Comparison
OnScanner vs Qualys Web Application Scanning (WAS)
Qualys Web Application Scanning is part of the broader Qualys platform, built for organizations that need governed, portfolio-wide application scanning integrated with the rest of the Qualys stack. OnScanner is the self-serve counterpart: point it at a target you own, get a live consolidated report in one pass, automate it over a REST API or MCP server, and never sit through a procurement cycle to start.
Evaluating options? See OnScanner as an alternative to Qualys WAS.
Qualys Web Application Scanning (WAS) facts verified ·Page updated
TL;DR
Choose OnScanner when you want to start scanning today without a procurement cycle: self-serve signup, published credit prices, and live consolidated reports with privacy and consent checks, safe exploit verification and EPSS and CISA KEV context. Free plan, REST API and hosted MCP server included.
Qualys Web Application Scanning (WAS) is a great choice when you are standardizing on a platform suite: governed scanning across large application portfolios, integration with the wider Qualys stack, and formal procurement and support processes.
Feature comparison
Verified against public product pages on 2026-07-02. Cells marked "Not listed" mean the capability is not described on the vendor's public docs as of that date, not that it is impossible.
| Capability | OnScanner | Qualys Web Application Scanning (WAS) |
|---|---|---|
| External (unauthenticated) scanning | YesThe anonymous attacker's view, no agents | YesCloud-based DAST with discovery scans ('information gathered checks only') and vulnerability scans (XSS, SQL injection checks) |
| Authenticated scanning | YesScan behind login with credentials | YesForm-based, server-based (Basic, Digest, NTLM), OAuth2 (all four grant types) and Selenium-script authentication |
| Privacy, tracker & consent scanning | Yes40+ categories incl. fingerprinting | PartialNo cookie, tracker or consent-behavior scanning listed, but WAS detects PII exposure and collection points |
| Consent & Global Privacy Control verification | YesAdvanced and deep scans click Accept all and Reject all, send the GPC signal, and diff trackers and cookies against a normal visit | Not listed* |
| CVE intelligence (EPSS & CISA KEV) | YesCVE/CPE matching with EPSS + KEV context | YesTruRisk scoring factors in CVSS, EPSS, CISA KEV and end-of-life status |
| Active exploit verification | YesSafe, non-destructive, in-band probes | Not listed*Not listed on public docs as of 2026-07-02 |
| Patch-status & end-of-life detection | YesVendor/distro patch data + EOL flags | Partial'End of Life & End of Service for software, operating systems, or hardware' is an explicit TruRisk scoring factor |
| Email security (SPF, DKIM, DMARC) | Yes | Not listed*Not listed on public WAS docs as of 2026-07-02 |
| WAF detection | Yes | Not listed*Not listed on public docs as of 2026-07-02 |
| Continuous monitoring | YesMonitors re-scan weekly or daily and diff each run; on paid plans, an alert email when something changes for the worse | Yes'We recommend you schedule your scans to run automatically (daily, weekly, monthly)' |
| REST API | Yes | YesDedicated WAS API with a published user guide covering launching scans and retrieving scan status and results |
| MCP server for AI agents | YesHosted: mcp.onscanner.com | NoNo first-party MCP server listed on Qualys public pages as of 2026-07-02 |
| Deployment regression gate | YesCompares a preview scan with a production baseline (headers, TLS, exposed paths, trackers, OWASP families) for pass, regressed or inconclusive, via the REST API or MCP | Not listed* |
| AI analysis & remediation | YesOptional AI Findings (no extra credits per scan, turned on in account settings): executive summary, Top Risks, attack paths and remediation | Not listed* |
| Rule-based compliance matrix | YesOptional, turned on in account settings, +1 credit per scan. Versioned rules map scan evidence to SOC 2, ISO 27001, GDPR, PCI DSS, HIPAA, US state privacy and EU CRA controls; a plain-language AI narrative over each framework never changes a verdict | Not listed* |
| Compliance evidence & coverage | YesEach failing control cites what the scan observed; PDF evidence binder plus JSON or Vanta-format export. 25 of 229 controls are checkable from outside, the rest need your own evidence. Evidence at scan time, not a certification | Not listed* |
| Transparent self-serve pricing | YesFree plan; Pro $129/mo for 20 credits | NoLive vendor pricing page lists no dollar amounts |
Why teams pick OnScanner
- Start today: self-serve signup and a free plan, with a first report in minutes and no quote or procurement cycle.
