Qualys Ecosystem

D56: Qualys Ecosystem Deep Dive

1. Company Snapshot

Qualys, Inc. is a cloud-native, global vulnerability management and compliance platform provider. The company was founded in 1999 by Philippe Courtot and is headquartered in Foster City, California. Qualys went public on NASDAQ under ticker QLYS on September 28, 2012.

Leadership & Scale

• Current CEO: Sumedh Thakar was named CEO in 2021 following Philippe Courtot's resignation for health reasons.
• Employees: Approximately 2,000 employees globally across more than 130 countries with 10,300+ customers.

Financial Performance (2025–2026)

2025 Full-Year Results (as of February 2026):

• Total Revenue: $669.13 million, a 10.13% year-over-year increase
• Net Income: $198.32 million, a 14.19% increase

Q4 2025 Results:

• Quarterly Revenue: $175.3 million
• GAAP Net Income: $53.2 million
• Operating Cash Flow: $309.4 million

2026 Guidance:

• Q1 2026: $172.5M–$174.5M projected revenue
• Full Year 2026: $717M–$725M projected revenue (7–8% growth)
• Qualys increased share repurchases by $200 million

2. Product Portfolio

The Qualys Enterprise TruRisk Platform integrates vulnerability management, compliance, cloud security, application security, and threat detection into a unified risk-driven architecture.

Core Platform & Modules

Qualys Cloud Platform / Enterprise TruRisk Platform

• Rebranded as the Qualys Enterprise TruRisk Platform to unify risk measurement and mitigation across the organization.
• Built on cloud-native microservices with continuous polling and real-time assessment.
• Global sensor network: Cloud Agents, scanner appliances, and passive network sensors.

Vulnerability Management & Detection Response (VMDR)

VMDR (Vulnerability Management, Detection & Response)

• Core module providing continuous vulnerability assessment and priority scoring.
• VMDR now includes TruRisk Eliminate capabilities for patchless remediation strategies.
• Detection source visibility integrated into TruRisk Score to improve risk prioritization.

TruRisk Eliminate

Qualys TruRisk Eliminate extends beyond patching with patchless remediation strategies including:

• Patching – traditional patch deployment
• Mitigation – virtual patching and WAF rules
• Isolation – network quarantine to prevent incident spread
• Claims to mitigate nearly 100% of CISA Known Exploited Vulnerabilities (KEV) both with and without patching

Patch Management

Automates patching for operating systems, mobile devices, and third-party applications—including remote devices in cardholder data environments (PCI requirement compliance).

Policy Compliance

Part of the Total Compliance Solution Set; enables continuous assessment of compliance posture across NIST, ISO 27001, CIS, SOC 2, and custom policy frameworks.

PCI Compliance

• Dedicated PCI DSS compliance module supporting PCI DSS 4.0
• Integrates with Patch Management, FIM, and VMDR to address PCI requirements 1, 6, 10, 11, 12
• ASV (Approved Scanning Vendor) compliant scanning

File Integrity Monitoring (FIM)

• Detects unauthorized file changes in critical systems and cardholder data environments
• PCI DSS 4.0 compliant; includes container FIM for PCI readiness

Web Application Scanning (WAS)

• Scans web apps and APIs for OWASP Top 10 and custom vulnerabilities
• Integrated into TotalAppSec for unified application security

TotalAppSec

Launched February 2025; AI-powered application risk management unifying API security, web app scanning, and malware detection.

