CISO Tribune

Vendor comparison · 2 companies

Qualys vs Xcitium

Qualys provides the Enterprise TruRisk Platform, an end-to-end solution for all aspects of IT, security and compliance. Xcitium sells a zero trust cybersecurity platform that protects endpoints, networks and cloud workloads from zero-day threats by isolating unknown files until they are analyzed and given a verdict. CISO Tribune files both under Cloud-native application protection (CNAPP) and EDR and XDR. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Qualys
  • Xcitium
Qualys vs Xcitium: Products, Customers and Funding Compared
QualysQualys provides the Enterprise TruRisk Platform, an end-to-end solution for all aspects of IT, security and compliance.qualys.comXcitiumXcitium sells a zero trust cybersecurity platform that protects endpoints, networks and cloud workloads from zero-day threats by isolating unknown files until they are analyzed and given a verdict.xcitium.com
What it sells
  • Enterprise TruRisk Platform[1][2]An end-to-end solution for all aspects of IT, security and compliance.
  • CNAPP[1][2][5]Cloud Native Application Protection Platform for cloud workloads.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
1999[1]Not stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • March 5, 2026Xcitium introduced a Google Workspace integration that ingests Google Workspace logs into its MDR service.[3]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Not written yetFrom its own pages, Xcitium sells mainly to organizations that want zero trust protection across endpoints, networks and cloud workloads. Xcitium offers Managed SOC services for MSPs and MSSPs, so service providers are a named audience. Xcitium names a family-owned distribution company among its customers. Xcitium also names a non-profit healthcare organization among its customers.
Last verified
November 4, 2026October 7, 2026

Where they overlap

  • Qualys and Xcitium are both filed under Cloud-native application protection (CNAPP) and EDR and XDR.

Where they differ, field by field

  • Qualys's primary category is Vulnerability management; Xcitium's is EDR and XDR.
  • Qualys is also filed under External attack surface management. Xcitium is also filed under Zero trust network access and SASE and SSE.
  • Qualys lists Enterprise TruRisk Platform. Xcitium lists CNAPP.
  • Qualys was founded in 1999.

What it sells: Qualys

What Enterprise TruRisk Platform does[1][2]
The Enterprise TruRisk Platform is a suite of apps integrated into a single platform. Enterprise TruRisk Platform apps natively share the data they collect. The Enterprise TruRisk Platform covers IT, security and compliance.

Questions about Qualys and Xcitium

What do Qualys and Xcitium sell?
Qualys sells Enterprise TruRisk Platform. Xcitium sells CNAPP.
Are Qualys and Xcitium in the same category?
They share Cloud-native application protection (CNAPP) and EDR and XDR. Qualys's primary category is Vulnerability management and Xcitium's is EDR and XDR.
When were Qualys and Xcitium founded?
Qualys was founded in 1999.
Who are Qualys and Xcitium sold to?
From its own pages, Xcitium sells mainly to organizations that want zero trust protection across endpoints, networks and cloud workloads.
What have Qualys and Xcitium announced recently?
March 5, 2026: Xcitium introduced a Google Workspace integration that ingests Google Workspace logs into its MDR service.

About Qualys

Qualys provides the Enterprise TruRisk Platform, an end-to-end solution for all aspects of IT, security and compliance. The Enterprise TruRisk Platform is a suite of apps integrated into a single platform. Enterprise TruRisk Platform apps natively share the data they collect, so the financial impact of a security posture can be expressed in real time. Qualys is a SaaS security company with 25 years of history.[2]

Qualys states that frontier AI weaponizes vulnerabilities in hours while patch cycles run in weeks. Qualys proposes an operating model of AI-Speed Detection, Hyper-Prioritization and Zero-Day Remediation. Qualys builds AI agents into Enterprise TruRisk Management for prioritizing, remediating and eliminating risks.[2]

TruRisk Eliminate 2.0 is the Autonomous RemOps platform from Qualys. TruRisk Eliminate 2.0 runs on TruConfidence, a Remediation Intelligence and Orchestration Engine. TruRisk Eliminate 2.0 decides on and executes remediation paths across the attack surface. InstaScan matches each disclosed CVE against a live inventory in real time to show exposure.[2]

Qualys addresses AI that an organisation does not know about, assessing what that AI can expose, access and do.[2]

Policy Audit uses improved control statements that describe the intent of each control. Some control statements include the technology name. Control checks apply to Windows services, Linux files, Oracle parameters and network device configurations. Control statements appear in the control library and control details. Control statements appear in posture results and evaluation output. Integrations can reference controls by CID, and those integrations are not affected by the statement change. Improved control statements are the first step in an effort to change how Policy Audit controls are described, rated and organised. Upcoming releases are planned to add consistent, formula-based criticality ratings.

Improved control statements apply to subscriptions on the Shared Cloud Platform (SCP), while Private Cloud Platform (PCP) subscriptions follow a separate release cycle. The improved control statements setting applies at the subscription level, and once it is enabled all users in the subscription see the updated statements. Until April 2027, a Manager or POC Manager can switch back to the previous control statements.

Qualys offers a FedRAMP High Authorized platform for VMDR and CNAPP that is aimed at NIST 800-53 requirements.[2]

Qualys on the record

Sources

Qualys full record

  1. [1]CompanyQualys · qualys.com · undated page, accessed November 4, 2026 · Tier A
  2. [2]Enterprise Cyber Risk and Security Platform | QualysQualys · undated page, accessed November 10, 2026 · Tier A
  3. [3]Introducing Improved Control Statements in Policy Audit | Qualys NotificationsQualys · published October 29, 2026 · Tier A

Xcitium full record

  1. [1]xcitium.comXcitium · xcitium.com · undated page, accessed October 7, 2026 · Tier A
  2. [2]#1 Zero Trust Cybersecurity Platform | XcitiumXcitium · undated page, accessed October 31, 2026 · Tier A
  3. [3]Release Notes: Xcitium Enterprise & Platform Update - March 05 2026Xcitium Forum · published March 5, 2026 · Tier A
  4. [4]Xcitium Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 31, 2026 · Tier C
  5. [5]XDR Cyber Security | Benefits of Cybersecurity SolutionsXcitium · undated page, accessed November 3, 2026 · Tier A
  6. [6]Extended Detection & Response (XDR) | XcitiumXcitium · undated page, accessed November 3, 2026 · Tier A
  7. [7]Case Studies for Cybersecurity | XcitiumXcitium · undated page, accessed November 3, 2026 · Tier A

Spot a factual error? Request a correction.