Qualys TotalCloud Sign Up: Complete Guide to Getting Started with Cloud-Native Security in 2026

Cloud security has become a top priority for organizations moving workloads to AWS, Azure, and Google Cloud. Qualys TotalCloud offers a single platform that handles everything from vulnerability scanning to compliance checks. But getting started can feel overwhelming if you don’t know where to begin.

This guide walks you through the Qualys TotalCloud sign up process step by step. We’ll cover what you need before creating your account, how to connect your cloud providers, and ways to get the most out of the platform’s features. Whether you’re a federal agency needing FedRAMP High authorization or a private company wanting better visibility into your cloud assets, you’ll find practical advice here.

By the end, you’ll understand exactly how to register for Qualys TotalCloud, set up your first connector, and start scanning your environment for security gaps.

What Is Qualys TotalCloud and Why Should You Care?

Qualys TotalCloud is a cloud-native application protection platform, often called a CNAPP. It brings together multiple security functions into one tool. You get vulnerability management, compliance monitoring, asset discovery, and threat detection without juggling separate products.

The Problem TotalCloud Solves

Most organizations use five to ten different security tools for their cloud environments. One tool scans for vulnerabilities. Another checks compliance. A third handles container security. This creates gaps. Data doesn’t flow between systems. Teams waste time switching between dashboards.

TotalCloud fixes this by putting everything in one place. Your security team sees the full picture. They can track a vulnerability from discovery to fix without leaving the platform.

Core Features You Get After Signing Up

Once you complete the Qualys TotalCloud registration process, you unlock several features:

• Cloud Security Posture Management (CSPM) – Finds misconfigurations across your cloud accounts
• Cloud Workload Protection (CWP) – Scans virtual machines and containers for vulnerabilities
• Infrastructure as Code (IaC) Security – Catches problems in Terraform and CloudFormation templates before deployment
• Container Security – Protects Docker images and Kubernetes clusters
• Software Composition Analysis (SCA) – Identifies risky open-source libraries in your code

You don’t need to buy each feature separately. The platform gives you a unified view of risk across your entire cloud footprint.

Who Uses TotalCloud?

TotalCloud works for different types of organizations. Large enterprises use it to manage complex multi-cloud environments. Mid-sized companies appreciate the single-platform approach that reduces tool sprawl.

Federal agencies have a special reason to choose TotalCloud. The platform achieved FedRAMP High authorization in 2026. This means it meets the strict security requirements for handling sensitive government data.

Prerequisites Before Starting Your Qualys TotalCloud Account Setup

Before you begin the sign-up process, gather some information. Having everything ready makes the registration go faster.

Information You’ll Need

The Qualys TotalCloud enrollment form asks for basic details about your organization:

• Company name and address – Must match your official business registration
• Work email address – Personal email domains like Gmail or Yahoo won’t work
• Phone number – For verification and sales contact
• Estimated number of cloud assets – Helps Qualys size your subscription correctly
• Primary cloud provider – AWS, Azure, GCP, or multiple

You’ll also need to know who in your organization will manage the platform. TotalCloud uses role-based access control. Planning your user structure early saves time later.

Technical Requirements

The platform runs in the cloud, so you don’t need to install servers. But you do need a few things ready:

Browser compatibility: TotalCloud works best with Chrome, Firefox, or Edge. Safari works but may have minor display issues. Internet Explorer isn’t supported.

Cloud account access: You’ll need administrator credentials for the cloud accounts you want to monitor. The sign-up process includes connecting at least one cloud provider.

Network access: Your firewall must allow outbound connections to Qualys servers. The specific IP ranges depend on your assigned Qualys platform. The support team provides this information during onboarding.

Understanding the Connector Requirement

Here’s something people often miss. The only prerequisite to start with TotalCloud is configuring a CSPM connector for your cloud account. A connector links your cloud provider account with Qualys so that Qualys applications can fetch the necessary data from your environment.

