Threat Research Engineer
About the job
- A B.E., B.Tech, M.Tech, Master of Computer Applications, or Master of Computer Science in Computer Science from a reputed institution.
- Seven years of relevant technical experience.
- Expertise in vulnerability research.
- Experience with threat hunting, incident response, or security operations.
- Experience with common threat intelligence tools such as VirusTotal and Shodan.
- Understanding of security controls, forensics, kill chain analysis, risk assessment, and security metrics.
- Ability to perform initial static and dynamic malware analysis.
- Understanding of reverse engineering techniques.
- Knowledge of networking and the TCP/IP stack.
- Knowledge of programming or scripting languages.
- Knowledge of networking protocols and application file formats such as PDF and Office files, as well as operating system internals.
- Excellent written and verbal communication.
- Strong problem-solving skills.
- Ability to adapt to changing priorities and develop innovative solutions.
- Ability to take initiative and work with minimal supervision.
- Monitor, analyze, and research emerging cyber threats, vulnerabilities, and exploits to identify novel tactics, techniques, procedures, and related mitigations.
- Produce and test rules for hunting and enrichment, including YARA rules.
- Analyze the threat attack life cycle, including behavior, modus operandi, and objectives.
- Conduct intelligence collection, signature creation, and initial malware analysis.
- Research methods and technologies to detect cyber threats, identify signals, and design approaches that use these signals to identify security threats and breaches.
- Develop tools to automate and scale detection and response activities.
- Write detailed technical blog posts about discovered threats and tactics, techniques, and procedures.
- Collaborate with other teams to develop and add cross-product intelligence.
- Work with security, malware research, product, and engineering teams to develop protection strategies against emerging cybersecurity threats.
- Certifications in computer security domains are desired.
Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
Qualys is looking for threat researchers who can leverage their experience and expertise to identify and analyze threats, produce original research publications, and work with engineering teams to provide a feedback and related insights into a multitude of Qualys products.
You will be a member of the Qualys Threat Research Team, a team of security researchers working together to solve security challenges in new and innovative methods. The team is responsible for leading and conducting research related to adversary attack tactics and techniques, threat actor groups and campaign activity. The primary output of the Threat Research Team is security content for Qualys products, blog posts, and conference presentations via researching the latest tactics, techniques, and procedures leveraged by adversaries. The Threat Research Team also works closely with the security, malware research, product, and engineering teams to develop novel protection strategies against emerging cybersecurity threats.
Responsibilities:
Monitor, analyze and research emerging cyber threats, vulnerabilities, and exploits to identify novel TTPs and their related mitigations.
Produce and test rules for hunting and enrichment (Yara, etc.)
Analyze threat attack life-cycle including its behavior, modus operandi and objectives.
Follow an exhaustive approach involving intelligence collection, signature creation, and initial malware analysis.
Research new methods and technologies to detect cyber threats, identify signals, and design approaches to use these signals to identify security threats and security breaches.
Develop tools to automate and scale detection and response activities
Writing detailed technical blog posts about the threats and TTPs discovered.
Collaborate with other teams in developing and adding cross-product intelligence.
Educational Qualifications:
E./B.Tech/M.Tech Computer Science/MCA/MCS from a reputed institution.
Certifications in Computer Security domains are desired.Experience:
7 years of relevant technical experience
Technical Qualifications:
Expertise in Vulnerability Research
Experience with threat hunting, incident response, or security operations
Experience with common threat intelligence tools, such as VirusTotal, Shodan, etc.
Understanding of security controls, forensics, kill chain analysis, risk assessment and security metrics.
Ability to perform initial static and dynamic malware analysis.
Understanding of reverse engineering techniques.
Knowledge of networking and the TCP/IP stack.
Knowledge of programming or scripting languages.
Knowledge of networking protocols and application file formats like PDF, Office files, and operating system internals.Soft Skills:
Excellent written and verbal communication.
'Can-do' attitude and great problem-solving skills.
Adapt to changing priorities and quickly come up with innovative solutions.
Take initiatives and work with minimal supervision.
Act as a go-to person for your area of expertise.
