We are a pioneer and leading provider of a cloud-based platform delivering
security and compliance solutions that enable organizations to identify security
risks to their information technology (IT) infrastructures, help protect their
IT systems and applications from ever-evolving cyber-attacks and achieve compliance
with internal policies and external regulations. Our cloud solutions address
the growing security and compliance complexities and risks that are amplified
by the dissolving boundaries between internal and external IT infrastructures
and web environments, the rapid adoption of cloud computing and the proliferation
of geographically dispersed IT assets. Our integrated suite of security and
compliance solutions delivered on our Qualys cloud platform enables our customers
to identify their IT assets, collect and analyze large amounts of IT security
data, discover and prioritize vulnerabilities, recommend remediation actions
and verify the implementation of such actions. Organizations use our integrated
suite of solutions delivered on our Qualys cloud platform to cost-effectively
obtain a unified view of their security and compliance posture across globally-distributed
IT infrastructures as our solution offers a single platform for information
security, application security, endpoint, developer security and cloud teams.
IT infrastructures are more complex and globally-distributed today than ever
before, as organizations of all sizes increasingly rely upon a myriad of interconnected
information systems and related IT assets, such as servers, databases, web applications,
routers, switches, desktops, laptops, other physical and virtual infrastructure,
and numerous external networks and cloud services. In this environment, new
and evolving digital technologies intended to improve organizations’ operations
can also increase vulnerability to cyber-attacks, which can expose sensitive
data, damage IT and physical infrastructures, and result in serious financial
or reputational consequences. In addition, the rapidly increasing amount of
data and devices in IT environments makes it more difficult to identify and
remediate vulnerabilities in a timely manner. The predominant approach to IT
security has been to implement multiple disparate security products that can
be costly and difficult to deploy, integrate and manage and may not adequately
protect organizations. As a result, we believe there is a large and growing
opportunity for comprehensive cloud-based security and compliance solutions
delivered in a single platform.
We designed our Qualys cloud platform to transform the way organizations secure
and protect their IT infrastructures and applications. Our cloud platform offers
an integrated suite of solutions that automates the lifecycle of asset discovery,
security assessments, and compliance management for an organization’s
IT infrastructure and assets, whether such infrastructure and assets reside
inside the organization, on their network perimeter, on endpoints or in the
cloud. Since inception, our solutions have been designed to be delivered through
the cloud and to be easily and rapidly deployed on a global scale, enabling
faster implementation and lower total cost of ownership than traditional on-premises
enterprise software products. Our customers, ranging from some of the largest
global organizations to small businesses, are served from our globally-distributed
cloud platform, enabling us to rapidly deliver new solutions, enhancements and
security updates.
We believe that our cloud platform provides our customers with unique advantages,
including:
No hardware to buy or manage. There is no infrastructure or software to buy
and maintain thus reducing our customers’ operating costs; all services
are accessible in the cloud via web interface. Qualys operates and maintains
the platform.
Real-time visibility in one place, anytime and anywhere. Our customers can conveniently
see their security and compliance posture across their global IT asset inventory
in one browser window, without plugins or a virtual private network (VPN), whenever
and wherever Internet access is available.
Easy global scanning. Our customers can easily perform scans on geographically
distributed and segmented networks at the perimeter, behind the firewall, on
dynamic cloud environments and on endpoints.
Seamless scaling. Our cloud platform is a scalable, comprehensive, and end-to-end
solution for the IT security needs of our customers. Our customers can seamlessly
add new coverage, users and services after they have deployed our platform.
Up to date resources. Qualys has one of the largest knowledge bases of vulnerability
signatures in the industry. All security updates are made in real-time.
Data stored securely. Data is securely stored and processed in a multi-tiered
architecture of load-balanced servers. Our encrypted databases are physically
and logically secured.
