat information sharing across endpoint, firewall, network, email, cloud, and identity solutions with automatic response actions
Standard contract
No
No
No
Customer reviews
Ajay Paul
Vulnerability management has prioritized high‑risk patching and simplified bulk system reporting
Reviewed on Aug 07, 2026
Review provided by PeerSpot
What is our primary use case?
I use Qualys Enterprise TruRisk Management for vulnerability management. We receive reports daily from Qualys Enterprise TruRisk Management that show which systems have vulnerabilities and prioritize them based on risk factors. This allows us to identify which systems have more vulnerabilities or higher risk levels and take appropriate action. We primarily use this tool for patch management and vulnerability patch management.
What is most valuable?
The most valuable feature is the ability to get vulnerability lists for bulk systems. My company has more than 300,000 employees, so we can generate a report of all systems and filter the results by location. This is the most interesting aspect of the tool. Additionally, Qualys Enterprise TruRisk Management provides many scoring metrics for critical and non-critical vulnerabilities, as well as high-risk ratings. This allows us to prioritize which vulnerabilities are more critical and focus on those first. Qualys Enterprise TruRisk Management also provides resolutions for vulnerabilities. For example, if a Windows update is missing, we can patch those systems directly from Qualys Enterprise TruRisk Management. It will connect directly to the Microsoft site and download the patch, so there is no need to search for patches separately. The patch will install directly from Qualys Enterprise TruRisk Management itself. For vulnerability management, Qualys Enterprise TruRisk Management is very good for our organization.
What needs improvement?
The primary issue is with the reporting functionality. Even though we fix vulnerabilities, the reports do not reflect the changes immediately. Sometimes we need to manually run a script to scan the systems before Qualys Enterprise TruRisk Management will update the scan results. The main issue is the reporting delay, and sometimes the Qualys Enterprise TruRisk Management agent will not scan the system, which means we do not receive accurate reports in a timely manner. Additionally, there are many metrics for calculating vulnerabilities, such as the Qualys ID, severity scores, CVSS scores, and other metrics. The abundance of information can be confusing. These two aspects are the most significant negatives I have experienced with this tool.
For how long have I used the solution?
I have been using this tool for the last one year.
What do I think about the stability of the solution?
I experienced a stability issue last week. For approximately 12 hours, we did not have access to Qualys Enterprise TruRisk Management. Even when we regained access, instead of displaying all 300 plus systems, it only showed fewer than 50 systems. This issue persisted for 12 hours and was only resolved after one day. I am uncertain whether the issue was caused by Qualys Enterprise TruRisk Management or our internal team. In one year of use, I have experienced this issue only once, when we lost access for one day.
What do I think about the scalability of the solution?
Qualys Enterprise TruRisk Management is highly scalable. As my company has many employees, the tool performs very well for handling this large number of users. I believe the tool is very scalable for enterprise environments.
How are customer service and support?
I cannot contact Qualys Enterprise TruRisk Management directly. Only our Qualys team can contact them. I do not have the ability to contact them directly.
Which solution did I use previously and why did I switch?
I have not used other solutions in this company. However, in my previous company, I used a tool called ManageEngine. Compared with ManageEngine, Qualys Enterprise TruRisk Management is by far better.
What about the implementation team?
In my company, we have nearly 300,000 employees and approximately five or six team members dedicated to Qualys Enterprise TruRisk Management. They handle the deployment, access management, and patching for the entire organization. The size of the implementation team depends on the company size. If the company has very few users, such as 10 to 100 users, one fully dedicated team member is sufficient for managing the deployment.
What's my experience with pricing, setup cost, and licensing?
I am not familiar with the pricing structure. I know that Qualys Enterprise TruRisk Management charges per user, but I do not have detailed knowledge of the pricing. The pricing decisions are handled by the marketing team and senior management, so I do not have information about those details.
What other advice do I have?
Qualys Enterprise TruRisk Management is very easy to use. If we have access to the system, there is no need for high technical knowledge, and an average person can navigate and use this tool easily. The tool is also available as a web application, making it very easy to access. If we have internet connectivity and a password, we can access it from any laptop or location. The entire process depends on the type of vulnerability being addressed. For example, for Windows patch updates, the process takes between half an hour and one hour to fully complete, depending on internet speed. I consider this a normal timeframe and it does not take excessively long. I would rate this review an 8.5 out of 10.
