Qualys TotalCloud vs Upwind CNAPP
Qualys TotalCloud
qualys.com
Upwind CNAPP
upwind.ioSide by side
| Figure | Qualys TotalCloud | Upwind CNAPP |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| API | Yes | Yes |
| Plans published | 3 | 0 |
| Spec score · Cloud-Native Application Protection Platforms | 8.1 (#4) | 7.0 (#12) |
| Compliance | Built-in policy frameworks include CIS, PCI-DSS, HIPAA and NIST, with compliance reports and alert rules. | Upwind’s Trust Center lists SOC 2 Type 2, ISO/IEC 27001:2022, and GDPR among its compliance items. |
| Founded | 1999 | 2022 |
| Headquarters | Foster City, California, United States | San Francisco, California, United States |
| Integrations | Supported TotalCloud integrations include GitHub, GitLab, Bitbucket, Jenkins, Bamboo, Azure DevOps, VSCode, Jira, and ServiceNow. | The integrations page lists Jira, Slack, GitHub Actions, and AWS CloudTrail among its popular integrations. |
| Support | Qualys subscriptions include 24/7/365 telephone and online customer and technical support, free training, and certification. | The documentation offers 24/7 support through live chat in the management console, email, or a shared Slack channel. |
Plans
Qualys TotalCloud
- 30-day free trialFree
- TotalCloud Free licenseFree
- Qualys Cloud Platform subscriptionPriced on request
In their own words
Qualys TotalCloud
Qualys TotalCloud is a cloud-native application protection platform for multi-cloud and container environments. It covers AWS, Azure, Google Cloud Platform, and Oracle Cloud Infrastructure through a single license, control plane, and TruRisk score. Its security domains include CSPM, CWPP, CIEM, CDR, Kubernetes and container security, IaC, SSPM, DSPM, and AI-SPM. TruRisk prioritizes verified, attackable exposures using exploitability, threat intelligence, asset criticality, and runtime context. FlexScan offers agentless, agent-based, network, and pipeline scanning. QFlow provides more than 300 automated playbooks and integrates with ServiceNow, Jira, SIEM, and SOAR platforms. Qualys says TotalCloud can assess cloud resources, including transient and ephemeral resources, in under 10 minutes. It also manages SaaS security posture for Microsoft 365, Salesforce, Zoom, and Google Workspace. Pre-built policy frameworks include CIS, PCI-DSS, HIPAA, and NIST. A free license with limited API calls for control evaluation is listed; subscription pricing is available on request.
Upwind CNAPP
Upwind CNAPP brings application security, cloud security posture, and real-time protection together across the cloud lifecycle, from development through production. Agentless cloud scanners and runtime sensors build live inventory, identify exposures, and protect workloads as they run. Listed capabilities include CSPM, CIEM, DSPM, AI-SPM, attack path analysis, vulnerability management, Kubernetes and serverless security, API security, DAST, and cloud detection and response. Upwind describes live inventory and high-signal exposure prioritization as ways to focus on exposures. The platform supports AWS, Google Cloud, Microsoft Azure, and Oracle Cloud, and is available through web and API. Its integrations directory includes tools such as Jira, Slack, GitHub Actions, GitLab, and Argo CD, as well as ChatGPT, xAI Grok, OpenAI Enterprise, Anthropic Enterprise, and Claude. Upwind says stored data is protected with encryption, access controls, and authentication, and data in transit with TLS and HSTS. The Trust Center lists SOC 2 Type 2, ISO/IEC 27001:2022, and GDPR. Pricing is on request; the CNAPP page invites prospective customers to request a demo.