Tool integration

Qualys WAS Integration Guide

Qualys Web Application Scanning for continuous web app vulnerability detection

Get a Free API Key

Integrate Qualys WAS with Vulnetix. Export scan findings from Qualys Web Application Scanning as JSON via the WAS API or GitHub Actions integration, then upload to Vulnetix.

SaaS platformJSONXMLPDF

Run Qualys WAS in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Qualys WAS scan
  uses: Qualys/github-action-qwas@v1
  with:
    QUALYS_APISERVER: ${{ secrets.QUALYS_APISERVER }}
    QUALYS_USERNAME: ${{ secrets.QUALYS_USERNAME }}
    QUALYS_PASSWORD: ${{ secrets.QUALYS_PASSWORD }}
    APP_ID: ${{ secrets.QUALYS_APP_ID }}
    WAIT_FOR_RESULT: true

- name: Upload report
  run: vulnetix upload --file Qualys_WAS_Scan_Result.json

How Vulnetix compares: better together

Vulnetix does not replace Qualys WAS. Keep running it. Vulnetix sits on top of Qualys WAS (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

CapabilityVulnetixQualys WAS
Security coverage
SAST (static code analysis)Built-in rules + Semgrep augmentation
SCA / dependencies40+ ecosystems, transitive graph
DAST (dynamic testing)~ Ingests DAST results; no native dynamic engineCore: cloud DAST for web apps + REST/SOAP APIs, OWASP Top 10 + OWASP API Top 10, misconfig and sensitive-data exposure
Container & imageImage CVEs, base image, Dockerfile
IaC / misconfigurationTerraform, k8s, CloudFormation
Secret scanning1,000+ rules, source + binary + git history
Cloud / CSPMCloud-posture findings, compliance tab
Mobile (MAST)~ Ingests mobile scanner output; no native mobile engine
License complianceSPDX, copyleft/AGPL/SSPL policy
SBOM generationCycloneDX 1.7 + SPDX 2.3, cosign-signable
Malware / supply-chainDe-duplicated corpus + install-time firewall (25+ registries)~ Included Web Malware Detection scans external-facing web apps for malicious content via behavioural/deep-learning analysis, website-serving malware, not supply-chain package malware
Network / infra vuln~ Ingests network scanner output; no native network scanner
FuzzingIngests fuzzing crashes; no native fuzzer
Pentest / bug bountyIngests pentest/bug-bounty findings; not a testing service
The Vulnetix orchestration layer
Cross-scanner dedup & one queue (ASPM)Correlates every scanner into one prioritised queue with ownership routing
Exploit-intel prioritisationEPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV
Reachability analysisTree-sitter + CVEAffected; direct/transitive/semantic
Versioned VEX + audit trailImmutable OpenVEX/CycloneDX, cosign-signable
Safe Harbour autofixResolves + applies the nearest safe version
End-of-life policyFlags/blocks past-EOL runtimes & packages
SSVC / risk-based policySSVC v2 + CISA/FedRAMP/Essential-8 presets

✓ full · ~ partial · ✗ not covered

What Qualys WAS does well

Where Vulnetix adds to it: Vulnetix runs no DAST or web-malware scans of its own. It ingests Qualys WAS results and consolidates them. Note the malware overlap is different in kind: WAS detects malicious content served by a live website, whereas Vulnetix's malware/package-firewall guards install-time supply-chain packages across 25+ registries. Vulnetix layers cross-scanner dedup, exploit-intel prioritisation, reachability, versioned VEX and SSVC over the WAS dynamic findings.

No migration, no rip-and-replace. Qualys WAS keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Qualys WAS results in Vulnetix

Upload Qualys WAS JSON, XML, PDF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Qualys WAS documentation ↗

Wire Qualys WAS into your CI/CD pipeline →