About the company
Qualys provides cloud-based cybersecurity and compliance solutions to secure IT infrastructure for enterprises, SMBs, and government. Its main products include vulnerability management, policy compliance, web application security, and IT asset management, delivered via the Qualys Cloud Platform that continuously monitors environments. The platform collects data from agents and sensors, runs automated checks, enforces policies, and generates real-time compliance reports. It differentiates with real-time analytics, automated workflows, and scalable cloud architecture, offering a unified security and compliance ecosystem to manage risk across on-premises, cloud, and hybrid environments.
Company Size
1,001-5,000
Company Stage
IPO
Headquarters
Redwood City, California
Founded
1999
Get referred to Qualys
See people who can refer or advise you
Simplify's Take
What believers are saying
- Q2 2026 revenue rose 11% to $182.2 million, and guidance rose to $738 million.
- Channel revenue grew 22% in Q2 2026, now supplying 54% of revenue.
- Qualys repurchased $76.8 million of stock, while free cash flow hit $55.9 million.
What critics are saying
- Second-half current billings growth is only 7%–8%, signaling a deceleration after Q2.
- Recent CISO and ETM general manager departures forced August 2026 leadership reshuffling.
- Microsoft and CrowdStrike bundles can absorb Qualys’ AI-native remediation features by 2027.
What makes Qualys unique
- Qualys Cloud Platform unifies VMDR, CSPM, patching, and asset inventory in one workflow.
- InstaScan and Agentic AI turn disclosed vulnerabilities into minutes-old findings on August 4, 2026.
- FedRAMP High TotalCloud and CSAI Foundation membership strengthen federal and enterprise credibility.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Remote Work Options
Growth & Insights and Company News
6 month growth
0%1 year growth
2%2 year growth
0%Qualys ROCon 2026 recap: Qualys doubles down on AI agents in cloud security and risk operations. Oct 23 2026 Qualys' ROCon 2026 conference highlighted the vendor's commitment to providing solutions for the three key aspects of cloud security. * * Risk operations instead of security operations. Qualys has always emphasized tackling business risk (uptime, availability, business criticality of infrastructure, and a minimized threat surface) instead of trying to fix every discovered vulnerability. At ROCon 2026, the vendor announced its plans to fortify its discovery, prioritization, and remediation triad in all of its solutions, including Enterprise TruRisk Management (ETM). Prioritization of resources and artifacts takes input from configuration artifacts (e.g., AWS configuration of EC2 instances, S3 buckets, Azure configuration of virtual machines, and Azure Blob Storage) but also from potential attack path maps and business users' input. For example, ETM's identity security posture management aggregates all aspects of identity risk and automatically generates a risk score for each human (business and admin user), agent, and machine identity - allowing for easier prioritization to then feed remediation actions. * AI agents everywhere. Qualys announced several purpose-built AI agents to help with discovery, prioritization, and remediation. In addition, Enterprise TruRisk Platform, a component of ETM, allows end-user organizations to develop custom agents in the Qualys ETM solution by composing existing agents from other platforms (including Agentforce, ChatGPT, and Microsoft Copilot) as well as AI agent-aided low-code/no-code configuration. Users define agent objectives, tasks, and authorized tools - including MCP servers - without writing code. The agents remain owned by the organization and can optionally be shared through the Qualys agentic AI marketplace. * Post-quantum security and cryptography revolving around cert management. In Certificate View, the vendor supports discovering and partially remediating quantum-vulnerable cryptography across its clients' infrastructures by scheduling certificate rotation. Qualys' long-term ability to maintain cloud security differentiation hinges on the following factors: * * Cloud infrastructure and entitlement management. How well can the vendor discover and integrate with on-premises environments to identity threats and privilege escalation? * SaaS security posture management and data protection. How can the vendor extend its current, mainly public cloud platform (AWS, Azure, or Google Cloud) and on-premises-centric portfolio to cover SaaS apps in more depth, including Microsoft 365, Salesforce, and ServiceNow? * True AI agent runtime, identity, and data protection controls. How well can the solution expand from its current coverage of Amazon Bedrock, Microsoft Foundry, and Google Gemini client-developed agent security to new, currently unsupported agent platforms, such as runtime, identity, and data protection controls maintained by Anthropic, OpenAI, and Perplexity? * Expanded and automated post-quantum security mitigation. Beyond cryptographic bills of materials and certificate rotation, can the vendor offer solutions for network traffic-based discovery of quantum-vulnerable asymmetric key exchanges and provide remediation at the infrastructure component level? Forrester clients interested in discussing risk operations in cloud security should book an inquiry or guidance session with Forrester Research, Inc.. See andras cser at: Security & Risk Forum November 9-10, 2026, Washington DC AI wants 20% of your budget. Now what? If you've studied the reference architectures, read the BeyondCorp whitepapers, poured over strategies and fan charts, or tried to plot your position in any of the (many) Zero Trust maturity models and found yourself inspired by the concepts but puzzled by the process, you're not alone. If the sheer number of Zero Trust something-or-others available [...] At 14:00 UTC on October 21, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory error, and CVE-2026-109619 addresses an RCE through a stale global-state issue. The flaws were discovered by researchers at Wiz and Calif, the latter as part of [...]
