Qualys TotalCloud provides container security, vulnerability management, posture management, and more.
Qualys TotalCloud
QualysExternal reviews
24 reviews
from
External reviews are not included in the AWS star rating for the product.
Contextual risk insights have reduced my workload and provided clearer remediation paths
What is our primary use case?
What is most valuable?
Qualys TotalCloud saves about a third of resources. Qualys TotalCloud provides written explanations to guide remediation paths and eliminate cyber risk, and I appreciate the written explanation and the visualization of attack paths.
Qualys TotalCloud provides unified vulnerability and threat assessment for IaaS and SaaS. Qualys TotalCloud provides a single prioritized view of risk, which helps reduce my workload by not having to combine multiple sources.
What needs improvement?
In my opinion, what can be improved in Qualys TotalCloud includes pricing and container scanning.
For how long have I used the solution?
I started working with Qualys TotalCloud approximately one year ago.
What do I think about the stability of the solution?
I assess Qualys TotalCloud as stable, and I would rate it an 8, with 10 being the best.
What do I think about the scalability of the solution?
I would rate Qualys TotalCloud a 7 for scalability on a scale from 1 to 10.
How are customer service and support?
I would rate the technical support for Qualys TotalCloud about a 7 on a scale from 1 to 10.
How would you rate customer service and support?
Positive
How was the initial setup?
It is easy to deploy Qualys TotalCloud.
What's my experience with pricing, setup cost, and licensing?
Qualys TotalCloud is on the pricier side, and I would rate the pricing around an 8 on a scale from 1 to 10.
Which other solutions did I evaluate?
I compare Qualys TotalCloud with other solutions and other vendors as a good contender, though I acknowledge there are differences. In comparison with other vendors, including Microsoft, Qualys TotalCloud holds its own but presents distinct features.
What other advice do I have?
I do use the TruRisk Insight feature with Qualys TotalCloud. I assess the comprehensiveness and the range of risks found with TruRisk Insights as adequate.
The TruRisk Insights feature has found a small number of assets with high vulnerability scores. The effect of TruRisk Insights on security posture is significant, as it provides better awareness and focus on critical risks.
I would recommend this product to other users, and my advice would include doing a proof of concept to see if it fits their needs. I would rate this product an 8 overall.
Cloud security posture has improved and compliance decisions are now driven by risk insights
What is our primary use case?
I use Qualys TotalCloud for cloud security posture management across AWS and Google Cloud. I use this tool for compliance and other purposes. I scan AWS and Azure for S3 buckets, security groups, unencrypted databases, and generally for IAM roles. It helps in terms of securing the data. I also use CIS benchmarks as a standard for hardening cloud posture management. Qualys TotalCloud helps to ensure I am enforcing the CIS benchmarks automatically.
For the TrueRisk insights, it provides context-aware prioritization of findings, asset criticality, risk trends, and real-time exposures of risk parameters. It ensures I can make informed decisions with higher management.
FlexScan helps me run targeted, on-demand cloud security checks instead of waiting for full scheduled scans. It allows for immediate results on risky configurations or vulnerabilities after major configuration changes. I use it to validate checks post-scan.
TrueRisk Eliminates helps in lowering risks from the organization's context by comparing with global standards. Though not used extensively, it aids in reducing exposure ratings or ensuring compliance.
What is most valuable?
One of the valuable features of Qualys TotalCloud is its recurring scanning patterns, which detect misconfigurations, risky configurations, and weak IAM policies. The tool automates the maintenance of CIS benchmarks at scale, which is very useful. Qualys TotalCloud serves as a single-point tool integrating various modules such as VM and policy compliance and security, providing a holistic view of my security posture.
Qualys TotalCloud provides threat intelligence feeds or threat integration, enabling me to mix data with other modules to identify recurring vulnerabilities or threats I face in my organization.
What needs improvement?
From a downside perspective, the UI is not user-friendly and feels dated compared to other tools like Prisma Cloud. The navigation is difficult in terms of understanding risk relationships. Attack path analysis is another area needing improvement. It struggles to predict how attackers may move through phases. Automating remediation could also be improved, as many tasks remain manual. The lack of data load speed sometimes leads to system lags. Customizing reports based on business standards is cumbersome. Pricing is high compared to competitors.
