A vulnerability management platform needs privileged credentials, broad network reach and the power to push patches, so the way it is deployed and administered matters as much as what it finds. This guide explains how to run Qualys VMDR well and how to secure the platform itself: cloud agents, scanner appliances, authentication records and vault integrations, TruRisk prioritisation, patch jobs, user roles and API access. It is written for vulnerability management leads, platform owners and security engineers who operate a Qualys subscription or are taking one over. Product details come from Qualys documentation; NHI Mgmt Group recommendations are labelled as ours. For the general discipline, see the Vulnerability Scanning Guide and the Vulnerability Management Guide.
This is an independent guide from NHI Mgmt Group, based on Qualys's public documentation as of November 2026. It is not sponsored or reviewed by Qualys. Product features change, so confirm settings against Qualys's current documentation.
Key takeaways
- Use agents and appliances together. Cloud agents report from the host over outbound HTTPS on port 443, and scanner appliances assess the network from the inside, also calling the platform outbound on 443, so each covers what the other cannot reach.
- Authenticated scanning is the accuracy lever. Qualys states that authenticated scans give the most accurate results with fewer false positives, and compliance scans require authentication, which makes scan credentials a core asset to protect.
- Keep scan passwords in a vault. Authentication records can fetch credentials from a vault at scan time, and the appliance deletes the retrieved password or key after the scan.
- TruRisk ranks by asset value as well as severity. Asset Criticality Scores of 1 to 5 come from tags, Qualys Detection Scores run from 1 to 100, and the asset TruRisk score is capped at 1000.
- Roles and API clients are privileged access. Manager accounts, Patch Action Manager rights and Subscription Level API clients can change or patch every asset in scope, so give them owners, MFA and reviews.
What the tool does
Qualys VMDR (Vulnerability Management, Detection and Response) is a cloud platform that inventories assets, detects vulnerabilities and misconfigurations, prioritises them with TruRisk, and, with the patch add-on, deploys fixes. Qualys documents three packages: VMDR TruRisk for risk-based vulnerability management, VMDR TruRisk FixIT which adds remediation and patch management, and VMDR TruRisk ProtectIT which adds anti-virus and anti-malware protection.
| Component | What it does | Communication and requirements (per Qualys docs) |
|---|---|---|
| Cloud Agent | Lightweight host agent that collects inventory and vulnerability data and runs patch jobs | Outbound HTTPS on port 443 to the platform URL shown under Help > About; activation key binds the agent to the subscription and can assign tags; local administrator (Windows) or root or sudo (Linux, macOS, AIX) to install |
| Scanner appliance (virtual or physical) | Network scanning of internal targets, including authenticated scans | Outbound only HTTPS on port 443 to platform URLs; polls every three minutes by default; single NIC or split LAN (eth0) and WAN (eth1) |
| Authentication records and vaults | Credentials used for trusted scanning of Windows, Unix, databases, network devices, VMware, Kubernetes and more | Created under Scans > Authentication; optional vault lookup at scan time |
| TruRisk | Risk scoring for vulnerabilities (QDS) and assets (TruRisk score) | ACS from asset tags; QDS 1 to 100; asset score capped at 1000 |
| Patch Management | Deployment jobs for Windows and Linux via the Cloud Agent | Jobs under Jobs > Windows or Linux; patch windows, reboot control and pre and post actions |
Defender use cases
- Continuous host assessment: agents on laptops, servers and cloud instances report without waiting for a scan window, which suits remote workers and short-lived workloads.
- Network and device coverage: scanner appliances reach network devices, appliances and hosts where an agent cannot be installed.
- Configuration compliance: authenticated scans support policy compliance checks, which Qualys requires to run with authentication.
- Risk-based prioritisation: TruRisk weights detections by asset criticality. Qualys recommends prioritising vulnerabilities with a QDS of 70 or higher. See the Vulnerability Prioritisation Guide.
- Closing the loop: from the TruRisk view, Patch Now starts remediation for listed vulnerabilities, and automated patch selection can use Qualys Query Language (QQL) queries based on patches or vulnerabilities.