SharmaAbhijeet
Centralized risk-based visibility has improved vulnerability remediation and automates patching
Reviewed on Jul 13, 2026
Review provided by PeerSpot
What is our primary use case?
We are using Qualys Enterprise TruRisk Management for vulnerability management. It identifies, prioritizes, and remediates vulnerabilities while focusing on the business risk itself. The latest TruRisk platform provides this functionality, and we are not just getting vulnerability counts, but we are actually working on the business risk of the vulnerabilities.
We automate the vulnerability patching with Qualys Enterprise TruRisk Management and use patch management as well. In this overall scenario, we are automating the risk factor using Qualys for risk.
What is most valuable?
Qualys Enterprise TruRisk Management is a centralized vulnerability platform that provides us with wide centralized visibility. It has risk-based prioritization, useful reporting capabilities, and integration with different assets is quite easy. It is scalable in our environment.
With Qualys Enterprise TruRisk Management, we are able to perform risk-based prioritization. It is scalable for our environment, which gives us a good advantage. Reporting is very useful, so we get valuable reports.
Risk-based prioritization is a new feature with Qualys Enterprise TruRisk Management, and overall, the vulnerability posture of our organization has improved significantly. Qualys has quite improved the overall vulnerability management.
With Qualys Enterprise TruRisk Management, we are able to automate processes and prioritize risks. The resources who were previously working on the administrative part of vulnerability management are now free to work on different areas and are able to automate the administrative part. They are working on the automation and are able to address different vulnerabilities and patch them in time. This helps us considerably, and resources are easily managed.
With Qualys Enterprise TruRisk Management, all three metrics have improved. Resource allocation has decreased, time has improved, and we are getting positive results.
What needs improvement?
Qualys Enterprise TruRisk Management is a big platform, and the initial deployment is tedious.
Licensing and features are somewhat complex for new customers, and that area could be improved.
For how long have I used the solution?
I have been working on Qualys Enterprise TruRisk Management for around three years.
What do I think about the stability of the solution?
Qualys Enterprise TruRisk Management has been stable, and no downtime has been experienced.
What do I think about the scalability of the solution?
Qualys Enterprise TruRisk Management is scalable, and that is why we opted for it. It is one of the best products available for scalability.
How are customer service and support?
We reach out to customer support for Qualys Enterprise TruRisk Management occasionally, and it is quite easy to reach them. False positives are the main issue that we encounter and need to be handled by the support team.
Which solution did I use previously and why did I switch?
We were using a ManageEngine solution previously with Qualys Enterprise TruRisk Management, and we were conducting a proof of concept. As our environment was quite large, we migrated to Qualys, which proved to be more useful and more powerful for this environment.
How was the initial setup?
My experience with pricing, setup cost, and licensing for Qualys Enterprise TruRisk Management was somewhat tedious, and it consumed a lot of time.
Which other solutions did I evaluate?
Before choosing Qualys Enterprise TruRisk Management, we conducted a requirement analysis and selected a few vendors. We performed our own proofs of concept and finalized Qualys.
What other advice do I have?
We reach out to customer support for Qualys Enterprise TruRisk Management occasionally, and it is quite easy to reach them. False positives are the main issue that we encounter and need to be handled by the support team.
If you are looking for a good vulnerability management platform with Qualys Enterprise TruRisk Management and are open to a cloud-based or hybrid-based environment with good scalability for a large environment, you should choose Qualys. I would rate this solution a 9 out of 10.
Pramod Borana
Clear risk scoring has guided my patch priorities and supports fully auditable vulnerability management
Reviewed on Feb 23, 2026
Review provided by PeerSpot
What is our primary use case?
Primarily, I use Qualys Enterprise TruRisk Management for assessing the current posture of my infrastructure as I am responsible for vulnerability management for my organization. Qualys Enterprise TruRisk Management gives me a clear picture of the current status of vulnerabilities relative to different criteria across my various integrated servers.
I work in a regulated banking entity, so we are highly regulated. Most of our data comes from Qualys itself, making all data auditable from the standpoint of Indian regulators. Every data point that comes out of Qualys is auditable.
I work with Qualys Enterprise TruRisk Management, though we are not using Patch Management. Beyond that, we are using Vulnerability Management and Secure Configuration, which is the new name for Policy Audit in Qualys.