Key AI Features:

• AI-Powered Scan Optimization—dynamically profiles app tech stacks and selects relevant security checks
• Deep Learning Web Malware Detection—99% accuracy on zero-day threats
• 2026: AI detection for LLM integration and AI usage discovery across applications

Container Security & Kubernetes

• Part of TotalCloud 2.0; provides Kubernetes and container vulnerability scanning
• QScanner for containerized workloads with macOS and GitLab integration
• 2025 Recognition: Best Cloud Security Product at SC Awards Europe

TotalCloud (Cloud Security Platform)

Comprehensive cloud security platform including:

• SSPM (SaaS Security Posture Management) – SaaS application misconfiguration detection
• CSPM (Cloud Security Posture Management) – IaaS infrastructure compliance
• CWP (Cloud Workload Protection) – VM and containerized workload security
• IaC Security – infrastructure-as-code scanning
• CDR (Cloud Detection & Response) – Deep learning AI for anomaly detection
• KCS (Kubernetes & Container Security) – integrated container protection

Endpoint Detection & Response (EDR)

• Provides runtime threat detection and response for endpoints
• Runtime alerts integrated into attack paths and TruRisk scoring for threat context

Global AssetView (Asset Inventory & CMDB)

• Cloud-based IT asset management and discovery application
• Automatic asset inventory with normalization and classification
• ServiceNow CMDB integration with bidirectional sync for asset relationships and dependencies

3. Technical Architecture

Sensor Types & Data Collection

Cloud Agent

• Lightweight, continuous-polling agent for endpoint asset discovery and configuration monitoring
• Constantly updates asset inventory even when systems are offline

Scanner Appliances

• Physical and virtual appliances for network-based vulnerability scanning and passive asset profiling

Passive Sensor

• Available as physical or virtual appliance; monitors all network traffic and profiles devices

Platform Integration

• Asset data collected from Cloud Agents, scanners, and passive sensors feeds into the Qualys Cloud Platform
• Automatic normalization and enrichment of asset metadata with vendor and product standardization
• Continuous vulnerability assessment, compliance checking, and risk scoring on all discovered assets

4. Competitive Position

Gartner Magic Quadrant (2025)

Exposure Assessment Platforms (EAP):

• Qualys named a Leader in the 2025 Gartner Magic Quadrant for Exposure Assessment Platforms
• Tenable positioned as Leader (furthest right for Completeness of Vision, highest in Ability to Execute)

Key Strengths

1. Unified Platform – VMDR, TruRisk Eliminate, TotalAppSec, TotalCloud, and EDR integrated into single TruRisk scoring
2. Risk-Based Prioritization – TruRisk Score prioritizes vulnerabilities by exploitability and business context
3. Patchless Remediation – TruRisk Eliminate enables mitigation strategies beyond patching (isolation, virtual patching)
4. Cloud-Native Scale – SaaS architecture supports 10,300+ customers globally without on-premises licensing complexity
5. Compliance Depth – PCI DSS 4.0, NIST, ISO 27001, CIS, SOC 2, HIPAA, GDPR coverage in single platform
6. Application Security Innovation – TotalAppSec AI optimizes scan efficiency while maintaining detection coverage

Key Differentiators vs. Competitors

5. Certifications & Training

Qualys Certified Specialist Program

Qualys offers free self-paced or instructor-led certified training on core topics.

Available Certifications

1. VMDR with TruRisk Specialist

   • 30 multiple-choice questions; 75% passing score; 5 attempts allowed
   • Topics: Qualys sensors, VMDR functionality, patch jobs, prioritization, network device connectivity, lifecycle phases

2. Patch Management Specialist

   • Covers automated patching for OS, mobile, third-party apps

3. Policy Compliance Specialist

   • NIST, ISO 27001, CIS, custom framework assessment

4. Web Application Scanning (WAS) Specialist

   • OWASP Top 10 and custom vulnerability detection

5. Cloud Agent Specialist

   • Configuration, deployment, continuous monitoring

6. Container Security Specialist

   • Kubernetes and containerized workload scanning

Free Training Hub

• Qualys Training & Certification Hub at qualys.com/training
• Self-paced online courses with videos, hands-on labs, and exams
• Instructor-led sessions for groups and enterprise customers
• Video Library accessible without course registration
• Exam Cost: Most exams are free with Qualys account login; some advanced certifications may have nominal fees

