Qualys VMDR Explained: Cloud Agent, TruRisk Scores and Patching from the Prioritisation Report

Qualys is one of the longest-established vulnerability management vendors, and VMDR (Vulnerability Management, Detection and Response) is its core product. It is a common choice in large enterprises and regulated industries, so analysts often meet it first in a job rather than in a lab.

What it is

VMDR is a cloud service that inventories assets, detects vulnerabilities and misconfigurations, prioritises them with the TruRisk scoring model, and can trigger patching. Related Qualys products include TotalCloud (cloud security, with agentless and snapshot-based scanning), Enterprise TruRisk Management (bringing in third-party findings) and TruRisk Eliminate (patching and mitigation). In March 2026 Qualys announced an AI agent for safe exploit validation.

How it works

Sensors. VMDR uses several kinds of sensor:

• the Cloud Agent installed on hosts
• network scanners
• passive sensors that watch traffic
• container sensors
• mobile agents

Each vulnerability check has a Qualys ID (QID). Configuration checks are based on CIS benchmarks.

Scoring. Each detection gets a Qualys Detection Score (QDS) built from:

• the CVSS rating
• exploit maturity
• evidence of exploitation
• use by threat actors, malware or ransomware
• the likelihood of exploitation in the next 30 days

Each asset has an Asset Criticality Score from 1 to 5. The asset's TruRisk Score, from 0 to 1000, combines its criticality with the detection scores on it and weights internet-facing assets more heavily. A newer TruRisk 2.0 model exists but is not on by default.

How to use it

Day one: deploy agents and scanners

Install the Cloud Agent on servers and laptops through your software deployment tools, and place scanners in network segments that hold devices you cannot put agents on, such as appliances and printers. Add cloud connectors through TotalCloud so cloud assets appear without waiting for agents.

Week one: set criticality and check coverage

1. Tag assets by business service and environment, and set asset criticality for the systems that matter. Without it, TruRisk cannot tell a payment server from a test VM.
2. Compare inventory with your CMDB and cloud accounts. Assets with no agent and never scanned are the gap.
3. Read the prioritisation report for the top assets by TruRisk Score and the detections driving them.

Every day: patch, mitigate, verify

Send findings to owners as ServiceNow tickets through the ITSM integration. With a Patch Management subscription, deploy missing patches directly from the prioritisation report. Where a patch is not possible yet, use a mitigation, such as disabling a vulnerable service, and record the exception with an expiry date. Confirm fixes with the next agent upload or scan.

Where it stops

• Scores reflect what you tell them. TruRisk depends on criticality tags; untagged assets are weighed as average.
• Patching is an extra subscription, and many remediation features need the Cloud Agent on the host.
• Agents cover hosts, not networks. Exposed services and devices without agents still need scanners.
• Mitigation is not a fix. A disabled service can be re-enabled; track mitigations until the real patch lands.

How it comes up in interviews

• "How would you prioritise 50,000 vulnerabilities?" Exploitation evidence and likelihood, asset criticality, exposure, then fixability.
• "Agent or scanner?" Agents for local accuracy and roaming hosts; scanners for network exposure and devices that cannot run agents.
• "A patch cannot be applied for three months. What do you do?" Mitigate, monitor, document an expiring exception.

Sources

Checked on 13 November 2026: Qualys VMDR getting started documentation; Qualys documentation on understanding the TruRisk Score; Qualys TotalCloud documentation on FlexScan and snapshot-based scanning; Qualys Patch Management release notes for Mitigate Now; Qualys blog announcing TruRisk Eliminate (30 July 2024); Qualys press release on Agent Val (23 March 2026).