What is most valuable?
The most valuable function of Qualys Enterprise TruRisk Management is that it provides a clear picture of how my vulnerabilities across different servers can be categorized. I must provide input about servers and their criticality, but based on that information, it gives me a clear understanding of whether a particular vulnerability on my server needs to be fixed based on the proof of concept and attack vectors available in the market. Based on this, it provides me a scoring mechanism that tells me which vulnerabilities I need to patch immediately or which ones I can defer for a later time.
Qualys Enterprise TruRisk Management provides me with a QDS scoring mechanism, which has helped me identify which vulnerabilities I need to patch immediately. It also provides me with the criticality rating of each vulnerability. Understanding whether a vulnerability needs immediate action or whether I can take some time based on my current posture and available bandwidth has been instrumental.
What needs improvement?
The live threat intelligence updates in Qualys are good, with updates provided on the last Friday of each month. However, I am not satisfied with Qualys support. The response time is slower than needed.
I have raised only technical cases with Qualys. I am comfortable with the GUI and how they have defined it. However, I do require a certain level of technical input, and they take considerable time to provide responses. This typically misses the timeline or the criticality of the particular matter. After three years of working with Qualys, I am familiar with most aspects of the system. When the system misbehaves and I need to raise a case with Qualys, they take an extended amount of time to provide input. Even after that, the response time for scheduling calls to discuss and understand the issue is slow.
Overall, they are good. A few bugs once or twice per month is acceptable because no tool is perfect. My primary recommendation is to increase their technical support team to ensure that clients are not impeded or running back and forth. We only raise support when we need urgent assistance or when action needs to be taken immediately. Receiving a response three to seven days later does not align with our needs.
For how long have I used the solution?
I have been working with Qualys Enterprise TruRisk Management for approximately three years.
What do I think about the stability of the solution?
I rate the stability of Qualys Enterprise TruRisk Management at eight point five out of ten because I occasionally find bugs that are frustrating, and I have already commented on the support issues. Overall, eight point five is a good rating.
What do I think about the scalability of the solution?
I rate the scalability of Qualys Enterprise TruRisk Management at nine out of ten. Scalability is not a challenge. Since it is primarily an on-premises solution, I can simply scale it up as needed.
How are customer service and support?
Regarding pricing, Qualys Enterprise TruRisk Management is a more costly product compared to what is available in the market. However, it does provide good features that justify the investment. My competitors, including Tenable, Rapid7, and other products, do not provide a good GUI function where I can actively track my vulnerabilities in real time. I always need to pull down a report in Excel and then work with the Excel file. With Qualys Enterprise TruRisk Management, I can work directly on the dashboard itself and ensure that all my servers are scanned within twenty-four hours or four hours according to my feasibility. Regarding its competitors in the market, I believe Qualys Enterprise TruRisk Management has a strong offering.
The GUI in Qualys Enterprise TruRisk Management is excellent. Although it is quite elaborate and may require some navigation, it is very familiar and easy to use. Compared to other solutions, the GUI is superior.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I have experience with competitors including Tenable, Nessus, and Rapid7. To be honest, they ask a high price, but they also provide certain functionality that other competitors do not. In the market, if you are pricing higher, that is what you can expect.
How was the initial setup?
Overall, the initial setup for Qualys Enterprise TruRisk Management is good and straightforward. I have taken the SaaS model and am not discussing the on-premises model. I am working with the SaaS model. Scanners and QGS need to be deployed on-premises, which is straightforward. I only need to build a server and deploy the ISO. Qualys provides the SaaS model itself. Overall, if I go with the SaaS model, I would not find much difficulty or hindrance.
What about the implementation team?
I set up Qualys Enterprise TruRisk Management on my own. It was not difficult. If I followed the official documentation, I could learn everything I needed. The process was straightforward.
What's my experience with pricing, setup cost, and licensing?
I rate the pricing of Qualys Enterprise TruRisk Management as high, giving it a six out of ten.
What other advice do I have?
Agentic AI is one of the models running in the background for Qualys. It is responsible for all vulnerability closures and vulnerability testing. All data collected by agents in the field is gathered and pushed into the Agentic AI model, which then processes that information and provides output based on proof of concept mechanisms or the MITRE ATT&CK pattern.
