Sold by: Qualys
Deployed on AWS
Free Trial
AWS Free Tier
Qualys TotalCloud: Making your cloud secure by providing the only solution that assesses, communicates and eliminates an organization's security risk.
4.4
Overview
TotalCloud is a Cloud Native Application Protection Platform (CNAPP) built to detect, prioritize, and mitigate risks within multi-cloud and hybrid-cloud environments. As the most thorough cloud security solution, TotalCloud identifies, ranks, and facilitates the remediation of risks from key vulnerabilities, misconfigurations, and threats that other tools might miss, including potential attack paths and lateral movements targeting critical cloud resources. By integrating a wide range of solutions, including CSPM, KSPM, CWPP, CIEM, CDR, Workflow Automation and Remediation, TotalCloud provides a seamless cloud security management experience, without the complexity of managing multiple tools. For more details: https://www.qualys.com/apps/totalcloud/
*Qualys provides custom pricing for customers via Private Offer. Please contact https://www.qualys.com/forms/request-a-call/ for a better understanding of our pricing model and products.
Highlights
- 6 Sigma Accurate Vulnerability Prioritization:Combines threat feeds from over 25 sources to create a unified vulnerability score. This score dynamically adjusts risk priorities based on patch availability, vulnerability criticality, and organizational context.
- Integrated no-code/low-code remediation: Enable custom remediation workflows out of the box with Qualys QFlow Cloud Workflow Automation, allowing drag and drop of no-code/low-code workflows.
- FlexScan : Allows security teams to combine agent and agentless scanning for workload protection across ephemeral and long-lived environments, including hosts, VMs, Containers, Kubernetes, and Serverless setups.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free according to the free trial terms set by the vendor.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Total Cloud package 16 | Package of 16 Hosts for Total Cloud | $5,400.00 |
Dimensions summary
This listing offers one contract package covering 16 hosts of Qualys TotalCloud. Pricing works as a fixed bundle, priced per unit, where each unit represents one package of 16 hosts. To cover more hosts, you buy additional packages, so cost scales in blocks of 16 rather than one host at a time. TotalCloud is a cloud security platform that discovers assets, manages posture and compliance, and prioritizes risk across cloud and container environments. This package gives you access to those capabilities for the host count you commit to under the contract term.
Top-of-mind questions for buyers
A host is a workload the platform discovers and protects across cloud and container environments. This includes virtual machines and compute instances. Each virtual machine counts as one host, even when several share a physical machine. Container hosts are also counted. One package covers 16 such hosts.
Coverage scales in blocks of 16. To protect more hosts, you buy additional packages, each adding another 16 hosts of coverage. Cost rises in fixed increments rather than one host at a time. Plan your purchase around the total host count you expect during the contract term.
The package gives access to TotalCloud capabilities for your covered hosts. This includes asset discovery, cloud security posture and compliance management, container security, risk-based prioritization, and automated remediation workflows. These capabilities apply across cloud and container environments. Coverage is limited to the number of hosts you purchase.
www.qualys.com
Helpful?
Vendor refund policy
Licensed Qualys customers should refer to their Service User Agreement (SUA) or contact their Qualys Technical Account Manager if they have questions about refund or cancellation policies which would apply to them
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Qualys' policy is to respond to all Qualys customer cases promptly as per SLA. An incident ticket is assigned a priority number based on the nature of the issue. || Service Level Agreement (SLA): https://www.qualys.com/support/sla/ https://www.qualys.com/support/ || support@qualys.com || US/Canada: +1 (866) 801-6161 (toll free) or +1 (650) 801-6161 || UK/Europe/International: +44 (0)1753 872102 || France: +33 1 41 97 35 81
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
The Qualys Cloud Agent provides continuous security assessment and compliance monitoring
Qualys VMDR (Vulnerability Management, Detection, and Response) allows you to discover, assess, prioritize in real time across your global hybrid IT environment.
