Welcome back to Radical Security Reviews. Last time we reviewed Tenable Nessus; this time it's the other name that comes up in nearly every vulnerability management conversation: Qualys VMDR — Vulnerability Management, Detection and Response.

Short version: if you want a vulnerability management program rather than just a scanner — continuous visibility, prioritization and reporting in one cloud console — Qualys is one of the strongest choices on the market. Below we cover setup, daily use, finding quality, reporting, pricing, why PCI teams in particular trust it, and a few things worth knowing before you buy.

How we review products

The same ground rules apply to every review in this series. We don't resell anything — no vendor pays for placement, there are no affiliate links, and we have no commercial relationship with Qualys. We only review tools we've run in real environments on real engagements. And "positive" doesn't mean "uncritical": the edges are in the good to know section so you can buy with open eyes. You can find every review in our Product Reviews section.

What Qualys VMDR is — and what it isn't

Qualys has delivered vulnerability scanning from the cloud since the early 2000s — long before "cloud-native" was a buying criterion. VMDR is its flagship: asset discovery and inventory, vulnerability assessment, threat-based prioritization and patch detection in a single workflow, all running on the Qualys Cloud Platform.

Data comes in through sensors: lightweight Cloud Agents on servers and endpoints, virtual or physical scanner appliances for network scans, and cloud connectors for AWS, Azure and Google Cloud. Whatever the source, results land in the same console, against the same asset record.

What it isn't: it isn't a penetration test — it's the continuous, broad coverage that makes a pen test sharper, as we explain in Vulnerability Scanning vs. Penetration Testing. It isn't an EDR. And it isn't a single tool you install on a laptop — it's a platform, and that's the point. Where a standalone scanner gives you the engine, VMDR gives you the engine and the dashboard together.

One credential worth knowing up front: Qualys is a PCI SSC Approved Scanning Vendor (ASV) and one of the longest-standing names in PCI scanning. More on that in the PCI section.

Setup and first scan

There is no console to install, no database to maintain and no server to size. You log in to the web console and you're working. Deployment follows two paths, and most organizations use both:

  • Cloud Agents roll out through whatever software deployment tooling you already use. They start reporting within minutes and assess hosts without scan windows or credential management — a genuine operational win.
  • Scanner appliances drop into network segments for agentless scanning of everything that can't take an agent: network gear, printers, appliances and IoT devices. Import the image, register it, define targets, scan.

First results arrive the same day. On large estates, plan the agent rollout like any software deployment — in waves — but because Qualys runs the back end, there's no capacity planning for your side at all.

Day-to-day use

Daily use is where the platform approach pays off:

  • Continuous visibility. Agents assess hosts continuously, including laptops that never touch the office network, so nothing slips through the gaps between scheduled scans. For hybrid teams this is a big deal — see patching a remote workforce.
  • Asset inventory built in. Hardware and software inventory come with the data the agents already collect, including software that has reached end of life — the risk we cover in End-of-Life Software.
  • Dynamic tags. Tag assets by rule — "PCI CDE", "Production", "Finance" — and scans, reports and dashboards follow the tags automatically as assets come and go.
  • Dashboards and trending. Open criticals, remediation time and progress by business unit are built in, which makes vulnerability management metrics a matter of choosing widgets rather than building spreadsheets.
  • A knowledge base that keeps up. Detections are updated continuously, and vulnerabilities in CISA's Known Exploited Vulnerabilities catalog are easy to isolate.

Finding quality

Agent-based assessment is authenticated by design: the agent reads what's actually installed rather than inferring it from network banners. Accuracy is high, and the version-guessing noise we describe in Taming False Positives in Vulnerability Scans largely disappears.

Each detection carries what a team needs to act: severity, a description of the threat and its impact, a concrete solution, the evidence the check observed, CVEs and CVSS scores. Two features turn that raw data into decisions:

  • TruRisk prioritization combines vulnerability severity, real-world threat intelligence such as active exploitation, and the business criticality of the asset into a single risk score — the practical answer to "what do we fix first?" It's risk-based vulnerability management out of the box.
  • Patch detection maps vulnerabilities to the patches that resolve them, so a list of hundreds of findings becomes a short list of updates to deploy.

Why PCI teams rely on Qualys

Qualys has been part of PCI scanning since the standard's earliest scanning requirements, and VMDR maps onto PCI DSS v4.0 cleanly. The requirements where it shines:

  • Requirement 11.3.1 — internal vulnerability scans. Scheduled appliance scans plus continuous agent data cover the quarterly internal scans, and rescans confirm fixes. Tag your CDE assets once and the quarterly evidence essentially assembles itself.
  • Requirement 11.3.1.2 — authenticated internal scanning. Agents are authenticated by nature, and appliance scans use stored authentication records — exactly what this requirement, mandatory since March 2025, expects. Background in Authenticated Internal Scanning: What Requirement 11.3.1.2 Means for You.
  • Requirement 11.3.2 — external scans via an ASV. Qualys is an Approved Scanning Vendor with a dedicated PCI compliance service for quarterly external scans, including the workflow for submitting false-positive disputes. What counts as a pass is covered in ASV Scans Explained.
  • Requirement 6.3.3 — timely patching. Patch detection and remediation dashboards make it easy to track critical patches against PCI's one-month installation window.
  • Requirement 11.4.5 — segmentation validation. Scanner appliances placed in different segments show what can actually reach the CDE, a natural first step before the penetration test the requirement calls for. More in Segmentation Testing: What Requirement 11.4.5 Actually Requires.