Installation could be simplified with fewer integration issues. Documentation focused on detailed user cases with if and else scenarios would be beneficial.
For how long have I used the solution?
I have been using Qualys TotalCloud for the past four years with different organizations. I have been with two organizations in the past four years and have been using it at both.
What do I think about the stability of the solution?
It happens not very often, but sometimes it does occur. In terms of stability, I could say Qualys TotalCloud operates at 95% of the time, and the rest 5% depends on how I manage it.
What do I think about the scalability of the solution?
From a scalability standpoint, I could say it is 90% scalable. The remaining 10% presents a challenge that Qualys could address.
How are customer service and support?
From a technical support perspective, those individuals are competent enough to provide information regarding the product. They offer level one support initially, escalating as needed. I rate them four out of five because they respond quickly if issues are marked as high priority. I would give them 8.5.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I used Prisma Cloud previously. Prisma Cloud has better navigation and UI compared to Qualys TotalCloud. However, I have taken a whole package of Qualys and tend to use it.
How was the initial setup?
In terms of installation, it could be simplified compared to other tools due to its packaging and tooling. A lack of specific help articles and integration issues are present. From a security standpoint, it is good but requires time.
What about the implementation team?
For one of the organizations, I partnered with Qualys as a team since I have large projects. They assisted with a global rollout.
What's my experience with pricing, setup cost, and licensing?
Pricing compared to competitor tools is high. My costs depend on asset subscriptions. Pricing remains constant regardless of asset utilization, whereas other tools employ a credit system.
Which other solutions did I evaluate?
Prisma Cloud and similar tools have slight variations in flow but follow the same frameworks. Prisma Cloud offers user-friendly navigation that is better than Qualys TotalCloud.
What other advice do I have?
From a technical support perspective, those individuals are competent enough to provide information regarding the product feel. They provide level one support first to understand better. If they cannot resolve the issue, they can escalate it to the next level and come on a call. However, it does not make sense for them to escalate if it is a medium or low priority issue; they address those according to their SLAs. From another perspective, there could be some downsides. In my opinion, this is the best tool. My overall review rating for Qualys TotalCloud is 8.
Cloud security posture has improved and CI/CD pipeline now prevents misconfigurations early
What is our primary use case?
My use case is for cloud security posture management and for getting alerts as we have onboarded most of our accounts in Qualys. Qualys provides the cloud and identifies misconfigurations in our cloud security module, providing us alerts, and we have integrated many tools into that solution. This helps us maintain our cloud security.
Qualys TotalCloud helps with my cloud security posture management by identifying vulnerabilities at a better early stage because we have deployed it into a CI/CD pipeline. This helps us detect vulnerabilities at the development level only. Before moving into production, it helps us detect the vulnerabilities, close them, remediate them, and then move the code into production. We have integrated that into our CI/CD pipeline.
What is most valuable?
The best features of Qualys TotalCloud include good threat intelligence and segregation of cloud accounts. Since we have multiple cloud accounts, it provides a segregation overview of all of our cloud accounts. It also has workload protection which identifies vulnerabilities in the Kubernetes environment and in our Docker images.
Qualys TotalCloud provides written explanations to help guide remediation paths and eliminate cyber risks with recommendations. Whenever any alerts or vulnerabilities have been detected by the solution, it provides the resource name, the asset name, and the solution on how to remediate that with all the steps included.
Qualys TotalCloud provides unified vulnerability and threat assessment for both IaaS and SaaS software.
Qualys TotalCloud provides a single prioritized view of risk through the dashboard, which displays all the risks that are identified in our images, Docker images, Kubernetes environment, and cloud security.
I use the TruRisk Insights feature, which is built into that solution. I assess the comprehensiveness of the risks found by the insights to be good due to its threat intelligence, as it identifies most risks whenever they are detected in the wild. It almost detects all the risks that are well-known in the industry. It has also some capabilities of artificial intelligence but not enough to detect any zero-day vulnerabilities.
What needs improvement?
The areas in the solution that have room for improvement include the UI/UX design, which should be improved, and they should integrate more artificial intelligence into the product.
For how long have I used the solution?
