Qualys Policy Compliance

Name: Qualys Policy Compliance
Brand: Qualys
Rating: 3.6 (57 reviews)

Leader

Security and compliance for your global IT assets.

Est 1999|Valuation $5.5B|Raised $152.6M

LinkedIn 297K|Website|Web traffic 412K|FTEs 2,718|HQ Foster City, California, US

Platform CoversPolicy Management Cyber Risk Management

Published Oct 22, 2026

01Common complaints

1. When the procurement target is the legacy Policy Compliance UI/module - Qualys migrated customers to Policy Audit and deprecated the legacy UI; contracts or procurement that reference the legacy UI should instead validate Policy Audit functionality and migration plans. 2. When an organization cannot tolerate inconsistent or slow support - Community reports include extended resolution times and variable technical account management experiences. Organizations with tightly constrained audit calendars or minimal tolerance for vendor delays should validate support SLAs and perform reference checks. 3. When extremely flexible custom control execution is required without external scripting - Historical approaches to custom policies in the legacy module relied on external scripting and parsing. Validate how Policy Audit implements custom controls; if the current implementation still requires heavy external tooling, consider alternatives or a specialist configuration tool. 4. When the primary requirement is cloud-native control evidence rather than host/server configuration - CSPM and CNAPP tools may provide more direct cloud service evidence and faster time-to-value for cloud-native controls. 5. When reporting performance and deep report customization are deal-breakers - Community feedback suggests report generation and configurability can be problematic; confirm reporting performance in a proof of concept. 1. Legacy product deprecation - Policy Compliance has been phased out and replaced by Policy Audit; confirm that required workflows and reports are supported in Policy Audit. 2. Reporting performance and configurability - Report generation delays and limited report customization have been reported by users. 3. Support variability - Community posts indicate inconsistent support responsiveness and differing levels of technical account management value. 4. Custom policy ergonomics (historical) - Historical implementations of custom policy execution sometimes required external scripting and parsing. Confirm the current Policy Audit approach for custom control authoring and execution. 5. Public documentation gaps - Module-specific documentation for SSO/SCIM/audit logs and data residency is not consolidated in the publicly accessible sources reviewed; request vendor security and compliance materials during procurement.

Why some customers leave or reduce usage (churn reasons seen in discussions)

Support experience, including slow resolution and inconsistent technical account management.
Reporting performance and limited report configurability.
Customization ergonomics for bespoke policies.
Platform complexity and inconsistent behavior across multiple applications.

02Why they buy

Candidate differentiators (vendor claims and observed behavior)

Platform consolidation: Qualys provides compliance features that are integrated with vulnerability management and asset inventory modules, enabling combined workflows and shared asset context.
Coverage breadth: The vendor states coverage for many technologies and frameworks (vendor-provided counts should be validated for scope and applicability).

Where competitors may have advantages

Rapid7 publishes detailed documentation on custom policy building and agent-based policy assessment capabilities.
Tenable has a strong presence in vulnerability management and a mature ecosystem that some organizations prefer, particularly where scanner maturity and ecosystem integrations are priorities.

Why customers chose Qualys PC/PA (common themes)

Coverage across a range of technologies and frameworks (vendor-provided mappings and libraries).
Integration with vulnerability management and asset inventory, enabling combined risk and compliance workflows.
Consolidation for teams already using multiple Qualys modules.

03Field reports

Review platforms (examples with quotes)

TrustRadius (Qualys platform review referencing Policy Compliance) - Quoted review excerpt: "Qualys Policy Compliance helps an organization to create policy, establish controls, write user-defined controls and manage the entire compliance of the organization... easy-to-use UI..." - Reported cons in the same review: "Controls customisation can be improved... Technology support can be improved... Some of the tasks to select sensors can be automated." PeerSpot (Qualys Policy Compliance reviews page) - PeerSpot aggregates commentary and provides a market-style sentiment view; attribution and exact module/version used by reviewers is not always explicit, which is relevant given the Policy Compliance to Policy Audit migration.