Think of connectors as bridges. They let TotalCloud see what’s happening in your AWS, Azure, or GCP accounts. Without a connector, the platform has nothing to scan.

You can set up connectors during or after the sign-up process. But having your cloud credentials ready speeds things up.

Step-by-Step Guide to the Qualys TotalCloud Sign Up Process

Let’s walk through creating your TotalCloud account from start to finish. The process takes about 15 to 30 minutes depending on how many cloud accounts you want to connect.

Step 1: Visit the Qualys Website

Go to qualys.com and look for the TotalCloud product page. You’ll see options for a free trial or a demo request. Most organizations start with the trial to test the platform before committing.

Click the “Free Trial” button. This takes you to the registration form.

Step 2: Complete the Registration Form

The form asks for your contact information and company details. Fill in each field accurately. Qualys verifies business information before activating accounts.

Pro tip: Use your work email address. Accounts tied to free email providers often get flagged for additional review, which delays activation.

After submitting the form, check your email. Qualys sends a verification link within a few minutes. Click it to confirm your address.

Step 3: Receive Your Platform Credentials

Once verified, you’ll get a second email with your Qualys platform URL and temporary login credentials. The URL depends on which data center hosts your account.

Common platform URLs include:

• qualysguard.qualys.com (US Platform 1)
• qualysguard.qg2.apps.qualys.com (US Platform 2)
• qualysguard.qg3.apps.qualys.eu (EU Platform)
• qualysguard.qg4.apps.qualys.com (UAE Platform)

Bookmark your specific URL. You’ll use it every time you log in.

Step 4: First Login and Password Change

Log in with your temporary credentials. The system immediately asks you to create a new password. Qualys enforces strong password requirements:

• At least 12 characters
• Mix of uppercase and lowercase letters
• At least one number
• At least one special character
• Can’t match your last 10 passwords

Consider using a password manager. You’ll need to change your password every 90 days by default.

Step 5: Accept the Terms of Service

Before accessing the dashboard, you must accept the Qualys Master Subscription Agreement and Privacy Policy. Read these documents. They explain data handling, liability limits, and your obligations as a customer.

Federal customers should note that Qualys offers government-specific terms that align with FedRAMP requirements.

Step 6: Initial Platform Configuration

After accepting the terms, you land on the main dashboard. TotalCloud displays a getting started wizard. Follow it to configure your basic settings:

Time zone: Set this correctly. All timestamps in reports use your configured time zone.

Notification preferences: Choose how you want to receive alerts. Options include email, API webhooks, or integration with ticketing systems.

Asset tags: Create your first tags. Tags help organize assets by business unit, environment, or criticality level.

Step 7: Set Up Your First Cloud Connector

Now comes the most technical part. You need to create a connector that links TotalCloud to your cloud provider.

The process varies by provider. Here’s how it works for the big three:

AWS Connector Setup

TotalCloud uses an IAM role in your AWS account to access resources. You have two options:

Option A: CloudFormation Stack (Recommended)

TotalCloud provides a CloudFormation template. Upload it to AWS CloudFormation, and it creates all the needed IAM roles and policies automatically. This method takes about five minutes.

Option B: Manual IAM Configuration

If your security policy doesn’t allow CloudFormation, create the IAM role manually. TotalCloud provides the exact policy document. Copy it into the AWS IAM console.

After creating the role, copy the Role ARN back into TotalCloud. The platform tests the connection and confirms success.

Azure Connector Setup

Azure connectors use an App Registration in Azure Active Directory. The process involves:

1. Creating an App Registration in the Azure portal
2. Granting the app Reader permissions on your subscriptions
3. Generating a client secret
4. Entering the Application ID, Directory ID, and client secret into TotalCloud

TotalCloud walks you through each step with screenshots. Most users complete Azure setup in ten to fifteen minutes.

Google Cloud Connector Setup

GCP connectors use service accounts. You create a service account in your GCP project, grant it the Viewer role, and generate a JSON key file.

