Qualys launches TruRisk Eliminate 2.0 with AI remediation. Wed, 28th Oct 2026 (Today) Qualys has launched TruRisk Eliminate 2.0 with TruConfidence, now generally available as an upgrade for existing TruRisk Eliminate customers. The release adds a remediation intelligence and orchestration engine to Qualys' security platform as it pushes what it calls Autonomous RemOps, a model aimed at automating how organisations fix cyber exposures. The new version is designed to help security and IT teams decide whether to patch, apply a compensating control, uninstall software, isolate affected assets or use a custom fix. It extends beyond managed endpoints to cover perimeter devices, cloud environments and applications, including assets that cannot run an agent. Those non-agent assets can be handled through scanners and existing security and IT integrations, with the aim of reducing manual intervention in remediation workflows. Automation focus The launch comes as security teams face growing pressure to close vulnerabilities more quickly as AI tools accelerate both discovery and exploitation. Qualys is positioning the update around that shift, arguing that manual ticketing and handoffs between security and IT operations are too slow for current attack timelines. At the centre of the system is Agent Sara, an AI entity that builds wave-based deployment plans. The agent analyses asset criticality, operational dependencies and traffic patterns so updates can be rolled out in stages rather than across an entire environment at once. That staged approach is intended to detect problems in smaller groups of systems before wider deployment. The system also draws on data from half a billion patch deployments, with less than 0.1% rollback, and Qualys said 40% of those deployments were carried out autonomously. Another element of the update is what Qualys calls Patch Reliability Score, which assesses the likely success of a patch before deployment. The product also includes patch failure analysis, which can explain why a remediation attempt failed and suggest corrective action such as a localised rollback. Broader coverage A key part of the release is the use of compensating controls where patching is not immediately practical. The system first assesses which risks are already covered by existing security controls, then looks for remaining gaps and identifies third-party mitigations that can be applied through tools already in use on endpoints and perimeter systems. That reflects a broader trend in vulnerability management, as organisations increasingly want alternatives to immediate patching for systems that are operationally sensitive or cannot be taken offline. In practice, this can include temporary measures while a permanent fix is tested or scheduled. Qualys also said the system monitors the health of systems after remediation through integrations with observability providers including Dynatrace, Datadog and New Relic. That monitoring is intended to detect anomalies such as CPU spikes, memory leaks and service-impacting conditions after a patch or mitigation has been applied. Jon Nelson, Principal Advisory Director in the Security & Privacy Practise at Info-Tech Research Group, said the gap between security teams that find vulnerabilities and IT teams that patch them has become harder to manage. "For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone," Nelson said. "Qualys TruRisk Eliminate gives security a viable path to drive remediation at machine speed, with patch reliability scoring, progressive rollouts and patchless mitigation that reduce the risk of disrupting operations," he added. Market pressure Qualys is entering a market where suppliers are trying to tie vulnerability prioritisation more closely to remediation and operational oversight. Rather than simply listing exposures, vendors are under pressure to show organisations can act on those findings with less human coordination and lower risk of disruption. For Qualys, that means linking asset visibility, remediation decisions and post-deployment validation in a single workflow. The company said the new release sits within its wider Risk Operations Centre framework, which combines visibility, prioritisation and remediation across hybrid environments. Sumedh Thakar, President and Chief Executive Officer of Qualys, said customer hesitation about automation is often rooted in concerns about outages rather than opposition to automated action itself. "Autonomous exploitation requires equally automated remediation, but organisations' hesitation isn't about automation, it's a lack of confidence that it won't cause an outage," Thakar said. "That's why we're excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Centre. By unifying telemetry, asset visibility and validation inside the ROC framework, we give organisations the structural confidence to reduce cyber risk quickly while permanently removing outage concerns," he added.

