Qualys scanners, free editions and contract terms covers the parts of Qualys licensing that sit outside the per-application asset counts. These are the scanner appliances and software sensors used to collect data, the free Community Edition and trials, the consultant subscription, and the term, renewal and exit provisions of the MCSA. Qualys does not sell its hardware or software outright. When an Order Form includes Hardware, Qualys provides it “on a subscription basis and only for the limited use as permitted”.[1] Software, meaning the software on the Hardware and the software loaded onto customer servers for virtual scanning or connection to the Cloud Services, is likewise provided “on a subscription basis”.[1]
Editions
Sensors
Qualys lists these sensor types:[4]
- Cloud Agents. Their inventory function is “Included with all subscriptions”.
- Qualys Gateway Service, a virtual appliance for extending Cloud Agents into locked-down environments.
- Passive Scanners, which are also “Included with all subscriptions”.
- Virtual Scanners, for software-only internal scanning.
- Scanner Appliances, which are on-premises rack hardware.
- Internet Scanners, which are cloud-based scanners for the external perimeter.
- Out-of-Band Sensors, Container Sensors, Cloud Connectors and REST APIs.
Qualys also offers containerized and headless scanners.[3] VMDR includes unlimited virtual scanners, Cloud Agents, passive sensors, agent gateways and container sensors (see Qualys VMDR and endpoint asset counting).
Physical scanner appliances
The physical Scanner Appliance performs internal vulnerability, compliance and web application scanning. Four current models are documented:[2]
| Model (catalog SKU) | Scanning capacity | Architecture |
|---|---|---|
| QGSA-6120-B1 | 1245 units | 64-bit |
| QGSA-6120-A1 | 1040 units | 64-bit |
| QGSA-5120-A1 | 910 units | 32-bit |
| QGSA-4120-A1 | 835 units | 32-bit |
Scanning capacity is the maximum number of scan job units a scanner can handle when idle. Each scan type has a predefined unit cost, and “a VM scan uses two units per IP”, so a 1000-unit scanner can scan up to 500 IPs in parallel.[2] Capacity is an operational sizing figure, not a licence limit. To add virtual appliances to a licence, customers contact their TAM or Qualys Support. Virtual appliances are qualified for VMware, Hyper-V, XenServer, VirtualBox, Amazon EC2, Azure, Google GCE and OpenStack.[2] Qualys publishes no prices for appliances.
Private Cloud Platform
For customers with data-sovereignty or possession requirements, Qualys offers a Private Cloud Platform. It runs the Enterprise TruRisk Platform on customer premises, and Qualys keeps it updated and maintained. Qualys lists MSSPs selling co-branded services from their own data centres among the intended users.[11]
Metrics
Scanners and sensors are not a counting unit in their own right. The unit is the Asset in the Order Form,[1] or the IP addresses added to an IP-based subscription (see the IP address catalog row). A Qualys subscription entitles the customer to an unlimited number of scans. Qualys also mentions “pay per scan” packages but recommends the annual subscription.[12]
Counting / floors
Community Edition
The current Community Edition page describes a free version of the Enterprise TruRisk Platform with these limits:[6]
- “Unlimited vulnerability scanning for up to 16 internal assets and 3 external assets”
- “One virtual scanner appliance”
- Web Application Scanning for one web app URL
The 2018 Getting Started Guide is older. It lists 16 Cloud Agents, Vulnerability Management for 16 internal and 3 external IPs, Web Application Scanning for one URL, one virtual scanner appliance and CloudView. It describes Community Edition as “a limited version of Express Lite”.[7] The guide’s comparison table records these differences from Express Lite:[7]
- one user instead of three
- scan data retained for 3 months instead of up to 13
- account data purged after 6 months of inactivity
- no API access
- no PCI attestation
- only weekly and monthly scheduled scans
These 2018 limits are historical. Only the current page’s limits are recorded as a catalog rule.
No Charge Services
Under the MCSA, “No Charge Services” are Cloud Services provided at no cost. Support bundled into paid pricing is never a No Charge Service.[1] Two provisions change for No Charge Services. The service and hardware warranties do not apply, and the services “are provided ‘AS IS’” (§8.2, §8.3). Qualys’s aggregate liability is capped at USD 100 instead of the greater of twelve months’ fees or USD 1,000 (§10.1).[1] This matters when Community Edition or other free tools are used for business purposes.