Upload the key file to TotalCloud. The platform validates the connection and begins discovering your GCP resources.

Step 8: Wait for Initial Discovery

After connecting your cloud accounts, TotalCloud starts discovering assets. This process runs automatically. Depending on your environment size, it takes anywhere from ten minutes to several hours.

You can watch progress on the dashboard. The asset count increases as TotalCloud finds VMs, containers, databases, storage buckets, and other resources.

Don’t worry if the count seems low at first. TotalCloud performs a deep scan that catches resources other tools miss.

Step 9: Review Your Cloud Inventory

Once discovery completes, you have a full inventory of your cloud assets. This is the foundation for everything TotalCloud does.

The inventory shows:

• Virtual machines and their configurations
• Container images and running containers
• Storage buckets and their permissions
• Databases and encryption status
• Network security groups and their rules
• IAM users, roles, and policies

Spend time exploring the inventory. Look for resources you didn’t know existed. Many organizations find forgotten test environments or unauthorized resources during this step.

Understanding the TotalCloud Dashboard After Account Creation

Your new TotalCloud account includes a dashboard that organizes security information in a logical way. Let’s look at what you’ll see and how to use it.

The Risk Operations Center

The main dashboard is called the Risk Operations Center, or ROC. It shows your overall security posture at a glance.

A large risk score sits at the top. This number combines vulnerability data, misconfiguration findings, and threat intelligence. A lower score means better security.

Below the score, you see trend charts. They show whether your risk is increasing or decreasing over time. Green arrows pointing down are good. Red arrows pointing up need attention.

Asset Views

The asset section organizes your cloud resources by type. You can view:

Compute assets: Virtual machines, container hosts, and serverless functions

Storage assets: S3 buckets, Azure Blob containers, and GCP Cloud Storage

Network assets: VPCs, subnets, security groups, and load balancers

Identity assets: IAM users, service accounts, and access keys

Each view includes filters. Narrow down by cloud provider, region, tag, or risk level. Filters persist across sessions, so you can build custom views for different teams.

Findings and Vulnerabilities

The findings section lists security problems TotalCloud discovered. Each finding includes:

• Severity rating – Critical, High, Medium, Low, or Informational
• Affected resource – The specific asset with the problem
• Description – What the problem is and why it matters
• Remediation guidance – How to fix it
• Evidence – Technical proof of the finding

You can sort findings by severity to tackle the worst problems first. TotalCloud also prioritizes based on exploitability and exposure, not just CVSS scores.

Compliance Reports

The compliance section shows how your environment stacks up against frameworks like CIS Benchmarks, PCI DSS, HIPAA, and NIST 800-53.

Each framework appears as a scorecard. You see the percentage of controls you pass, fail, or can’t assess. Drill down into failed controls to see which resources need attention.

TotalCloud updates compliance scores continuously. When you fix a problem, the score improves automatically. No need to run manual scans.

Configuring FlexScan for Cloud-Native Assessments

FlexScan is TotalCloud’s comprehensive cloud-native assessment solution. It allows organizations to combine multiple cloud scanning options for the most accurate security assessment of their cloud environment.

What Makes FlexScan Different

Traditional vulnerability scanners use a single approach. They either scan from outside your network or require agents on every machine. Both methods have limitations.

FlexScan combines multiple scanning techniques:

API-based scanning: Uses cloud provider APIs to check configurations without touching your workloads

Snapshot scanning: Creates temporary snapshots of VM volumes and scans them for vulnerabilities

Agent-based scanning: Deploys lightweight agents for deep host-level visibility

Network scanning: Scans from inside your VPC to find exposed services

You pick which methods to use based on your needs. Some organizations use all four. Others start with API-based scanning and add agents later.

Setting Up FlexScan After Your TotalCloud Registration

Once you’ve signed up for TotalCloud and connected your cloud accounts, enabling FlexScan takes a few clicks.

Navigate to the FlexScan settings page. Choose your preferred scanning methods. For each method, configure the scope. You might scan everything, or target specific resource types.

