Most engineers think…
Most people assume vulnerability scanning is just 'point a tool at IPs and get a list of CVEs'. That works for a demo, but it fails in production and in interviews.
Qualys VMDR scanning is a policy-driven pipeline: you define what to check (option profile — ports, QIDs, authentication), what to scan (asset tags and groups), where the scanner sits (internal appliance vs cloud), and when it runs (scheduled windows). Understanding every knob in that pipeline is what separates engineers who get clean, actionable results from engineers who drown the SOC in noise — or miss half the estate because they forgot to place a scanner inside the DMZ.
① Authenticated vs unauthenticated scanning — the coverage gap
Every Qualys VMDR scan is either authenticated or unauthenticated. An unauthenticated scan (also called an external or network scan) probes the host purely from the outside — it checks open ports, service banners and responses without logging in. It finds exposed services and some network-visible vulnerabilities, but it cannot see what software versions are installed inside the OS, what patches are missing, or what misconfigurations exist at the system level.
An authenticated scan uses stored credentials — Windows domain credentials, SSH keys, or local accounts — to actually log into the target. Once inside, Qualys checks the OS patch level, installed software, registry keys, file permissions, running services and configuration settings. Authenticated scans typically find three to ten times more vulnerabilities than an unauthenticated scan on the same host, because the overwhelming majority of CVEs require local access to detect.
Qualys also supports agent-based scanning through the Qualys Cloud Agent, which runs continuously on the endpoint and eliminates the need for credentials altogether — useful for laptops, remote workers and assets that are rarely on the corporate network during scan windows.
Why does an authenticated scan find significantly more vulnerabilities than an unauthenticated scan?
② Option profiles and scan profiles — the control panel
A scan profile in Qualys VMDR is a saved scan job template that bundles a title, target scope, scanner selection and an option profile. The option profile is the granular control panel: it specifies which ports to probe (standard, full 1–65535, or custom), how many parallel hosts and checks to run simultaneously (performance throttle), which authentication records to attach, and the vulnerability detection mode (basic versus comprehensive).
Key option profile tabs
The Scan tab sets ports, performance and detection mode. The Authentication tab links the stored credential records for Windows, Unix/Linux, databases and network devices. The Compliance tab adds policy compliance checks if licensed. A single option profile can be reused across many scan schedules — change it once and every scan that references it inherits the update, which is the main reason you invest in clean profile hygiene rather than copying profiles ad-hoc.
Logs into the host with stored credentials or SSH keys. Checks patch level, registry, config and installed software — finds the vast majority of real CVEs.
Probes only what is network-visible — open ports, banners, service responses. Faster but finds far fewer vulnerabilities than an authenticated scan.
The reusable control panel for a scan: ports, parallel hosts, authentication records, detection mode and compliance checks. Referenced by scan jobs and schedules.
A flexible label (e.g. Location:Mumbai, Criticality:High) applied manually or by dynamic rules. Supports parent/child hierarchy; tag-scoped scans auto-include new matching assets.
Create one option profile per scanning tier (e.g. External-Unauth, Internal-Auth-Standard, Internal-Auth-Comprehensive) and reference them from all scan schedules. When you tune a port list or update credentials, every scan that references that profile inherits the change automatically — no need to edit dozens of individual scan jobs.
Which Qualys object defines the ports to probe, the authentication records to use and the parallel-scan performance settings?
③ QIDs and the KnowledgeBase — what gets checked and when
Every Qualys vulnerability check is identified by a QID (Qualys ID) — a numeric identifier assigned by Qualys in its KnowledgeBase. QIDs cover CVEs, configuration findings and informational checks. When you run a complete scan the scanner applies every QID that is applicable to the detected OS and services. When you run a custom scan you attach search lists — saved lists of QIDs — to scope the option profile to only the checks you care about (e.g. only critical-severity QIDs, or only checks for a specific CVE campaign).
Scheduling in Qualys VMDR lets you set recurring scan windows — daily, weekly, monthly — with a start time, time-zone and a scan duration limit so a slow scan does not bleed into business hours. You can also set a notification email when a scan completes or fails. Scans can be launched on-demand as well, which is useful after emergency patching to confirm remediation before the next scheduled window.
Qualys scan schedules default to UTC. If your assets are in IST (+5:30) and you schedule without adjusting the time-zone, scans run during peak business hours. Set the correct time-zone and a scan duration limit so a slow scan cannot bleed into the next business day or trigger IDS alerts.
▶ Watch an authenticated scan find a critical missing patch
How a single scan job runs end-to-end. Press Play for the healthy path, then Break it to see the classic scanner placement failure.
Your security team needs to scan only for critical-severity vulnerabilities related to a new CVE campaign. What is the correct approach?
④ Scanner placement, asset tags and asset groups
Scanner appliances are virtual or physical Qualys-supplied probes deployed inside your network segments. The Qualys Cloud Scanner (external) probes internet-facing assets from Qualys infrastructure — you do not control it. For internal assets — servers, workstations and devices behind the firewall — you must deploy one or more internal scanner appliances. The rule: a scanner can only reach hosts it has routed, layer-3 access to. DMZs and isolated VLANs each typically need their own scanner.
