Qualys Adds Automated Vulnerability Scanning for AWS Lambda, Extending Serverless Security Beyond CSPM
What Happened — Qualys announced a new service that automatically scans AWS Lambda functions for vulnerable open‑source packages and outdated libraries. The scans run at deployment and on every code update, covering cross‑account and multi‑region environments without manual triggers.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Change Management) requires evidence that code changes are reviewed for security risk; automated Lambda scans generate that evidence at the exact moment of change.
- Continuous vulnerability visibility satisfies CC7.1 (Risk Assessment) and provides audit‑ready documentation of how identified CVEs are prioritized and remediated.
- Mapping scan results to the Qualys Trust Center creates a defensible, real‑time control‑mapping artifact that can be presented to auditors.
Who Is Affected — Cloud‑native developers, AI‑focused SaaS providers, and any organization that builds production workloads on AWS Lambda.
Recommended Actions
- Integrate Qualys Lambda scanning into your CI/CD pipeline and map the scan logs to SOC 2 CC6.1 and CC7.1 controls.
- Export scan findings as immutable evidence for your audit repository or Trust Center.
- Periodically review the prioritized remediation list to ensure timely patching of vulnerable dependencies.
Source: Qualys Blog – AWS Lambda Vulnerability Scanning
Technical Notes
- The service detects vulnerable open‑source packages, outdated libraries, and transitive dependencies inside function code—issues CSPM tools miss.
- Scans are event‑driven (triggered on function creation or update) and combine Qualys vulnerability data with AWS IAM permission context to rank risk.
- No persistent agents are required; the solution works across accounts and regions.
Source: Qualys Blog – Technical Details