I have been using Qualys TotalCloud for around three years.
What do I think about the stability of the solution?
I would rate stability around eight out of ten.
What do I think about the scalability of the solution?
For scalability, I would rate it nine out of ten.
How are customer service and support?
Qualys TotalCloud requires maintenance, but it is managed by the Qualys team.
I would rate the technical support around eight out of ten.
How would you rate customer service and support?
Positive
How was the initial setup?
The deployment was not easy, but with the help of the support team, we completed it.
It took about a week because we had many accounts we needed to migrate, and we needed to check the policies and define our policies. It took time because everything cannot go in one go, so we did it in a phase-wise manner.
What was our ROI?
It helps us because we have monthly meetings with our leadership team. These graphs help us give the return on investment of the product to the leadership team and also give us an overview of how this product is working, what the thresholds are, and how the configurations are working or not. This helps us determine that.
What other advice do I have?
I would recommend Qualys TotalCloud to other users because it is cost-efficient and has a good return on investment. We can recommend it over other tools available in the market that are more costly.
I find the pricing of Qualys TotalCloud to be cost-efficient as of now. We evaluated three other tools that were more costly than this.
My comparison of Qualys with other vendors is based on the different features we tested. Based on the reports, we implemented the tools into our environment. We conducted proof of concept testing and checked that every tool provides the CSPM feature, the CWP feature, and the IaC feature. Qualys also provides those features. We tested those features with the default policies by running scans. We created some misconfigurations and checked whether they were detected by the tool. We conducted thorough POCs for each solution.
Qualys TotalCloud can be mentioned as a total cloud platform because it has the CWP model and CSPM model.
It has affected my security posture by integrating tools like Jira into that solution, which helps to generate tickets on the development team dashboard and the DevOps team's dashboard. This helps them remediate the findings. We also create weekly reports from the tool, and with the help of the DevOps team, we try to mitigate the risks which helps us manage our security posture.
Currently, there are around fifteen users who are using the solution. I would rate this solution an overall eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Unified cloud security has delivered strong compliance reporting and streamlined audit workflows
What is our primary use case?
I have approximately three to four years of experience working with Qualys TotalCloud.
I have been using Qualys TotalCloud while working with EY, Ernst & Young, where I utilize cloud tools for Qualys, employing two types of tools: one for policy and compliance, for security and compliance audits, and another for security audits such as vulnerability assessments and risk assessments. Based on that tool, it is very easy to go through the inventory and easily deploy the compliance policies as needed while also receiving comprehensive assessment scores.
I use Qualys TotalCloud primarily for compliance and cloud security, and I am also getting certified from Qualys in both compliance auditing and vulnerability management, making me a certified specialist for Qualys.
In Qualys TotalCloud, everything is in a single platform and as a unified CNAP application, it combines CSPM, CWPM, CIEMs, and workload securities with a lightweight agent that covers everything, including cloud resources, configuration, misconfigurations, and shadow assets, allowing us to work around AWS, Azure, and GCP platforms while generating compliance reports and providing end-users with easy access to dashboard audit reports and executive views.
What is most valuable?
To eliminate cyber risk, I think the best method in Qualys TotalCloud is correlating vulnerability exposure and configuration with identity instead of just CVs, making it the perfect option for use within Qualys TotalCloud. If someone were to ask me to review Qualys TotalCloud, I would summarize it as an end-to-end solution for cloud security with visibility and governance-grade controls without needing to manage multiple disconnected tools. In comparison to other tools such as Prisma, Wiz, and Defender, Qualys TotalCloud helps unify vulnerability and threat assessment in IaaS and SaaS environments because it has an intuitive web interface that is simple enough for anyone to learn with just a few hours of preliminary training, allowing users to easily deploy initial assets and policy configurations as needed while generating customized reports.
I have compared Qualys TotalCloud with other vendors such as Prisma, Wiz, and Defender, noting that despite some limitations in those other tools, Qualys TotalCloud performs exceptionally well across various compliance requirements, offering a simple interface for customizing reports while meeting auditors' needs with regulatory benchmarks, including CIS, NIST, ISO, and PCI.