Qualys powers up Autonomous RemOps with TruRisk Eliminate 2.0 with TruConfidence. Published: 15 October 2026 21:43 Qualys used its Qualys ROCON Americas event this week in Austin to announce TruRisk Eliminate 2.0 with TruConfidence, a new remediation intelligence and orchestration engine that powers Qualys' vision for Autonomous RemOps, a new category for the frontier AI era. Was that Autonomous RemOps there? Yes... Autonomous RemOps is an AI-driven security operations framework that automatically fixes, mitigates, and orchestrates cyber risk remediation across hybrid environments at machine speed while ensuring operational continuity and zero business disruption. Built on Qualys' experience of deploying half a billion patches with less than 0.1% rollback, of which 40% were deployed autonomously, TruRisk Eliminate combines the latest advances in autonomous remediation, remediation intelligence and orchestration to help organisations confidently eliminate cyber risk at machine speed while maintaining business resiliency and continuity. As AI accelerates vulnerability discovery and exploitation, the ability to remediate risk has become a critical constraint. Traditional remediation limitations. Security teams must not only determine what needs to be fixed, but also account for controls already protecting the environment, select the appropriate, safe remediation path, manage deployment risk across increasingly complex environments and verify that remediation succeeded without disrupting business operations. Qualys says that traditional remediation processes, built around manual decisions, tickets and point solutions, were not designed for this level of speed or complexity. According to Sumedh Thakar, president and CEO, Qualys, writing on LinkedIn, "Today one of the biggest vulnerabilities for an organisation is a slow patching programme. While autonomous remediation is the solution, teams are hesitant to patch because of a lack of confidence that it won't create a business outage." He says that after deploying over half a billion patches, Qualys is now providing its customers all the intelligence needed to avoid patches if they can, use an AI reliability score if they must patch... and he points to the company's new partnership with Dynatrace, which means it can monitor the resiliency of an application after patching to roll back to a previous state if something doesn't work. "For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone," said Jon Nelson, principal advisory director in the security & privacy practice, Info-Tech Research Group. Nelson thinks that Qualys TruRisk Eliminate gives security a "viable path to drive remediation at machine speed", with patch reliability scoring, progressive rollouts, and patchless mitigation that reduce the risk of disrupting operations. Operating model for Autonomous RemOps. TruConfidence is the cyber risk remediation and orchestration intelligence engine that turns TruRisk Eliminate into an operating model for Autonomous RemOps. It brings together the capabilities Qualys introduced over the past two quarters, including the AI-powered Patch Reliability Score, intelligent wave-based remediation orchestrated by Agent Sara, peer-to-peer distribution and compensating controls with intelligence drawn from half a billion real-world patch deployments. These capabilities enable organisations to reduce exposure with the least disruptive remediation, while avoiding duplicate protections already provided by existing controls. This establishes the core operating loop for Autonomous RemOps: fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it held. TruRisk Eliminate with TruConfidence enables organisations to: * Remediate across the entire hybrid attack surface. TruRisk Eliminate now reaches perimeter devices, cloud, and applications, not just agent-based endpoints, to patch, mitigate without a patch, uninstall, isolate or apply a custom fix wherever the exposure lives. Assets that cannot run an agent are remediated through Qualys scanners and existing security and IT integrations, so nothing is left waiting on a manual workaround. * Reduce exposure when patching is not the answer. TruConfidence first credits what existing security controls already protect, so teams avoid duplicate coverage. When exposures remain, built-in third-party mitigation intelligence identifies available compensating controls and applies mitigations through security tools customers already run on their perimeter and endpoints. This reduces exposure while a permanent fix is planned or validated, moving organisations from "wait for a patch" to "taking the right available action." * Ensure operational continuity, with no business disruption after remediation. After every action, TruRisk