Qualys ROCon 2026 recap: Qualys doubles down on AI agents in cloud security and risk operations. Oct 23 2026 Qualys' ROCon 2026 conference highlighted the vendor's commitment to providing solutions for the three key aspects of cloud security. * * Risk operations instead of security operations. Qualys has always emphasized tackling business risk (uptime, availability, business criticality of infrastructure, and a minimized threat surface) instead of trying to fix every discovered vulnerability. At ROCon 2026, the vendor announced its plans to fortify its discovery, prioritization, and remediation triad in all of its solutions, including Enterprise TruRisk Management (ETM). Prioritization of resources and artifacts takes input from configuration artifacts (e.g., AWS configuration of EC2 instances, S3 buckets, Azure configuration of virtual machines, and Azure Blob Storage) but also from potential attack path maps and business users' input. For example, ETM's identity security posture management aggregates all aspects of identity risk and automatically generates a risk score for each human (business and admin user), agent, and machine identity - allowing for easier prioritization to then feed remediation actions. * AI agents everywhere. Qualys announced several purpose-built AI agents to help with discovery, prioritization, and remediation. In addition, Enterprise TruRisk Platform, a component of ETM, allows end-user organizations to develop custom agents in the Qualys ETM solution by composing existing agents from other platforms (including Agentforce, ChatGPT, and Microsoft Copilot) as well as AI agent-aided low-code/no-code configuration. Users define agent objectives, tasks, and authorized tools - including MCP servers - without writing code. The agents remain owned by the organization and can optionally be shared through the Qualys agentic AI marketplace. * Post-quantum security and cryptography revolving around cert management. In Certificate View, the vendor supports discovering and partially remediating quantum-vulnerable cryptography across its clients' infrastructures by scheduling certificate rotation. Qualys' long-term ability to maintain cloud security differentiation hinges on the following factors: * * Cloud infrastructure and entitlement management. How well can the vendor discover and integrate with on-premises environments to identity threats and privilege escalation? * SaaS security posture management and data protection. How can the vendor extend its current, mainly public cloud platform (AWS, Azure, or Google Cloud) and on-premises-centric portfolio to cover SaaS apps in more depth, including Microsoft 365, Salesforce, and ServiceNow? * True AI agent runtime, identity, and data protection controls. How well can the solution expand from its current coverage of Amazon Bedrock, Microsoft Foundry, and Google Gemini client-developed agent security to new, currently unsupported agent platforms, such as runtime, identity, and data protection controls maintained by Anthropic, OpenAI, and Perplexity? * Expanded and automated post-quantum security mitigation. Beyond cryptographic bills of materials and certificate rotation, can the vendor offer solutions for network traffic-based discovery of quantum-vulnerable asymmetric key exchanges and provide remediation at the infrastructure component level? Forrester clients interested in discussing risk operations in cloud security should book an inquiry or guidance session with Forrester Research, Inc.. See andras cser at: Security & Risk Forum November 9-10, 2026, Washington DC AI wants 20% of your budget. Now what? If you've studied the reference architectures, read the BeyondCorp whitepapers, poured over strategies and fan charts, or tried to plot your position in any of the (many) Zero Trust maturity models and found yourself inspired by the concepts but puzzled by the process, you're not alone. If the sheer number of Zero Trust something-or-others available [...] At 14:00 UTC on October 21, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory error, and CVE-2026-109619 addresses an RCE through a stale global-state issue. The flaws were discovered by researchers at Wiz and Calif, the latter as part of [...]

