Qualys Web Application Scanning
Qualys Web Application Scanning: A broad DAST service for authenticated web and API testing in Qualys environments. Ranked #15 of 26 in Dynamic Application Security Testing Software by our editors (8.0/10); pricing: Pricing on request; best for large organizations already using Qualys.
At a glance
- Editor score8.0 / 10
- PricingPricing on request
- Best forLarge organizations already using Qualys
- Free planNo
- Authenticated scanningYes
- Facts checked22 Sep 2026
Where it wins
- Authenticated scanning supports complex workflows and login methods.
- REST API testing covers Swagger, Postman, Burp, and OWASP API risks.
- GitHub Actions adds build pass/fail criteria and JSON artifacts.
Where it doesn't
- Pricing is handled through Qualys sales rather than published plans.
- The named integration options center on GitHub Actions and Qualys APIs.
- Internal scanning requires scanner appliances instead of cloud scanners alone.
Our verdict on Qualys Web Application Scanning
Qualys Web Application Scanning is a cloud-based dynamic application security testing service for organizations assessing web applications and APIs. It combines automated crawling with fault-injection vulnerability testing, authenticated scanning, workflow support, reporting, and dashboards. The service fits security and development teams that need to scan externally accessible applications through Qualys Security Operations Centers or assess internal applications through scanner appliances. Its web and API coverage also suits organizations with both browser-based applications and API-driven services.
Pricing follows a contact-sales model, with no free plan listed. Qualys positions WAS around a wide testing scope rather than a single scanning method: authenticated scans support form, HTTP Basic, and Digest authentication, while Selenium script playback handles complex workflows and login authentication. API testing accepts Swagger definitions, Postman collections, and Burp captures, and includes OWASP API Top 10 coverage plus OpenAPI/Swagger compliance verification. These capabilities make the product a fit for teams whose applications require authenticated paths or structured API assessment, rather than only unauthenticated perimeter checks.
For delivery workflows, GitHub Actions integration provides build pass/fail criteria and JSON artifacts, while the Qualys WAS API supports automation. Dashboards provide asset and vulnerability visualization, and deployment can span Qualys cloud scanners and internal scanner appliances. The product is strongest for large organizations already using Qualys and needing web, API, authenticated, and CI/CD coverage in one service. Teams seeking transparent self-service pricing, a free plan, or a broader set of named integrations should consider alternatives built around those requirements instead.
Your product? Our editors can test Qualys Web Application Scanning in depth and publish a review, labelled as paid · from $149/mo →
Qualys Web Application Scanning pricing
Qualys Web Application Scanning fact sheet
| Free plan | No |
|---|---|
| Paid from | Not verified |
| Authenticated scanning | Yes |
| API testing | Yes |
| Browser-based scanning | Yes |
| CI/CD integration | Yes |
| Deployment model | Hybrid |
| Included scan targets | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Chrome extension |
| Support | Email, Phone, Docs · 24/7 |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 1 integrations: Jenkins See all → |
| Pricing | Pricing on request (source) |
| Website | qualys.com |
| Facts checked | 22 Sep 2026 |
Qualys Web Application Scanning integrations
Qualys Web Application Scanning lists 1 integrations on its own site.
- Jenkins
See all Qualys Web Application Scanning integrations →
Alternatives to Qualys Web Application Scanning
- Safeguard DASTBroad authenticated web and API scanning with paid plans starting at $9/month.9.4
- OWASP ZAPA capable free DAST tool with broad web, API, browser, and automation coverage.9.3
- apPosture DASTEvidence-backed DAST for developers who need deep web and API testing.9.2
See all Qualys Web Application Scanning alternatives →
Also Ranked In
Qualys Web Application Scanning is ranked in 3 of our directories.
Used Qualys Web Application Scanning? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Qualys Web Application Scanning for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Qualys Web Application Scanning is listed in our Dynamic Application Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/qualys-web-application-scanning/"><img src="https://www.itechguides.com/best/badge/qualys-web-application-scanning.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update