Qualys has launched Real-Time Cloud Security Posture Management, or CSPM, a capability built into its Enterprise TruRisk Platform. It promises to catch cloud misconfigurations as they happen rather than on a schedule. The pitch is sound, but the label deserves scrutiny.
CSPM tools watch cloud configurations — open storage buckets, loose identity permissions, drifted Kubernetes settings — and flag them against security baselines. Traditional versions scan every few hours or days. Qualys says its new version detects changes in real time, using event-driven APIs and sub-minute polling.
What Qualys launched
The capability is agentless, covering more than 200 cloud services, and folds findings into Qualys’s risk platform alongside vulnerability and endpoint data. It offers remediation workflows that connect to Jira and ServiceNow, and maps to standards including NIST, CIS Benchmarks and PCI-DSS.
Qualys frames it as closing the gap between detection and action. Its product director compares a periodic scan to an air traffic controller watching a screen that refreshes every 15 minutes.
The limits of “real-time”
Two limits are worth stating plainly.
First, coverage. Qualys’s own documentation says Real-Time CSPM supports AWS and Azure in the initial release, with other providers to follow. The release’s framing — multi-cloud across AWS, Azure and Google Cloud — describes the problem, not yet the product.
Second, and more important, what posture management can see. Agentless CSPM reads configuration through cloud provider APIs. That makes it excellent at spotting a public bucket or an over-privileged role. It is far weaker at detecting an attack in progress. An intruder using valid credentials against a correctly configured resource changes nothing for a posture scan to flag.
Independent analysts make the point bluntly. Agentless scanning describes the system at rest. Event-driven scanning narrows the window for changes that alter configuration, but activity that changes nothing never triggers a scan at all. Real-time posture is not the same as real-time attack detection.
A CSPM market that is consolidating
Qualys is pushing into a category under pressure. CSPM is increasingly a feature inside broader cloud-native application protection platforms rather than a standalone product. Google closed its US$32 billion acquisition of Wiz in March 2026, the largest security deal on record, and Palo Alto, CrowdStrike and Microsoft all bundle posture into wider platforms.
That has compressed the standalone segment. Analysts estimate CSPM at about US$5.25 billion in 2025, reaching roughly US$10.6 billion by 2030. The faster growth sits next door, in runtime workload protection.
For Qualys, a long-established vulnerability management vendor, bundling real-time posture into its risk platform is a defensive move as much as an offensive one.
A note on timing
Qualys announced Real-Time CSPM on its own blog on 12 August 2026. The version distributed to journalists carried a 5 October dateline. Readers should treat the announcement as a re-issue, not a fresh launch.
What to watch
Whether Google Cloud support arrives, since Qualys’s own documentation lists only AWS and Azure. Whether “real-time” posture actually reduces mean time to remediation in customer environments, which Qualys claims but has not evidenced publicly. And whether Qualys’s integration story holds up against the platform consolidation reshaping this market.
Real-time visibility into configuration is a genuine improvement. It is not, on its own, real-time defence.
Editor’s Note
Sources: Qualys‘s media alert of 5 October 2026 and its blog post of 12 August 2026; Qualys product documentation; and independent analysis of agentless scanning and the CSPM market. The “real-time” and coverage claims are Qualys’s own. Market-size figures are estimates and are cited as such. TechRecast has not independently tested the product. This article is not investment advice.