Qualys TotalCloud provides a single unified dashboard for all types of reports, executive views, and dashboards, allowing you to easily access key summaries and recommendations.
What needs improvement?
I think Qualys TotalCloud needs to improve its handling of zero-day vulnerabilities and supply chain management because modern ransomware attacks not only target prime critical infrastructures but also the supply chain system. If Qualys TotalCloud can solely assess risks based on initially added assets, there may be vulnerabilities within supporting firms that go undetected.
What do I think about the stability of the solution?
For stability, I would rate Qualys TotalCloud a nine out of ten. While there may be occasional disruptions due to internet connectivity issues, the application supports both offline and online functionality, maintaining operability even under hybrid working conditions.
What do I think about the scalability of the solution?
Qualys TotalCloud is highly scalable, rated at ten out of ten, facilitating easy scale-up or scale-down based on audit and compliance needs.
How are customer service and support?
I rate the technical support from Qualys TotalCloud a perfect ten out of ten because whenever we log incidents, all service level agreements are met within half an hour, with prompt provision of root cause analyses by the support teams.
How would you rate customer service and support?
Positive
What other advice do I have?
I have limited feedback on how Qualys TotalCloud helps my cloud security posture management, but it works well with misconfiguration detections and provides deep mapping with CIS, NIST, ISO frameworks, PCI compliance, and regulatory benchmarks.
In terms of pricing, compared with the top market leaders in Gartner's reports, I find Qualys TotalCloud to have a reasonable standard rate, which is not too hard to access. They have also introduced use case basis rates that allow auditors to purchase specific instances of the cloud service, leading to a flexible pay-per-usage model.
Overall, deploying Qualys TotalCloud across all cloud platforms is very easy.
We handle clients of all sizes, including direct work with government entities, and are currently deployed in various states within government and public sectors.
Vendor maintenance, such as patches for Qualys TotalCloud, is conducted promptly. I observe that if a zero-day vulnerability emerges, the vendor deploys patches as per market recommendations without significant delays.
While we do not work directly with Qualys in our organization, I utilize it during audit activities at client premises alongside various other tools such as Metasploit, Rapid7, and others that I prefer not to disclose. We can deploy Qualys TotalCloud where needed, particularly for presentation layers, while other tools handle deeper network layer security requirements.
I recommend Qualys TotalCloud, having written various articles on it. I suggest potential users align their use cases with its capabilities before deciding, as a proof of concept could be beneficial.
I have given this review an overall rating of eight out of ten.
Automated vulnerability detection has improved risk visibility but container security still needs work
What is our primary use case?
We have experience with Veracode and other SCA solutions, but I'm not interested in participating in any campaign. Other than Snyk, we use Qualys for Vulnerability Management, specifically the VMDR solution. TrueRisk Management is not what we use; it's an extension to VMDR, but what we actually use is the main module of Qualys, which is Vulnerability Management, Detection, and Response.
We are not using TrueRisk at all because we have our own framework and we use Qualys Detection Score for everything. We do use Qualys TotalCloud for continuous monitoring. The main use case with Qualys TotalCloud is that VMDR provides a direct solution for on-prem systems and it offers a similar solution for cloud infrastructure including AWS, Azure, and GCP, along with an option to scan containers and other related resources.
The features I value about using Qualys include container scanning; they did give us some requested features, but maturity-wise, they are not there yet with respect to container scanning. The solution is maybe slightly expensive, but it's not as expensive as other tools such as Wiz. Generally, Qualys is very good at detections, whether on cloud or on-prem. The agent allows deployment on both infrastructures, providing continuous monitoring of your assets, which is a key selling point for us.
What is most valuable?
The features I value about using Qualys include container scanning; they provided us with some requested features, but maturity-wise, they are not there yet with respect to container scanning.
The solution is slightly expensive, but it's not as expensive as other tools such as Wiz. Generally, Qualys is very good at detections, whether on cloud or on-prem. The agent allows deployment on both infrastructures, providing continuous monitoring of your assets, which is a key selling point for us.
Detections get updated in Qualys with a unique identifier called QID. Whenever there's new information, such as a new CVE, Qualys processes that and generates a QID. Since our agents are installed across our infrastructure, they identify vulnerabilities based on the agent information, and any new detections also get updated to a manifest that runs every four hours, checking for new vulnerabilities.