The Qualys Cloud Agent provides continuous security assessment and compliance monitoring
The Qualys Cloud Agent provides continuous security assessment and compliance monitoring
Customer reviews
Purvesh Kothari
Agent-based cloud security has transformed vulnerability visibility and prioritization
Reviewed on Nov 10, 2026
Review from a verified AWS customer
What is our primary use case?
We use Qualys TotalCloud across multiple products in our company environment, including our AWS environment, container environment, EC2 instances, and containerized workloads in Kubernetes. We have installed Qualys TotalCloud Agent for all of these. We perform only agent-based scanning, not scanner-based or agentless scanning. Agent-based scanning is very useful for us to get instant live vulnerabilities for our cloud environment.
We do not use any detection of malware, crypto mining, or suspicious communications.
How has it helped my organization?
Qualys TotalCloud has helped us identify vulnerabilities in our runtime environment, including normal OS vulnerabilities, application vulnerabilities, and kernel updates.
Qualys TotalCloud has significantly improved our visibility and control across Kubernetes because we were lagging in that area compared to our normal endpoints or VMs. Our teams were not able to go deep and perform vulnerability remediation of Kubernetes; they were only re-imaging their images and VMs but not Kubernetes.
We provided teams with reports from Qualys TotalCloud, and they can now remediate everything including container images, workloads, Kubernetes, and the entire OS landscape.
What is most valuable?
TruRisk and QDS score are very good and represent the best part about Qualys TotalCloud. We get asset and vulnerability scores combined with exploitable things, EPSS score, and CVSS score.
This scoring system eliminates the need for us to do any manual effort because the scores help us prioritize our remediation vulnerability strategy. Teams can prioritize scores from 900 to 1,000 first and then work through critical exploitation items automatically. It provides a single source of truth number.
What needs improvement?
Qualys TotalCloud has some features where reports have limitations for downloading. In Qualys VMDR, we can download reports with multiple options, but in Qualys TotalCloud, we have to use tags and only some IP addresses reports are available. The reporting strategy is a limitation.
When I compared Qualys TotalCloud with Upwind, I noticed that the visualization could be better. Attack pattern analysis is helpful, but the visualization capabilities could be improved.
For how long have I used the solution?
I have been working with Qualys TotalCloud for two years.
What do I think about the stability of the solution?
No maintenance is required for Qualys TotalCloud. The agent is reliable and there are no loopholes or crashes with the agent data. I have not seen any lagging or crashing with Qualys TotalCloud.
What do I think about the scalability of the solution?
Qualys TotalCloud appears scalable for our environment. Our environment is short in scale, so I cannot really speak to full scalability, but given our current environment, Qualys TotalCloud performs well.
How are customer service and support?
I have contacted technical support or customer support once or twice, primarily when an agent was installed from their end but we were unable to verify it on our end. The quality and speed of the support was quite good.
Within one to two days they requested data, and once they gathered the data, we requested a call with them. Within three to four days they set up a call with my team and the Qualys team. On a scale from 1 to 10, I would give their support a score of 9.
How was the initial setup?
The initial deployment and installation of Qualys TotalCloud is easy. Installation is straightforward. Once we share the YAML file or use one of two or three installation methods with commands, it is only one to two days' work for the team responsible for getting agents into their environment.
Which other solutions did I evaluate?
I have used Upwind as an alternative. Both solutions have different use cases. I have been using Upwind for only three months because we are on a trial.
Upwind has introduced new features such as continuous workflow visualization showing how attacks are performed. For any vulnerability such as recent PHP attacks, they show how attackers targeted it and the visualization is better in Upwind than Qualys TotalCloud.
What other advice do I have?
I have 10 years of experience in my current field overall. I have not seen any problems with risky configurations or excessive access in Qualys TotalCloud. Overall, I would give Qualys TotalCloud a score of 9 out of 10.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
reviewer2920917
Cloud security study has expanded my knowledge and clarifies complex vulnerabilities
Reviewed on Nov 01, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for Qualys TotalCloud is to expand my imagination, professionalism, and knowledge. One specific example of how I have used it is that some of the things I have seen in studying have been things I have not seen in my life, and I learn about very specific topics that I did not even know existed.