Scheduling options:

• Continuous – Scans run constantly, checking resources as they change
• Daily – Full scans run once per day at your chosen time
• Weekly – Full scans run on a specific day each week
• On-demand – You manually trigger scans when needed

Most organizations choose continuous scanning for production environments. Development environments often use daily or weekly schedules to reduce noise.

Understanding FlexScan Results

FlexScan results appear in the main findings list. Each finding shows which scanning method detected it. This helps you understand coverage.

If FlexScan finds the same vulnerability through multiple methods, it consolidates into a single finding. You won’t see duplicates cluttering your dashboard.

Results include remediation scripts when available. For common issues like outdated packages, FlexScan provides copy-paste commands to fix the problem.

Setting Up Rule-Based Alerts in TotalCloud

Finding security problems is only useful if the right people know about them quickly. TotalCloud’s alerting system makes sure issues don’t slip through the cracks.

How Alert Rules Work

Alert rules define what triggers a notification and who receives it. You create rules based on conditions like:

• Severity level (alert on all Critical findings)
• Resource type (alert when storage buckets have public access)
• Compliance framework (alert when PCI controls fail)
• Tag values (alert on issues in production environment)

Rules support AND and OR logic. Create simple rules or complex ones that match specific scenarios.

Creating Your First Alert Rule After Signing Up

Let’s create a rule that alerts your security team when TotalCloud finds critical vulnerabilities in production.

Go to Settings, then Alert Rules. Click Create New Rule.

Step 1: Name your rule

Give it a descriptive name like “Critical Vulns in Prod – Security Team.” Clear names help when you have dozens of rules.

Step 2: Define conditions

Set condition 1: Severity equals Critical

Add condition 2: Tag Environment equals Production

Combine with AND logic. Both must be true to trigger the alert.

Step 3: Choose recipients

Enter email addresses for your security team. You can also send alerts to Slack channels, PagerDuty, or custom webhooks.

Step 4: Set frequency

Choose immediate for urgent issues. Or batch alerts into daily digests for less critical rules.

Save the rule. It starts working immediately.

Alert Best Practices

Alert fatigue is real. If you send too many notifications, people start ignoring them. Follow these guidelines:

Start narrow, expand later: Begin with rules for only the most critical issues. Add more rules as your team adjusts.

Route to the right teams: Infrastructure alerts go to the infrastructure team. Application vulnerabilities go to developers. Don’t send everything to everyone.

Use digests for noise: Low and medium findings often work better as daily summaries than instant alerts.

Include context: TotalCloud lets you add custom text to alerts. Use this to explain why the alert matters and what action to take.

Connecting TotalCloud to Your Existing Security Tools

TotalCloud doesn’t exist in isolation. It works better when connected to your other security and IT systems.

SIEM Integration

Security Information and Event Management (SIEM) platforms like Splunk, Microsoft Sentinel, and IBM QRadar collect data from across your environment.

TotalCloud sends findings to SIEMs in several formats:

• Syslog: Traditional format supported by all SIEMs
• CEF: Common Event Format with structured fields
• API: Pull data directly from TotalCloud’s REST API

The SIEM integration helps your SOC team see cloud security events alongside network and endpoint data. They can correlate events and spot attack patterns.

Ticketing System Integration

Finding vulnerabilities means nothing if they don’t get fixed. Integrating with ticketing systems creates accountability.

TotalCloud connects to:

• Jira
• ServiceNow
• Zendesk
• GitHub Issues
• Azure DevOps

When TotalCloud finds an issue, it can automatically create a ticket. The ticket includes all the details: affected resource, severity, remediation steps, and evidence.

As tickets move through your workflow, TotalCloud tracks status. When someone marks a ticket resolved, TotalCloud rescans to confirm the fix worked.

DevOps Pipeline Integration

Shift-left security means finding problems before deployment. TotalCloud integrates with CI/CD pipelines to scan code and infrastructure templates.

