Originally reported by Help Net Security. Source: helpnetsecurity.com
Qualys Expands Web Application Security for DevSecOps
Qualys has announced new functionality in its web application security platform designed to help engineering teams automate and operationalize DevSecOps practices across the full Software Development Lifecycle (SDLC). The headline release, Qualys Web Application Scanning (WAS) 6.0, adds REST API scanning via Swagger, a native Jenkins plugin, and a free browser recording tool — each aimed at catching and eliminating vulnerabilities before code reaches production, where remediation costs are significantly higher.
New Functionality in Qualys WAS 6.0
1. Swagger 2.0 REST API Scanning
Qualys WAS has historically supported scanning of SOAP-based web services. Version 6.0 extends that capability to REST APIs by leveraging the Swagger (OpenAPI) specification version 2.0. When a Swagger 2.0 definition file in JSON format is accessible to the scanning service, WAS will automatically enumerate and test the API endpoints for common application security flaws — no additional manual configuration required. This closes a significant gap for organizations that have migrated from SOAP to REST-based microservice architectures.
2. Native Jenkins Plugin for CI/CD Integration
The new Qualys WAS Jenkins plugin allows DevOps teams to embed automated vulnerability scans directly into their existing Continuous Integration / Continuous Delivery (CI/CD) pipelines. By triggering scans as part of the build or deployment process, security testing shifts left — occurring earlier in the SDLC when defects are cheapest and fastest to fix. This avoids the expensive and disruptive remediation cycles that occur when vulnerabilities are discovered post-deployment in production environments.
Key workflow benefits of the Jenkins integration include:
- Automated scan triggering on each build or on a defined schedule
- Pass/fail gate capability to block deployments that exceed a defined severity threshold
- Results surfaced directly within Jenkins build logs and dashboards
3. Qualys Browser Recorder Chrome Extension
The Qualys Browser Recorder is a new Google Chrome extension that allows users to capture real browser interactions — including complex authentication flows and multi-step business workflows — and save them as repeatable test scripts. Those scripts are then played back within Qualys WAS so the scanning engine can navigate authenticated sessions and application workflows that a standard unauthenticated crawl would never reach.
Notably, the Qualys Browser Recorder is free and available to anyone via the Chrome Web Store, not just existing Qualys customers. This makes it a useful standalone tool for teams evaluating coverage of their application authentication surfaces.
Why Shifting Security Left in the SDLC Matters
The core value proposition of these features is the “shift left” principle: integrating security testing earlier in the development process rather than treating it as a final-stage gate before release. Vulnerabilities found during development cost a fraction of those found in production — both in engineering hours and in potential business impact from breaches or compliance failures.
Philippe Courtot, then chairman and CEO of Qualys, summarized the approach at RSA Conference 2018:
“As companies move their internal apps to the cloud and embrace new technologies, web app security must be integrated into the DevOps process to safeguard data and prevent breaches. Qualys is helping customers streamline and automate their DevSecOps through continuous visibility of security and compliance across their applications and REST APIs.”
Philippe Courtot, Chairman & CEO, Qualys
A customer perspective from OSIsoft, Inc. reinforced the practical value of CI/CD integration:
“One of our goals is to perform security testing early in the software development lifecycle and being able to seamlessly integrate scanning into our build environments is key to that. We are looking forward to using these new capabilities in Qualys WAS to further automate testing of our web apps and APIs.”
Dmitry Tysh, Sr. Software Developer, IT Development, OSIsoft, Inc.
Pricing and Availability
Qualys WAS 6.0 was made available as an annual subscription priced based on the number of web applications under management. At the time of announcement, annual subscriptions started at $1,995. Prospective customers should contact Qualys directly for current pricing, as subscription costs may have changed since the original 2018 announcement.
The Qualys Browser Recorder Chrome extension remains free and publicly available regardless of subscription status.
Summary: What WAS 6.0 Means for DevSecOps Teams
| Feature | Benefit | Who It’s For |
|---|---|---|
| Swagger 2.0 REST API scanning | Automated coverage of modern REST API endpoints | Teams with REST/microservice architectures |
| Jenkins plugin | Embedded security gates in CI/CD pipelines | DevOps engineers, build engineers |
| Browser Recorder (Chrome) | Authenticated and workflow-aware scanning | QA, security engineers, free for all |
Together, these three capabilities represent a meaningful step toward treating web application security as a first-class concern within the DevOps toolchain — automated, repeatable, and integrated — rather than a one-time audit performed at the end of a release cycle.