Qualys VMDR Pros and Cons

During our time using the tool, 2 years, we really liked the capabilities of the agent. The amount of details collected by the Qualys agent is really impresive. Also, the capabilities to check for default credentials during scans. Review collected by and hosted on G2.com.

VMDR seems outdated, very old, and hard to navigate, plus some areas are in a newer version and then some still in the mid 2000. The reporting component in Qualys is terrible, very time consuming to do simple stuff. The connectivity to their SaaS console can get really slow. Review collected by and hosted on G2.com.

Vulnerability Management and Asset Management Review collected by and hosted on G2.com.

Some dashboard on Qualys VMDR and api feature Review collected by and hosted on G2.com.

Their interactive Dashboard for Threat and vulnerability research is awesome. Review collected by and hosted on G2.com.

Support Team takes lots of time to respond. Review collected by and hosted on G2.com.

Best thing about Qualys VMDR is the ease of deployment of the cloud agent and cloud agent in general. It allows you to (essentially) replace the "old school" internal authenticated scanning process with a continuous light-weight agent based scanning and reporting process. Getting the agent deployed as part of normal CI/CD build processes in modern cloud architecture/infrastructure deployments is a piece of cake as well. It has worked fairly reliably too. Review collected by and hosted on G2.com.

Getting support is painful. I ran into a recent issue with the VM API that suddenly occurred out of the blue, with nothing more than a non-descript general error message. Opened a support ticket, and two months later, it still wasn't resolved. I ended up tracking it down myself to an issue with our account (an accident made on their end to our subscription), and that was apparently what was causing the random error. Additionally, there seems to be little-to-no innovation happening and I rarely see any meaningful updates to the platforms we use (VMDR, PCI, WAS, FIM) aside from them breaking out pre-existing modules into new stand-alone services that they then add as new SKUs ( and want to charge extra $$$). For example, instead of improving the existing, native asset management/inventory management module that is included with VMDR, they build a new Cyber Security Asset Management (CSAM) platform, designate the old one as a "legacy" module, and now charge extra for the new one. Total BS. Review collected by and hosted on G2.com.

Its Web UI and to do VA Scanning and also its Administration is very easy. Review collected by and hosted on G2.com.

Nothing to dislike for Qualys VMDR as it is very easy to use. Review collected by and hosted on G2.com.

Ability to quickly prioritize Vulnerabilities and being able to present executive-friendly metrics with the usage of dynamic dashboards that showcase the riskiest areas of our customers Review collected by and hosted on G2.com.

Having CSAM as a sepparate module is not helpful. Its a great tool but not big enough to have to pay additional for it. Great potential for increasing VMDR wow factor if that would have been included in VMDR 2.0 Review collected by and hosted on G2.com.

VMDR will show you many of the issues in your organazation from various sources. Dynamic Tags are a great feature if you add the Global Asset View Module Review collected by and hosted on G2.com.

Garbage in Garbage Out- Connectors and agents seem unreliable; Authenticated Scanning is difficult to implement, and this is after a year. So your data can be off until you fix your inputs, repeatedly Review collected by and hosted on G2.com.

Best thing about VMDR is the Real-time threat protection module, patch management, asset discovery and dashboard with customization options. Easy integration with ticketing management tools. Review collected by and hosted on G2.com.

The remediation module is a bit complex and needs more automation and traceability at VMDR end itself not on the defect tool. The reporting module specific to leadership shows the data and matrix are not available separately. Review collected by and hosted on G2.com.

The best part of the tool is felt is about Cloud agents, one agent can do everything for you starting from Vulnerability management, policy compliance, continuous monitoring, asset view, patch management. Also, the capability to run the scans on the cloud platform and containers with a holistic view of the assets is very impressive. Review collected by and hosted on G2.com.

As such I do not have anything to dislike about Qualys but I would really like to see improvements in Web Application scanning capabilities and enhanced patching facility on other platforms. Review collected by and hosted on G2.com.