Supported platforms include:

• Jenkins
• GitLab CI
• GitHub Actions
• Azure Pipelines
• CircleCI

Add TotalCloud as a step in your pipeline. It scans Terraform, CloudFormation, Kubernetes manifests, and container images. If it finds critical issues, the build fails. Developers fix problems before they reach production.

Setting Up Integrations After Your Account Setup

Integrations live under Settings, then Integrations. Each integration type has its own configuration page.

For most integrations, you need:

• API credentials from the target system
• Network connectivity between TotalCloud and the system
• Appropriate permissions in both platforms

Test each integration before relying on it. TotalCloud includes a test button that sends a sample event and verifies it arrived.

FedRAMP High Authorization: What It Means for Your TotalCloud Enrollment

If you work for a federal agency or a contractor handling government data, FedRAMP authorization matters. Qualys TotalCloud achieved FedRAMP High authorization in 2026, and this has big implications.

What Is FedRAMP High?

FedRAMP stands for Federal Risk and Authorization Management Program. It’s a government program that standardizes security assessment for cloud services.

There are three authorization levels: Low, Moderate, and High. High is the most stringent. It applies to systems where a security breach could cause “severe or catastrophic adverse effects.”

Getting FedRAMP High authorization requires meeting over 400 security controls from NIST SP 800-53. Qualys underwent extensive third-party assessment to prove TotalCloud meets all requirements.

Benefits for Federal Agencies Creating TotalCloud Accounts

When a federal agency signs up for TotalCloud, they get several advantages:

Compliance inheritance: Agencies and contractors inherit 421+ validated NIST 800-53 High controls. This accelerates your Authority to Operate (ATO) timeline by months.

Reduced audit costs: Qualys documentation shows that customers can reduce audit costs by up to 40%. You don’t need to validate controls that Qualys already proved.

Multi-framework coverage: The same authorization satisfies CMMC 2.0, HIPAA, and PCI DSS requirements from a single platform.

Meeting BOD 22-01 and BOD 23-01 Requirements

Federal civilian agencies must comply with Binding Operational Directives from CISA. BOD 22-01 and BOD 23-01 are mandatory federal law, not just best-practice guidance.

These directives require agencies to:

• Continuously discover all internet-facing assets
• Track known exploited vulnerabilities
• Remediate critical findings within strict timelines
• Report compliance status to CISA

TotalCloud directly supports these requirements. Its continuous scanning satisfies the discovery mandate. The vulnerability database includes all CISA Known Exploited Vulnerabilities. Reports show compliance with remediation timelines.

Federal agencies that create a TotalCloud account get a head start on meeting these directives.

How FedRAMP Authorization Affects the Sign Up Process

If you’re signing up as a federal customer, the process has some differences:

Platform location: Your account will be provisioned on a FedRAMP-authorized data center, typically in the US.

Contract terms: Federal customers sign government-specific terms that include provisions required by FedRAMP.

Dedicated support: Federal accounts get access to Qualys staff with appropriate clearances.

Documentation: You receive a FedRAMP authorization package that your security team can reference.

Request the federal enrollment path when filling out the sign-up form. The Qualys team will route your application appropriately.

Understanding CNAPP and How TotalCloud Fits the Definition

You may have heard the term CNAPP used in cloud security discussions. TotalCloud is Qualys’s answer to this category.

What CNAPP Actually Means

CNAPP stands for Cloud-Native Application Protection Platform. Gartner coined the term to describe tools that combine multiple cloud security functions.

Before CNAPP, organizations bought separate products:

• CSPM (Cloud Security Posture Management) for misconfigurations
• CWPP (Cloud Workload Protection Platform) for vulnerability scanning
• CASB (Cloud Access Security Broker) for SaaS visibility
• CIEM (Cloud Infrastructure Entitlement Management) for identity

CNAPP merges these into one platform. You get a unified view instead of four separate consoles.