We were founded and incorporated in December 1999 with a vision of transforming
the way organizations secure and protect their IT infrastructure and applications
and initially launched our first cloud solution, Vulnerability Management (VM),
in 2000. As VM gained acceptance, we introduced new solutions to help customers
manage increasing IT security and compliance requirements. Today, the suite
of solutions offered on our cloud platform, which we refer to as the Qualys
Cloud Apps, includes: Asset Inventory (AI), CMDB Sync (SYN), VM, Continuous
Monitoring (CM), Cloud Agent Platform (CAP), Threat Protection (TP), Security
Configuration Assessment (SCA), Indication of Compromise (IOC), Policy Compliance
(PC), PCI Compliance (PCI), Security Assessment Questionnaire (SAQ), File Integrity
Monitoring (FIM), Web Application Scanning (WAS) and Web Application Firewall
(WAF).
Our cloud platform consists of a suite of asset management, IT security, compliance
monitoring, and web application security solutions, which we refer to as the
Qualys Cloud Apps, that leverages our shared and extensible core services and
our highly scalable multi-tenant cloud infrastructure. We also provide open
application program interfaces, or APIs, and other developer tools that allow
third parties to embed our technology into their solutions and build applications
on our cloud platform.
Our cloud platform utilizes sensors, including physical, virtual and cloud
scanners, and cloud agents that provide our customers with continuous visibility
enabling customers to respond to threats immediately. It automatically gathers
and analyzes security and compliance data in a scalable, state-of-the-art backend.
The technology underlying our cloud infrastructure enables us to ingest, process,
analyze and store a high volume of sensor data coming from our agents, scanners
and passive analyzers, and correlate information at very high speeds in a distributed
manner for millions of devices.
Our core services enable integrated workflows, management and real-time analysis
and reporting across all of our IT security and compliance solutions for our
customers inside their organizations, on the perimeter, on endpoints or in the
cloud.
Our core services constitute dynamic and customizable dashboards and centrally
managed, self-updating integrated Cloud Apps, through what we call a “single-pane-of-glass”
user interface. Our interactive, dynamic dashboards and cloud platform allow
our customers to aggregate and correlate all of their IT, security and compliance
data in one place, drill down into details, and generate reports customized
for different audiences. Our cloud platform’s powerful elasticsearch clusters
enable customers to instantly find detailed data on any asset.
Our core services include:
Asset Tagging and Management. Enables customers to easily identify, categorize
and manage large numbers of assets in highly dynamic IT environments and automates
the process of inventory management and hierarchical organization of IT assets.
Built on top of this core service is the Qualys AI framework, which is a global
asset inventory service enabling our customers to search for information on
any IT asset, scaling to millions of assets for customers of all sizes, helping
IT and security personnel to search IT assets and maintain an up-to-date inventory
on a continuous basis.
Reporting and Dashboards. A highly configurable reporting engine that provides
customers with reports and dashboards based on their roles and access privileges.
Questionnaires and Collaboration. A configurable workflow engine that enables
customers to easily build questionnaires and capture existing business processes
and workflows to evaluate controls and gather evidence to validate and document
compliance.
Remediation and Workflow. An integrated workflow engine that allows customers
to automatically generate helpdesk tickets for remediation and to manage compliance
exceptions based on customer-defined policies, enabling subsequent review, commentary,
tracking and escalation. This engine automatically distributes remediation tasks
to IT administrators upon scan completion, tracks remediation progress and closes
open tickets once patches are applied and remediation is verified in subsequent
scans.
Big Data Correlation and Analytics Engine. Provides elasticsearch capabilities
for indexing, searching and correlating large amounts of security and compliance
data with other security incidents and third-party security intelligence data.
Embedded workflows enable customers to quickly assess risk and access information
for remediation, incident analysis and forensic investigations.
Alerts and Notifications. Creates email notifications to alert customers of
new vulnerabilities, malware infections, scan completion, open trouble tickets
and system updates.
Many organizations have an array of heterogeneous point tools that do not interoperate
well and are difficult and costly to maintain and integrate, making it difficult
for Chief Information Officers (CIOs) and Chief Information Security Officers
(CISOs) to obtain a single, unified view of their organization’s security
and compliance posture. The Qualys cloud platform and its Cloud Apps help organizations
escape this tool-fragmentation dilemma by drastically simplifying their security
stacks and regaining unimpeded visibility across their IT environment.
The Cloud Apps are self-updating, centrally managed and tightly integrated,
and cover a broad range of functionality in areas such as vulnerability management,
IT asset management, IT security, web app security and compliance monitoring.