How TruRisk scores work
| Score | Range | Source | Practical use |
|---|---|---|---|
| Qualys Detection Score (QDS) | 1 to 100: Critical 90 to 100, High 70 to 89, Medium 40 to 69, Low 1 to 39 | Per vulnerability; a QID with several CVEs takes the highest score | Triage threshold for remediation queues |
| Asset Criticality Score (ACS) | 1 to 5 | Asset tags; the highest tag value wins | Encodes business value; set it deliberately |
| TruRisk score (asset) | Up to 1000 | ACS multiplied by weighted averages of QDS per severity band; external assets multiplied by 1.2 | Ranking assets and tracking risk reduction over time |
Because ACS comes from tags, TruRisk is only as good as the tagging. We recommend agreeing criticality tags with asset owners before relying on TruRisk for service level targets (our recommendation).
Deployment and safe use
Rollout plan
- Design roles and business units first: decide who will be Manager, Unit Manager, Scanner, Reader and Remediation User before inviting anyone, and map business units to asset ownership.
- Create activation keys per purpose: in the Cloud Agent module go to Agent Management and choose New Key. Activation keys can assign tags, so separate keys per environment or business unit give clean scoping (our recommendation). Treat keys as sensitive and retire unused ones.
- Pilot agents: install on a pilot ring through your software distribution tool, from an elevated session. Qualys lists 512 MB RAM for inventory, VM and PC, 1 GB for FIM and Patch Management, 200 MB free disk on Windows and TLS 1.2 or later. Proxy support varies by platform across Qualys pages, so confirm the current proxy options for each operating system in Qualys's install guide.
- Deploy scanner appliances: request a personalisation code, deploy the virtual appliance image and allow outbound HTTPS on 443 from the LAN (single network) or the WAN interface (split network). Place appliances where they can reach targets and nothing more.
- Add authentication: create authentication records, ideally backed by a vault, enable authentication in the option profile, and use Enable authentication testing to check credentials before a full scan.
- Verify: check the scan Appendix for authentication status and run the Authentication Report for pass, fail and error codes, then fix failures before the next scan.
- Introduce patching slowly: start with on-demand deployment jobs to a test tag, then scheduled jobs with a patch window.
Scan credentials and vaults
Qualys documents authentication record types for Windows, Unix, Cisco, VMware ESXi and vCenter, Oracle, MS SQL, MySQL, PostgreSQL, MongoDB, Kubernetes, Docker, SNMP and HTTP, and vault integrations including CyberArk, HashiCorp, Azure Key Vault and Thycotic Secret Server. With a vault, the authentication record names a vault type and vault record; the platform sends the appliance the record details, the appliance requests the password, private key or root delegation password from the vault, scans, then deletes the retrieved credential and uploads results. The appliance must be able to reach the vault endpoints.
- Least privilege: Qualys states credentials are used for read access and only for the scan duration. Create dedicated scan accounts per technology, never reuse a domain admin, and restrict where each account can log on (our recommendation). See the Authenticated vs Unauthenticated Scanning Guide.
- Who can create records: Managers can. Unit Managers and Scanners need the Create/edit authentication records/vaults permission. Grant it narrowly.
- Host artefacts: Qualys notes that the optional Dissolvable Agent and Agentless Tracking features can write files to hosts and that temporary files may occasionally remain. Decide whether you need them and document the choice.
Patch jobs
- Scoping: a deployment job can include up to 200 assets and 50 tags, with tag matching on Any or All and exclusion assets or tags.
- Timing: on-demand or scheduled (daily, weekly, monthly, with a Patch Tuesday option), a Patch Window of 30 minutes to 168 hours and optional Randomize Download Time.
- Reboots: Suppress Reboot, Override Reboot, Reboot Request and Reboot Countdown options control user impact.
- Change control: a saved job starts as DISABLED until enabled, and on-demand and run-once jobs cannot be edited or disabled once enabled. Review the asset and patch list before enabling.
- Actions: pre and post actions require the Patch Action Manager role, which can run actions on every asset in a job, so limit it. See the Patch Management Guide.
- Rollback: keep a test tag that receives patches first, and disable a scheduled job to pause a bad rollout while you investigate.
Detection and hardening value
Securing the platform: users, roles and API access
| Role | Scope (per Qualys) | Hardening note (our recommendation) |
|---|---|---|
| Manager | All configurations; manages business units and global settings; can create API clients | Few named people; MFA; quarterly review |
| Unit Manager | Configurations within its business units | Use for regional or team leads instead of Manager |
| Scanner | Launch scans; personal configurations; auth records only if granted | Default role for operators |
| Reader | Reports and vulnerability views | Default for stakeholders and auditors |
| Remediation User | View vulnerabilities, edit, close or ignore tickets | For system owners who fix findings |
| User Administrator | Create and edit users (not other User Administrators), manage business units | Separate from Manager where staff size allows |
- MFA: a Manager can enable Symantec VIP two-factor authentication per user under Users > User Accounts > Security when it is not enabled globally. Turn on a second factor for every account with Manager or patching rights.
