Qualys Bolsters Cloud-Native Security with Serverless Function Vulnerability Scanning

Qualys has announced the release of Container Security Release 1.44, introducing significant enhancements to its Enterprise TruRisk™ Platform. A key highlight of this update is the addition of new asset types, specifically enabling the scanning of serverless functions, with AWS Lambda being explicitly mentioned, alongside improved code repository scanning capabilities. This expansion means that organizations can now leverage Qualys's platform to assess the security posture of their serverless deployments, identifying vulnerabilities and misconfigurations within these increasingly prevalent cloud-native components. This update is profoundly significant for security and DevOps practitioners. As enterprises increasingly adopt serverless architectures for their agility and scalability benefits, the security of these ephemeral functions has become a critical concern. Serverless functions, while abstracting away infrastructure management, still contain application code and configurations that can harbor vulnerabilities. Prior to such integrated solutions, securing serverless often required disparate tools and processes, leading to security blind spots and increased operational overhead. By unifying container and serverless security under a single platform, Qualys addresses a major pain point, enabling a more holistic and streamlined approach to vulnerability management and compliance across diverse cloud-native environments. The broader context for this development lies in the ongoing evolution of cloud-native security. As organizations move beyond monolithic applications to microservices, containers, and serverless functions, the attack surface expands and becomes more dynamic. The industry has been steadily moving towards comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platforms (CWPP) that can provide consistent visibility and control across this heterogeneous landscape. This Qualys release reflects a market trend where security vendors are adapting their offerings to provide integrated solutions that can keep pace with rapid cloud development cycles and the unique security challenges posed by serverless computing. Other major cloud security players are also enhancing their platforms to cover FaaS, underscoring the critical need for such capabilities. In practice, this means that security teams can now extend their established Qualys Container Security workflows to include their AWS Lambda functions. This allows for continuous vulnerability assessment of serverless code and dependencies, integrating scans into CI/CD pipelines to identify and remediate issues early in the development lifecycle. For compliance-driven organizations, this simplifies the process of demonstrating comprehensive vulnerability management across all compute resources, including serverless. Practitioners should prioritize integrating this new capability, reviewing their existing security policies to ensure serverless functions are adequately covered, and leveraging the unified reporting to gain a clearer, more actionable view of their overall cloud-native security posture. This move facilitates a more centralized and efficient approach to risk assessment and remediation across the modern application stack.