Cloud Platform
Cloud platform apps

Cloud platform apps

Web Application Firewall.

Block attacks and virtually patch web application vulnerabilities.

Industry-leading cloud service for scalable, simple and powerful protection of web applications


We are excited that Qualys WAF will allow us to act quickly and respond to threats by using the one-click virtual patching feature to remediate active vulnerabilities.

David Cook David Cook Chief Security Officer at Jive Software


True, integrated web app security

Qualys gives you a single, interactive console for web app vulnerability detection (WAS) and attack protection (WAF) for seamless identification and mitigation of risks — for a dozen apps or thousands. You scan web apps using WAS, deploy virtual patches for vulnerabilities in WAF and manage it all from a centralized portal.

Cloud agility

With no special hardware to buy nor maintain, WAF can be quickly deployed for apps on public or private clouds, and scaled quickly. Application traffic stays in your environment to minimize latency and maintain control. Virtual machine images of WAF appliances can be deployed alongside web applications using VMware vCenter, Hyper-V or Amazon EC2 AMI.

Full visibility into firewall operation

WAF gives you complete visibility into its data for continuous monitoring, risk assessments and remediation paths. A dashboard summarizes website traffic information and security event trends. Detailed threat information lets you assess severity and adjust security settings. Search for suspicious activity and drill down into threat data to gain actionable insights.

Strong rules, flexible control

WAF protects your web apps with strong security policies backed by Qualys’ security intelligence and one-click responses to events. You can address specific application security needs with simple, customizable and reusable policies and custom rules. WAF comes with out-of-the-box policies for popular platforms such as WordPress, Joomla, Drupal and Outlook Web Application.

Prevent breaches by blocking
attacks on web server

You can’t protect – nor defend yourself from – what you don’t know is in your network, like unapproved devices and unauthorized software. Qualys gives you full horizontal visibility of all hardware and software, scaling up to millions of assets – on premises, in cloud instances and mobile endpoints.

  • Protect cloud apps
    • Quickly and easily protect apps in public or private clouds by deploying virtual machine images containing Qualys WAF sensor software alongside your web apps. No need to buy special nor maintain special hardware
    • Add as many new applications as necessary as often as you need, as these virtual machines scale seamlessly in AMI format for Amazon EC2, in OVA format for VMware vCenter and in VHD format for Hyper-V
    • Ensure high performance and availability of business-critical web apps thanks to built-in load balancing of web servers and application health checks
  • Adopt a new approach for web app security with Qualys WAF’s adaptive policies, which are always up to date and don’t require specialized expertise, nor complex rulesets to configure and maintain
    • Describe the security level for each application with a few clicks, and Qualys WAF automatically decides what to do in different situations
    • Simplify Qualys WAF configuration with built-in security policies for popular platforms such as WordPress, Joomla, Drupal and Outlook Web Application
  • Defend yourself from current and future threats with customizable protection
    • Block a wide range of attacks such as Cross-Site Scripting (XSS), SQL injection, corrupted requests, and more with native protection. Qualys’ security experts add defenses as new threats emerge
    • Tailor how Qualys WAF handles different types of threats, from simply logging the event to actively blocking it
    • Create custom security rules to address specific security needs of your application and minimize false positives
    • Maintain website uptime by complementing network DDoS defenses with protection against HTTP-based attacks
  • Protect your users against clickjacking, Cross-Site Scripting (XSS), and other browser-based attacks with Qualys WAF’s security features for modern web browsers
  • Integrate WAF into your DevSecOps environment and protect web servers hosting the apps you’re rapidly and iteratively developing and deploying

Benefit from native, deep integration between WAF and WAS

With the new ScanTrust feature, Qualys WAF combines with Qualys WAS to provide true, integrated web application security: Detect with WAS, protect with WAF and get scalable scanning, false-positive reduction and one-click patching to web apps.

  • From a single console, use WAS to detect vulnerabilities in web apps, including mobile and IoT apps, and – with one click – mitigate them with WAF virtual patches

  • Leverage the creation of these virtual patch rules to fine-tune policies, remove false positives, and customize security rules

  • Avoid the redundancies and gaps that come with trying to glue separate, siloed solutions

  • Evaluate and create exceptions to web events to better prioritize and mitigate vulnerabilities by combining WAF rules and policies with WAS scan data

  • Integrate web app scan data via a rich, extensive set of APIs into other security and compliance systems, such as firewalls, and SIEM and ERM solutions

Simplify IT compliance

It’s easier than ever for employees to bypass their IT department and adopt web apps, a trend that generates significant security and compliance risks. Simultaneously, the quantity and complexity of government regulations, industry mandates and internal policies that impact InfoSec technologies and processes continues to grow. WAF can help you comply.

  • Address mandates such as PCI DSS 6.6 that require app firewalls

  • Comply with policies and regulations that prohibit access to certain web applications or information from particular locations by restricting access from specific countries or network address blocks

  • Prevent transmission of sensitive data by blocking users’ ability to upload or download content or files in unapproved or suspicious formats

Visualize and report

You need an easy, intuitive way of understanding the security of all your web applications at once. WAF gives your security team complete visibility into its data for continuous monitoring, risk assessments and remediation paths. WAF tools for visualization and reporting include a graphics-rich dashboard, interactive insights and detailed information on each threat and ways to address it.

  • Spot unusual patterns in the dashboard, which shows summarized website traffic information and trends of WAF security events, including when they occurred and where they originated

  • Quickly assess severity and adjust your security settings for aggressive mitigation or to minimize false positives by leveraging detailed information on each threat detected by WAF

  • Use extensive filtering and dynamic search capabilities to identify suspicious activity, drill down into threat data and the Qualys KnowledgeBase, and gain actionable insights into the threat landscape

Powered by the Qualys Cloud Platform

Single-pane-of-glass UI

See the results in one place, in seconds. With AssetView, security and compliance pros and managers get a complete and continuously updated view of all of their IT assets — from a single dashboard interface. Its fully customizable and lets you see the big picture, drill down into details, and generate reports for teammates and auditors. Its intuitive and easy-to-build dynamic dashboards aggregate and correlate all of your IT security and compliance data in one place from all the various Qualys Cloud Apps. With its powerful elastic search clusters, you can now search for any asset – on-premises, endpoints and all clouds – with 2-second visibility.

Centralized & customized

Centralize discovery of host assets for multiple types of assessments. Organize host asset groups to match the structure of your business. Keep security data private with our end-to-end encryption & strong access controls. You can centrally manage users’ access to their Qualys accounts through your enterprise single sign-on (SSO). Qualys supports SAML 2.0-based identity service providers.

Easy deployment

Deploy from a public or private cloud — fully managed by Qualys. With Qualys, there are no servers to provision, no software to install, and no databases to maintain. You always have the latest Qualys features available through your browser, without setting up special client software or VPN connections.

Scalable and extensible

Scale up globally, on demand. Integrate with other systems via extensible XML-based APIs. You can use Qualys with a broad range of security and compliance systems, such as GRC, ticketing systems, SIEM, ERM, and IDS.

See for yourself. Try Qualys for free.

Start your free trial today. No software to download or install. Contact us or call us at +1 800 745 4355.