Qualys Web Application Scanning is built into Kikimora as a core platform capability. There’s no Qualys account to create, no license to procure, and no API key to paste. The platform provides the scanning engine, and you talk to it.
Web application scanning, included and conversational
The capability covers the full web application scanning lifecycle: launching, monitoring, and cancelling scans, configuring crawl scope and scan templates, and managing authentication records for logged-in scanning. Because it is built in, the usual friction of standing up a scanner, buying seats, and managing API keys simply is not there.
What you can do
- Launch, monitor, and cancel web application scans conversationally.
- Configure crawl scope, scan templates, and authentication records for logged-in scanning.
- Get findings summarized, prioritized, and folded into cross-stack triage with the rest of your tools.
Things you might ask
- “Launch a scan against the staging app, then show me only the findings that are new since last week.”
- “Set up an authenticated scan for the dashboard behind our login and run it tonight.”
- “Roll the critical web findings into our audit evidence.” Web scan results make solid control evidence. Our guide on how to collect your SOC 2 evidence by asking for it shows how findings like these become audit artifacts.
Why it matters
A standalone Qualys WAS subscription is a serious line item. Kikimora includes the capability out of the box. Every plan, including free, can run enterprise-grade web application scans without owning or managing a separate Qualys license. For broader vulnerability data, pair it with the Tenable integration, which brings your existing scanner findings into the same conversational triage.