And because reports can be scoped to the CDE tag, they double as assessor evidence — the kind of dated, scoped artifact a QSA asks for, as we note in Preparing for Your QSA Assessment.

Reporting

Reporting is one of VMDR's strongest areas. Dashboards are built from configurable widgets with trending over time; scheduled reports can target any tag; templates cover executive, technical and compliance audiences; and exports come in PDF, CSV and HTML. An API and ticketing integrations push findings into the systems your IT team already works in.

The underrated benefit is history. Because every scan lives in the platform, "how much better are we than last quarter?" is a dashboard, not a spreadsheet project — which makes board security reporting far less painful.

Good to know before you buy

None of these are dealbreakers, and all of them are useful to know going in:

  • It's a platform, so there's a learning curve. Tags, option profiles and authentication records take a day or two to set up well. That time pays itself back quickly.
  • Capabilities are modular. VMDR covers the core program; adjacent capabilities such as configuration compliance auditing, patch deployment and web application scanning are separate apps. Scope what you need up front.
  • Licensing is per asset. Count carefully, including cloud instances that come and go, so your subscription matches your real estate.
  • Agent rollout is a project on large estates. A one-time one — after that, coverage maintains itself.

Pricing and licensing

VMDR is sold as an annual subscription priced by the number of assets, with additional apps added as needed, and Qualys offers a free trial. Check Qualys for current figures; the important point is the shape of the pricing. Cost scales with what you protect, and the infrastructure overhead — servers, databases, upgrades, scan engine maintenance — is zero, because Qualys runs it.

If you're comparing options, our guide to choosing a vulnerability scanner lays out the criteria — coverage, credentialed scanning, KEV data, integrations, pricing — and VMDR scores strongly across all of them.

Who should buy Qualys

Qualys VMDR is an easy recommendation for:

  • Mid-sized and larger organizations that want a complete vulnerability management program — inventory, assessment, prioritization and reporting — in one console.
  • PCI-driven organizations that want internal scans, authenticated scanning, external ASV scans and CDE-scoped reporting from a single vendor.
  • Distributed and remote workforces, where agents follow laptops wherever they go.
  • Teams that report upward and need trending and metrics without building them by hand.

Who might not need it? A very small environment that only needs periodic scans may find a standalone scanner the simpler fit — our Nessus review covers that end of the market.

The verdict

Recommended. Qualys VMDR turns vulnerability scanning into a vulnerability management program: continuous agent-based visibility, accurate authenticated findings, risk-based prioritization that tells you what to fix first, and dashboards that show progress over time — with no infrastructure to maintain. For PCI environments it's a natural fit, from authenticated internal scanning and CDE tagging to external scans from one of the most established ASVs in the industry.

If Nessus is the best scanning engine you can run yourself, Qualys is one of the best ways to have the whole program delivered from the cloud. Both earn our recommendation; the right choice depends on whether you need the engine or the platform. And if you'd like help turning findings into a remediation plan, that's exactly what our vulnerability management team does.

Frequently asked questions

Can I use Qualys for PCI compliance?

Yes. VMDR covers the quarterly internal vulnerability scans in Requirement 11.3.1 and the authenticated internal scanning required by 11.3.1.2, and Qualys is a PCI SSC Approved Scanning Vendor, so it can also perform the quarterly external ASV scans required by 11.3.2. Tagging your cardholder data environment keeps scans, reports and QSA evidence neatly scoped.

Qualys or Nessus — which should I choose?

Both are excellent. Nessus Professional is a standalone scanner you run yourself, ideal for smaller teams and consultants. Qualys VMDR is a cloud platform with agents, asset inventory, prioritization and dashboards built in, ideal when you want a full vulnerability management program in one console. The choice usually comes down to engine versus platform.

Do I need agents, scanner appliances, or both?

Most organizations use both. Agents give continuous, authenticated visibility on servers and laptops wherever they are; scanner appliances cover devices that can't run an agent, like network gear and printers, and provide the network view needed for perimeter and segmentation checks.

Key takeaways

  • Qualys VMDR is a cloud-delivered platform combining asset inventory, vulnerability assessment, prioritization and patch detection — recommended for organizations building a full program.
  • Cloud Agents provide continuous, authenticated visibility, including remote laptops, with no scan windows.
  • TruRisk prioritization and patch mapping turn long finding lists into short fix lists.
  • PCI teams get internal and authenticated scanning, external ASV scans, CDE tagging and QSA-ready reports in one place.
  • Built-in dashboards and trending make metrics and board reporting easy.
  • Invest a little setup time in tags and profiles, size licensing by asset count, and start with the free trial.