Skip to content
SPECIFICTION
Get listed

Qualys TotalCloud

qualys.com

Free plan WebAPI
Visit qualys.com
Spec score 8.2 #4 of 25 in Cloud Infrastructure Entitlement Management Software

What it is

Qualys TotalCloud is a cloud-native application protection platform for multi-cloud and container environments. It covers AWS, Azure, Google Cloud Platform, and Oracle Cloud Infrastructure through a single license, control plane, and TruRisk score. Its security domains include CSPM, CWPP, CIEM, CDR, Kubernetes and container security, IaC, SSPM, DSPM, and AI-SPM. TruRisk prioritizes verified, attackable exposures using exploitability, threat intelligence, asset criticality, and runtime context. FlexScan offers agentless, agent-based, network, and pipeline scanning. QFlow provides more than 300 automated playbooks and integrates with ServiceNow, Jira, SIEM, and SOAR platforms. Qualys says TotalCloud can assess cloud resources, including transient and ephemeral resources, in under 10 minutes. It also manages SaaS security posture for Microsoft 365, Salesforce, Zoom, and Google Workspace. Pre-built policy frameworks include CIS, PCI-DSS, HIPAA, and NIST. A free license with limited API calls for control evaluation is listed; subscription pricing is available on request.

Spec sheet

What it does
Qualys TotalCloud is a cloud-native application protection platform covering cloud infrastructure, workloads, applications, containers, identities, SaaS and AI security.Read 14 Oct 2026 · docs.qualys.com
Integrations
Supported TotalCloud integrations include GitHub, GitLab, Bitbucket, Jenkins, Bamboo, Azure DevOps, VSCode, Jira, and ServiceNow.Read 30 Sep 2026 · docs.qualys.com
Compliance
Built-in policy frameworks include CIS, PCI-DSS, HIPAA and NIST, with compliance reports and alert rules.Read 14 Oct 2026 · docs.qualys.com
Support
Qualys subscriptions include 24/7/365 telephone and online customer and technical support, free training, and certification.Read 30 Sep 2026 · qualys.com
Headquarters
Foster City, California, United StatesRead 23 Sep 2026 · qualys.com
Founded
1999Read 23 Sep 2026 · qualys.com
Acquisition history
TrustRadius says TotalCloud originated as Blue Hexagon, acquired by Qualys in October 2022.Read 14 Oct 2026 · trustradius.com
API documentation
Qualys publishes online help, API user guides, release notes and platform-specific API server guidance for TotalCloud.Read 14 Oct 2026 · docs.qualys.com
App requirements
Qualys Agent is free, requires iOS or iPadOS 12 or later, and requires backend enterprise setup.Read 14 Oct 2026 · apps.apple.com
Attack-path analysis
TruRisk prioritizes verified exposures using exploitability, threat intelligence, asset criticality and runtime context.Read 14 Oct 2026 · docs.qualys.com
Automated remediation
QFlow supplies more than 300 automated playbooks and supports no-code remediation workflows.Read 14 Oct 2026 · docs.qualys.com
Cloud coverage
The platform supports AWS, Azure, Google Cloud Platform and Oracle Cloud Infrastructure through one license, control plane and TruRisk score.Read 14 Oct 2026 · docs.qualys.com
Company facts
Qualys, Inc. is a public company founded in 1999, headquartered in Foster City, United States, with 1,001–5,000 employees listed by Gartner.Read 14 Oct 2026 · gartner.com
Connector catalog
Qualys lists more than 100 connectors overall, including 14 marked as working with Total Cloud.Read 14 Oct 2026 · qualys.com
Continuous detection
Cloud Detection and Response continuously monitors for emerging threats.Read 14 Oct 2026 · docs.qualys.com
Deployment model
The documented product is delivered through Qualys cloud services and uses connectors, agents, snapshots and appliances for assessment.Read 14 Oct 2026 · docs.qualys.com
Detection accuracy
Qualys states that its scanning methods provide up to Six Sigma accuracy of 99.99966%.Read 30 Sep 2026 · qualys.com
Government compliance
Qualys announced that TotalCloud CNAPP achieved FedRAMP High authorization for cloud security and compliance assurance.Read 30 Sep 2026 · blog.qualys.com
Infrastructure-as-code
TotalCloud scans IaC templates before deployment and integrates with GitHub, GitLab, Bitbucket, Jenkins, Bamboo, Azure DevOps and VS Code.Read 14 Oct 2026 · docs.qualys.com
ITSM integrations
Documented integrations include Jira and ServiceNow for ticketing, CMDB synchronization and remediation workflows.Read 14 Oct 2026 · docs.qualys.com
Limit: integration cost and complexity