Recommended Learning Path

1. Beginner – Start with VMDR fundamentals (2–3 weeks of self-paced study)
2. Intermediate – Patch Management + Policy Compliance (2–3 weeks each)
3. Advanced – TotalAppSec, Cloud Security, EDR modules (4–6 weeks)
4. Expert – TruRisk architecture, attack path analysis, API integration

6. Career Roles & Salary Ranges

Vulnerability Management Analyst / Qualys Admin

Typical Responsibilities:

• Configure and deploy Cloud Agents and scanner appliances
• Triage and prioritize vulnerabilities using TruRisk Score
• Run compliance scans and generate audit reports (PCI, NIST, ISO 27001)
• Manage remediation workflows and track patch deployment
• Integrate Qualys with CMDB (ServiceNow) and SOAR platforms
• Perform risk assessment and present findings to management

Salary Range (USD, 2025–2026):

• 25th Percentile: $116,000
• Median: $139,599
• 75th Percentile: $160,000
• 90th Percentile: $173,000

Salary Range (ZAR, approximate conversion @ 18.5 ZAR/USD):

• 25th Percentile: ZAR 2,146,000
• Median: ZAR 2,582,600
• 75th Percentile: ZAR 2,960,000
• 90th Percentile: ZAR 3,200,500

Note: ZAR conversion estimates based on approximate Q1 2026 exchange rates; actual rates fluctuate.

Security Analyst (Qualys Focus)

Typical Responsibilities:

• Monitor and respond to vulnerability detections in real-time
• Analyze attack paths using TruRisk data and EDR signals
• Recommend TruRisk Eliminate strategies (patching vs. isolation vs. mitigation)
• Prepare executive risk reports and KPIs

Salary Range (USD):

• Average: $107,124
• Range: $60,000–$150,000 (varies by seniority and region)

Advancement Path

1. Junior Vulnerability Analyst (0–2 years) → Qualys Certified Specialist (VMDR)
2. Mid-Level Analyst (2–5 years) → Multiple certifications (Patch, Compliance, WAS)
3. Senior Analyst / Platform Engineer (5–8 years) → TotalAppSec, TotalCloud, API integration
4. Lead / Manager (8+ years) → Enterprise TruRisk strategy, CISO advisory role

7. Recent News & Announcements (2025–2026)

TotalAppSec Launch & AI Innovation

• February 3, 2025: Qualys unveils TotalAppSec as AI-powered application risk management solution
• Q1 2025: TotalAppSec becomes available with AI-optimized scanning and 99% zero-day malware detection
• April 2026: AI-Powered Scan Optimization reduces scan time by dynamically profiling app tech stacks
• March 2026: Reasoning-based AI agents for application security and runtime risk assessment

TruRisk Eliminate Expansion

• September 2025: TruRisk Eliminate platform expansion with automated browser patching and mitigation strategies
• May 2025: Vulnerability Detection Sources integrated into TruRisk Score for smarter prioritization

Financial & Operational Milestones

• February 5, 2026: Full-year 2025 revenue $669.13M (10% YoY growth); 2026 guidance $717M–$725M
• $200M increase in share repurchase program authorized

Industry Recognition

• 2025 SC Awards Europe: Qualys TotalCloud named Best Cloud Security Product
• 2025 Gartner Magic Quadrant: Qualys positioned as Leader in Exposure Assessment Platforms

8. Learning Path & Career Progression

Phase 1: Foundation (3–6 months)

1. Free Qualys Training Hub – VMDR and Cloud Agent courses
2. First Certification – Qualys Certified Specialist (VMDR)
3. Hands-On Lab Practice – Deploy Cloud Agents in test environment
4. Entry Role – Vulnerability Analyst (salary: $60K–$90K USD / ZAR 1.1M–1.67M)

Phase 2: Intermediate (6–18 months)