The single prioritized view of risk helps reduce the work significantly; Qualys Detection Score not only considers the basic CVSS score but also factors in threat information and the exploitability factor, which helps us prioritize effectively. We also have another separate framework we developed that we use on top of this.
What needs improvement?
The downside is only in container security, but it has not been a long time since they introduced these models. Our use cases were edge use cases, so they had to develop some features for us, but they are indeed doing a good job.
How are customer service and support?
I would rate their support a seven on a scale of one to ten. For working with the people from Qualys, I would say seven is an accurate rating.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Before switching to Qualys, we were doing everything completely manual, and we wanted a more automated solution, which prompted us to switch.
How was the initial setup?
Our experience with the setup and deployment was quite good; Qualys was supportive, and we met with them twice a week while setting up the scanners and operations.
What about the implementation team?
The setup was done by us while Qualys guided us, as they do not have access to our infrastructure for deployments.
What's my experience with pricing, setup cost, and licensing?
Regarding pricing and setup cost, it was not the most expensive. While checking tools for container scanning, we considered Wiz and a startup, but we believe having one tool for as much as possible makes tracking and monitoring easier. We had Qualys agents installed everywhere, which facilitated the shift to container scanning.
What other advice do I have?
Qualys TotalCloud does help guide remediation paths and eliminate cyber risks. I would rate this solution a seven overall.
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Has supported vulnerability detection and device inventory but needs better automation and risk prioritization
What is our primary use case?
I use Qualys TotalCloud for vulnerability as a service, vulnerability management as a service. I use it to check my devices to see if they're free from vulnerabilities, to send updates, and also as a form of inventory for the devices.
What is most valuable?
I can use Qualys TotalCloud to uninstall unwanted devices, which is great. I can also use the feature of seeing what my vulnerabilities are, a form of inventory, and knowing the criticals and the less criticals. Once you have your vulnerabilities fixed and your patches pushed out using Qualys TotalCloud, then you are able to eliminate threats and cyber risk. Qualys TotalCloud is also used to provide unified vulnerability and threat assessment across both IaaS and SaaS.
What needs improvement?
I sometimes have difficulty detecting or uninstalling certain versions of applications, which I have to do manually. More advanced features or AI could improve this process. A single prioritized view of risk is also lacking, which could enhance decision-making. Additionally, it could use improvements to perform actions without requiring manual intervention.
For how long have I used the solution?
I have been using Qualys TotalCloud for one year now.
What do I think about the stability of the solution?
It is stable. I have not had any issues with it.
How are customer service and support?
I rate the documentation they provide or the knowledge base between five to seven.
How would you rate customer service and support?
Negative
Which solution did I use previously and why did I switch?
I have done POC with Okta and CrowdStrike. Qualys TotalCloud focuses on vulnerability management and security features. Okta focuses more on identities and IAMs. CrowdStrike is more of intrusion detection and assessment.
How was the initial setup?
The application was quite easy to deploy in over 3,000 applications using Qualys TotalCloud.
What about the implementation team?
It's just me using Qualys TotalCloud. The users don't really have anything to do with it. I do all the admin side from my end.
What was our ROI?
The return on investment I've seen in the past year with Qualys TotalCloud is quite significant, around 10% to 20%.
What's my experience with pricing, setup cost, and licensing?
Qualys TotalCloud's pricing is fair. It is not expensive and is affordable.
What other advice do I have?
Cloud security posture changes with time when using Qualys TotalCloud. It depends on how early you detect threats and fix them. Qualys TotalCloud doesn't provide a single prioritized view of risk. The product does what it says it's going to do, so I recommend it. I rate Qualys TotalCloud six out of ten.
A centralized tool for vulnerability and misconfiguration management in a multiple cloud environment
What is our primary use case?
We are managing AWS, Azure, as well as Google Cloud services in the cloud. We have different applications using those. We were previously checking the configurations manually. Qualys is helping us identify vulnerabilities related to the cloud. It identifies if something is misconfigured or if any AWS key or private key is exposed. We receive this information from Qualys TotalCloud.
How has it helped my organization?