How TotalCloud Delivers CNAPP Capabilities

Qualys TotalCloud covers all the functions expected from a CNAPP:

CSPM functions: TotalCloud continuously checks cloud configurations against best practices. It catches open security groups, unencrypted storage, and excessive permissions.

CWPP functions: FlexScan provides multiple ways to assess workload security. It finds vulnerabilities in operating systems, applications, and containers.

CIEM functions: TotalCloud analyzes IAM policies. It identifies over-privileged users and service accounts. It shows who has access to sensitive resources.

IaC security: Scan infrastructure templates before deployment. Catch problems in Terraform, CloudFormation, and ARM templates.

Container security: Protect the full container lifecycle. Scan images in registries, monitor running containers, and secure Kubernetes configurations.

Why CNAPP Matters When You Register for TotalCloud

Understanding CNAPP helps you get more value from TotalCloud. Many users sign up thinking it’s just a vulnerability scanner. They miss the broader capabilities.

After your Qualys TotalCloud account setup, take time to explore all the modules. Enable CSPM if you haven’t. Set up IaC scanning in your pipelines. Check the identity analysis features.

Using the full CNAPP reduces your need for other tools. It also gives you better context when investigating security issues.

Pricing and Licensing Models for TotalCloud

Understanding pricing helps you plan your budget before signing up. Qualys uses a subscription model with several variables.

How TotalCloud Licensing Works

TotalCloud pricing depends on:

Number of assets: You pay based on the cloud resources TotalCloud monitors. VMs, containers, and serverless functions all count.

Modules enabled: Each capability (CSPM, CWP, IaC scanning, etc.) can be licensed separately or as a bundle.

Contract length: Longer contracts get better rates. Annual contracts are most common.

Support tier: Standard support comes included. Premium support with faster response times costs extra.

Trial Options When Creating Your Account

Qualys offers free trials for TotalCloud. The trial lets you test all features with your actual cloud environment.

During the Qualys TotalCloud registration, select the trial option. You won’t need to provide payment information until you’re ready to convert.

Trial periods typically last 14 to 30 days. Sales teams can extend trials if you need more time to evaluate.

Getting a Quote

Pricing isn’t published on the website because it varies by organization size and needs. After signing up, work with your Qualys sales rep to get a custom quote.

Come prepared with:

• Estimated number of cloud assets across all providers
• Which modules you want (or start with “all of them” to see everything)
• Your preferred contract length
• Any compliance requirements that affect your needs

Ask about volume discounts if you have a large environment. Qualys offers significant breaks at higher asset counts.

Comparing TotalCloud to Alternative Solutions

TotalCloud isn’t the only CNAPP on the market. Here’s how it compares to other options you might consider.

TotalCloud vs. Palo Alto Prisma Cloud

Prisma Cloud is a well-known competitor with broad capabilities. Both platforms cover CSPM, CWPP, and container security.

Where TotalCloud wins:

• Unified vulnerability management across cloud and on-premises
• FedRAMP High authorization (Prisma has Moderate)
• Deeper integration with Qualys’s other security modules

Where Prisma Cloud wins:

• Larger market share means more community resources
• Tighter integration with Palo Alto firewalls
• More mature identity security features

TotalCloud vs. Wiz

Wiz is a newer entrant that grew quickly with its agentless scanning approach.

Where TotalCloud wins:

• More scanning options (not just agentless)
• Better for organizations with existing Qualys investments
• FedRAMP High vs. Wiz’s FedRAMP Moderate

Where Wiz wins:

• Faster time to value with simpler setup
• Highly visual attack path analysis
• Strong venture funding driving rapid feature development

TotalCloud vs. CrowdStrike Falcon Cloud Security

CrowdStrike added cloud security to complement its endpoint protection platform.