Community / social (summarized observations)

Migration and product changes - Community threads indicate user uncertainty and friction around the module status and migration from Policy Compliance to Policy Audit. Support and account management complaints - Some community posts describe long issue resolution cycles and dissatisfaction with technical account management, which can impact operational success for compliance programs that rely on timely vendor support. Performance and reporting complaints - Community comments include reports of slow or stuck compliance report generation. Feature limitations and customization friction - Some forum discussions critique older custom policy approaches that relied on external scripting and parsing to achieve bespoke checks; these observations predate or may not fully reflect the current Policy Audit behavior but indicate potential friction for non-standard controls.

Vendor / conference-style case material

Qualys conference materials reference deployments of Policy Compliance to align with large healthcare organizations and other regulated entities.

Critical evaluation:

Vendor-produced case materials typically highlight observed outcomes but often lack transparent baselines, independent verification, staffing effort disclosure, and timelines. These materials should be evaluated with those limitations in mind.

Vendor marketing performance claims (Policy Audit)

- Example marketing claim: a vendor marketing page claims a significant reduction in audit-related errors. Critical evaluation: - Such vendor claims should be treated as promotional until a supporting methodology and independent verification are provided. The claim lacks a public description of sample size, error definition, timeframe, and third-party audit of results; therefore it should be considered unverified marketing unless the vendor supplies substantiating data.

04Best fit

Company size

Typically suited to mid-market to very large enterprise organizations with formal compliance requirements and dedicated security or compliance operations.

Industries

Regulated industries such as finance, healthcare, government or defense-adjacent organizations, and critical infrastructure.

Roles and personas

Decision makers: Chief Information Security Officer (CISO), Head of GRC, VP Security Engineering, Head of Infrastructure Security.
End users: compliance analysts, vulnerability management engineers, platform administrators, and IT operations teams responsible for remediation.

Fit drivers

Organizations that already use Qualys VMDR and the cloud agent and prefer compliance capabilities tied into the same platform.
Requirements for benchmark-based configuration auditing (CIS, STIG) combined with internal control mappings.

Disqualifiers

Organizations seeking a tool primarily focused on GRC workflow management (policy lifecycle, attestations, enterprise risk registers) rather than technical configuration checks.
Organizations that require transparent, self-serve pricing and a very low-friction onboarding experience.

05The pitch

What the product does (core value proposition)

Qualys Policy Compliance (PC) is a security configuration assessment and technical compliance product that audits endpoint and infrastructure configurations against internal policies and external benchmarks (for example, CIS and DISA STIGs) and produces evidence-oriented reports for auditors. Historically, it has been delivered as part of the broader Qualys cloud platform to support ongoing compliance monitoring across on-premises and cloud assets. Important recent product status change (2025–2026): Qualys has phased out the Policy Compliance UI/module and migrated customers to Qualys Policy Audit (PA), with the migration completing in early 2026 (vendor rollout milestone). As a result, evaluations should focus on Policy Audit feature parity and behavior rather than the legacy Policy Compliance interface, although older PC guides and datasheets remain in circulation.

Target market and positioning

- Target buyers: security engineering, governance/risk/compliance (GRC) teams, vulnerability management teams, and IT operations teams responsible for audit readiness. - Typical environments: mid-market to large enterprises; regulated industries; mixed operating system estates. - Positioning: a cloud-based compliance assessment capability integrated with Qualys' TruRisk platform and adjacent applications (VMDR, asset inventory, cloud posture, and related modules).