Qualys TotalCloud provides written explanations to help guide the remediation paths and eliminate cyber risk. We are using TruRisk for the remediations. The TruRisk shows anything critical, and we can then focus on that. We also assess manually whether an asset is a critical target or not.
Qualys TotalCloud provides a single, prioritized view of risk. We are using CIS-CAT standards to harden our clouds, such as AWS, Google Cloud, and Azure. We are able to analyze the scans and identify which policies have failed and how we can remediate them. We can customize policies as per our organization's requirements. That is very helpful for us.
With the TruRisk Insights feature, security has significantly improved. In six months of using it, we see that everything is under control. We've solved many problems related to asset management, cloud configuration, and the new asset identification. If an application team has onboarded any cloud asset, we can see that. We have that information now.
What is most valuable?
The best features in Qualys TotalCloud include the total asset management of the cloud environment. It is very easy to export the report and see the vulnerabilities related to the cloud specifically. We can segregate that particular report and give it to the appropriate team for remediation. Before, we were doing it manually. From the whole sheet, we had to find out the cloud vulnerabilities and check manually if it was a cloud vulnerability.
It is very helpful for us to generate reports related to the cloud vulnerabilities.
What needs improvement?
The onboarding process is a bit difficult. In the initial phase, it is very difficult to understand the features, what the dashboard contains, and what criteria they are using. This information is very difficult to understand as a newcomer to Qualys TotalCloud. Once we learn it, it becomes easy. It is hard for a complete newcomer.
For how long have I used the solution?
I have been using Qualys TotalCloud for the last six months. There was one Qualys conference, and after that, we purchased it. Our management people were there, and they saw the usage of Qualys TotalCloud and how we could secure the cloud environment. They looked at how we can identify cloud vulnerabilities. That's why they decided to use this product.
What do I think about the stability of the solution?
Qualys TotalCloud is stable. We didn't experience any lag or slowness issues. They inform us beforehand that maintenance is scheduled, and there might be some slowness. Apart from that, there are no issues. I would rate it a ten out of ten for stability.
What do I think about the scalability of the solution?
For scalability, I would rate it a ten out of ten. It does not matter how many assets we have; it's very manageable. It's centralized.
Our environment consists of multiple clouds and multiple locations. We have only three members using Qualys TotalCloud. The team is narrow. After six months, more users will come since they're having different customizations available.
How are customer service and support?
The support from Qualys TotalCloud is a ten out of ten. The support team is very helpful in every aspect. If we get any issues, we can directly communicate with them. They have been helpful from day one. They have been solving issues efficiently.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Before using Qualys TotalCloud, we were using the cloud-native tools. For example, for AWS, we used the AWS console. We were doing the misconfiguration identification manually, checking everything manually. If any new policies or vulnerabilities came, we needed to check those manually. They provided some advice, and we relied on them, but we don't need to depend on them anymore. Qualys TotalCloud is identifying everything, and we take action based on that.
How was the initial setup?
The deployment was handled by a third-party vendor. They completed it within one week because they had expertise in that. Afterward, they did a knowledge transfer with us about how we can deploy and the process involved.
Qualys TotalCloud does not require any maintenance as it is based on the cloud.
What's my experience with pricing, setup cost, and licensing?
It isn't cheap, but it's reasonable. It helps us to manage things with very few resources.
What other advice do I have?
Currently, AI access is restricted in our environment. We are testing the outcomes and possibilities. Within two months, we may start using GenAI.
I would definitely recommend Qualys TotalCloud to other users. If someone is looking for a centralized management tool while using different cloud platforms, Qualys TotalCloud is very helpful. It helps manage and identify vulnerabilities and misconfigurations. It helps with asset management. It helps understand how many AWS or Google Cloud instances are in the environments.
I would rate Qualys TotalCloud a ten out of ten.
Makes cloud and asset management easy
What is our primary use case?
Qualys TotalCloud is very helpful for me for auditing purposes.
How has it helped my organization?
Qualys TotalCloud has helped us with centralized cloud management. We have Azure and AWS machines on the cloud. Previously, we were facing a lot of issues with vulnerability remediation. With Qualys TotalCloud, we can see vulnerabilities and misconfigurations and provide them to the remediation team with a timeline for fixing. Previously, we were unable to do that. It has helped us identify and plan the timeframe for the updates.