How has it helped my organization?
Qualys TotalCloud positively impacts my own work because I really expand my knowledge.
It expands my knowledge by helping me understand new security concepts and tools I had not seen before, and it clarifies things I was struggling with, so now I have a much clearer understanding.
The TruRisk insights feature affects my security posture a lot because I was not aware that these tools were readily available, and now that I know we can work with them, it has been a very good experience.
What is most valuable?
In my opinion, the best features Qualys TotalCloud offers are the large and extensive knowledge base, making it a very good experience for studying and working on it.
The vulnerability scanning is a particular feature within Qualys TotalCloud that I have found especially helpful and interesting while studying, as it is one of my favorite topics, and I learn a lot from it.
Regarding Qualys TotalCloud's AI capabilities, I think its governance and security are adequate. I feel the governance and security are adequate because right now in the industry, we already have new tools and the right tools to react to the vulnerabilities we are experiencing today.
I think that Qualys TotalCloud has great accuracy and reliability, as it is a very complete program with tools that help experts understand the vulnerabilities of today.
Qualys TotalCloud does provide unified vulnerability and threat assessment across both IaaS and SaaS, and this unified view affects my overall cloud security posture management because you can see it in almost every example provided.
Regarding TruRisk insights, the actions I can take based on the information about assets with high vulnerability scores involve the vulnerability management actions, which I think are the ones that involve all the others.
What needs improvement?
I think Qualys TotalCloud is a very extensive study and a very complete matter, so I see no need for improvements.
For how long have I used the solution?
I have been using Qualys TotalCloud when I take the courses and for some personal projects and for some projects of the work that I was looking forward to working on with some clients.
This adds up to only a few months, as I have been studying it more than practicing in the job because I have not practiced that job until now and have only been studying.
What other advice do I have?
My advice to others looking into using Qualys TotalCloud is that it is a very good experience.
On a scale of 1 to 10, I would rate Qualys TotalCloud a nine. I chose nine out of 10 because, for starters, I do not believe in perfection. I always say nine or four, but it is a very complete study and I learn a lot, including some concepts I have not seen before.
reviewer2910915
Cloud monitoring has improved as it finds misconfigurations in my public cloud setup
Reviewed on Oct 15, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for Qualys TotalCloud is to find misconfiguration in the cloud, and I am focused on identifying misconfiguration in cloud configuration.
For how long have I used the solution?
I have just started to use Qualys TotalCloud, and I connected with Amazon Cloud and attempted to find different resources in Amazon.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
reviewer2910954
Visibility into cloud risk has improved and now supports ongoing telemetry monitoring
Reviewed on Oct 14, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for Qualys TotalCloud is telemetry, although I am unsure about the specifics.
A quick specific example of how I use Qualys TotalCloud for telemetry is to look at risk.
I do not have anything else to add about how I use Qualys TotalCloud for telemetry or risk assessment at this time.
What is most valuable?
In my opinion, the best feature Qualys TotalCloud offers is the solution itself.
I would not like to add anything else about the features at this time.
Qualys TotalCloud has positively impacted my organization by providing visibility into the environment.
I cannot tell you more about how this visibility has benefited my team or organization, as I have not noticed any specific outcomes or improvements.
What needs improvement?
I am unsure about how Qualys TotalCloud can be improved.
I do not have anything else to add about the needed improvements, even if it is something small.
For how long have I used the solution?
I have been using Qualys TotalCloud for a year.
What other advice do I have?
I rate Qualys TotalCloud a 10 on a scale of 1 to 10. I choose this rating because it is an overall great solution.
Jaswanth Kotla
Centralized cloud monitoring has improved our security posture and supports timely remediation
Reviewed on Oct 14, 2026
Review from a verified AWS customer
What is our primary use case?