Where TotalCloud wins:

• Deeper vulnerability management capabilities
• More compliance framework coverage
• Independent from endpoint vendor lock-in

Where CrowdStrike wins:

• Better for customers already using Falcon for endpoints
• Stronger threat intelligence integration
• Real-time threat detection in cloud workloads

Making Your Decision

The best choice depends on your situation. TotalCloud fits well if:

• You already use other Qualys products
• You need FedRAMP High authorization
• You want flexibility in scanning methods
• You prefer a single platform for cloud and on-premises security

Request trials from multiple vendors. Test them in your actual environment before committing.

Best Practices After Completing Your TotalCloud Registration

Getting signed up is just the beginning. Here’s how to get the most from TotalCloud in your first 30 days.

Week 1: Foundation Building

Day 1-2: Connect all cloud accounts

Don’t stop at one connector. Link every AWS account, Azure subscription, and GCP project. TotalCloud can’t protect what it can’t see.

Day 3-4: Review initial findings

After discovery completes, look at what TotalCloud found. Focus on critical and high severity items first. Note any false positives to tune later.

Day 5-7: Set up basic alerts

Create rules for the most urgent issue types. Make sure the right people get notified. Test that alerts actually arrive.

Week 2: Deep Configuration

Day 8-10: Organize with tags

Create a tagging strategy. Use tags to identify production vs. development, business owners, and data sensitivity levels. Tags power reporting and alerting.

Day 11-12: Enable compliance policies

Activate the compliance frameworks that apply to your organization. Run initial compliance reports. Share them with your compliance team.

Day 13-14: Configure FlexScan

Choose your scanning methods. Set appropriate schedules for different environments. Verify scans run successfully.

Week 3: Integration and Automation

Day 15-17: Connect to ticketing

Link TotalCloud to your ticketing system. Start creating tickets for critical findings. Establish ownership and SLAs.

Day 18-19: SIEM integration

Send TotalCloud data to your SIEM. Create correlation rules that combine cloud security events with other data sources.

Day 20-21: Pipeline integration

Add TotalCloud scanning to your CI/CD pipelines. Start with warnings only, then shift to blocking once teams adjust.

Week 4: Optimization and Training

Day 22-24: Tune false positives

Review any findings your team marked as false positives. Create exceptions where appropriate. Reduce noise without hiding real issues.

Day 25-27: Train your team

Hold training sessions for security analysts, cloud engineers, and developers. Each group uses TotalCloud differently. Tailor training to their needs.

Day 28-30: Document and iterate

Write down your processes. How does your team triage findings? What’s the escalation path? Review what’s working and what needs improvement.

Troubleshooting Common Issues During TotalCloud Account Setup

Even with good documentation, things can go wrong. Here are solutions to problems people frequently encounter.

Connector Fails to Authenticate

Symptoms: TotalCloud shows an authentication error when testing the connector. No assets appear.

Causes and fixes:

• Wrong credentials: Double-check the Role ARN, Application ID, or service account key. Copy-paste errors are common.
• Missing permissions: Verify the IAM role or service account has the required policies attached.
• Trust relationship: For AWS, ensure the trust policy allows the Qualys account ID to assume the role.
• Expired credentials: Azure client secrets and GCP keys can expire. Generate new ones if needed.

Assets Not Appearing After Discovery

Symptoms: The connector tests successfully, but asset counts stay at zero.

Causes and fixes:

• Regional limitations: Check if you restricted the connector to specific regions. Assets in other regions won’t appear.
• Discovery still running: Large environments take hours. Check the discovery status page for progress.
• Resource filters: Review any filters configured on the connector. They might exclude the assets you expect.

Scans Not Running on Schedule

Symptoms: You configured scheduled scans, but they don’t run at the expected times.

Causes and fixes:

• Time zone mismatch: Verify your account time zone matches your expectations. A schedule for 2 AM might run at 2 AM UTC, not your local time.
• Scan window conflicts: Multiple scans can’t run simultaneously. Later scans queue until earlier ones finish.
• Connector errors: If the connector is unhealthy, scans can’t run. Check connector status first.

Too Many False Positives

Symptoms: Your team spends more time dismissing findings than fixing real issues.

