CyberIndexBeta

Qualys Patch Management

QualysPatch Management (primary)Compare with others in Patch Management

Product

Patch deployment driven by the vendor's own vulnerability scanning, correlating detected vulnerabilities with the updates that close them. Qualys Patch Management covers Linux, macOS and Windows. Delivery is a hosted SaaS service. Recorded capabilities include air-gap operation, application patching, automated patch deployment and central management console. Its record also notes local patch repository, multi-tenant (msp) management, operating system patching and patch compliance reporting.

Current Version
6.2.0.25
Product Page
qualys.com/apps/patch-management
Market
Enterprise
Licence
Paid
Price
Quote
Record Created
2026-10-04
Last Updated
2026-10-28

Vendor

Qualys was founded in 1999 and was among the first security companies to deliver its product entirely as a cloud service rather than as software to install — an unusual choice at the time and the basis of its business since. It is headquartered in Foster City, California, and listed on Nasdaq. Its core business is knowing what an organisation has and what is wrong with it: vulnerability management, detection and response across servers, endpoints, cloud workloads and containers, with compliance and asset inventory built on the same platform and the same lightweight agent. Qualys Endpoint Protection, the product listed here, extends that agent into anti-malware and endpoint detection. It is bought by organisations that already run Qualys for vulnerability management and want one agent rather than two, which is the more useful way to read it than as a standalone competitor to the dedicated endpoint vendors here. Vendor page →

Website
qualys.com
Country
United States
Headquarters
Foster City, United States
Year Established
1999
Customers
10K organisations
Users
110M devices protected
Revenue
$669.1M (2025)

Platforms

Linuxnative
macOSnative
Windowsnative

Target Market

Enterprise primary

Capabilities

Application Patchingkeynative
Operating System Patchingkeynative
Automated Patch Deploymentkeynative
Vulnerability-Based Prioritisationkeynative
Patch Rollbackkeynative
Phased / Ring Deploymentpartial
Roaming Endpoint Patchingkeynative
Patch Compliance Reportingnative
Reboot Managementnative
Software Deploymentnative
Vulnerability Shieldingnative
Central Management Consolenative
Air-Gap Operationkeypartial
Local Patch Repositorynative
Agentless Patchingkeynot supported
Multi-Tenant (MSP) Managementkeynative

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 6.2.0.25Windows
  • 6.1.0-20macOS

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

FedRAMPHigh1 activeFR2231052341
OESIS Framework SupportSupported1 activeSupported

Change History

This record was created 2026-10-04. Everything below is what has changed since.

  • 2026-10-14Pricing plan addedPrice: price on requestevidence
  • 2026-10-12Certification addedCertified: FedRAMP (High)evidence
  • 2026-10-10New versionNew version: 6.2.0.25 (Windows)evidence
  • 2026-10-10New versionNew version: 6.1.0-20 (macOS)evidence
  • 2026-10-10Product updatedSold to: Enterpriseevidence
  • 2026-10-09New versionNew version: 4.2evidence
  • 2026-10-08Capability addedMulti-Tenant (MSP) Management: built inevidence
  • 2026-10-08Capability addedAir-Gap Operation: limitedevidence
  • 2026-10-08Capability addedLocal Patch Repository: built inevidence
  • 2026-10-06Certification addedCertified: OESIS Framework Support (Supported)evidence
  • 2026-10-05Capability addedAgentless Patching: not supportedevidence
  • 2026-10-05Capability addedCentral Management Console: built inevidence
  • 2026-10-05Capability addedVulnerability Shielding: built inevidence
  • 2026-10-05Capability addedSoftware Deployment: built inevidence
  • 2026-10-05Capability addedReboot Management: built inevidence
  • 2026-10-05Capability addedPatch Compliance Reporting: built inevidence
  • 2026-10-05Capability addedRoaming Endpoint Patching: built inevidence
  • 2026-10-05Capability addedPhased / Ring Deployment: limitedevidence
  • 2026-10-05Capability addedPatch Rollback: built inevidence
  • 2026-10-05Capability addedApplication Patching: built inevidence
  • 2026-10-04Capability addedVulnerability-Based Prioritisation: built inevidence
  • 2026-10-04Capability addedAutomated Patch Deployment: built inevidence
  • 2026-10-04Capability addedOperating System Patching: built inevidence
  • 2026-10-04Platform addedRuns on macOSevidence
  • 2026-10-04Platform addedRuns on Linuxevidence
  • 2026-10-04Platform addedRuns on Windowsevidence
  • 2026-10-04Product createdNew product, listed in Patch Managementevidence
Something wrong? Suggest a correction →

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.