We are cloud providers and cloud partners that provide services to customers, so we monitor cloud assets, vulnerabilities, and security misconfigurations of instances using Qualys TotalCloud. We also host multiple websites and monitor website vulnerabilities.
We use Qualys TotalCloud on a weekly basis to generate reports and check for misconfigurations or vulnerabilities.
We also use Qualys TotalCloud for website vulnerabilities such as cross-site scripting and SQL injection, as well as TLS version inspection to determine if old versions are supported, and for SSL security and SSL scans.
For more accurate information, we are using the agent among Qualys TotalCloud's flexible scanning options.
How has it helped my organization?
We have achieved timely patching of vulnerabilities with Qualys TotalCloud and are increasing our security scorecard, which is beneficial for customers to monitor. Our scorecard is above 90.
Previously, our security scorecard was around 75, and after using Qualys TotalCloud, we are maintaining it at 90, which represents an increase of about 17 points and varies between 92 and 93 sometimes.
Qualys TotalCloud provides unified vulnerability and threat assessment across both IaaS and SaaS, and this unified view has positively affected our overall cloud security posture management, as previously our security scorecard was 75 and has been increased to around 90 to 93 after vulnerability remediation and applying all patches.
Qualys TotalCloud has helped my team identify hidden exposures related to cloud, runtime, data, identity, SaaS, application, or Shadow AI before they become exploitable risks through our weekly reports from Qualys and timely patching, along with scheduling patch updates.
What is most valuable?
The best feature Qualys TotalCloud offers is its multi-cloud visibility, allowing us to view all three clouds at a time in a single console.
Multi-cloud visibility saves time and makes things easier, as we can also have comparability to see what configuration differences have been made from cloud to cloud.
Some features such as remediation for vulnerabilities and recommendations stand out regarding Qualys TotalCloud.
Qualys TotalCloud's AI capabilities are good in terms of governance and security, as it is following governance requirements.
For assets with high vulnerability scores such as older OS versions or older application versions such as Apache or Tomcat, we patch them step-by-step based on TrueRisk information, planning the steps one by one and taking a backup of everything.
TrueRisk is helpful for prioritizing vulnerabilities based on risk instead of raw CVEs, allowing us to remediate high-risk issues first by comparing the risk, making it very helpful.
FlexScan provides comprehensive visibility across our on-premises, multi-cloud, and container environments, ensuring there are no gaps.
What needs improvement?
Qualys TotalCloud can be improved in terms of initial configuration, as it would be somewhat complex.
It should increase the risk prioritization accuracy in AI regarding Qualys TotalCloud's AI capabilities, especially in terms of accuracy and reliability of output.
In my opinion, the combination of detection and protection features in Qualys TotalCloud cannot protect but can only detect.
For how long have I used the solution?
We have been using Qualys TotalCloud for four years.
What do I think about the stability of the solution?
Qualys TotalCloud is stable.
What do I think about the scalability of the solution?
Qualys TotalCloud is scalable and can support cloud environments across multiple platforms, but performance and ease of reporting on cost and optimization could be improved as the number of cloud assets and workloads increases.
How are customer service and support?
Customer support for Qualys TotalCloud is good.
I would rate the customer support an eight out of ten.
What was our ROI?
We have seen a return on investment in terms of our security posture, which has been increased, alongside a good reputation with customers.
What's my experience with pricing, setup cost, and licensing?
We purchased Qualys TotalCloud for GCP and Azure as well.
It is comparatively better than others regarding pricing.
The pricing is reasonable for Qualys TotalCloud without facing any challenges.
Which other solutions did I evaluate?
Before choosing Qualys TotalCloud, we evaluated options such as Microsoft Security, Palo Alto Prisma Cloud, and Check Point CloudGuard.
What other advice do I have?
I would rate Qualys TotalCloud a nine out of ten. I chose nine because it has better features, better visibility, a better console, and centralized monitoring, along with all the multi-cloud visibility capabilities, and the vulnerabilities shown are accurate with accurate recommendations. Qualys TotalCloud is deployed as a SaaS-based product in our organization.