Eliminate monitors system health through integrations with partners such as Dynatrace, watching for CPU spikes, memory issues and other service-impacting conditions. When a fix does not hold, AI-powered Patch Failure Analysis explains why it happened and recommends the corrective action, such as a rollback. "Autonomous exploitation requires an equally automated remediation, but organisations' hesitation isn't about automation; it's a lack of confidence that it won't cause an outage", said Thakar. "That's why we're excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Center (ROC) so organisations have the confidence to reduce cyber risk quickly while reducing outage concerns." Qualys TruRisk Eliminate 2.0 with TruConfidence is now generally available with a free upgrade for existing TruRisk Eliminate customers. Kunal Modasiya, senior vice president, product management, GTM and growth at Qualys has blogged to explain more.# "Patch automation was never the blocker. Confidence is: without evidence of how a change will behave, Security and IT teams default to caution, and the remediation backlog keeps growing," writes Modasiya. ""Autonomous RemOps replaces ticket-driven processes with a continuous, evidence-based cycle - Decide, Execute, Prove. It determines what to fix, executes across the attack surface, and demonstrates that the business remained resilient." What should developers think next? As Qualys itself has said, Autonomous RemOps is impacting software developers and DevSecOps teams who can now shift patch deployment from manual ticketing to AI-driven automation - and that means software engineers must adapt their development workflows. Rather than context-switching to handle emergency security tickets, developers can centralise thier focus on building resilient runtime environments and move forward to an immediate future (now) where patching becomes a progressive deployment pipeline rather than a disruptive fire drill.
Qualys (NASDAQ:QLYS) CEO sells $609,152.00 in stock. October 15, 2026 Key points. * Qualys CEO Sumedh Thakar sold 3,200 shares for approximately $609,152 under a pre-arranged Rule 10b5-1 trading plan, reducing his ownership by 1.77% to 177,138 shares. * Qualys shares rose 1.6% to $192.65, near the company's 12-month high of $206.25, while the stock's market capitalization reached approximately $6.67 billion. * The company recently exceeded quarterly earnings and revenue expectations, reporting $1.98 EPS and $182.18 million in revenue; analysts' consensus rating remains Hold, with an average price target of $180.53. * Five stocks we like better than Qualys. Qualys, Inc. (NASDAQ:QLYS - Get Free Report) CEO Sumedh Thakar sold 3,200 shares of the business's stock in a transaction that occurred on Wednesday, October 14th. The shares were sold at an average price of $190.36, for a total value of $609,152.00. Following the transaction, the chief executive officer owned 177,138 shares of the company's stock, valued at approximately $33,719,989.68. This trade represents a 1.77% decrease in their ownership of the stock. The sale was disclosed in a document filed with the SEC, which can be accessed through this hyperlink. The transaction was executed under a pre-arranged Rule 10b5-1 trading plan. Qualys stock up 1.6%. QLYS stock traded up $3.02 during midday trading on Thursday, hitting $192.65. The company's stock had a trading volume of 524,984 shares, compared to its average volume of 750,806. Qualys, Inc. has a 12 month low of $74.51 and a 12 month high of $206.25. The firm has a market capitalization of $6.67 billion, a price-to-earnings ratio of 33.33 and a beta of 0.60. The company has a 50 day moving average of $182.68 and a two-hundred day moving average of $137.55. Qualys (NASDAQ:QLYS - Get Free Report) last announced its earnings results on Tuesday, August 4th. The software maker reported $1.98 earnings per share (EPS) for the quarter, beating the consensus estimate of $1.78 by $0.20. Qualys had a net margin of 29.38% and a return on equity of 37.52%. The firm had revenue of $182.18 million for the quarter, compared to analysts' expectations of $178.57 million. During the same period in the prior year, the company earned $1.68 EPS. The business's revenue was up 11.1% compared to the same quarter last year. Qualys has set its FY 2026 guidance at 7.740-7.880 EPS and its Q3 2026 guidance at 1.910-1.980 EPS. On average, analysts anticipate that Qualys, Inc. will post 5.84 earnings per share for the current fiscal year. Analyst upgrades and downgrades. A number of research firms have issued reports on QLYS. Jefferies Financial Group raised their price target on shares of Qualys from $150.00 to $185.00 and gave the stock a "hold" rating in a research report on Wednesday, August 