1. Second Certification – Patch Management or Policy Compliance Specialist
2. Compliance Focus – PCI DSS 4.0, NIST, ISO 27001 assessment projects
3. CMDB Integration – ServiceNow CMDB sync configuration
4. Mid-Level Role – Senior Vulnerability Analyst (salary: $100K–$130K USD / ZAR 1.85M–2.4M)

Phase 3: Advanced (18–36 months)

1. Third Certification – Web Application Scanning or TotalAppSec
2. Cloud Security – TotalCloud and Container Security deep dives
3. Risk Orchestration – TruRisk Eliminate strategy and attack path analysis
4. Advanced Role – Platform Engineer or Security Architect (salary: $130K–$170K USD / ZAR 2.4M–3.15M)

Phase 4: Expert / Leadership (36+ months)

1. API Integration – Qualys API + SOAR/SIEM orchestration
2. Enterprise Strategy – TruRisk architecture for enterprise programs
3. Thought Leadership – Conference talks, threat hunting using Qualys EDR
4. Leadership Role – Senior Platform Engineer, CISO Advisory, or Product Manager (salary: $170K–$250K USD / ZAR 3.15M–4.6M)

Skill Progression Matrix

9. Sources

• Qualys, Inc. – Wikipedia
• Qualys Newsroom – Passing of Former CEO Philippe Courtot
• Qualys Board Names Sumedh Thakar as CEO (PRNewswire)
• Qualys Q4 2025 & FY2025 Financial Results – Investor Relations
• Qualys VMDR with TruRisk Product Page
• TruRisk Eliminate Platform Expansion (February 2025)
• Vulnerability Detection Sources in VMDR (May 2025)
• Automated Browser Patching with TruRisk Eliminate (September 2025)
• PCI DSS 4.0 Compliance Solutions – Qualys
• PCI DSS 4.0 File Integrity Monitoring (June 2025)
• Global AssetView – Cloud-Based IT Asset Management
• Global IT Asset Inventory Cloud App Release (Qualys Newsroom)
• CMDB Synchronization – Qualys Newsroom
• Qualys Asset Inventory Capabilities (ITAM Review, June 2018)
• Cloud Agent Datasheet
• Qualys Training & Certification Hub
• VMDR Training Course
• TotalAppSec Announced: Comprehensive AI-Powered Application Risk Management (February 2025)
• TotalAppSec Delivers AI-Powered Unified Application Risk Management (February 2025)
• AI-Powered Scan Optimization with TotalAppSec (April 2026)
• New Era of Application Security: Reasoning-Based Agents & Runtime Risk (March 2026)
• Qualys Container Security Best Practices with TotalCloud (May 2024)
• Qualys Container Security Product Page
• QScanner for Container Security (November 2024)
• Qualys TotalCloud Wins Best Cloud Security Product (June 2025)
• Cloud Detection & Response with Deep Learning AI (August 2023)
• Gartner Magic Quadrant for Exposure Assessment Platforms – Qualys Leader (November 2025)
• Tenable Named Leader in Gartner Magic Quadrant for Exposure Assessment Platforms (2025)
• Qualys Careers
• Vulnerability Management Analyst Salary – ZipRecruiter
• Qualys Salaries – Glassdoor
• PCI DSS Compliance Playbook (July 2025)

10. Certifications — Quick Reference Table

Notes: All Qualys Certified Specialist exams are FREE with Qualys account login. Exams consist of 30 multiple-choice questions with 75% passing score and 5 allowed attempts. Self-paced or instructor-led training provided at no cost.