Get a comprehensive analysis of Qualys Policy Compliance including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 22, 2026

01Common complaints

When the procurement target is the legacy Policy Compliance UI/module
- Qualys migrated customers to Policy Audit and deprecated the legacy UI; contracts or procurement that reference the legacy UI should instead validate Policy Audit functionality and migration plans.
When an organization cannot tolerate inconsistent or slow support
- Community reports include extended resolution times and variable technical account management experiences. Organizations with tightly constrained audit calendars or minimal tolerance for vendor delays should validate support SLAs and perform reference checks.
When extremely flexible custom control execution is required without external scripting
- Historical approaches to custom policies in the legacy module relied on external scripting and parsing. Validate how Policy Audit implements custom controls; if the current implementation still requires heavy external tooling, consider alternatives or a specialist configuration tool.
When the primary requirement is cloud-native control evidence rather than host/server configuration
- CSPM and CNAPP tools may provide more direct cloud service evidence and faster time-to-value for cloud-native controls.
When reporting performance and deep report customization are deal-breakers
- Community feedback suggests report generation and configurability can be problematic; confirm reporting performance in a proof of concept.
Legacy product deprecation

Policy Compliance has been phased out and replaced by Policy Audit; confirm that required workflows and reports are supported in Policy Audit.

Reporting performance and configurability

Report generation delays and limited report customization have been reported by users.

Support variability

Community posts indicate inconsistent support responsiveness and differing levels of technical account management value.

Custom policy ergonomics (historical)

Historical implementations of custom policy execution sometimes required external scripting and parsing. Confirm the current Policy Audit approach for custom control authoring and execution.

Public documentation gaps

Module-specific documentation for SSO/SCIM/audit logs and data residency is not consolidated in the publicly accessible sources reviewed; request vendor security and compliance materials during procurement.

Why some customers leave or reduce usage (churn reasons seen in discussions)

Support experience, including slow resolution and inconsistent technical account management.
Reporting performance and limited report configurability.
Customization ergonomics for bespoke policies.
Platform complexity and inconsistent behavior across multiple applications.

02Why they buy

Candidate differentiators (vendor claims and observed behavior)

Platform consolidation: Qualys provides compliance features that are integrated with vulnerability management and asset inventory modules, enabling combined workflows and shared asset context.
Coverage breadth: The vendor states coverage for many technologies and frameworks (vendor-provided counts should be validated for scope and applicability).

Where competitors may have advantages

Rapid7 publishes detailed documentation on custom policy building and agent-based policy assessment capabilities.
Tenable has a strong presence in vulnerability management and a mature ecosystem that some organizations prefer, particularly where scanner maturity and ecosystem integrations are priorities.

Why customers chose Qualys PC/PA (common themes)

Coverage across a range of technologies and frameworks (vendor-provided mappings and libraries).
Integration with vulnerability management and asset inventory, enabling combined risk and compliance workflows.
Consolidation for teams already using multiple Qualys modules.

03Field reports

Review platforms (examples with quotes)

TrustRadius (Qualys platform review referencing Policy Compliance)

Quoted review excerpt: "Qualys Policy Compliance helps an organization to create policy, establish controls, write user-defined controls and manage the entire compliance of the organization... easy-to-use UI..."
Reported cons in the same review: "Controls customisation can be improved... Technology support can be improved... Some of the tasks to select sensors can be automated."

PeerSpot (Qualys Policy Compliance reviews page)

PeerSpot aggregates commentary and provides a market-style sentiment view; attribution and exact module/version used by reviewers is not always explicit, which is relevant given the Policy Compliance to Policy Audit migration.

Community / social (summarized observations)

Migration and product changes

Community threads indicate user uncertainty and friction around the module status and migration from Policy Compliance to Policy Audit.

Support and account management complaints

Some community posts describe long issue resolution cycles and dissatisfaction with technical account management, which can impact operational success for compliance programs that rely on timely vendor support.

Performance and reporting complaints

Community comments include reports of slow or stuck compliance report generation.

Feature limitations and customization friction

Some forum discussions critique older custom policy approaches that relied on external scripting and parsing to achieve bespoke checks; these observations predate or may not fully reflect the current Policy Audit behavior but indicate potential friction for non-standard controls.

Vendor / conference-style case material

Qualys conference materials reference deployments of Policy Compliance to align with large healthcare organizations and other regulated entities.

Critical evaluation:

Vendor-produced case materials typically highlight observed outcomes but often lack transparent baselines, independent verification, staffing effort disclosure, and timelines. These materials should be evaluated with those limitations in mind.