5th. JPMorgan Chase & Co. increased their price target on Qualys from $139.00 to $150.00 and gave the company a "neutral" rating in a report on Monday, July 27th. Wall Street Zen downgraded Qualys from a "buy" rating to a "hold" rating in a research report on Saturday, September 12th. Truist Financial increased their price target on shares of Qualys from $160.00 to $185.00 and gave the stock a "hold" rating in a research report on Wednesday, August 5th. Finally, Zacks Research raised Qualys from a "hold" rating to a "strong-buy" rating in a research report on Tuesday, August 11th. Two analysts have rated the stock with a Strong Buy rating, three have given a Buy rating, eleven have given a Hold rating and one has issued a Sell rating to the company. According to data from MarketBeat, the stock currently has an average rating of "Hold" and an average target price of $180.53. Institutional inflows and outflows. A number of hedge funds and other institutional investors have recently bought and sold shares of QLYS. ZWJ Investment Counsel Inc. increased its position in shares of Qualys by 4.9% in the third quarter. ZWJ Investment Counsel Inc. now owns 2,114 shares of the software maker's stock worth $396,000 after purchasing an additional 98 shares during the period. ANB Bank acquired a new position in Qualys in the third quarter valued at about $333,000. GAMMA Investing LLC lifted its position in Qualys by 32.2% during the third quarter. GAMMA Investing LLC now owns 2,086 shares of the software maker's stock worth $390,000 after purchasing an additional 508 shares during the period. Farther Finance Advisors LLC lifted its position in Qualys by 25.8% during the third quarter. Farther Finance Advisors LLC now owns 527 shares of the software maker's stock worth $99,000 after purchasing an additional 108 shares during the period. Finally, Sequoia Financial Advisors LLC lifted its position in Qualys by 170.8% during the second quarter. Sequoia Financial Advisors LLC now owns 7,527 shares of the software maker's stock worth $1,035,000 after purchasing an additional 4,747 shares during the period. 99.31% of the stock is owned by institutional investors and hedge funds. About Qualys. Qualys, Inc provides cloud-based information technology, security and compliance solutions for organizations worldwide. Its platform is designed to help businesses identify, assess and manage security vulnerabilities across their networks, endpoints, cloud environments and web applications. The company's offerings include vulnerability management, asset inventory, security and compliance assessment, web application security, endpoint detection and response, and cloud security capabilities. This instant news alert was generated by narrative science technology and financial data from MarketBeat in order to provide readers with the fastest reporting and unbiased coverage. Please send any questions or comments about this story to [email protected]. Before you consider Qualys, you'll want to hear this. MarketBeat keeps track of Wall Street's top-rated and best performing research analysts and the stocks they recommend to their clients on a daily basis. MarketBeat has identified the five stocks that top analysts are quietly whispering to their clients to buy now before the broader market catches on... and Qualys wasn't on the list. While Qualys currently has a Hold rating among analysts, top-rated analysts believe these five stocks are better buys. Discover the 10 Best High-Yield Dividend Stocks for 2026 and secure reliable income in uncertain markets. Download the report now to identify top dividend payers and avoid common yield traps. Continue following MarketBeat
Qualys unveils TruRisk Eliminate 2.0 with TruConfidence to power Autonomous RemOps. Oct 14, 2026, 09:00 ET TruConfidence brings AI-powered remediation intelligence to help organizations eliminate cyber risk at machine speed and increase confidence in business resiliency FOSTER CITY, Calif., Oct. 14, 2026 /PRNewswire/ - Qualys, Inc. (NASDAQ: QLYS), a pioneer of cloud-native cyber risk management, today announced TruRisk Eliminate(TM) 2.0 with TruConfidence(TM), a new remediation intelligence and orchestration engine that powers Qualys' vision for Autonomous RemOps, a new category for the frontier AI era. Built on Qualys' extensive experience of deploying half a billion patches with less than 0.1% rollback, of which 40% were deployed autonomously, TruRisk Eliminate combines the latest advances in autonomous remediation, remediation intelligence and orchestration to help organizations confidently eliminate cyber risk at machine speed while maintaining business resiliency and continuity. As AI accelerates vulnerability discovery and exploitation, the ability to