Qualys TotalCloud helped us show the attack vectors and their criticality to the client. The client could take immediate action. Previously, the client could not understand how critical an issue was. This automation is beneficial for us compared to the manual process.
Qualys TotalCloud has made asset management easy. We have many cloud resources. Previously, the cloud team was not aware of all of the resources. It is pretty easy now because we have visibility into the assets hosted on the cloud.
Qualys TotalCloud provides a single, prioritized view of risk. It reduces the work needed to combine multiple sources to prioritize risk. We can see them categorized based on the criticality which saves time. Previously, it would take us a week to manage, investigate the issues, and configure three or four cloud resources. We can now do that in two days. Once we have the report, we need to analyze it and showcase it to the client. They can then start the remediation.
Over three months, we have seen 20% to 25% improvement in the security posture. It identified about 70% misconfigurations which have now been reduced to 20%.
What is most valuable?
With TotalCloud, we can scan through the API. If we are not able to deploy cloud agents on the machine, we can use the API. This feature is quite nice.
What needs improvement?
It is already perfect, but they can bring some newer dashboards and customization options for the dashboard. It would be great to be able to include on-prem assets on the dashboard. For example, when I am hosting my own server to the public, I should be able to segregate the dashboard to monitor that particular server.
For how long have I used the solution?
I have been using Qualys TotalCloud for about three months.
What do I think about the stability of the solution?
Initially, we faced some performance issues. After implementing it, I noticed it took a lot of time to load. However, it was not an issue from the Qualys side, so we waited on our end. After logging out and in again, the issue was resolved, and it became perfectly smooth. The initial gathering of data seems to have contributed to the delay.
What do I think about the scalability of the solution?
We have not scaled it yet.
How are customer service and support?
We did not need any support so far because TotalCloud has been working well. However, in the future, I might require support, and I expect good assistance from the company. It should not take much time.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
This is the first time I am working on a cloud security platform like this.
How was the initial setup?
We did not encounter complexity because TotalCloud supports AWS. We do not need much customization or configuration either. The options for configuration are user-friendly. It took around two weeks to complete, with some management approval delays contributing to the timeframe.
Its maintenance is easy. We do not need more utilization or resources. We currently have 7 applications, and we will be onboarding 17 applications soon.
What about the implementation team?
There are five members in our team. Three of us were deploying and configuring the cloud setup, while others managed tasks, analyzed errors, and showcased the progress to the client.
What's my experience with pricing, setup cost, and licensing?
Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great.
Which other solutions did I evaluate?
We evaluated WIZ cloud security. It has a limited number of dashboards, and customization is not possible. We have to rely on the data showcased on the dashboards, whereas Qualys TotalCloud shows us a lot of parameters and data which makes it easier to show information to the management.
What other advice do I have?
I would definitely recommend it because it is easy to handle any cloud resources. Asset management is possible, and we can effectively do an audit of cloud resources.
I would rate Qualys TotalCloud a ten out of ten.
Misconfiguration detection and on-demand scans have transformed our cloud environment monitoring
What is our primary use case?
Sometimes I lack the details of misconfigured devices, such as cloud servers and cloud machines, which are hosted in our environment. We face issues while identifying these devices. We used to execute commands to check connectivity, which helped us identify misconfiguration issues or rely on vulnerability reports. Since TotalCloud was introduced, we can remediate these issues once we get the report from TotalCloud.
What is most valuable?
There are many features that impress me. The first is the misconfiguration detection, as mentioned earlier, and the detection feature alerts us about security tools and reported users. TotalCloud allows us to monitor our cloud environment. Monitoring devices hosted in the cloud dashboard is easy. Additionally, some features prioritize the misconfiguration option. For instance, if a cloud server is critical, it should be prioritized for prompt alerts. These are key features I like about TotalCloud. The best part I like is the on-demand scans. For example, if some machines have open vulnerabilities and the remediation team resolves them, the on-demand feature allows us to verify vulnerability resolution promptly. This helps the remediation teams significantly in closing critical vulnerabilities efficiently.
What needs improvement?