Our suite of Cloud Apps currently includes: AI, SYN, VM, CM, CAP, TP, SCA,
IOC, PC, PCI, SAQ, FIM, WAS and WAF.
We believe that our applications are easy to use and provide our customers
with a high level of control because our applications are part of one platform,
share a common user interface, utilize the same scanners and agents, access
the same collected data, and leverage the same user permissions.
Our customers can subscribe to one or more of our security and compliance Apps
based on their initial needs and expand their subscriptions over time to new
areas within their organization or to additional Qualys solutions. We offer
three editions of our Qualys Cloud Apps: Enterprise for large enterprises, Express
for medium-sized businesses, and Express Lite for small-sized businesses.
Many of our customers use multiple Cloud Apps to develop a more complete understanding
of their respective environment’s security and compliance posture. The
Qualys cloud platform currently provides the following Cloud Apps to our customers:
Asset Management
Asset Inventory (AI): AI provides a complete, continuously updated inventory
of a customer’s IT assets everywhere: on premises, in clouds or at mobile
endpoints. It lists assets’ installed software, existing vulnerabilities
and hardware details. A powerful search engine enables ad hoc queries and refines
such queries. In addition to Qualys’ network scanners, AI leverages our
Cloud Agents, which are lightweight, self-updating and run in the background.
These Cloud Agents continuously enable the assessment of the compliance and
security status of customer assets, including intermittently connected assets,
without the need for scan windows or credential management.
CMDB Sync (SYN): This certified application synchronizes AI data with ServiceNow’s
Configuration Management system. Device changes are immediately transmitted
to the Qualys cloud platform and then synchronized with ServiceNow. For customers,
this means an end to unidentified and misclassified assets and to data update
delays, all of which decrease chances of breaches. SYN provides real-time, comprehensive
visibility of IT asset inventories enabling immediate detection of security
and compliance risks.
IT Security
Vulnerability Management (VM): VM is an industry leading and award-winning
solution that automates network auditing and vulnerability management across
an organization, including network discovery and mapping, asset management,
vulnerability reporting and remediation tracking. Driven by our comprehensive
knowledge base of known vulnerabilities, VM enables cost-effective protection
against vulnerabilities without substantial resource deployment.
Continuous Monitoring (CM): Built on top of VM, CM is a next-generation cloud
service that can detect network threats and unexpected changes before they turn
into breaches. Whenever it spots an anomaly in your network, it immediately
sends targeted, informative alerts to the right people for each situation and
each machine. CM tracks what happens throughout public perimeters, internal
networks, and cloud environments - anywhere in the world.
Threat Protection (TP): Thousands of new vulnerabilities are disclosed annually.
With TP, customers can pinpoint their most critical threats and identify what
they need to remediate first. TP continuously correlates external threat information
against a customers vulnerabilities and IT asset inventory, so customers know
which threats pose the greatest risk to their organization at any given time.
As Qualys engineers continuously validate and rate new threats from internal
and external sources, TP’s live feed displays the latest vulnerability
disclosures and maps them to customers’ impacted IT assets. Customers
can see the assets affected by each threat, and drill down into details.
Security Configuration Assessment (SCA): A VM add-on, SCA expands our VM program
with automatic assessment of IT assets’ configurations using the latest
Center for Internet Security (CIS) Benchmarks for operating systems, databases,
applications and network devices. SCA provides intuitive workflows for assessing,
monitoring, reporting and remediating security-related configuration issues.
SCA’s CIS assessments are provided via a web-based user interface and
delivered from the Qualys cloud platform, enabling centralized management with
minimal deployment overhead. SCA users can automatically create downloadable
reports and view dashboards.
Indication of Compromise (IOC): IOC delivers threat hunting, detects suspicious
activity, and confirms the presence of known and unknown malware for devices
both on and off the network. From its single console, customers can monitor
current and historical system activity for all on-premises servers, user endpoints,
and cloud instances - even for assets that are currently offline or have been
re-imaged by IT. IOC utilizes the Cloud Agent to capture endpoint activity on
files, processes, mutant handles, registries, and network connections, and uploads
the data to the Qualys cloud platform for storage, processing, and query.
5.85% 
196.41 %