Asset groups are administrator-defined collections of IP addresses or IP ranges. When you scope a scan to an asset group, only those IPs are targeted; you can also assign a default scanner to an asset group so scans always route to the right appliance automatically.
Asset tags are flexible key-value labels (e.g. Location:Mumbai, Criticality:High, OS:Linux) that you apply to hosts manually, via dynamic rules, or through cloud connector imports. Tags support parent/child hierarchies — tagging a parent (e.g. Region:India) applies to all child tags beneath it. Scoping a scan to a tag dynamically includes any new asset that earns that tag, making tag-based scanning far more maintainable than managing static IP lists.
Priya at a Pune fintech firm faces this
The weekly Qualys VMDR scan reports zero vulnerabilities on a new batch of Linux servers in the internal DMZ, but the security team knows unpatched packages exist.
The scan is routed through the corporate LAN scanner appliance, which has no layer-3 route to the DMZ VLAN. The scan job completes in seconds because no hosts are reached.
Check the scan results — hosts show as 0 found or not reachable. The scan history confirms a near-instant completion time, confirming the scanner never reached those IPs.
VMDR ▸ Scans ▸ Scan History ▸ [Scan Name] ▸ Host DetailsDeploy a new Qualys virtual scanner appliance inside the DMZ VLAN. Assign it as the default scanner for the DMZ asset group. Update the scan schedule to use the DMZ appliance and attach an authentication record with SSH keys for the Linux hosts.
Re-run the scan — the host count now matches the known DMZ inventory, authenticated findings appear (patching backlog confirmed), and the scan duration is realistic rather than near-instant.
A scan that returns zero vulnerabilities is suspicious, not good news. Always check the scan history for realistic host counts and scan durations. A near-instant scan completion or a host count of zero almost always means the scanner appliance cannot route to those targets — not that the hosts are clean.
A Qualys scan misses all hosts in a newly created server VLAN that is isolated from the rest of the network. What is the most likely cause?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the single biggest mistake engineers make when setting up Qualys VMDR scanning for the first time? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- QID (Qualys ID)
- A unique numeric identifier for a specific vulnerability or information-gathered check in the Qualys KnowledgeBase. Each QID maps to one or more CVEs and carries a severity rating from 1 to 5.
- KnowledgeBase
- Qualys's continuously updated library of all vulnerability checks, each identified by a QID, including detection logic, severity, CVE mappings and remediation guidance.
- Option profile
- A reusable set of scan parameters — ports, parallel performance, authentication records and detection mode — referenced by scan schedules and on-demand jobs.
- Scan profile
- A saved scan job template bundling a title, target scope, scanner selection and an option profile for quick reuse.
- Authenticated scan
- A scan that logs into the target host using stored credentials or SSH keys, enabling OS-level inspection of patches, software and configuration.
- Scanner appliance
- A virtual or physical Qualys probe deployed inside a network segment to scan internal hosts. Each isolated segment needs its own appliance with layer-3 access to targets.
- Asset tag
- A flexible key-value label applied to hosts manually or by dynamic rules, supporting parent/child hierarchies. Tag-based scan scoping auto-includes new matching hosts.
- Asset group
- An administrator-defined static collection of IP addresses or ranges used to scope scan jobs and assign a default scanner appliance.
- Search list
- A saved list of QIDs used to restrict a custom scan to specific vulnerability checks — useful for targeted CVE campaigns or severity-filtered scans.
- Cloud Agent
- A lightweight Qualys agent installed on endpoints that performs continuous local scanning without credentials, uploading findings to the Qualys Cloud Platform.
📚 Sources
- Qualys Documentation — Scanning: The Basics (for VM/VMDR Scans). docs.qualys.com/en/vm/latest/scans/scanning_basics.htm
- Qualys Documentation — VM Option Profile: Scan tab — ports, performance, authentication and detection settings. docs.qualys.com/en/vm/latest/option_profiles/op_scan_tab.htm
- Qualys Documentation — Create/Edit Option Profile for VM/VMDR. docs.qualys.com/en/vm/latest/option_profiles/win_option_profile.htm
- Qualys Documentation — Choosing a scanner appliance — internal vs cloud scanner placement. docs.qualys.com/en/vm/latest/scanner_appliances/choosing_scanner_appliance.htm
- Qualys Blog — Unified vulnerability view of unauthenticated and agent scans. blog.qualys.com/product-tech/2021/01/21/unified-vulnerability-view-of-unauthenticated-and-agent-scans
- Qualys — Vulnerability Management, Detection and Response (VMDR) product overview. qualys.com/apps/vulnerability-management-detection-response
What's next?
Got scanning down? Next, go deep on VMDR remediation workflows — how detections become tickets, how patch orchestration closes the loop, and how to measure time-to-remediate across your asset estate.