Qualys External Attack Surface Management

Qualys External Attack Surface Management provides an outside-in view of an organization's internet-facing infrastructure and continuously monitors connected assets. It discovers domains, subdomains, cloud workloads, web applications, APIs, certificates, and exposed services, then identifies organizational ownership and maps relationships. The service can flag unmanaged resources such as unapproved cloud services, test environments, and abandoned assets, and detect newly exposed assets or changes to existing services. Qualys TruRisk scores prioritize findings using vulnerabilities, misconfigurations, asset criticality, and external exposure. Discovered assets can be added to inventory and scanned with VMDR for vulnerabilities, exposed services, certificates, and configuration weaknesses. Listed native integrations include VMDR, Certificate View, Policy Compliance, and Web Application Scanning. CSAM with EASM can create PCI-DSS and FedRAMP asset security health reports and provides bidirectional ServiceNow CMDB integration. The service is managed from a public or private cloud and accessed through a browser, without local server or software installation. A no-cost CSAM with EASM offer is listed for 30 days; other pricing is on request. Shodan-based discovery on leased IPv4 netblocks requires contacting a Qualys Technical Account Manager.

Qualys EASM focuses on discovering, attributing, and prioritizing internet-facing assets. Its listed no-cost offer is time-limited, and pricing beyond it is on request.

It suits security teams that need to identify and monitor external-facing assets and connect findings to vulnerability or compliance workflows. Organizations seeking Shodan-based discovery on leased IPv4 netblocks need to contact a Qualys Technical Account Manager to enable it.

Qualys External Attack Surface Management is a managed service for finding and assessing internet-facing assets. It suits organizations that need broad external visibility tied to Qualys security workflows. Its strongest case is continuous discovery and risk prioritization; the 30-day no-cost offer does not provide a permanent free tier.

Overview

EASM discovers domains, subdomains, cloud workloads, web applications, APIs, certificates and publicly exposed services, then identifies which assets belong to an organization and maps their relationships. That combination helps security teams find unmanaged resources such as unapproved cloud services, test environments and abandoned assets, rather than relying only on a known asset inventory.

Continuous monitoring detects newly exposed assets and changes to existing internet-facing services. Qualys TruRisk scores prioritize assets using vulnerabilities, misconfigurations, criticality and external exposure. Teams can add discoveries to inventory and scan them with VMDR, linking outside-in visibility to vulnerability assessment of exposed services, certificates and configuration weaknesses. The product is less compelling for organizations that need a standalone discovery tool without a broader Qualys workflow.

Key features

• Discovery and attribution: Broad coverage of internet-facing infrastructure, plus ownership mapping, gives teams a way to make sense of assets they did not know they had.
• Change monitoring and risk scoring: Continuous detection paired with TruRisk prioritization helps teams focus on exposed changes with meaningful security context, rather than treating every discovery as equally urgent.
• Qualys security workflows: Native integrations include VMDR, Certificate View, Policy Compliance and Web Application Scanning. CSAM with EASM can also produce PCI-DSS and FedRAMP asset-security-health reports.
• External enumeration: Shodan data can identify exposed assets on leased IPv4 netblocks. A Qualys Technical Account Manager must enable this discovery, adding a coordination step for teams that need it.
• Asset operations: CSAM provides enriched, bidirectional ServiceNow CMDB integration for maintaining an updated asset view. Extensible XML-based APIs and integrations with GRC, ticketing, SIEM, ERM and IDS systems support broader workflows.
• Managed deployment: The service runs from public or private cloud, requires no server or software installation, and is accessed through a browser. Qualys documents end-to-end encryption, strong access controls and SAML 2.0 enterprise SSO for CSAM.

Pricing

Qualys uses a freemium pricing model, but there is no ongoing free plan. The Qualys CyberSecurity Asset Management 3.0 with External Attack Surface Management offer costs free, billed every 30 days, and includes CSAM with EASM at no cost for 30 days. It is best treated as a short evaluation, not a lasting option for teams that need continuing coverage; pricing after the offer is custom pricing on request.

The 30-day offer includes external and cloud asset discovery, continuous monitoring, API access, certificate discovery, revocation workflows, TLS certificate support and CA integrations. It also lists capabilities across registry scanning, SBOM generation, image scanning, runtime protection, Kubernetes security, admission control, authenticated scanning, API testing, browser-based scanning and CI/CD integration. For a security team assessing its breadth, that is a substantial trial scope. There is no cheaper continuing tier with fewer capabilities or published seat and quota limits to compare.

Platforms

Qualys identifies API, Linux and web as platforms. Its deployment is browser-based and fully managed from public or private cloud, with no local software installation required. The service is described as hybrid; listed supported platforms also include Windows, Linux and Mac. Offline device support is not included. Reboot controls can defer reboots, and scheduled deployment is supported.

Who it's for

EASM is a good fit for organizations with complex internet-facing estates that need to uncover shadow IT, map asset ownership and continuously track exposure. It is especially suitable for teams already using Qualys products or integrating asset data into ServiceNow and enterprise security systems. Smaller teams seeking a permanent free service, or buyers looking only for container image or source-code scanning, should consider more focused alternatives.

Pros and cons

Pros

• Wide external asset coverage: Discovers infrastructure ranging from cloud workloads and APIs to certificates and exposed services, useful when asset inventories may be incomplete.
• Risk context and follow-through: TruRisk prioritization and VMDR scanning connect discovery to vulnerability work instead of leaving teams with an unranked list.
• Enterprise workflow support: ServiceNow CMDB integration, SAML 2.0 SSO, compliance reporting and extensible APIs support operational and governance needs.

Cons

• No lasting free plan: The no-cost offer ends after 30 days, so ongoing use requires a paid arrangement.
• Custom pricing: Buyers cannot compare a published ongoing price or seat-based tiers before contacting Qualys.
• Shodan discovery requires coordination: A Technical Account Manager must enable leased-netblock enumeration, which may slow teams that depend on that coverage.

Alternatives

Choose Snyk Open Source instead if your priority is source dependency analysis and you want a permanent free tier covering five projects; its Team plan is $25 a month, billed monthly, for up to 10 developers. For open-source container vulnerability scanning, Trivy is a free, self-hosted option with no trial, while Clair is another free, self-hosted choice for container image vulnerability analysis.

Docker Desktop is a better fit for developers seeking Docker tooling with a free Personal plan for one user, one Docker Scout-enabled repository, 100 Docker Hub pulls per hour and one private Docker Hub repository; Docker Pro costs $9 a month. Grype suits teams seeking a free, open-source vulnerability scanner. Mondoo CSPM is worth considering for free tools spanning cloud, Kubernetes, OS, SaaS and API scanning. RapidFort is more specific to teams seeking five curated near-zero-CVE images from a limited catalog, with daily rebuilds and patching. Aqua Container Security may suit buyers seeking paid container security capabilities with a trial and repository-based pricing.

For category browsing, see Container Image Scanning Tools, Dynamic Application Security Testing Software, Security Configuration Management Software, Container Security Software, Database Vulnerability Scanners and Vulnerability Scanning Software.

Verdict

Choose Qualys EASM if your organization needs continuous discovery and prioritization across a broad internet-facing estate, particularly when Qualys and ServiceNow workflows are already central. The key reason to look elsewhere is the lack of a permanent free tier or transparent ongoing price; teams wanting a narrow, free scanner can find more direct options.