Qualys powers up Autonomous RemOps with TruRisk Eliminate 2.0 with TruConfidence. Published: 15 October 2026 21:43 Qualys used its Qualys ROCON Americas event this week in Austin to announce TruRisk Eliminate 2.0 with TruConfidence, a new remediation intelligence and orchestration engine that powers Qualys' vision for Autonomous RemOps, a new category for the frontier AI era. Was that Autonomous RemOps there? Yes... Autonomous RemOps is an AI-driven security operations framework that automatically fixes, mitigates, and orchestrates cyber risk remediation across hybrid environments at machine speed while ensuring operational continuity and zero business disruption. Built on Qualys' experience of deploying half a billion patches with less than 0.1% rollback, of which 40% were deployed autonomously, TruRisk Eliminate combines the latest advances in autonomous remediation, remediation intelligence and orchestration to help organisations confidently eliminate cyber risk at machine speed while maintaining business resiliency and continuity. As AI accelerates vulnerability discovery and exploitation, the ability to remediate risk has become a critical constraint. Traditional remediation limitations. Security teams must not only determine what needs to be fixed, but also account for controls already protecting the environment, select the appropriate, safe remediation path, manage deployment risk across increasingly complex environments and verify that remediation succeeded without disrupting business operations. Qualys says that traditional remediation processes, built around manual decisions, tickets and point solutions, were not designed for this level of speed or complexity. According to Sumedh Thakar, president and CEO, Qualys, writing on LinkedIn, "Today one of the biggest vulnerabilities for an organisation is a slow patching programme. While autonomous remediation is the solution, teams are hesitant to patch because of a lack of confidence that it won't create a business outage." He says that after deploying over half a billion patches, Qualys is now providing its customers all the intelligence needed to avoid patches if they can, use an AI reliability score if they must patch... and he points to the company's new partnership with Dynatrace, which means it can monitor the resiliency of an application after patching to roll back to a previous state if something doesn't work. "For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone," said Jon Nelson, principal advisory director in the security & privacy practice, Info-Tech Research Group. Nelson thinks that Qualys TruRisk Eliminate gives security a "viable path to drive remediation at machine speed", with patch reliability scoring, progressive rollouts, and patchless mitigation that reduce the risk of disrupting operations. Operating model for Autonomous RemOps. TruConfidence is the cyber risk remediation and orchestration intelligence engine that turns TruRisk Eliminate into an operating model for Autonomous RemOps. It brings together the capabilities Qualys introduced over the past two quarters, including the AI-powered Patch Reliability Score, intelligent wave-based remediation orchestrated by Agent Sara, peer-to-peer distribution and compensating controls with intelligence drawn from half a billion real-world patch deployments. These capabilities enable organisations to reduce exposure with the least disruptive remediation, while avoiding duplicate protections already provided by existing controls. This establishes the core operating loop for Autonomous RemOps: fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it held. TruRisk Eliminate with TruConfidence enables organisations to: * Remediate across the entire hybrid attack surface. TruRisk Eliminate now reaches perimeter devices, cloud, and applications, not just agent-based endpoints, to patch, mitigate without a patch, uninstall, isolate or apply a custom fix wherever the exposure lives. Assets that cannot run an agent are remediated through Qualys scanners and existing security and IT integrations, so nothing is left waiting on a manual workaround. * Reduce exposure when patching is not the answer. TruConfidence first credits what existing security controls already protect, so teams avoid duplicate coverage. When exposures remain, built-in third-party mitigation intelligence identifies available compensating controls and applies mitigations through security tools customers already run on their perimeter and endpoints. This reduces exposure while a permanent fix is planned or validated, moving organisations from "wait for a patch" to "taking the right available action." * Ensure operational continuity, with no business disruption after remediation. After every action, TruRisk Eliminate monitors system health through integrations with partners such as Dynatrace, watching for CPU spikes, memory issues and other service-impacting conditions. When a fix does not hold, AI-powered Patch Failure Analysis explains why it happened and recommends the corrective action, such as a rollback. "Autonomous exploitation requires an equally automated remediation, but organisations' hesitation isn't about automation; it's a lack of confidence that it won't cause an outage", said Thakar. "That's why we're excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Center (ROC) so organisations have the confidence to reduce cyber risk quickly while reducing outage concerns." Qualys TruRisk Eliminate 2.0 with TruConfidence is now generally available with a free upgrade for existing TruRisk Eliminate customers. Kunal Modasiya, senior vice president, product management, GTM and growth at Qualys has blogged to explain more.# "Patch automation was never the blocker. Confidence is: without evidence of how a change will behave, Security and IT teams default to caution, and the remediation backlog keeps growing," writes Modasiya. ""Autonomous RemOps replaces ticket-driven processes with a continuous, evidence-based cycle - Decide, Execute, Prove. It determines what to fix, executes across the attack surface, and demonstrates that the business remained resilient." What should developers think next? As Qualys itself has said, Autonomous RemOps is impacting software developers and DevSecOps teams who can now shift patch deployment from manual ticketing to AI-driven automation - and that means software engineers must adapt their development workflows. Rather than context-switching to handle emergency security tickets, developers can centralise thier focus on building resilient runtime environments and move forward to an immediate future (now) where patching becomes a progressive deployment pipeline rather than a disruptive fire drill.