Web Application Security: Q&A with Will Bechtel | Qualys

Summary: Qualys is working to integrate its Web Application Scanning and Vulnerability Management detection tools with its Web Application Firewall, feeding WAF-observed traffic back into the scanner to reveal site areas hidden behind higher authentication levels and to map AJAX and REST API calls and their parameters. The company is also addressing discovery gaps caused by DNS-based and virtual-server hosting, where one IP can serve many DNS names, by peeking into customer DNS records to capture server-name-to-IP mappings and flag new web applications for separate scanning.
What's compelling: Large clients, per the source, have very little insight into what is newly coming onto their network, as business and marketing groups stand up sites for two or three weeks and drop them, and a scanner given a lower authentication level may be missing parts of a site without anyone knowing.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026