remediate risk has become a critical constraint. Security teams must not only determine what needs to be fixed, but also account for controls already protecting the environment, select the appropriate, safe remediation path, manage deployment risk across increasingly complex environments and verify that remediation succeeded without disrupting business operations. Traditional remediation processes, built around manual decisions, tickets and point solutions, were not designed for this level of speed or complexity. "For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone," said Jon Nelson, principal advisory director in the Security & Privacy practice, Info-Tech Research Group. "Qualys TruRisk Eliminate gives security a viable path to drive remediation at machine speed, with patch reliability scoring, progressive rollouts, and patchless mitigation that reduce the risk of disrupting operations." TruConfidence is the cyber risk remediation and orchestration intelligence engine that turns TruRisk Eliminate into an operating model for Autonomous RemOps. It brings together the capabilities Qualys introduced over the past two quarters, including the AI-powered Patch Reliability Score, intelligent wave-based remediation orchestrated by Agent Sara, peer-to-peer distribution and compensating controls with intelligence drawn from half a billion real-world patch deployments. These capabilities enable organizations to reduce exposure with the least disruptive remediation, while avoiding duplicate protections already provided by existing controls. This establishes the core operating loop for Autonomous RemOps: fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it held. TruRisk Eliminate with TruConfidence enables organizations to: Remediate across the entire hybrid attack surface. TruRisk Eliminate now reaches perimeter devices, cloud, and applications, not just agent-based endpoints, to patch, mitigate without a patch, uninstall, isolate or apply a custom fix wherever the exposure lives. Assets that cannot run an agent are remediated through Qualys scanners and existing security and IT integrations, so nothing is left waiting on a manual workaround. Reduce exposure when patching is not the answer. TruConfidence first credits what existing security controls already protect, so teams avoid duplicate coverage. When exposures remain, built-in third-party mitigation intelligence identifies available compensating controls and applies mitigations through security tools customers already run on their perimeter and end points. This reduces exposure while a permanent fix is planned or validated, moving organizations from "wait for a patch" to "taking the right available action." Ensure operational continuity, with no business disruption after remediation. After every action, TruRisk Eliminate monitors system health through integrations with partners such as Dynatrace, watching for CPU spikes, memory issues and other service-impacting conditions. When a fix does not hold, AI-powered Patch Failure Analysis explains why it happened and recommends the corrective action, such as a roll-back. "Autonomous exploitation requires an equally automated remediation, but organizations' hesitation isn't about automation, it's a lack of confidence that it won't cause an outage", said Sumedh Thakar, president and CEO, Qualys. "That's why we're excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Center (ROC) so organizations have the confidence to reduce cyber risk quickly while reducing outage concerns." Availability Qualys TruRisk Eliminate 2.0 with TruConfidence is now generally available with a free upgrade for existing TruRisk Eliminate customers. Qualys will demonstrate its vision for RemOps and how it advances the Risk Operations Center (ROC) at ROCon Americas 2026, October 14-15 in Austin, TX. Additional Resources About Qualys Qualys, Inc. (NASDAQ: QLYS) is a pioneer of cloud-native cyber risk management, helping organizations measure, communicate, and eliminate cyber risk. The Qualys platform and its solutions power the Risk Operations Center (ROC), unifying asset visibility, exposure management, risk prioritization, and remediation to help organizations continuously reduce risk across hybrid, multi-cloud, endpoint, and AI environments. Qualys equips security and IT teams for the Frontier AI Era with AI-speed detection, hyper-prioritization, and autonomous remediation. Trusted by more than 10,000 organizations globally, including most of the Fortune 100, Qualys helps customers transform cybersecurity into a measurable business function that strengthens resilience and drives business outcomes. For more information, visit www.qualys.com. Media Contact: Rachel Yap Winship Qualys [email protected] SOURCE Qualys, Inc.