Trials
The public trials page offers 30-day use-case trial bundles and 30-day product trials, for example of VMDR, CSAM, TotalCloud, Kubernetes and Container Security, ETM and TruRisk Eliminate. It also lists free services such as Global AssetView, Community Edition, SSL Labs, CertView and BrowserCheck.[8] For existing QFlex customers, trials are activated in the platform and “cover a restricted number of assets”.[9]
Virtualization & partitioning
Virtual scanner appliances run on the virtualization and cloud platforms listed above.[2] Deploying one does not change how the assets it scans are counted. The MCSA does not allow Hardware to be moved freely. The customer “has no right to relocate Hardware without Qualys’ consent” (§3.7).[1]
Cloud / BYOL
No BYOL construct applies. Internet Scanners are Qualys-operated cloud scanners.[4] Virtual scanners deployed in customer cloud accounts are Software under the MCSA and must be uninstalled at the end of a non-renewed term (§3.8).[1]
Programs
Consultants and MSPs
MCSA §4 defines a Consulting Edition for consultants and managed service providers serving the SMB/SME market. That market means clients that do not individually exceed 5000 employees, 5120 IPs or 200 URLs. The consultant may not use the Cloud Services internally, except for testing under the PCI ASV program. API use is limited to the consultant, and clients may not pull API data. A network subscription “for each Consultant Client” is required.[1] Consultants must flow Minimum Terms and Conditions down to clients: that Qualys owns the service, that it is provided “AS IS”, and that Qualys has no liability to the client. They must pay Qualys whether or not their clients pay them.[1] Other partner types (MSSP and GSI, distributors, technical alliances and resellers) are described on the partner program page, which publishes no commercial terms.[13]
Resellers
For reseller purchases, the MCSA still governs use. Fees, invoicing, renewal and payment terms are those agreed between the reseller and the customer (§5, §11.2).[1]
Term, renewal and exit
The MCSA provisions below apply to direct purchases (version [11.25v], as published 2026-09-27):[1]
| Provision | Rule | Clause |
|---|---|---|
| Renewal | Order Forms renew for additional one-year terms unless notice is given at least 60 days before the term ends | §11.2 |
| Renewal price | Per-unit price rise on auto-renewal capped at 8%, except Special Pricing; changes of service type or volume reductions are not protected | §11.2 |
| Quantity | Fees based on subscriptions purchased; quantities cannot be decreased mid-term; fees non-refundable | §5.1 |
| Payment | Invoiced in advance, net 30; late interest 1.5% per month after 10 days’ notice; suspension possible when 30 days overdue | §5.2 to 5.4 |
| Hardware return | Return within 30 days after a non-renewed term, at the customer’s cost, or pay USD 3,000 per piece | §3.6 |
| Software | Uninstall within 30 days after a non-renewed term; on termination, destroy or uninstall and certify | §3.8, §11.5 |
| Data | Customer Data available for export on request within 60 days after termination or expiration, then deleted | §11.4 |
| Reports | Reports may be kept and used after termination | §11.5 |
| Assignment | Consent needed, except to an Affiliate or in a merger, acquisition, reorganization or sale of substantially all assets; the other party may terminate if the assignee is a direct competitor | §12.10 |
| Updates | Qualys may update the terms, which apply on posting | §12.15 |
The October 2017 Service Description also provides Managed Intranet Scanners, physical or virtual, “on an annual subscription basis”. It says Qualys deletes Customer Scan Data within 13 months of termination, or all online subscription data within one month on request.[5] That document predates the MCSA [11.25v], whose 60-day export window is the current contractual statement.
Support
Qualys Standard Support is included and accepts tickets 24x7 by web or telephone. Targeted initial responses are 2 hours or less for Severity 1, 12 hours or less for Severity 2, and 2 business days or less for Severity 3. Qualys aims to ship replacement Hardware within 48 hours of validating a Hardware Error. Changes to the support policy take effect after 30 days’ notice. If service levels are materially reduced, the customer may terminate and receive a prorated refund.[10]
Out of scope
This article does not cover hardware specifications beyond scanning capacity, scanner deployment procedures, or partner discount and margin terms, which Qualys does not publish.