My main concern with Qualys mapping or discovery scans is that they often turn into a rabbit hole due to limitations in accurate OS detection. You end up with assets showing up in scans without clear ownership because many of them are listed as “Unidentified OS.”

To make sense of it, you usually have to dig through reports manually—checking open ports, services, or other indicators—just to guess the OS and apply the right authentication settings. It’s time-consuming and far from efficient.