While I am still learning TotalCloud, which has the latest features introduced, I attended a Qualys event this year. There are navigations that can be improved. Some customizable dashboards provided in the dashboard part also need attention. The main area needing improvement is integration. Although the team is strengthening TotalCloud, integration can be enhanced with SIEM, SOAR, ITSM, and other sources. An enhancement feature could improve TotalCloud further.
For how long have I used the solution?
I have been using TotalCloud for more than two and a half years.
What do I think about the scalability of the solution?
It is obviously scalable. However, it is improving, so I rate it nine.
How are customer service and support?
Technical support can be rated 8.5 out of 10.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I started my career in college. I was completely involved in college. I recently switched to CloudSight. As per the company's requirement, they have shifted me to the CloudSight product. I am still using Qualys and CloudSight. There is no difference as Callist is a centralized tool. It starts from the lifecycle, detection, remediation, and reporting. If vulnerabilities reopen, it detects them again. The lifecycle continues. It also patches and remediates endpoint servers in the tool itself. This is the part I like best about Callist compared to other vendors.
How was the initial setup?
It is quite easy. We deployed the Cloud TotalCloud Agent to servers and endpoints easily, without feeling any complexity.
What was our ROI?
It saves a lot of time and manual effort. We have many options to raise a case if it can be automated. CallStream helps us integrate and automate tasks. It helps us automate lots of things.
What's my experience with pricing, setup cost, and licensing?
It is not cheap. For smaller businesses, people running businesses with a small number of users cannot afford Qualys, as I understand. However, in MNCs and bigger organizations, the cost is not significant. There are different pricing models, like the patch management module, which requires a different price to access. It is not cheaper, but also not expensive.
What other advice do I have?
I definitely recommend other organizations to have this product in their environment. The price is a factor. Smaller organizations might find it unaffordable. However, there are different options depending on the budget, such as purchasing a smaller number of licenses. I highly recommend it. I work for LTI Mindtree, a large organization. Overall, I rate the product nine out of ten.
Provides unified vulnerability and compliance assessment
What is our primary use case?
We use it to obtain cloud compliance status. TotalCloud assists in presenting the cloud compliance data in a report format.
How has it helped my organization?
TotalCloud provides the easiest and the best approach for cloud infrastructure management. It helps us get all risks and vulnerabilities in a single report.
TotalCloud provides unified vulnerability and threat assessment across IaaS as per my knowledge. I am not sure about SaaS.
It provides a single, prioritized view of risk. We get to know about the severity of an issue and we can get it rectified as soon as possible.
The vulnerability and posture management information help us remediate the issue and improve our security posture.
TotalCloud saves us time and cost. We do not have to separately integrate each and every account subscription. Once we integrate the parent account, all the other child accounts get integrated automatically. It collects all the tag and inventory information on the cloud. That helps us to reduce risks.
The TruRisk Insights feature has helped to identify issues with high vulnerability scores and reduce risk. We did not have similar insights previously. There is about 50% to 80% reduction.
What is most valuable?
TotalCloud's best feature is the integration of cloud accounts. It helps with the risk and security posture management of our cloud infrastructure.
What needs improvement?
There should be improvement from a dashboard perspective when collecting and showcasing data to lead management. In such cases, improvement is necessary. While the policies and integration are perfect, issues arise when showcasing data.
We have brief written explanations explaining the issue, but a video explanation would also be useful.
For how long have I used the solution?
I have used the solution for one and a half years.
What do I think about the stability of the solution?
It is stable. I would rate it a ten out of ten for stability.
What do I think about the scalability of the solution?
It is scalable. I would rate it a ten out of ten for scalability.
We have different environments and multiple cloud platforms. As an admin, there are more than 50 users.
How are customer service and support?
Their support is good. I would rate their support a nine out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We were not using any similar solution previously.
How was the initial setup?
It is easy to deploy and integrate accounts. It took just five to ten minutes to integrate the API and collect information.
It is a SaaS platform that does not require any maintenance.
What other advice do I have?
I recommend using it for posture management if a cloud agent is available. The cloud agent collects information for vulnerabilities and makes it accessible as a single source of information.
I would rate Qualys TotalCloud a nine out of ten.
showing 1 - 10