Gartner's displayed dislikes identify integration cost and complexity as recurring concerns.Read 14 Oct 2026 · gartner.com
Limit: OS-specific guidance
The same TrustRadius review said remediation guidance could include more operating-system-specific detail.Read 14 Oct 2026 · trustradius.com
Limit: pricing
PeerSpot respondents describe TotalCloud pricing as expensive or on the pricier side.Read 14 Oct 2026 · peerspot.ai
Limit: user interface
PeerSpot reviews call for a more modern UI and report slower platform load times.Read 14 Oct 2026 · peerspot.com
Notable news
Qualys announced TotalCloud 2.0 with TruRisk Insights and SaaS security capabilities in 2024.Read 14 Oct 2026 · qualys.com
Open-source scanning
TotalCloud 2.0 scans open-source software components in compute workloads and containers before execution.Read 14 Oct 2026 · qualys.com
Praise: risk prioritization
AWS Marketplace reviewers describe using TotalCloud to prioritize high-risk findings and coordinate remediation across multi-cloud assets.Read 14 Oct 2026 · aws.amazon.com
Praise: unified visibility
Gartner reviewers repeatedly praise a single view of multi-cloud resources, vulnerabilities, misconfigurations and compliance risks.Read 14 Oct 2026 · gartner.com
Praise: vulnerability identification
A TrustRadius reviewer praised vulnerability identification, multi-operating-system support and forwarding affected-file details to Cisco Security.Read 14 Oct 2026 · trustradius.com
Prerequisite
Initial setup requires configuring a CSPM connector linking a cloud-provider account to Qualys.Read 14 Oct 2026 · docs.qualys.com
Product type
Qualys TotalCloud is a unified Cloud-Native Application Protection Platform for multi-cloud and container environments.Read 30 Sep 2026 · qualys.com
Public API
The TotalCloud REST API uses the cloudview-api module with versioned paths and supports provider and object operations such as GET and POST.Read 14 Oct 2026 · docs.qualys.com
Rating on Apple App Store
The Qualys Agent app has too few ratings for Apple to display an overview.Read 14 Oct 2026 · apps.apple.com
Rating on AWS Marketplace
4.3 out of 5 from 49 ratingsRead 14 Oct 2026 · aws.amazon.com
Rating on Gartner Peer Insights
4.6 out of 5 from 74 ratingsRead 14 Oct 2026 · gartner.com
Rating on TrustRadius
8 out of 10 from 4 reviewsRead 14 Oct 2026 · trustradius.com
Release cadence
The Qualys release index lists TotalCloud releases 2.26 through 2.28 during July through September 2026, including separate API releases.Read 14 Oct 2026 · qualys.com
Remediation
QFlow provides more than 300 automated playbooks and integrates with ServiceNow, Jira, SIEM, and SOAR platforms.Read 30 Sep 2026 · docs.qualys.com
Risk prioritization
TruRisk prioritizes verified, attackable exposures using exploitability, threat intelligence, asset criticality, and runtime context.Read 30 Sep 2026 · docs.qualys.com
SaaS protection
TotalCloud manages security posture across SaaS applications including Microsoft 365, Salesforce, Zoom, and Google Workspace.Read 30 Sep 2026 · qualys.com
SaaS security
The product extends posture monitoring to SaaS applications including Microsoft 365, Salesforce, Zoom and Google Workspace.Read 14 Oct 2026 · qualys.com
Scanning
FlexScan provides agentless, agent-based, network, and pipeline scanning for multimodal cloud asset discovery.Read 30 Sep 2026 · docs.qualys.com
Scanning methods
FlexScan supports agentless API scanning, network or virtual-appliance scanning, snapshot assessment, cloud agents and pipeline scanning.Read 14 Oct 2026 · docs.qualys.com
Security authorization
Qualys markets TotalCloud as FedRAMP High authorized and lists continuous compliance mappings such as PCI DSS 4.0, HIPAA, NIST 800-53, DORA and GDPR.Read 14 Oct 2026 · qualys.com
Security domains
The platform integrates CSPM, CWPP, CIEM, CDR, Kubernetes and container security, IaC, SSPM, DSPM, and AI-SPM.Read 30 Sep 2026 · docs.qualys.com
Security modules
TotalCloud combines CSPM, CWPP, CIEM, CDR, Kubernetes and container security, IaC security, SSPM, DSPM and AI-SPM.Read 14 Oct 2026 · docs.qualys.com
Status
Qualys's live status page currently lists Total Cloud as operational.Read 14 Oct 2026 · qualys.statuspage.io
Unified visibility
Its inventory provides a centralized view of cloud resources across multiple accounts and providers.Read 14 Oct 2026 · docs.qualys.com
Visibility speed
Qualys says TotalCloud can assess cloud resources, including transient and ephemeral resources, in under 10 minutes.Read 30 Sep 2026 · qualys.com

