Eliminate Risk with Precision: Introducing Vulnerability Detection Sources in VMDR | Qualys
Summary: Qualys VMDR added a Vulnerability Detection Sources feature that records whether each vulnerability was found by a Cloud Agent, perimeter scan, internal scanner, or another supported method, and shows it in a new Sources column, a Group by filter, QQL search tokens, CSV reports, and the API parameter vuln_detection_source=1. When a vulnerability is detected on an externally exposed asset, TruRisk automatically increases its score by 20%, and the detection source data is not retroactive, appearing only from the next scan onward.
What's compelling: A 20% TruRisk score bump for externally exposed assets only works if you can tell an internet-facing finding from an internal one, and the feature is not retroactive, so everything already in your environment carries no source data until it is rescanned. One commenter also reports the vuln_detection_source=1 API response runs about 8x slower than without it, with a faster endpoint not due until later in 2026.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026