Vendor marketing performance claims (Policy Audit)

Example marketing claim: a vendor marketing page claims a significant reduction in audit-related errors.

Critical evaluation:

Such vendor claims should be treated as promotional until a supporting methodology and independent verification are provided. The claim lacks a public description of sample size, error definition, timeframe, and third-party audit of results; therefore it should be considered unverified marketing unless the vendor supplies substantiating data.

04Best fit

Company size

Typically suited to mid-market to very large enterprise organizations with formal compliance requirements and dedicated security or compliance operations.

Industries

Regulated industries such as finance, healthcare, government or defense-adjacent organizations, and critical infrastructure.

Roles and personas

Decision makers: Chief Information Security Officer (CISO), Head of GRC, VP Security Engineering, Head of Infrastructure Security.
End users: compliance analysts, vulnerability management engineers, platform administrators, and IT operations teams responsible for remediation.

Fit drivers

Organizations that already use Qualys VMDR and the cloud agent and prefer compliance capabilities tied into the same platform.
Requirements for benchmark-based configuration auditing (CIS, STIG) combined with internal control mappings.

Disqualifiers

Organizations seeking a tool primarily focused on GRC workflow management (policy lifecycle, attestations, enterprise risk registers) rather than technical configuration checks.
Organizations that require transparent, self-serve pricing and a very low-friction onboarding experience.

05The pitch

What the product does (core value proposition)

Important recent product status change (2025–2026): Qualys has phased out the Policy Compliance UI/module and migrated customers to Qualys Policy Audit (PA), with the migration completing in early 2026 (vendor rollout milestone). As a result, evaluations should focus on Policy Audit feature parity and behavior rather than the legacy Policy Compliance interface, although older PC guides and datasheets remain in circulation.

Target market and positioning

Target buyers: security engineering, governance/risk/compliance (GRC) teams, vulnerability management teams, and IT operations teams responsible for audit readiness.
Typical environments: mid-market to large enterprises; regulated industries; mixed operating system estates.
Positioning: a cloud-based compliance assessment capability integrated with Qualys' TruRisk platform and adjacent applications (VMDR, asset inventory, cloud posture, and related modules).

Get a comprehensive analysis of Qualys Policy Compliance including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

When the procurement target is the legacy Policy Compliance UI/module
- Qualys migrated customers to Policy Audit and deprecated the legacy UI; contracts or procurement that reference the legacy UI should instead validate Policy Audit functionality and migration plans.
When an organization cannot tolerate inconsistent or slow support
- Community reports include extended resolution times and variable technical account management experiences. Organizations with tightly constrained audit calendars or minimal tolerance for vendor delays should validate support SLAs and perform reference checks.
When extremely flexible custom control execution is required without external scripting
- Historical approaches to custom policies in the legacy module relied on external scripting and parsing. Validate how Policy Audit implements custom controls; if the current implementation still requires heavy external tooling, consider alternatives or a specialist configuration tool.
When the primary requirement is cloud-native control evidence rather than host/server configuration
- CSPM and CNAPP tools may provide more direct cloud service evidence and faster time-to-value for cloud-native controls.
When reporting performance and deep report customization are deal-breakers
- Community feedback suggests report generation and configurability can be problematic; confirm reporting performance in a proof of concept.
Legacy product deprecation

Policy Compliance has been phased out and replaced by Policy Audit; confirm that required workflows and reports are supported in Policy Audit.

Reporting performance and configurability

Report generation delays and limited report customization have been reported by users.

Support variability

Community posts indicate inconsistent support responsiveness and differing levels of technical account management value.

Custom policy ergonomics (historical)

Historical implementations of custom policy execution sometimes required external scripting and parsing. Confirm the current Policy Audit approach for custom control authoring and execution.

Public documentation gaps

Module-specific documentation for SSO/SCIM/audit logs and data residency is not consolidated in the publicly accessible sources reviewed; request vendor security and compliance materials during procurement.