Qualys, a provider of disruptive cloud-based IT, security and compliance solutions, is opening up its risk management platform to AppSec teams to bring their own detections to assess, prioritize and remediate the risk associated with first-party software and its embedded open source components. The new Qualys solution enables organizations to bring their own detection and remediation scripts created using popular languages like PowerShell and Python to Qualys Vulnerability Management, Detection and Response (VMDR) as Qualys ID (QIDs), which the Qualys Cloud Agent executes in a secure and controlled manner.

Qualys TruRisk then detects and prioritizes the findings in the same workflow and reporting as used for the third-party software findings. This empowers application and security teams to leverage their own detections to identify sensitive content, assess critical process and application statuses, tag assets based on sensitive or PII data presence, and mitigate risks associated with critical vulnerabilities like Log4J by configuring file parameters or addressing Follina by modifying GPOs/registry settings to efficiently manage the risk arising from both first and third-party sources.

The new Qualys platform capabilities allow teams to:

• Easily Build Your Own Signatures: Create Qualys Detections (QIDs) and remediations based on your own logic or scripts leveraging major scripting languages such as Python, PowerShell and others. These detections integrate directly into VMDR workflows and TruRisk scoring, helping SecOps teams unify and manage risk across first and third-party applications in their environment.
• Proactively Detect, Manage and Reduce Supply Chain Risks: Get continuous, real-time visibility into deeply embedded open source software packages, such as Log4J, openSSL and commercial software components leveraging the Qualys Cloud Agent. Qualys TruRisk then prioritizes and correlates the information based on data from over 25 threat feeds and the asset’s business criticality. This information allows security teams to rapidly mitigate the risk of high-profile security issues such as zero-day threats and Log4J outbreaks by crafting custom detection and responses.
• Effectively Communicate Risk with Unified Reporting and Dashboarding: With native integration to VMDR workflows, effectively communicate the unified view of risk in first and third-party software to the right stakeholders via real-time dashboards and reports. Integration with ticketing systems such as ServiceNow and JIRA enables the automatic assigning of detailed remediation tickets to the right owners through a common view to quickly close tickets and reduce risk.

Enhancements to the Qualys Cloud Platform, including Custom Assessments and Remediation via VMDR integrations, will be available by the end of August. Click here to sign up for a free trial.