https://cybertoolchain.io/tools/qualys-web-application-scanning New releases and features in Qualys Web Application Scanning, tracked by The Cyber Toolchain. en Wed, 28 Oct 2026 06:35:45 GMT https://blog.qualys.com/category/vulnerabilities-threat-research https://blog.qualys.com/category/vulnerabilities-threat-research Wed, 28 Oct 2026 06:35:45 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/qualys-web-application-scanning https://blog.qualys.com/category/qualys-insights https://blog.qualys.com/category/qualys-insights Mon, 05 Oct 2026 16:29:39 GMT Qualys TotalAppSec achieves FedRAMP High authorization with continuous API discovery, BOLA/BFLA/BUA testing, and TruRisk prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Qualys TotalAppSec is now FedRAMP High Authorized on the Qualys Government Platform (Class D, package `FR2231052341`), enabling organizations to inherit controls from an agency-accepted boundary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Continuously discovers known, unknown, shadow, zombie, and rogue web apps and APIs across cloud, on-premises, internet-facing environments, API gateways, AI-serving endpoints, and MCP servers. • Imports API specs from Swagger, Postman, and Burp, pulling from gateway and cloud connectors, and reconciles every discovered endpoint against the declared inventory to surface shadow and zombie APIs. • Tests running applications and APIs for OWASP Top 10 risks, sensitive-data exposure, and authorization flaws — broken object level authorization (BOLA), broken function level authorization (BFLA), and broken user authentication (BUA) — that carry no CVE. • Authenticates test sessions with OAuth 2.0, Proof Key for Code Exchange (PKCE), bearer tokens, and API keys to reach everything a legitimate caller can access. • Deep-learning detection catches zero-day web malware with no existing signature. • AI-Powered Scan Optimization cuts scan time by up to 50 percent to make the daily scanning cadence required by FedRAMP at High impact achievable. • TruRisk prioritization engine ranks findings by severity, exploitability, threat context, asset criticality, and business impact, and ingests results from third-party AppSec tools and pen tests into a single remediation queue. • Routes findings into CI/CD pipelines, Jira, and ServiceNow, with automatic retest after remediation and scheduled evidence output for FedRAMP controls SA-11, RA-5, SI-2, CM-8, and CA-7. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/qualys-web-application-scanning