Qualys Cloud Agent and Software Composition Analysis Implementation

This technical report outlines the implementation of Qualys Cloud Agent and Software Composition Analysis (SwCA) at NCR Atleos. The document details the transition from Rapid7 to Qualys, which accompanied a significant increase in workforce and infrastructure complexity. The report discusses the establishment of a Vulnerability Management Program that addresses challenges such as vulnerability remediation and managing third-party risks. It describes how SwCA was proposed and integrated into the organization's processes, enabling daily scans across numerous assets and enhancing visibility into vulnerabilities. The effectiveness of SwCA in identifying and managing vulnerabilities, particularly log4j issues, is documented. Additionally, the report covers future steps, including the implementation of TruRisk for identifying high-risk assets, and the planned integration of Cloud Connector for enhanced monitoring. The overall goal is to achieve minimal risk exposure across the environment through targeted patching and proactive vulnerability management.