Causes and fixes:

• Overly strict policies: Default policies catch everything. Customize them for your environment.
• Missing context: Some findings only matter in certain situations. Use tags and exceptions to add context.
• Outdated baselines: If your environment changed, TotalCloud might flag intentional changes as problems.

Getting Help

If you can’t solve a problem yourself, contact Qualys support. The support portal is available from the help menu in the TotalCloud console.

For complex issues, open a support case and include:

• Screenshots of error messages
• Timestamps when the problem occurred
• Steps you already tried
• Your connector IDs and asset IDs

The support team can access your account with permission to help diagnose issues.

Security Considerations When Granting TotalCloud Access

Connecting TotalCloud to your cloud accounts requires granting access. Do this carefully to maintain security.

Principle of Least Privilege

The IAM roles and service accounts used by TotalCloud should have only the permissions they need. No more.

Qualys provides pre-built policies that follow least privilege. Don’t add extra permissions “just in case.” If TotalCloud needs something, the documentation will specify it.

Review the policies before applying them. Understand what access you’re granting. Your security team should approve the permissions.

Using Read-Only Access

For most TotalCloud functions, read-only access is sufficient. This includes:

• Asset discovery
• Configuration assessment
• Compliance monitoring
• Vulnerability detection

Write access is only needed for optional features like automated remediation. If you’re not using those features, stick to read-only.

Monitoring Third-Party Access

Once you grant TotalCloud access, monitor its activity. Cloud providers offer logging for API calls made by third parties.

In AWS, use CloudTrail to see what TotalCloud’s role does. In Azure, check Azure Activity Logs. In GCP, use Cloud Audit Logs.

Set up alerts for unexpected activity. If TotalCloud suddenly starts accessing resources it shouldn’t, investigate immediately.

Regular Access Reviews

Every quarter, review the access you’ve granted to TotalCloud. Verify it’s still appropriate. Remove permissions for features you’re not using.

If you stop using TotalCloud entirely, revoke all access immediately. Don’t leave dormant IAM roles in your accounts.

Getting Maximum Value From Your TotalCloud Subscription

You’re paying for TotalCloud. Here’s how to make sure you get your money’s worth.

Use All the Features You Licensed

Many organizations buy TotalCloud but only use half the features. Review your license to see what’s included. Then enable those features.

If you licensed IaC scanning, actually scan your templates. If you have container security, scan your images. Unused features are wasted money.

Build Custom Dashboards

The default dashboards work for most situations. But custom dashboards show exactly what your team needs.

Build dashboards for different audiences. Executives want high-level risk scores. Engineers want detailed finding lists. Compliance teams want framework coverage.

Automate What You Can

TotalCloud’s API enables automation. Common automation scenarios include:

• Automatically tagging new assets based on naming conventions
• Creating tickets for high-severity findings without manual steps
• Generating weekly reports and emailing them to stakeholders
• Triggering remediation workflows when specific findings appear

Automation saves time and ensures consistency. Invest in building automations early.

Stay Current With Updates

Qualys regularly adds new features and improves existing ones. Watch the release notes. Attend webinars about new capabilities.

New features might address problems you’ve been working around. Or they might open up use cases you hadn’t considered.

Participate in the Community

Qualys has user forums and community groups. Other TotalCloud users share tips, ask questions, and help each other.

Joining the community gives you access to real-world experiences. Learn how other organizations solved problems similar to yours.

Conclusion

Signing up for Qualys TotalCloud opens the door to better cloud security. The platform combines vulnerability management, compliance monitoring, and threat detection in one place. Getting started takes just a few steps: create your account, connect your cloud providers, and configure your first scans.

Take advantage of the FedRAMP High authorization if you handle government data. Use FlexScan’s multiple scanning methods for complete coverage. And integrate TotalCloud with your existing tools to build a connected security program. The investment in proper setup pays off with better visibility and faster response times.

Frequently Asked Questions About Qualys TotalCloud Sign Up