Based on my understanding, I have not found any false positives in Qualys Enterprise TruRisk Management. There are some vulnerabilities that might not be applicable to my environment or that I do not want to address, but there have been no false positives in my environment. In the last three years, I have only seen one vulnerability for which the patch was not released, but that was also a true positive. The only issue was that the OEM did not release the patch for that particular vulnerability.
My final score for Qualys Enterprise TruRisk Management is eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Roshan Ugale
Comprehensive risk scanning has protected servers and improves monthly vulnerability remediation
Reviewed on Jan 13, 2026
Review provided by PeerSpot
What is our primary use case?
I mostly work on Qualys Enterprise TruRisk Management. I work in an organization where I use cybersecurity to address cyber threats and system vulnerabilities. We focus on keeping the systems away from attackers, ensuring the system stays up to date and healthy, and increasing the performance of the system. For that purpose, we use Qualys Enterprise TruRisk Management.
Qualys has multiple products, and the particular product we use is Qualys Enterprise TruRisk Management. As per your need, if you want to use Qualys Enterprise TruRisk Management for the assessment of vulnerabilities and only scanning, we use Qualys software for scanning the systems, taking out the report, taking out the remedies, and taking out the severity and compliances for these things. If someone wants to understand what purpose exactly they want to use Qualys Enterprise TruRisk Management for, it would be better to evaluate their needs. There are seven to eight other similar tools to Qualys Enterprise TruRisk Management, such as cybersecurity asset management, TruRisk management, vulnerability management, detection, and response. If they want to only take out the report for vulnerability management, detection, and response, that tool will be better. If they want compliance reports, remedies reports, severity reports, and everything that will impact their infrastructure, then Qualys Enterprise TruRisk Management will be better. Additionally, we can push the patch from Qualys Enterprise TruRisk Management to a particular system or server. If someone wants all things handled only by Qualys Enterprise TruRisk Management, they can go with the advanced version.
What is most valuable?
Qualys Enterprise TruRisk Management is quite good for analyzing and scanning the systems individually. It not only scans the system but also shows the hardware vulnerability as well. If there is any low hardware, for example, if there is one application running on DDR3 RAM, and the same application running on DDR4 RAM, it will show that this application will perform better on DDR4. It will be good or best to change your hardware. These kinds of things Qualys Enterprise TruRisk Management shows to us. For our infrastructure, it helps us understand how we can run our infrastructure smoothly without preventing any downtime. It also shows the remedies, such as how we can close those vulnerabilities, bugs, and loopholes if we find in our systems and infrastructure on our servers. It scans each and everything deeply. For example, if you just created a text file and you keep that file for one year, it will show you that file name, file path, and it will reflect as a vulnerability. It shows why this file was just left in your system for the last one year. Qualys Enterprise TruRisk Management is a very good software application to scan each and every vulnerability. Through that, it prevents the attackers from exploiting the systems, servers, or our data. It prevents data leaks in short.
What needs improvement?
Qualys Enterprise TruRisk Management has a few things that need to be enhanced. First, there is the issue of superseded patches. Superseded means if we miss the current month patch, for example, if we miss the January patch to deploy on a particular server, Microsoft includes January changes in the second month security patch, and then the second month security patch includes all things in March. For example, if we miss two month patches and we directly deploy the March month security patch on a system, the other two patches, such as January and February, will be closed. Superseded means these patches are not deployed on a system, but after the latest one, which we already deployed, the older one does not need to be installed or deployed on a system. Qualys Enterprise TruRisk Management takes a report of each and every vulnerability and shows that the January month patch was not deployed on a system and the February month patch was not deployed on a system. However, that is not a proper scanning method. If we have already deployed the latest patch that includes the older security things or older security parameters and the latest parameters, when we deploy that latest patch, why does Qualys Enterprise TruRisk Management show the older patches also in potential vulnerabilities? That is a main factor that should be improved from Qualys Enterprise TruRisk Management.
Second, the remedies provided by Qualys Enterprise TruRisk Management are sometimes not useful most of the time. In that case, we need to troubleshoot or find out the remedies by ourselves. The remedies will also be something that needs to be improved in the system or in the application.
What do I think about the stability of the solution?
We did not analyze or monitor any issues in our stability, performance, or crashes.
What do I think about the scalability of the solution?
