Qualys review

Qualys is a cloud-based cyber risk management platform for organizations that need to track IT assets, security exposure and compliance across one product family. Its apps cover asset inventory, vulnerability and configuration-risk detection, remediation workflows, and re-validation after fixes. The wider lineup also includes cloud and endpoint detection and response, policy compliance, security assessments, file integrity monitoring, and AI risk governance that finds AI assets and helps document their risks.

That breadth does not mean every capability comes in one flat license. The listed Qualys Subscription Plan is custom-priced for organizations licensing Qualys apps. The pricing information says it includes Global AssetView, unlimited scans and unlimited Cloud Agents for Inventory, while licensed IPs, web applications and user licenses determine limits. Qualys is best understood as a modular security platform, not a single fixed-scope scanner.

Qualys brings asset visibility, vulnerability management, remediation and compliance tools into a single platform. That can suit organizations trying to connect findings to assets and remediation work rather than buying a separate point product for every task. Its listed subscription includes Global AssetView, unlimited scans and unlimited Cloud Agents for Inventory; those are meaningful inclusions, though the license still depends on the counts of IPs, web applications and users.

The product range also extends beyond vulnerability scanning. The published feature list includes cloud and endpoint detection and response, policy compliance, security assessments, file integrity monitoring, and AI asset and risk governance. That breadth may matter to teams evaluating several security functions together.

User feedback is mixed, not uniformly negative. In one Reddit thread, a Qualys user said its headless capabilities can handle some work at scale with a development team behind them. Another commenter said Qualys provided useful detail, even while criticizing its interface and reporting. Those comments are individual experiences, not proof that every module or deployment performs the same way.

The biggest buying drawback is price opacity. The pricing information lists no monthly or annual price, no starting price and no published trial details. It describes a custom subscription, with limits tied to licensed IPs, web applications and user licenses. Scans and Cloud Agents for Inventory are listed as unlimited, but that does not make the overall license unlimited. Ask Qualys to spell out each licensed unit and included app before comparing renewal quotes.

Usability and administration are recurring complaints in the Reddit threads we read. Users describe switching between old and new interfaces, slow-loading pages, confusing labels, licensing duplication and weak reporting. Others ask for a clearer host ID across APIs and better automation for user roles and permissions. These are reports from commenters, not universal findings, but they point to migration and operations questions worth checking in a procurement review. One commenter also called database security checks a weak area; that is an individual comparison, not a published product limit.

Qualys does not publish a starting price or monthly and annual rates. The pricing information available describes a custom subscription, with the quote depending on licensed IPs, web applications, and user licenses. That means there is no public tier ladder to compare, and we can’t calculate a per-asset cost from the published details.

The listed subscription includes unlimited scans, unlimited Cloud Agents for Inventory, and Global AssetView. “Unlimited scans” does not mean unlimited coverage: the plan’s limits still depend on the IPs, web apps, and users in the license. The pricing information does not list add-on prices or explain whether particular apps cost extra.

Ask Qualys for a quote that separates app licensing from those capacity limits. Confirm what happens when your asset count, web app scope, or user count grows, and whether the quote is monthly, annual, or both. Those billing details are not published, so compare them directly before treating a quote as your likely renewal cost.

The available information does not document a migration process, data-export formats, or how long a move takes. Before switching in, inventory the IPs, web applications, and users you need covered: those are the published subscription limits, and they affect the custom quote. Also map which Qualys apps you actually need, rather than assuming the full platform is part of one fixed-price package.

Before signing, ask Qualys what data you can export, in what format, and whether historical findings, asset records, and compliance evidence remain usable outside the platform. Get the same answers from any replacement vendor before you leave; export and retention terms are not published on the vendor's site.

The review brief flags recurring complaints about usability and reporting, which may prompt teams to consider alternatives. The underlying Reddit posts and their specifics were not provided, so we can’t verify how common those complaints are. Teams that need transparent pricing or simpler workflows should resolve those questions in a demo and quote process before committing.