Cloud Platform
Solutions
Cloud Platform Apps
Customers
Partners
Community
Support
Company
Login
Contact us
Try it

CyberSecurity Asset Management (CSAM) v2.0

with External Attack Surface Management

Try it free


or call us at +1 800 745 4355.

IDC

Qualys’ unique approach to EASM is integrating the internal and external asset data from CyberSecurity Attack Management with its VMDR solution into a single view.

Michelle Abraham Michelle Abraham Research Director, Security and Trust at IDC
IDC

Qualys CSAM provides invaluable attack surface insights from an external attacker's point of view. The automated workflows enable us to prioritize security engineering actions that will reduce cyber risk and rapidly improve our company's security.

Mike Orosz Mike Orosz Vice President of Information and Product Security at Vertiv
IDC

Asset management in the security operations context isn’t just ‘seeing’ an asset; it is having the right ‘risk’ context of each and every software, hardware and IoT asset at our fingertips.

Jatinder Pal Singh Jatinder Pal Singh Director of Security Operations at Informatica
IDC

With Qualys, organizations can better identify undiscovered assets and immediately access and mitigate the cyber risk within the same workflow.

Michelle Abraham Michelle Abraham Research Director, Security and Trust at IDC
IDC

Qualys CyberSecurity Asset Management allows us to proactively augment our vulnerability management program by discovering risks presented by previously unknown internet-facing devices.

Mike Orosz Mike Orosz Vice President of Information and Product Security at Vertiv

See your attack surface like an attacker would

The attack surface is expanding at an exponential rate, providing attackers with new targets. More than 30% of all on-premises and cloud assets and services are not inventoried. It’s a huge visibility gap for cybersecurity!

CyberSecurity Asset Management (CSAM) is a cloud service that allows customers to continuously discover, classify, remediate, and measurably improve their cybersecurity posture for internal and external IT assets before the attackers can – and with the same actionable intelligence that the attackers use. It discovers all known and previously unknown internet-facing assets for 100% visibility and tracking of risks.

Qualys CSAM 2.0 includes External Attack Surface Management which adds “defense-in-depth” to update an organization’s cybersecurity posture. It provides the ability to continuously discover and classify previously unknown assets with a Red Team-style asset and vulnerability management solution for full 360-degree coverage.

Manage your security posture with Qualys CyberSecurity Asset Management | Qualys, Inc.

Complete asset and software visibility across distributed hybrid environments

Improve threat prioritization with asset criticality ratings

Reduce tech debt with real-time EOL/EOS software tracking compliant with CISA guidelines

Synchronized with CMDB for comprehensive inventory of managed & unmanaged assets

Key Features

Asset Management Built for Security and Integrated with IT

360-degree inventory of the full IT ecosystem

Get an attacker’s view of the enterprise ecosystem with continuous discovery of all assets on-premises, OT, IoT, and in the cloud. CyberSecurity Asset Management uses advanced credentialed and non-credential scanning technologies to continuously and quickly discover and classify vulnerabilities for remediation. It automatically finds known and previously unknown assets ranging from instances and containers to repositories and devices along with domains and subdomains, connected subsidiaries and business partners for full visibility of potential risk vectors.
Read more

Detect and monitor security gaps

CyberSecurity Asset Management enables easy identification of at-risk assets. It automatically assigns the asset criticality score to a tag and the corresponding asset with organizational in-context enrichment data. This context enables analysis of threats and misconfigurations in real time, with six-sigma accuracy. The service continuously detects remotely exploitable vulnerabilities and critical misconfigurations across the global hybrid environment such as EOL/EOS and unauthorized or missing titles. CyberSecurity Asset Management also discovers missing required software, and provides real-time alerts on zero-day vulnerabilities, compromised assets, and network irregularities.
Read more

Orchestrate with VMDR 2.0

Automatically deploy the most relevant, correct, and superseding patch to quickly remediate vulnerabilities and threats across any size environment. CyberSecurity Asset Management automatically quarantines suspicious devices until they can be investigated. As part of the Qualys Cloud Platform, the service continuously delivers integrated endpoint detection & response, vulnerability & patch management, and policy compliance.
Read more

Integrate with ServiceNow

CyberSecurity Asset Management provides enriched ServiceNow CMDB bi-directional integration for a continuously updated view on assets. Certified with the Service Graph Connector Program, it enriches Qualys assets with key CMDB business context data such as data owner. More than 200 enterprise customers use the ServiceNow CMDB integration in production.
Read more

Getting visibility and control of the entire attack surface

External Attack Surface Management (NEW) (2 mins)

External Attack Surface Management (NEW) (2 mins)

CSAM Highlights (2 mins)

Features Overview (5 mins)

Get an attacker’s view of the full IT ecosystem

What isn’t known can’t be secured. CSAM 2.0 with External Attack Surface Management collects data from on-premises devices and applications, all endpoints, cloud, containers, OT, and IoT. It continuously discovers IT assets for 100% real-time visibility of a global hybrid IT environment. The service works in conjunction with the Qualys Cloud Platform and Qualys sensors (scanners, cloud connectors, container sensors, cloud agents, passive sensors and APIs) to continuously discover all assets.

  • Gain actionable intelligence, visibility, and insight into the entire internal and external attack surface

  • Discovers domains, subdomains, and certificates within the enterprise and in subsidiaries and business partners for full visibility of remotely exploitable vulnerabilities – including previously unknown devices via attribution

  • Expose “shadow IT” and baseline discrepancies including VMs, containers, functions-as-a-service, and IoT that spin up faster than IT can track with legacy tools

  • Get an outside-in view of internet-facing assets to spot security endpoint blind spots

  • Reduce tech debt with CISA-compliant end-of-life and end-of-support software tacking, and Ling software versioning to track OS status and related vulnerabilities

    Learn more
Unmanaged assets view in Qualys Global AssetView | Qualys, Inc.