Qualys Enterprise TruRisk Management is scalable and flexible. It has multiple things for a particular need. For example, if we only want scanning, Qualys Enterprise TruRisk Management will provide that. Qualys Enterprise TruRisk Management has multiple products according to the infrastructure or the industrial demand. Whatever we choose as per our choice, we can choose, and in that application, such as Qualys Enterprise TruRisk Management that we use, we can add different plugins as well. It is flexible and scalable, and we can use it and modify it as per our needs.
How are customer service and support?
We have already done technical support for Qualys Enterprise TruRisk Management so many times. Since we use it daily, I know much more than the Qualys Enterprise TruRisk Management technical supporter sometimes in some things. I would give out of ten around seven out of ten.
Which other solutions did I evaluate?
As a product and solution, Qualys Enterprise TruRisk Management is one of the best I have ever seen. Another solution I would mention is BigFix. BigFix is quite popular, and I would place that one in the first position and Qualys Enterprise TruRisk Management in the second position. Regarding the rating, Qualys Enterprise TruRisk Management is also better, but most of the features and things are more in BigFix. According to me, I would give eight out of ten for Qualys Enterprise TruRisk Management for all its features.
What other advice do I have?
Qualys Enterprise TruRisk Management shows material impacts on security. For example, if we scan a UPI server from Qualys Enterprise TruRisk Management agent, it will show that if we are not going to update that UPI server, that UPI hardware, or that application, going forward, it will be risky to us. Anyone, even a small hacker, can exploit your server, lose your data, collect your data, and misuse it in a black market. Every parameter, small to small and high to high, each and every parameter Qualys Enterprise TruRisk Management identifies and shows in an alert way, functioning as a monitoring tool also. It shows the severity. If we are not going to close this vulnerability, then what will happen. Severity is there also. There are severity five, four, three, two, and one. If the severity is five, it is most critical, and that vulnerability needs to be closed as soon as possible.
In the current place where I work, they have their own infrastructure with multiple servers. We usually get a monthly report of vulnerabilities. The vulnerability count around monthly is approximately twenty thousand, thirty thousand, or more every month. We get a report from the Qualys Enterprise TruRisk Management department showing what the vulnerabilities are. We need to find out the most potential vulnerability. Qualys Enterprise TruRisk Management shows that the most important things are operating system related criticality, application related, and third-party application related vulnerabilities. It aggregates the most potential criticality in a severity. Severity means how critical this vulnerability is. There are numbers from one to five, with five being the most critical vulnerability. When we get a report, there is a column as a criticality tier. We usually filter it out with tier five, so all the vulnerabilities that are the most potential come up. For example, if I filter out with the five-tier, it usually shows around the most potential vulnerability count of one thousand or two thousand. This is not only for one server. We manage around eight hundred to nine hundred servers. We get a report every month for all servers' vulnerabilities, and it is approximately thirty thousand plus. It shows each and every potential critical vulnerability. We found two or three for each server. If we want to patch or deploy that vulnerability on each server, we need to take downtime. We have limitations to patch the servers each day. For example, in one day, we can patch fifty servers. If we want to patch five hundred servers, within ten days, we close that potential vulnerability by taking downtime as per the scheduled time. Mostly we take downtime at night for the deployment and patching those vulnerabilities.
Once we complete our side patching, as per the Patch Tuesday schedule when Microsoft releases their patches and security patches every second Tuesday, we do patches and close the vulnerability with the remedies Qualys Enterprise TruRisk Management shows you. After patching, we take a report and share with the security team that we have closed this vulnerability and kindly scan the servers for rescanning. After patching, we take a reboot, and then after reboot, we rescan the system. We ensure everything is as per the expectation or not, and we verify if the vulnerability is closed or not. We rescan all the systems, and after rescan, it shows the previous vulnerabilities are closed in our scanned system.
Confidence comes when we do practical validation. If due to some vulnerabilities or some bugs or some loopholes, attackers attack the servers and successfully collect the data, we do the root cause analysis to understand why the server got compromised or data got compromised. In that case, we learn that the particular server has not been patched since the last one month, two months, or three months. Due to that, till now, this kind of attack has not happened in our infrastructure because we make sure that every month patches should be deployed on that particular server within one month, thirty days. It prevents the situation in which if Microsoft releases one security patch with some enhancement in security, we deploy that. It is not that a particular patch has total one hundred percent security enhancement. Every patch has a loophole and security enhancement both things. If we patch the system and after then, attackers will try to find out the loophole in that particular patch. But once they find the loophole, before that, the second patch will be released by Microsoft, and the second patch will be deployed on that particular server by the patching team. This is how all things work. The attacker will not get enough time. That is why monthly patching is most necessary. We call it patching or vulnerability management.