Plans and prices

30-day free trial Free at no cost for 30 days TotalCloud with TruRisk Insights evaluation Read 14 Oct 2026 · qualys.com
TotalCloud Free license Free limited API calls for control evaluation Read 30 Sep 2026 · cdn2.qualys.com
Qualys Cloud Platform subscription Priced on request pricing varies by Cloud Platform Apps · network addresses (IPs) · web applications · user licenses Read 30 Sep 2026 · qualys.com

Every Qualys TotalCloud plan and price →

Strong points and limits

Strong points

  • Covers four cloud providers under one control plane.
  • FlexScan supports agentless, agent-based, network, and pipeline scanning.
  • QFlow includes more than 300 automated playbooks.
  • Pre-built frameworks include CIS, PCI-DSS, HIPAA, and NIST.

Limits

  • Free license has limited API calls.
  • Subscription pricing is available only on request.

Who it suits

TotalCloud suits teams managing cloud, container, and SaaS security across the listed cloud providers. Its scanning methods and automated playbooks may fit teams that need exposure prioritization and remediation workflows.

Qualys TotalCloud in depth

Read the full write-up

Qualys TotalCloud is a hybrid cloud security platform for organizations protecting workloads, containers, and SaaS across multiple providers. It is best suited to teams that need several security disciplines and remediation in one control plane. Its breadth is a strong reason to consider it; the subscription’s custom pricing makes the cost harder to forecast.

Overview

TotalCloud covers AWS, Microsoft Azure, Google Cloud Platform, and Oracle Cloud Infrastructure under a shared license, control plane, and TruRisk score. It brings cloud posture, workload protection, entitlement management, detection and response, Kubernetes and container security, infrastructure as code, SaaS, data, and AI security together. That reach can reduce fragmentation for multi-cloud teams, but may be more platform than organizations seeking a single-purpose tool need.

TruRisk ranks verified, attackable exposures using exploitability, threat intelligence, asset criticality, and runtime context. FlexScan supports agentless, agent-based, network, and pipeline scanning. Qualys says TotalCloud can assess cloud resources, including transient and ephemeral assets, in under 10 minutes, and claims scanning accuracy up to 99.99966%. These vendor claims address speed and precision, but the value depends on how well the resulting findings fit a team’s environment and response process.

Key features

Security across cloud domains: CSPM, CWPP, CIEM, CDR, Kubernetes and container security, IaC, SSPM, DSPM, and AI-SPM share a platform. This is useful for teams consolidating work across disciplines, though buyers should weigh that breadth against the cost of licensing a wider platform.

Remediation workflows: QFlow provides more than 300 automated playbooks and integrates with ServiceNow, Jira, SIEM, and SOAR platforms. Email, Slack, Microsoft Teams, PagerDuty, and Jira tickets are supported response actions. These options can connect exposure findings to existing operations; teams without established workflows may gain less from automation.

SaaS posture: TotalCloud manages security posture for Microsoft 365, Salesforce, Zoom, and Google Workspace, extending coverage beyond cloud infrastructure.

Compliance and development integrations: Pre-built frameworks include CIS, PCI-DSS, HIPAA, and NIST. Supported integrations include GitHub, GitLab, Bitbucket, Jenkins, Bamboo, Azure DevOps, VSCode, Jira, and ServiceNow, making the platform relevant to teams tying security checks to development and service workflows.

Support and government authorization: Qualys subscriptions include 24/7/365 telephone and online customer and technical support, free training, and certification. Qualys has announced FedRAMP High authorization for TotalCloud CNAPP, which matters to organizations with that compliance requirement.

