Assessing Mainframe Compliance While Minimizing Operational Impact | Qualys

Summary: Qualys introduced Out-of-Band Configuration Assessment for mainframes, which uses an offline data-push mechanism rather than connecting directly to the systems or installing a Cloud Agent. Customers run prescribed commands such as 'SETROPTS LIST' for IBM z/OS RACF, upload the output through the UI or API, and Qualys runs compliance signatures against frameworks including PCI-DSS, DISA STIG, GDPR, NIST, and SOX. The blog cites Forrester surveys finding security incidents are commonplace on mainframes and notes that 71% of Fortune 500 companies and 90% of the world's largest banks depend heavily on them.
What's compelling: Mainframes hold the most critical data at 90% of the world's largest banks, yet the article states authenticated scans are often infeasible and scanning overhead is too high on these real-time systems - so compliance evidence depends on configuration data your own scripts and automation must collect and push.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026