The economics of vendor education have settled into a predictable shape. Courses are free, the credential is not, and the exam fee is where the vendor recovers the cost of the programme and manufactures a bit of scarcity around the badge. Qualys does not do this. Training is free, the certifications are free, and there is no upsell waiting at the end of the learning path.
After working through a lot of vendor academies where the $200 to $600 exam fee arrives as a surprise at the end of a free course, I find this genuinely refreshing and it is the main reason the score sits where it does. The catalogue is organised by product area, which in Qualys's case maps fairly well onto security functions: vulnerability management including VMDR, cyber security asset management and the TruRisk scoring modules, policy compliance, PCI compliance, endpoint detection and response, container security, file integrity monitoring, cloud and application security. There are also standalone courses on the Qualys Query Language, the API and Qualys Flow. The learning paths have a sensible shape, seven courses for the vulnerability management track, two each for the compliance tracks.
The vulnerability management content is the part with value beyond the product. Vulnerability management is a discipline before it is a tool, and the hard parts are scoping, asset ownership, prioritisation under a finite remediation budget and the perpetual argument about what constitutes an acceptable risk. The course material does engage with prioritisation seriously, particularly around the TruRisk scoring approach, and a learner comes away understanding why CVSS alone is a poor prioritisation signal. That is a real lesson and it applies whatever scanner you run.
Where it stops short, and this is my main criticism of the content rather than the pricing, is on the organisational side. Anyone who has run a vulnerability management programme knows the scanner is the easy part. The difficulty is getting an application team to patch something in a quarter when their roadmap is already committed, or establishing who owns an unlabelled EC2 instance that has been running since 2019. The training does not really go there.
It teaches you how to produce the report. It does not teach you what to do when the report is ignored for six months, which is the actual job. The platform itself is dated. Navigation is clunky, video production is functional, and the interface looks like enterprise learning software from an earlier era, because it more or less is.
Screenshots drift out of date relative to the console. None of this stops the material working, but it does mean the experience is noticeably worse than something like Confluent Developer or the better modern vendor academies. There is one honest trade-off in the free certification model. A free exam is easier to sit, which is good, but a credential with no cost of entry signals less to an employer, which is bad.
A hiring manager who sees a Qualys certification knows the candidate spent a few hours, not that they spent a few hundred dollars and a weekend. That is not a reason to skip it, since a free credential you hold beats a paid one you did not sit, but it is worth calibrating how much weight to put on it in a CV. Four point one. Not the slickest academy in this category and not close, but the most honest pricing I have come across in enterprise security training, with vulnerability management fundamentals that stand up on their own.