QUALYS · COVERAGE ON THE EXTERNAL SURFACE
Qualys is mature at the job it was built for: finding vulnerabilities across the known estate, with an agent on the asset. This page answers a different question, and it asks for no vendor switch: what answers on the internet outside the agent's count, and which of those an attacker exploits today.
WHY AUDIT THE COVERAGE
Agent-based detection is precise and deep on the asset where the agent runs. Its limit is not technical, it is one of inventory: the agent covers what somebody provisioned. The subdomain that went up on a Friday, the staging environment published by mistake, the asset that arrived with an acquisition, none of them got an agent, and none of them reach the report.
Qualys has an external surface module that extends that view outward. It discovers and enumerates exposed assets inside a suite whose centre of gravity stays on internal detection. It is a complementary capability in a broad product, and it works as one.
CSURFACE does one thing. It observes the organization's external surface from the root domain, attributes every discovered asset to its owner by technical trace and by legal ownership, and validates exploitability over what it discovered, delivering the finding with the evidence the target itself returned.
The two coexist, and most institutions run them that way. The comparison below is by capability, and the Qualys column acknowledges where it wins.
SIDE BY SIDE
The reading is by capability. Each cell describes, with honesty, the level of delivery of each approach on the external attack surface.
| Capability | Qualys EASM | CSURFACE |
|---|---|---|
| External surface discoveryMapping of exposed assets on the internet | Partial Discovery of external assets as a module within an extensive suite; the product focus remains on internal detection. |
Full The continuous discovery of the external surface is the central objective of the platform, starting from just the root domain. |
| Unrestricted discovery scopeLarger surface coverage | Limited The external surface module operates within scope limits that may require adjustment for larger inventories. |
Full Discovery encompasses all identified external surfaces without a predefined ceiling on assets. |
| Asset attribution and classificationConfirm ownership and criticality | Limited The organization and tagging of discovered assets depend on manual work by the team. |
Full Each asset is attributed to an organization and classified for business criticality through Machine Learning. |
| Shadow IT and subsidiaries coverageAssets outside the official inventory | Limited The external discovery reaches part of these assets, with coverage sensitive to configured scope. |
Full Shadow IT, brands, and subsidiaries enter the scope without prior inventorying. |
| Supply chain digital footprintThird-party components embedded in assets | Does not cover The mapping of third-party components embedded is not part of the external surface module. |
Full Third-party components embedded in assets are mapped as part of the exposure. |
| Vulnerability detection on internal assetsInternal park with agent | Full This is a consolidated strength of Qualys, with agent-based internal detection and broad coverage of the park. |
Does not cover CSURFACE is dedicated to the external surface and does not perform agent-based internal detection. |
| Prioritization by real exploitabilityWhat is being exploited now | Partial Threat intelligence is available in the suite, generally organized into separate modules. |
Partial Active validation covers the CVE that already has a detection module built for it, and the finding ships with its proof. Across the rest of the surface the assessment is passive, matching version and configuration. |
| Single and integrated platformCapabilities without stitching between modules | Partial Capabilities are distributed across distinct modules of the suite, which need to be combined. |
Full Discovery, classification, prioritization, and continuous monitoring operate on a single platform. |
| Validation and testing of discovered exposuresConfirm whether an exposed asset is actually exploitable | Partial The external surface module discovers and enumerates the assets and performs a lightweight scan at discovery; full vulnerability and web application testing requires the VMDR and WAS modules, purchased separately. |
Full Exploitability validation of external exposures is built into the platform, with no additional modules. |
This comparison addresses the external attack surface. For capabilities outside this scope—such as agent-based internal detection—the Qualys portfolio is broader, as indicated in the table itself.
DISCOVERY AND VALIDATION
Qualys's external surface module, within CyberSecurity Asset Management, is designed to discover and inventory what is exposed — domains, subdomains, IP addresses, certificates and APIs — with a lightweight scan at discovery. To test and validate those exposures in depth, two separately purchased modules are added: VMDR, for vulnerability scanning, and Web Application Scanning (WAS), for web applications. Enumerating the surface is one step; validating what is actually exploitable requires composing these products.
In CSURFACE, discovery and exploitability validation operate on the same platform. What is discovered already arrives attributed, classified and validated, without relying on separately sold modules.
WHERE CSURFACE DIFFERENTIATES
CSURFACE starts from the root domain and maps all identified external surface assets, with no predefined limit on the number of assets. The team does not need to choose which assets fit within the scope or provide lists to start coverage.
Each discovered asset is automatically attributed to an organization and classified by criticality through Machine Learning, without manual tagging. The result is a prioritizable inventory from the outset, not a list that still needs organizing.
Discovery, classification, prioritization by real exploitability, and continuous operational monitoring all operate on a single platform. There is no need to combine separate sold modules or lose context during transitions between them.
FREQUENTLY ASKED QUESTIONS
This depends on what your organization needs. For vulnerability detection in the internal park with an agent, Qualys has a broad and mature portfolio. For discovering and prioritizing external attack surface, CSURFACE is a dedicated platform for this problem. Many organizations use both approaches complementarily.
There is overlap in the idea of discovering exposed assets. The difference lies in depth and focus: with CSURFACE, the discovery of the external surface, property assignment, and classification by Machine Learning are the central objectives of the product, not a module within an internal detection suite.
There is no predefined ceiling for discovery. The platform maps the entire external surface that it can identify from the root domain, which is relevant for organizations with extensive online presence, multiple brands, or subsidiaries.
Yes, and it is a common arrangement. Qualys covers the depth of internal detection; CSURFACE covers continuous discovery of the external surface and prioritization based on what is exploitable. Both approaches sum up in an exposure program. For more details on your scenario, contact our team through the Contact page.
Enter your company domain and receive a preliminary analysis of your external exposure. No credit card.
Receive preliminary analysis