- Published prices: Pro at $129 per month for 20 scan credits, and every add-on has a listed credit cost.
- Privacy and consent scanning Qualys WAS does not list: 40+ tracker, cookie and fingerprinting checks, plus consent and Global Privacy Control verification on advanced and deep scans.
- Safe, in-band exploit verification for known CVEs, alongside EPSS, CISA KEV, patch-status and end-of-life context.
- Email authentication and WAF detection in the same pass as the web scan.
- A hosted MCP server, where Qualys lists no first-party one, and a deployment gate that compares a preview scan with a production baseline for a pass, regressed or inconclusive verdict, through the REST API or MCP.
- Optional compliance evidence mapping: versioned rules, a stated coverage ratio and a PDF evidence binder that describe the site at the time of the scan.
When Qualys Web Application Scanning (WAS) fits
- You need authenticated scanning for complex login flows: form, Basic/Digest/NTLM, OAuth2, and Selenium-scripted logins including SSO and TOTP.
- You want web app findings unified with the wider Qualys platform: TruRisk prioritization blends CVSS, EPSS, CISA KEV, asset criticality and business context.
- You need add-on modules such as web malware detection, PII exposure detection, and API security test signatures.
The difference in one line: OnScanner delivers a live consolidated report in minutes, self-serve from a free tier, with privacy checks and an optional, rule-based compliance matrix across seven frameworks and no procurement cycle.
Pricing
OnScanner is self-serve with a free plan and Pro at $129 per month for 20 scan credits. Qualys Web Application Scanning is sold by quote, priced by the Cloud Platform apps you select, the number of IPs and web applications, and user licenses, with no self-serve checkout. Qualys pricing verified 2026-07-02.
Frequently asked questions
Is OnScanner an enterprise DAST replacement?
For large regulated portfolios standardized on an enterprise platform, a dedicated DAST program has its place. OnScanner fits teams that need the outside-in picture now, broader per-pass coverage including privacy and email posture, and self-serve pricing without procurement.
Why does pricing transparency matter here?
Enterprise scanning platforms are typically quote-based, which makes comparison and budgeting slow. OnScanner publishes its prices: a free plan and Pro at $129 per month, so you can evaluate with a real scan instead of a sales cycle.
Can AI agents use OnScanner in an enterprise workflow?
Yes. The hosted MCP server lets Claude, Cursor and other MCP-compatible agents create targets, run scans and fetch structured findings, and the REST API can be called from your own CI scripts, including the deployment gate before a release. Authorization rules still apply: you may only scan targets you own or are authorized to test.
Sources
Every Qualys Web Application Scanning (WAS) fact above was checked against these public pages on 2026-07-02. If something has changed since, tell us at support@onscanner.com and we will correct it.
- Qualys WAS pricing
- Qualys WAS product page
- Qualys TotalAppSec
- Qualys WAS analyst story
- WAS authentication basics docs (Qualys)
- WAS scanning basics docs (Qualys)
- TruRisk in WAS post (Qualys blog)
- AI-powered API security in WAS post (Qualys blog)
- MCP servers and shadow AI post (Qualys blog)
- Community Qualys MCP server (GitHub)
- Qualys WAS API user guide (PDF)
See what OnScanner finds on your site
Live, never-cached security and privacy scanning: OWASP Top 10, CVE intelligence with EPSS and KEV, 40+ privacy checks with consent and Global Privacy Control verification, a REST API and an MCP server. Most scans finish in minutes. Free plan, no sales call.