AI-Powered Scan Optimization

The scanner profiles your application by running profiling-related detections and uses these results to build a detection plan using Qualys AI for your application through a process called Profiling. After profiling is completed, this detection plan is used to run security tests, followed by a standard reporting workflow.

We recommend a combination approach of running a full scan periodically or when there are major changes in an application, and using AI-Powered Scan optimization for your high-frequency scans.

Scan coverage is maintained by including all existing detections in the profiling process and ensuring no previously detected vulnerabilities are dropped. The Qualys AI builds upon your application's specific security profile to maintain comprehensive testing.

Yes, we recommend full scans periodically to detect application changes, especially for frequently updated applications. Consider full scans after major releases, security incidents, significant infrastructure changes, or quarterly for compliance requirements.

To perform a full scan, you can update the scan schedule or run a scan with the AI-Powered Scan Optimization feature disabled and detection scope with "everything" in option profile. This can be done through "scan configuration" settings.

Profiling is performed on Qualys Cloud. Hence, AI-based profiling is independent of the type of scanner. Internal scanners use this detection plan to execute tests.

The profile remains relevant as long as your application does not undergo major changes. Once created, the profile stays valid until you manually disable the AI-Powered Scan Optimization feature. There is an automatic refresh of the profile with every scan if AI-Powered Scan Optimization is enabled.

Major changes, such as tech stack modifications, hosting environment changes, authentication mechanism updates, significant architectural changes, new functionality additions, and infrastructure modifications. Any change that affects the application's attack surface or security posture requires profile recalibration.

Yes, existing detections are used for profiling, and any previously detected vulnerability will continue to be tested in post-profiling scans. No detection is ever dropped once it's been identified.

Since profiling is based on detections, purging will cause the scanner to recalibrate the profile. Detections that were purged but not found during profiling are not considered for future scanning.

Scan reports continue to show all detections found after profiling. The reporting format and vulnerability presentation remain unchanged from standard scanning.

Qualys AI consists of privately hosted AI models that analyze detection reports to create optimized scanning profiles. It operates within Qualys infrastructure without accessing your web application directly.

Qualys AI performs profiling-related detections, analyzes reports, and generates detection plans without accessing your web application’s private data. The AI context is confined to your application and never shared with other contexts.

Yes, it is completely secure as your web application cannot be seen by Qualys AI. No private data is ever shared with AI systems, and all processing occurs within secure, isolated environments.

Qualys AI is not trained using your data. Consequently, Qualys AI cannot trace any detection back to your application.

We utilize anonymized patterns derived from your detections to enhance the Qualys AI context. However, your specific data remains entirely private and accessible only to you at all times.

No, this feature is only available in TotalAppSec as it uses advanced technology available only with TAS. WAS architecture is not designed for this level of advanced intelligence capabilities.

AI-Powered Scan will run tests on an optimized set of detections based on the profiling of the application. This will usually result in a faster scan without loss of accuracy. 

Full scans are optional. We recommend that you run a full scan when there are major changes in the application. This will ensure that the profiling of AI is updated with the changes in the application, and accuracy is sustained.

Scans are reduced by using the Qualys AI-generated detection plan that focuses on relevant security tests based on profiling results. This eliminates extensive detections while maintaining coverage for identified risk areas.

Once a profile is created, it stays valid until you manually disable the AI-Powered Scan Optimization option. There's automatic refresh of profile with every scan if AI-Powered Scan Optimization is enabled.

Yes, we recommend full scans periodically to detect application changes, especially for frequently updated applications. Consider full scans after major releases, security incidents, significant infrastructure changes, or quarterly for compliance requirements.

Scan reports continue to show all detections found after profiling. The reporting format and vulnerability presentation remain unchanged from standard scanning.

Qualys AI takes an approach to ensure that there are minimal false negatives and loss of accuracy. However, our tests have shown promising results, indicating that it works effectively. Additionally, we have implemented guardrails to ensure that if we encounter anomalies in the detection plan, we can fall back to detection filters from the option profile.

No, Qualys AI doesn't connect to your web app, so no credential information is ever shared. The AI only extracts QID from your application detection results and finds patterns, not application access data.