Integrate Qualys WAS with Vulnetix. Export scan findings from Qualys Web Application Scanning as JSON via the WAS API or GitHub Actions integration, then upload to Vulnetix.
Run Qualys WAS in CI
Scan on every push and upload the report as a workflow artifact:
- name: Run Qualys WAS scan
uses: Qualys/github-action-qwas@v1
with:
QUALYS_APISERVER: ${{ secrets.QUALYS_APISERVER }}
QUALYS_USERNAME: ${{ secrets.QUALYS_USERNAME }}
QUALYS_PASSWORD: ${{ secrets.QUALYS_PASSWORD }}
APP_ID: ${{ secrets.QUALYS_APP_ID }}
WAIT_FOR_RESULT: true
- name: Upload report
run: vulnetix upload --file Qualys_WAS_Scan_Result.json
How Vulnetix compares: better together
Vulnetix does not replace Qualys WAS. Keep running it. Vulnetix sits on top of Qualys WAS (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
| Capability | Vulnetix | Qualys WAS |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✓ Core: cloud DAST for web apps + REST/SOAP APIs, OWASP Top 10 + OWASP API Top 10, misconfig and sensitive-data exposure |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ~ Included Web Malware Detection scans external-facing web apps for malicious content via behavioural/deep-learning analysis, website-serving malware, not supply-chain package malware |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Qualys WAS does well
- Cloud-based DAST that automates discovery, inventory and continuous testing of web apps + APIs across the wider Qualys Cloud Platform for unified asset management
- Strong API security: imports OpenAPI v3, tests REST/SOAP and covers the OWASP API Top 10 with prebuilt signatures (BOLA, excessive data exposure, rate limiting)
- Included Web Malware Detection uses behavioural/deep-learning analysis to catch external-facing sites serving malicious content, including client-side JavaScript threats
- AI scan optimisation claims ~96% detection while cutting scan times up to 80% versus sequential scanning
Where Vulnetix adds to it: Vulnetix runs no DAST or web-malware scans of its own. It ingests Qualys WAS results and consolidates them. Note the malware overlap is different in kind: WAS detects malicious content served by a live website, whereas Vulnetix's malware/package-firewall guards install-time supply-chain packages across 25+ registries. Vulnetix layers cross-scanner dedup, exploit-intel prioritisation, reachability, versioned VEX and SSVC over the WAS dynamic findings.
No migration, no rip-and-replace. Qualys WAS keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Qualys WAS results in Vulnetix
Upload Qualys WAS JSON, XML, PDF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.