Vulnerabilities don’t wait for your annual audit. If you’ve been through Cyber Essentials Plus (CEP) with us, you’ll have seen the Qualys vulnerability results we show during the audit. Vulnerability Insights gives you that same view all year round, directly in your CyberSmart dashboard.

This guide explains where to find Vulnerability Insights, how to deploy the Qualys scanning agent, and how to use the information to find and fix vulnerabilities across your devices.

Availability: Vulnerability Insights is currently only available by special request during our Early Adopter Programme. To register your interest, contact your Account Manager.

With Vulnerability Insights you can:

There’s a Vulnerabilities section in the left-hand menu of your organisation’s dashboard. Depending on the modules included in your package, you’ll see:

The Vulnerabilities section in the left-hand menu

Vulnerability Insights uses the Qualys scanning agent to detect vulnerabilities on your devices. You can deploy it yourself from the dashboard.

Insights and Manager (CSVM) both use the same Qualys agent. If you already have Qualys deployed for CSVM, you don’t need to install it again.

To get started, select Deployment options in the top-right corner of the Insights page.

Status

The Status panel shows how many devices are currently reporting into Insights. New devices can take up to 60 minutes to appear.

Installing the agent

The installation command is pre-configured with your Qualys Activation Key and Customer ID. These values, along with your WebServiceUri, are also shown on the panel with copy buttons, in case you need them for manual deployment.

The Deployment options panel

Sharing the installer with someone else

If you need someone else to install the agent, for example an end user installing on their own device, copy the Shareable link and send it to them. They can download the installer without logging in to the dashboard.

Detailed installation guides

Select View detailed installation instructions to open step-by-step Qualys installation guides for each operating system and method, including Intune and JAMF deployment. Each guide is tagged Individual or Centralised so you can find the right one quickly.

Qualys installation guides

The Insights page has two tabs: Vulnerabilities and Devices. The number on each tab shows how many vulnerabilities or devices are currently being reported.

The Vulnerabilities tab lists every vulnerability detected across your devices. For each one you’ll see:

The Vulnerabilities tab

Understanding the due date

Under Cyber Essentials Plus, all High and Critical vulnerabilities (CVSS score 7.0 or above) must be fixed within 14 days of being published. The “Was due” date is the published date plus 14 days, so you can see at a glance which vulnerabilities are overdue.

Searching, filtering and sorting

You can search by vulnerability title, and sort the table by any column. You can also filter by:

Each filter shows how many vulnerabilities match. Select Clear filters to remove them.

Severity, Sample and Published filters

Seeing which devices are affected

Select the arrow at the end of a row to expand it. You’ll see a list of Devices affected, with the host name, operating system, last user, last scan date and sample (if applicable) for each.

Expanding a vulnerability to see the devices affected

Viewing vulnerability details and how to fix it

Select a device to open the details panel. This shows:

Vulnerability details and remediation advice

Tip: You can fix third-party application vulnerabilities using Patch, or your own remote monitoring and management (RMM) tool.

The Devices tab lists every device reporting into Insights. For each device you’ll see the hostname, operating system, last user, number of vulnerabilities, last scan date and sample (if applicable).

The Devices tab

Last scan warnings

Keep an eye on the Last scan column. If a device hasn’t been scanned or checked in recently, you’ll see a warning:

Devices that aren’t checking in won’t show up-to-date results, so check they’re switched on and connected.

Searching, filtering and sorting

You can search for devices (for example by hostname or last user), and sort the table by any column. As well as Severity and Sample, you can filter by:

Last scan and Operating system filters

Seeing a device’s vulnerabilities

Select the arrow at the end of a row to expand it. You’ll see every vulnerability detected on that device, with its severity, title and published date.

Expanding a device to see its vulnerabilities

Select a vulnerability to open the same details panel described in section 3, including remediation advice.

Vulnerability details opened from the Devices tab

If your organisation is going through a Cyber Essentials Plus audit, devices selected by your auditor are tagged Sample 1 or Sample 2. A device can be in one or both samples.

We show these tags to help you:

While your audit is in progress, you’ll see a banner at the top of the Devices tab reminding you not to uninstall Qualys. Qualys can’t be uninstalled from sampled devices until the audit is complete.

Export

Select Export to download a report. The export respects any search or filters you’ve applied, so you can create a report for exactly what you need, for example all overdue Critical vulnerabilities.

Request rescan

Qualys scans your devices automatically every 4 hours. If you’ve fixed something and want to see updated results sooner, select Request rescan.

If a device no longer needs to be scanned, you can uninstall the Qualys agent from the Devices tab.

The confirmation shows how many of your selected devices are:

Uninstall confirmation showing eligible and audit restricted devices