- User visibility: under Users > Setup > User Permissions, settings such as Hide users outside the business unit keep business units separate.
- API clients: Qualys Managed Tokens issue JWTs for API authentication. A User Level Client stops working when its user is deactivated, while a Subscription Level Client keeps working, which suits shared automation but needs a named owner and a review date. API calls using basic or session authentication must send the
X-Requested-Withheader, and session users should log out, because too many open sessions can lead to denied access. - Security updates: keep agents and appliances current and apply Qualys security updates promptly.
Every one of these is a non-human identity: activation keys, scan accounts, vault records and API clients. Inventory them like any other machine credential; see the Non-Human Identity (NHI) Guide.
Metrics
- Authentication success rate per technology from the Authentication Report (target above 95%, our recommendation).
- Agent coverage: share of inventoried hosts reporting through a Cloud Agent in the last seven days.
- Mean time to remediate QDS 70 and above, split by ACS.
- Trend in average asset TruRisk score for each business unit.
- Patch job success percentage and reattempt counts.
- Number of Manager accounts and Subscription Level API clients, with age since last review.
Framework mapping
| VMDR capability | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | CIS Controls v8.1 |
|---|---|---|---|
| Agent and scanner inventory | CM-8 System Component Inventory | ID.AM-01 | Control 1 |
| Authenticated scanning and QDS | RA-5 Vulnerability Monitoring and Scanning | ID.RA-01 | Control 7 |
| Patch jobs | SI-2 Flaw Remediation | PR.PS-02 | Control 7 |
| Roles, auth records and API clients | AC-6 Least Privilege; IA-5 Authenticator Management | PR.AA-05 | Control 6 |
See the CIS Control 7 Continuous Vulnerability Management Guide.
Alternatives
Within a Qualys deployment the real choice is between assessment methods, and most programmes use all of them for different asset types.
| Approach | Best for | Trade-off |
|---|---|---|
| Cloud Agent | Laptops, servers and cloud instances you manage | Needs install rights and a software distribution path |
| Authenticated appliance scan | Network devices, databases, hosts without agents | Needs privileged scan credentials and network reach |
| Unauthenticated appliance scan | Attack surface view and unmanaged devices | Less depth; Qualys recommends authentication for accuracy |
| Manual patching outside VMDR | Systems with strict change windows or vendor-certified builds | VMDR still detects; remediation is tracked through tickets |
Small teams often start with agents and a single scanner appliance, then add vault-backed authentication. Large organisations split by business unit, assign Unit Managers and run dedicated appliances per network zone. For programme design see the Risk-Based Vulnerability Management Guide.
Practitioner checklist
- Define roles and business units before onboarding users, and keep Manager accounts to a few named people with MFA.
- Create separate Cloud Agent activation keys per environment, with tags, and retire unused keys.
- Allow outbound HTTPS on 443 to the platform URLs under Help > About for agents and appliances, and nothing inbound.
- Store scan credentials in a supported vault and create dedicated, least privilege scan accounts per technology.
- Run Enable authentication testing and the Authentication Report, and fix failures before the next scan.
- Set Asset Criticality through agreed tags before using TruRisk for service levels; prioritise QDS 70 and above.
- Pilot patch jobs on a test tag, use patch windows and reboot controls, and limit the Patch Action Manager role.
- Give every Subscription Level API client a named owner and review date, and send the X-Requested-With header on API v2 calls.
- Review roles, API clients and auth record permissions every quarter.
Standards and references
- Qualys: Why Use Host Authentication
- Qualys: How to use vaults
- Qualys: Calculating TruRisk Score
- Qualys: User Roles Comparison (Vulnerability Management)
- Qualys: Cloud Agent for Windows prerequisites
- Qualys: Scanner Appliance Communication
- Qualys: Creating Patch Job for Windows Assets
- Qualys: API Authentication using Qualys Managed Tokens
Related NHI Mgmt Group resources: Vulnerability Scanning Guide · Authenticated vs Unauthenticated Scanning Guide · Patch Management Guide · Vulnerability Prioritisation Guide