Choosing Your Sensors: Cloud Agents vs. Scanner Appliances
Qualys offers two primary data collection methods. Most mature deployments use both, because each closes coverage gaps the other cannot reach. Understand the differences before you deploy.
Capability |
Cloud Agent |
Scanner Appliance |
| Collection model | Continuous, lightweight sensor on the host | Network-based authenticated and unauthenticated scans |
| Footprint | Typically less than 2% CPU, less than 50 MB RAM | Virtual or physical appliance on your network |
| Best for | Laptops, cloud instances, remote and roaming hosts, ephemeral workloads | Network devices, legacy systems, printers, and hosts that cannot run an agent |
| Credentials | No network credentials required | Authenticated scans require stored credentials |
| Connectivity | Ingress and Egress communication to the Qualys platform | Requires network routing to scan targets |
| Coverage | Real-time data even when off the corporate network | Point-in-time view across reachable network ranges |
How to Decide
- Deploy Cloud Agents on endpoints, servers, and cloud workloads you control directly, especially mobile and intermittently connected devices.
- Deploy Scanner Appliances for unmanaged devices, network infrastructure, and any asset that cannot host an agent.
- Combine both for complete coverage. Agents deliver continuous endpoint visibility, while scanners assess the rest of your attack surface and validate findings.
Coverage: Agents alone will miss devices that cannot run software. Scanners alone require connectivity and credentials. Together, they give you the comprehensive, unified asset visibility that underpins accurate TruRisk scoring.