Frequently Asked Questions

QCSS is an Exposure Intelligence Platform.

It shows:

• what is exposed
• how systems connect
• what is reachable

In simple terms: how your organisation can be breached.

• Security Teams → prioritise real risk
• Compliance Teams → maintain audit visibility
• DevSecOps Engineers → reduce false positives
• IT Teams → manage exposure clearly

Vulnerability tools list issues.

QCSS shows: 

• how vulnerabilities connect 
• what is reachable across systems 
• how attackers move through environments

This helps teams understand real attack paths, not just isolated findings.

Yes. 

QCSS maps: 

• entry points 
• lateral movement 
• reachable critical assets

This answers a key question:

• how do attackers move through connected systems? 

Exposure is not just a vulnerability. 

It is:

• what is accessible 
• how systems connect
• what can be reached 

Exposure = risk in motion, not isolated risk. 

QCSS agentless scanning leverages cloud-native APIs and read-only snapshots to inspect your workloads without deploying any software to target hosts. For cloud environments (AWS, Azure, GCP), it uses provider APIs to enumerate resources and assess configurations. For on-premise assets, it uses network-based probing. No reboots, no agents, and no performance impact on your workloads. 

No.

QCSS is fully agentless.

Within minutes.

Define scope → run → see exposure.

The QCSS vulnerability database is updated continuously, typically every few hours, drawing from NVD, vendor advisories, threat intelligence feeds, and our own research team. Critical zero-day disclosures are prioritized and reflected in detection logic within hours of public disclosure.

• web application vulnerabilities 
• API security issues 
• misconfigurations 
• infrastructure exposure 

A vulnerability is a weakness. 

Exposure is: 

• whether it can be reached 
• how it connects to other systems

QCSS focuses on what can actually be exploited 

QCSS provides automated validation and simulation capabilities, including: 

• DeepDive™ → validation of potential exploitability
• AssureProbe™ → simulation of attack paths

No. QCSS complements manual testing by providing continuous visibility and validation between engagements.

By default, scan data and results are stored in SOC 2 Type II certified cloud infrastructure in the US (AWS us-east-1). Enterprise customers can opt for EU data residency (Frankfurt) or request private cloud deployment within their own VPC. All data is encrypted at rest (AES-256) and in transit (TLS 1.3). 

Only authorised users with permission-based access. 

Yes. 

All actions and findings are logged for traceability and compliance. 

 

QCSS integrates with Jira, ServiceNow, Splunk, Microsoft Sentinel, PagerDuty, Slack, GitHub, GitLab, Jenkins, and all major cloud providers (AWS, Azure, GCP). A REST API and Terraform provider are available for custom integrations and infrastructure-as-code workflows. 

Yes.

QCSS is designed for:

• distributed systems
• multi-environment visibility 
• enterprise-scale operations

Yes.

CSS includes one-click audit reports pre-mapped to SOC 2, ISO 27001, PCI-DSS, HIPAA, CIS Benchmarks, and NIST CSF. Reports export as PDF or CSV, or push directly to GRC platforms. Scheduled delivery to stakeholders and auditors is also supported.

Yes.

Each finding includes: 

• context
• impact
• recommended actions

Yes.

Each finding includes:

• context
• impact
• recommended actions

Yes.

Supports: 

• ISO 27001 
• SOC 2
• Cyber Essentials 

Helps maintain continuous audit readiness

Yes.

• encryption (in transit & at rest)
• strict access controls
• secure architecture

Yes.

QCSS has completed SOC 2 Type II audits covering Security, Availability, and Confidentiality trust service criteria. Our latest audit report is available under NDA upon request. We also hold ISO 27001 certification and undergo annual third-party penetration testing.

Yes.

QCSS shows how exposure in external systems connected to you can create internal risk.

Modern environments rely on: 

• vendors
• APIs 
• integrations

Attackers move through these connections.  QCSS helps you identify external attack paths into your environment.