Building an App Sec Program with Qualys WAS -Introduction and Configuring a Web Application or API: Default Scan Settings | Qualys
Summary: Qualys outlines how default scan settings in its Web Application Scanning tool are established when a web application is created and can be overridden at scan time, with option profiles acting as scan blueprints covering URL scope, specific tests (QIDs), error thresholds, and scan speed. The post describes default profiles such as 'Initial WAS Options' and 'Authentication Test' available to new subscriptions, External and Individual scanner appliances, scan duration controls including 'Do Not Cancel Scan' (up to 24 hours) and 'Cancel Scan At,' and Progressive Scanning that resumes where a prior scan left off.
Why it matters: Progressive Scanning exists because some applications have scan windows too small or are too large to finish in one run, and the post's own guidance is to enable it whenever the scan window is short - a reminder that scan coverage is a configuration decision, not a default guarantee.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026