Find security gaps with quantitative cyber risk management

Using a disciplined approach to managing cybersecurity risk will help an organization produce better, faster results for securing the enterprise. CSAM 2.0 with External Attack Surface Management is fully integrated with VMDR 2.0 with Qualys TruRisk. This enables a rigorous cyber risk management process based on automatic correlation of discovered assets, associated vulnerabilities found, and their degree of direct impact on the customer’s unique business. Continuous analysis enables viewing potential attacks from the attacker’s perspective: finding the easiest path to compromise business processes or steal the most valuable data. As a result, Cybersecurity teams know exactly which vulnerabilities to address first based on actual risk, and which can be de-prioritized or ignored due to low or no impact on the business.

  • Tag assets for easy grouping

  • Enable risk management

  • Execute like an attacker

  • Enable business impact analysis (BIA)

    Learn more

Unmanaged assets view in Qualys Global AssetView | Qualys, Inc.

Assign risk profile

Focus security prioritization efforts on high-importance and high-risk assets by defining key business and technical context. Asset Criticality is a user-defined measure of asset function, environment, and service and includes the following:

  • The user optionally selects a criticality score on a Tag which is then applied to one or more assets
  • An asset attribute is assigned the highest criticality score among allocated asset tags
  • If pulling data from CMDB, the asset criticality score is automatically assigned to a tag and the corresponding asset

Quickly identify blind spots

When considering IT inventory from a security perspective, it is not sufficient to just have a comprehensive view of the environment. Qualys CyberSecurity Asset Management (CSAM) applies multiple layers of in-context technical and business data to establish a security view of IT inventory that enables easy, quick identification of at-risk assets.

  • Proactively track authorized and unauthorized software
  • Automatically manage multiple software lists based on asset type, location, criticality, and usage
  • Track detailed asset information for flagging configuration issues, security risks, IT policy violations, and non-compliance
Unmanaged assets view in Qualys Global AssetView | Qualys, Inc.

Orchestrate automatic alert, report and response

Orchestration provides automatic response to true business threats. CSAM 2.0 in conjunction with VMDR 2.0 with Qualys TruRisk controls orchestration by thresholds and other criteria set by a team to enable faster MTTR. An orchestration process could be deployment of the most relevant, correct and superseding patch for auto-remediation. Another is automatic quarantine of suspicious devices until team investigation. The service automatically documents compliance with regulations and policies, including full SOC 2 Type II. As part of the Qualys Cloud Platform, CyberSecurity Asset Management is fully integrated with all Qualys services.

  • Alert, report, and respond to identified security risks

  • Auto-document compliance for PCI DSS, FedRAMP, NIST, ISO, and other policies

  • Leverage the integrated Qualys Cloud Platform, to extend beyond External Attack Surface Management

Unmanaged assets view in Qualys Global AssetView | Qualys, Inc.
Unmanaged assets view in Qualys Global AssetView | Qualys, Inc.

ServiceNow integration delivers full context on all assets

Continuous bi-directional synchronization with the ServiceNow CMDB enables automatic enrichment with business and organizational data. This feature populates a ServiceNow CMDB with 360-degree asset data from Qualys and infuses Qualys with relevant CMDB attribute data for business impact analysis (BIA). The result: creation of accurate asset risk profiles and criticality measures to help a team focus on remediating the risk present in the most critical assets first.

Learn more

  • Continuously sync with ServiceNow

  • Add context for security-centric asset visibility

  • Add security and business context to asset inventory

Unmanaged assets view in Qualys Global AssetView | Qualys, Inc.

Powered by the Qualys Cloud Platform

Easy deployment

Deploy from a public or private cloud — fully managed by Qualys. With Qualys, there are no servers to provision, no software to install, and no databases to maintain. You always have the latest Qualys features available through your browser, without setting up special client software or VPN connections.

Centralized & customized

Centralize discovery of host assets for multiple types of assessments. Organize host asset groups to match the structure of your business. Keep security data private with our end-to-end encryption and strong access controls. You can centrally manage users’ access to their Qualys accounts through your enterprise single sign-on (SSO). Qualys supports SAML 2.0-based identity service providers.

Scalable and extensible

Scale up globally, on demand. Integrate with other systems via extensible XML-based APIs. You can use Qualys with a broad range of security and compliance systems, such as GRC, ticketing systems, SIEM, ERM, and IDS.

Learn more about the Qualys Cloud Platform

CyberSecurity Asset Management Resources

CyberSecurity Asset Management (CSAM) 2.0

Datasheet

Qualys Brings External Attack Surface Management (EASM) to...

Press Release

Introducing CyberSecurity Asset Management 2.0 with Natively...

Blog

What is Attack Surface Management?

Blog

Qualys CyberSecurity Asset Management 2.0 with EASM

Watch Video

Introducing Qualys CSAM 2.0 with External Attack Surface Management

Webinar

Qualys CSAM helps discover and manage cybersecurity risks in IT assets

Report

CSAM Deep-Dive Demo

Watch Video

AssetView / CSAM Q&A

Watch Video

See for yourself. Try Qualys CSAM 2.0 with External Attack Surface Management. It's free!

Start your free trial today. No software to download or install. Email us or call us at 1 (800) 745-4355.

Try it free