The qualys scanner needs to be able to sudo to root in certain situations. The current use case is for RHEL EUS versions, where it needs to be able to run escalated scans. See: - https://github.com/ncsa/puppet-profile_audit/blob/a21db9d7972f2b22de55be76e4fc3564bbd73cf2/manifests/qualys.pp#L11