Integrate Qualys container scanning with Vulnetix. Use the Qualys Cloud Agent or qscanner CLI to scan container images and export findings for Vulnetix.
How Vulnetix compares: better together
Vulnetix does not replace Qualys QScanner. Keep running it. Vulnetix sits on top of Qualys QScanner (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Qualys QScanner is strongest at its core category and also carries features in SCA, SBOM Generation, Secret Scanning, Cloud Security & CSPM, just as Vulnetix spans categories.
| Capability | Vulnetix | Qualys QScanner |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Software composition analysis of image packages for Ruby, Rust, PHP, Java, Go, Python, .NET and Node.js |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✓ Core: scans container images and Docker V2 registries for OS/package CVEs across CI/CD and registries |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ Proactively scans images for exposed secrets/keys/tokens |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ~ Assesses running k8s clusters and Docker hosts for misconfigurations/posture (CSPM-adjacent); IaC-template scanning is a separate Qualys tool (qiac/CloudView), not QScanner |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✓ Generates an SBOM at first scan, re-evaluated against updated signatures; SBOM output format supported |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ~ Zero-day malware scanning of registry/images (image-time detection, not a supply-chain install-time package firewall) |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ TruRisk weights exploitability/threat relevance; Qualys-proprietary rather than a published EPSS/KEV blend |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Qualys QScanner does well
- Enterprise-grade container image and Docker V2 registry scanning backed by 35+ Qualys threat feeds and a mature vuln signature engine, with a build-time SBOM re-evaluated against new signatures without re-pulling the image
- TruRisk score prioritises CVEs by real-world exploitability rather than raw CVSS alone
- Single self-serve CLI fits CI/CD gating (GitHub Actions, Jenkins, Harbor) with JSON, Table, SARIF and SBOM output and build-fail policy; scans images from Docker, Containerd, CRI-O, Podman or local OCI layouts
- Detects zero-day malware and exposed secrets in registry/image scans in addition to OS/package CVEs, and ties into the broader Qualys Container Security platform for k8s cluster and Docker-host posture
Where Vulnetix adds to it: Vulnetix ingests QScanner findings (SARIF/JSON/SBOM) and dedups them alongside SAST, IaC, cloud and other scanners into one prioritised queue, layering EPSS + CISA KEV + Coalition ESS + Vulnetix LEV, tree-sitter reachability, immutable versioned VEX with audit trail, Safe Harbour autofix PRs, EOL and SSVC policy on top. It complements rather than replaces Qualys' image/registry scanning engine.
No migration, no rip-and-replace. Qualys QScanner keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Qualys QScanner results in Vulnetix
Upload Qualys QScanner SARIF, CycloneDX, SPDX, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.