Monitoring tools such as Zabbix provide real-time or active monitoring. Zabbix alerts provide alerts in different colors and criticality. For example, if there is one system that uses one hundred percent CPU utilization or memory usage, or disk space issue, these kinds of real environment monitoring will show. If you search some websites on Google, sometimes that website takes a long time to be visible on your device. That happens due to latency, and latency happens due to high memory utilization or RAM utilization. It is the time travel between the sender and receiver. When you send the request to the server, the server will give a response to you. The latency depends on read and write data. Zabbix is used for that. It enhances user experience, prevents downtime, and provides latest alerts. It monitors each and everything.
My overall review rating for Qualys Enterprise TruRisk Management is eight out of ten.
LuisPerez11
Centralized monitoring has strengthened vulnerability control and automated preventive security
Reviewed on Jan 11, 2026
Review provided by PeerSpot
What is our primary use case?
When a company needs to review and focus on all the vulnerabilities for their endpoints from actualizations or patches and all the programs they have installed, they need actualizations or to have this function available regarding the main use cases for Qualys Enterprise TruRisk Management.
What is most valuable?
The best features of Qualys Enterprise TruRisk Management are the capability to search and mitigate vulnerabilities from attackers in endpoints and focus on the preventive view of organizational security through virtual patching, making this function automatic for cybersecurity teams.
Qualys is a very good tool for companies, and the different tools this brand offers bring all the necessary tools for good development for these companies. Once it is set up, it works well.
Qualys has a new tool called Total AI, which requires review of the use and correct use of AI in companies and review and protection of the information that collaborators use in AI.
What needs improvement?
When a customer does not have control over vulnerabilities or architecture and needs a solution that automates this function for the company, it can be difficult to identify the vulnerabilities.
Because the case study is of the business model, I think identifying different vulnerabilities is not easy as companies need to be prepared to make decisions in time regarding what affects the business.
I focus on areas that could be improved with Qualys Enterprise TruRisk Management.
For how long have I used the solution?
I have experience with Qualys for about one year.
What do I think about the stability of the solution?
This tool has good and excellent performance in the companies that we sell to in the last months for customers, so stability is evident.
What do I think about the scalability of the solution?
Qualys Enterprise TruRisk Management is a scalable solution.
How are customer service and support?
In the brand I work for, we have a very good team of many engineers who are prepared and certified with the levels of support for these tools from this brand, which helps me evaluate the customer service from Qualys or their technical support.
The level of support is a nine out of ten.
They provide very good support.
Which solution did I use previously and why did I switch?
We used Tenable before switching to Qualys for this type of threat management.
Which other solutions did I evaluate?
The main differences between Tenable and Qualys is the model that brands use to consume the product; the licensing or size is different between Tenable and Qualys.
What other advice do I have?
I speak a little English.
I have experience with Check Point solutions and Microsoft solutions.
I have a little experience with the product portfolio of Check Point, as I have worked with this brand in a product manager commercial profile.
I sold a project two years ago about Check Point Harmony SASE or SASE product.
In the last twelve months with Check Point, I have experience with the firewalls and Harmony Email, but not with SASE.
With the Maestro lines, I have experience, but not with Quantum Force, as I have worked with Maestro and Harmony Email.
With CrowdStrike, I have a little experience, something about five months.
I have worked with Qualys Enterprise TruRisk Management and VMDR.
In the cybersecurity view, I understand what is being said.
I cannot understand the TrueConfirm capability or tool.
I am not familiar with the term TrueConfirm for threat enrichment capability.
Qualys is a reliable tool.
It is beneficial so far because the market today needs to protect all these factors that use AI for taking confidential information from the company.
My profile is more commercial, but I know about the deployment of these tools being easy for companies to be prepared for this; however, a good assessment is necessary to review the architecture of the customer for a good chronogram and good time for the development of these tools.
For this tool, we do not need cloud deployment because it requires some server and deployment from the endpoints of the company, so I do not have this technical knowledge.
Qualys has a good price for the benefits of the development of this tool.
My overall rating for this review is nine out of ten.