Pricing

The TotalCloud Free license costs nothing and has limited API calls for control evaluation. It offers a way to evaluate controls, but the API cap makes it unsuitable as a substitute for a full production subscription.

The Qualys Cloud Platform subscription has custom pricing. Cost varies by Cloud Platform Apps, network addresses (IPs), web applications, and user licenses, so organizations should scope those needs before comparing total cost. Qualys also offers a 30-day trial. No seat, asset, renewal, or trial-extension terms are given.

The free license is the lower-commitment option for limited evaluation; the paid subscription is for teams needing broader platform use, but its variable licensing factors make budgeting less straightforward than a fixed-price plan.

Platforms

TotalCloud is a hybrid deployment and supports API and web platforms. Its cloud coverage includes AWS, Microsoft Azure, Google Cloud Platform, and Oracle Cloud Infrastructure. Container, serverless, and Kubernetes protection are supported, as are CentOS, Red Hat Enterprise Linux, and Ubuntu hosts.

Who it's for

TotalCloud is a strong fit for security teams managing several cloud providers and wanting posture, workload, identity, container, SaaS, data, and AI security under a shared risk view. It is also relevant to organizations that can make use of automated playbooks, development integrations, and the included support. Teams that need only one security capability, or that require a predictable published subscription price, should look elsewhere.

Pros and cons

Pro: Four cloud providers share a license, control plane, and TruRisk score, giving multi-cloud teams a common exposure view.

Pro: FlexScan offers four scanning approaches, while QFlow adds more than 300 playbooks and integrations with common ticketing and security operations platforms.

Pro: SaaS posture coverage, compliance frameworks, and development integrations extend the platform beyond infrastructure scanning.

Con: The free license has limited API calls and is positioned for control evaluation, not broad ongoing use.

Con: Subscription cost varies with several licensed quantities and apps, making a budget difficult to estimate without a scoped quote.

Con: Its extensive set of security domains may be unnecessary for teams looking to solve only a narrow cloud security problem.

Alternatives

For a broader comparison of products in this category, see Cloud-Native Application Protection Platforms. Readers focused on identity entitlements can compare Cloud Infrastructure Entitlement Management Software; those prioritizing workload defenses can browse Cloud Workload Protection Platforms. For a scanning-led shortlist, see Cloud Vulnerability Scanners, while a wider platform comparison is available in Cloud Security Platforms and Cloud Security Posture Management Software.

CrowdStrike Falcon Surface is a paid alternative with a free trial and custom-priced Falcon Exposure Management; consider it when comparing exposure-management products rather than selecting on a free plan.

Tenable One Attack Surface Management offers unified visibility across IT, cloud, web applications, OT, and external attack surfaces. Its Tenable One Foundation plan has no stated price; choose it when that cross-domain attack-surface view is the priority.

Uptycs CNAPP has a Discover — Workload plan at $36 a year, with a $12K minimum annual order. It may fit buyers comparing a workload-focused entry point, though the minimum order is a significant commitment.

Cloudanix offers Cloud Pro Posture at $3.49 a month per monitored asset, billed at month-end, with a 100-asset minimum and CSPM, CIEM, compliance, and attack paths. It is worth considering when those functions and asset-based billing align with the requirement.

Sysdig Secure bases licensing on the number of hosts in the environment, including compute instances for CSPM. Consider it when host-based licensing is a better fit for comparing costs.

FortiCNAPP offers Standard tiers with one- or three-year terms and entitlement per vCPU. It may suit buyers who prefer term-based, vCPU-entitled licensing.

Palo Alto Networks Cortex Cloud API Security is another paid option.

Cyscale CNAPP has a Pro plan at $850 a month billed annually for up to 1,000 assets and 10 connectors, with full platform access. It is a comparison point for teams that want a priced asset-and-connector tier.

Verdict

Choose Qualys TotalCloud if your team needs a shared view across multiple clouds and security disciplines, especially when automated remediation and SaaS posture are part of the job. Its main advantage is the combination of broad coverage, TruRisk prioritization, scanning options, and operational integrations. Look elsewhere if you need one focused capability or a subscription price you can budget from a published rate.

Verdict

TotalCloud combines cloud, container, and SaaS security capabilities with exposure prioritization and automated playbooks. A limited free license is listed, while subscription pricing is available on request.

Where Specifiction places it

Alternatives to Qualys TotalCloudAll alternatives →