Qualys VMDR — Sensors, Asset Inventory, TruRisk & the Closed Loop

① What Qualys VMDR actually is — one cloud platform, one loop

The key idea: VMDR stands for Vulnerability Management, Detection and Response, and it runs on the Qualys Cloud Platform — a SaaS back end, not a box you rack. You deploy lightweight sensors, and they stream data to the cloud where all the analysis happens.

VMDR is built as one closed loop with four stages: Asset (discover and inventory everything), Detect (find vulnerabilities and misconfigurations), Prioritize (rank by real risk with TruRisk), and Respond (deploy the right patch). The interview line: VMDR is not a scanner — it is a single platform that takes you from 'what do I own?' all the way to 'the worst hole is now patched and verified', without you stitching separate tools together.

② The sensors and the global inventory — agents vs scanners

VMDR is only as good as the data its sensors feed it. The main options: Cloud Agents (a lightweight agent on Windows/Linux/macOS/cloud instances giving continuous, authenticated visibility — even when the host is off the corporate network), Scanner Appliances (virtual or physical, doing authenticated and unauthenticated network scans of anything you can reach), Passive Network Sensors (sniff traffic to spot unmanaged and rogue devices), Cloud Connectors (API links into AWS/Azure/GCP to inventory cloud assets), and the Qualys API for automation and integration.

Agents vs scanners — the question you will be asked

A cloud agent is best for laptops, servers and cloud hosts — it is always-on, authenticated by default, and near-real-time, with tiny network overhead. A scanner is best for devices you cannot install software on — printers, IoT, network gear, legacy boxes — and for unauthenticated 'outside-in' checks. Most real estates run both: agents on everything that takes them, scanners for the rest. On top of all sensors, CyberSecurity Asset Management (CSAM) builds one normalised, searchable global asset inventory.

③ Detect and prioritize — QIDs, TruRisk and threat intel

Every vulnerability check Qualys ships is a QID (Qualys ID) — a stable signature number that can map to one or more CVEs. When a sensor's data matches a QID, that is a detection against an asset. A big estate has tens of thousands of detections, so raw CVSS alone is useless for deciding what to fix first.

TruRisk turns 'severity' into 'risk'

The Qualys Detection Score (QDS) rates each QID from 1–100 (Low, Medium, High, Critical) using CVSS plus real-time threat indicators — exploit code maturity, active exploitation in the wild, malware and ransomware/threat-actor use, and CISA known-exploited status. The TruRisk Score then rolls QDS together with asset criticality into an asset/group score from 0–1000 (Low, Medium, High, Severe). The lesson: a medium-CVSS bug that is being actively exploited on a business-critical server outranks a 'critical' CVSS bug nobody is using on a test box.

④ Respond — closing the loop with integrated Patch Management

This is what makes it 'Response', not just 'detection'. From the same console, you select the highest-TruRisk findings and Qualys maps them to the correct patches for your exact environment, then deploys them through integrated Patch Management — often using the same cloud agent that detected the issue, so there is no separate patch tool to feed.

Deploy without breaking things

Start with discovery and detection in monitor mode, let CSAM and TruRisk baseline what really matters, then build patch jobs for the top-risk vulnerabilities — schedule them, ring them out to a pilot group first, and re-scan to verify the QID is gone. The failure mode everyone hits is treating the list by CVSS and patching everything at once: you cause outages and never close the genuinely dangerous, actively-exploited findings. Drive remediation by TruRisk, verify by re-detection — that is the closed loop.