Tools & Technologies
Sep 01, 2026
178
Trava runs a mix of commercial scanners (primarily Qualys), open-source tooling, and Trava-built scanners. Results are normalized and delivered in the Trava platform.
Current scan types
| Scan (product name) | Scope | Technology / tooling | Related Qualys product (if any) |
|---|---|---|---|
| External | External network / host vuln scanning | Qualys | VMDR |
| Port | External open-port discovery | Trava / Sentinel custom port scanner | — |
| Certificate | TLS/SSL certificate & config checks | SSLyze | VMDR or CertView |
| DNS | DNS email-auth posture (SPF/DKIM/DMARC, etc.) | CheckDMARC | — |
| Breach | Credential / breach exposure checks | Have I Been Pwned + Hunter.io | — |
| Web Application Surface | Lightweight / surface web app checks | Qualys | TotalAppSec |
| Web Application | Full web application vulnerability scanning (incl. authenticated where configured) | Qualys WAS | TotalAppSec |
| Cloud | Cloud configuration / posture scanning | ScoutSuite | Cloud Security |
| Agent | Internal host scanning via installed agent | Qualys Cloud Agent | VMDR |
| Internal | Internal network scanning via Qualys virtual scanner appliance | Qualys | VMDR |
| Microsoft 365 | M365 security configuration assessment | Microsoft Graph API | SaaSDR / CDR |
| MFA | MFA posture checks against identity providers | Direct provider APIs | Cloud Security (partial overlap) |
Short summary
Trava’s vulnerability scanning platform combines Qualys (VMDR for external/internal/agent scanning; TotalAppSec / WAS for web applications) with Trava-operated open-source and proprietary scanners for complementary coverage (ports, certificates/TLS, DNS email authentication, breach exposure, cloud configuration via ScoutSuite, and Microsoft 365 / MFA checks via native APIs). Findings are consolidated in the Trava platform for triage, reporting, and remediation tracking.
Qualys product cheat sheet (reference)
| Qualys product | Used for in Trava |
|---|---|
| VMDR | External, Agent, Internal |
| TotalAppSec / WAS | Web Application Surface, Web Application |
| CertView | Related to certificate/TLS coverage (Trava cert scan is SSLyze-based) |
| Cloud Security | Related Qualys capability; Trava cloud scan uses ScoutSuite |
| SaaSDR / CDR | Related Qualys SaaS posture; Trava M365 scan uses Microsoft Graph |