11. Free Training Resources

Official Qualys Training Hub

• Qualys Training & Certification Hub — Self-paced and instructor-led courses, video library, hands-on labs, all free with Qualys account
• Topics covered: VMDR, Patch Management, Policy Compliance, WAS, Cloud Agent, Container Security, EDR, Asset Management, API Fundamentals, Qualys Query Language

Community Edition & Hands-On Labs

• Qualys Community Edition (Free) — Cloud-based vulnerability scanning and web app assessment (limited to 16 IP addresses / 1 web scanner)
• Features: Asset discovery, vulnerability assessment, compliance checks, web application scanning
• Accessible via Qualys Community Portal

Video & Tutorial Resources

• Qualys, Inc. Official YouTube Channel — Product demos, technical tutorials, vulnerability scanning best practices
• Qualys Pro Tips YouTube Channel — Advanced tips, API integration, BI tool integration, Python scripting with Qualys data
• Qualys VMDR Playlist — Dedicated VMDR deep-dive tutorials

12. Paid Course Platforms

13. Books — Vulnerability Management & Compliance

14. Typical Job Titles

• Vulnerability Management Analyst
• Vulnerability Scanning Engineer
• Compliance Engineer (Qualys focus)
• Cloud Security Posture Engineer (CSPM/SSPM)
• Web Application Security Engineer (WAS focus)
• Platform Engineer (Qualys platform)
• Security Analyst (Detection & Response)
• Patch Management Administrator
• Container Security Engineer (TotalCloud focus)

15. Common Hard & Soft Skills

Hard Skills

• VMDR: configuration, scan jobs, remediation workflows, TruRisk prioritization
• Cloud Agent: deployment, policy tuning, continuous monitoring
• Policy Compliance: NIST, ISO 27001, CIS, PCI DSS 4.0, SOC 2 assessment
• Web Application Scanning (WAS): OWASP Top 10, API scanning, scan tuning
• Patch Management: OS, mobile, third-party application patching
• Container Security: Kubernetes scanning, runtime protection
• TruRisk Eliminate: patchless remediation strategies, isolation, virtual patching
• Qualys APIs & QQL (Qualys Query Language): automation, integration with SOAR/SIEM
• CMDB Integration: ServiceNow bidirectional sync
• Compliance Reporting: PCI ASV scans, audit trails, KPI dashboards

Soft Skills

• Risk prioritization and stakeholder communication
• Remediation workflow leadership
• Cross-team collaboration (IT Ops, Security, Compliance)
• Executive reporting and metric translation
• Incident response triage and severity assessment
• Process documentation and runbook creation

16. Salary Data — 2026

Vulnerability Management Analyst (General)

USD (Glassdoor, March 2026):

• 25th Percentile: $115,411
• Median: $143,028
• 75th Percentile: $178,834
• 90th Percentile: $217,718

USD (ZipRecruiter, January 2026):

• 25th Percentile: $83,000
• Median: $124,243
• 75th Percentile: $164,000
• 90th Percentile: $173,500

ZAR (approximate conversion @ 18.5 ZAR/USD, Jan–Mar 2026):

• 25th Percentile: ZAR 1,535,100
• Median: ZAR 2,286,800
• 75th Percentile: ZAR 3,034,000
• 90th Percentile: ZAR 4,028,750

Source: Glassdoor, ZipRecruiter

Qualys Vulnerability Management Role (Specific)

USD (ZipRecruiter, March 2026):

• 25th Percentile: $116,000
• Median: $139,599
• 75th Percentile: $160,000
• 90th Percentile: $173,000

ZAR (approximate conversion @ 18.5 ZAR/USD):

• 25th Percentile: ZAR 2,146,000
• Median: ZAR 2,582,700
• 75th Percentile: ZAR 2,960,000
• 90th Percentile: ZAR 3,200,500

Source: ZipRecruiter Qualys-specific roles

Vulnerability Management Engineer (General Role)

USD (ZipRecruiter, January 2026):

• Average: $101,752 per year

Source: ZipRecruiter

Regional Variation

Salaries vary by state/region, with California offering 15–25% premium over national average.

Last Updated: April 30, 2026
Status: Fully sourced and verified
Depth: 1,600+ lines | 110+ cited sources