Qualys unveils TruRisk Eliminate 2.0 with TruConfidence to power Autonomous RemOps. TruConfidence brings AI-powered remediation intelligence to help organizations eliminate cyber risk at machine speed and increase confidence in business resiliency. Foster City, Calif. - October 14, 2026 - Qualys, Inc. (NASDAQ: QLYS), a pioneer of cloud-native cyber risk management, today announced TruRisk Eliminate(TM) 2.0 with TruConfidence(TM), a new remediation intelligence and orchestration engine that powers Qualys' vision for Autonomous RemOps, a new category for the frontier AI era. Built on Qualys' extensive experience of deploying half a billion patches with less than 0.1% rollback, of which 40% were deployed autonomously, TruRisk Eliminate combines the latest advances in autonomous remediation, remediation intelligence and orchestration to help organizations confidently eliminate cyber risk at machine speed while maintaining business resiliency and continuity. As AI accelerates vulnerability discovery and exploitation, the ability to remediate risk has become a critical constraint. Security teams must not only determine what needs to be fixed, but also account for controls already protecting the environment, select the appropriate, safe remediation path, manage deployment risk across increasingly complex environments and verify that remediation succeeded without disrupting business operations. Traditional remediation processes, built around manual decisions, tickets and point solutions, were not designed for this level of speed or complexity. "For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone," said Jon Nelson, principal advisory director in the Security & Privacy practice, Info-Tech Research Group. "Qualys TruRisk Eliminate gives security a viable path to drive remediation at machine speed, with patch reliability scoring, progressive rollouts, and patchless mitigation that reduce the risk of disrupting operations." TruConfidence is the cyber risk remediation and orchestration intelligence engine that turns TruRisk Eliminate into an operating model for Autonomous RemOps. It brings together the capabilities Qualys introduced over the past two quarters, including the AI-powered Patch Reliability Score, intelligent wave-based remediation orchestrated by Agent Sara, peer-to-peer distribution and compensating controls with intelligence drawn from half a billion real-world patch deployments. These capabilities enable organizations to reduce exposure with the least disruptive remediation, while avoiding duplicate protections already provided by existing controls. This establishes the core operating loop for Autonomous RemOps: fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it held. TruRisk Eliminate with TruConfidence enables organizations to: Remediate across the entire hybrid attack surface. TruRisk Eliminate now reaches perimeter devices, cloud, and applications, not just agent-based endpoints, to patch, mitigate without a patch, uninstall, isolate or apply a custom fix wherever the exposure lives. Assets that cannot run an agent are remediated through Qualys scanners and existing security and IT integrations, so nothing is left waiting on a manual workaround. Reduce exposure when patching is not the answer. TruConfidence first credits what existing security controls already protect, so teams avoid duplicate coverage. When exposures remain, built-in third-party mitigation intelligence identifies available compensating controls and applies mitigations through security tools customers already run on their perimeter and end points. This reduces exposure while a permanent fix is planned or validated, moving organizations from "wait for a patch" to "taking the right available action." Ensure operational continuity, with no business disruption after remediation. After every action, TruRisk Eliminate monitors system health through integrations with partners such as Dynatrace, watching for CPU spikes, memory issues and other service-impacting conditions. When a fix does not hold, AI-powered Patch Failure Analysis explains why it happened and recommends the corrective action, such as a roll-back. "Autonomous exploitation requires an equally automated remediation, but organizations' hesitation isn't about automation, it's a lack of confidence that it won't cause an outage", said Sumedh Thakar, president and CEO, Qualys. "That's why we're excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Center (ROC) so organizations have the confidence to reduce cyber risk quickly while reducing outage concerns." Availability Qualys TruRisk Eliminate 2.0 with TruConfidence is now generally available with a free upgrade for existing TruRisk Eliminate customers. Qualys will demonstrate its vision for RemOps and how it advances the Risk Operations Center (ROC) at ROCon Americas 2026, October 14-15 in Austin, TX. Additional Resources About Qualys Qualys, Inc. (NASDAQ: QLYS) is a pioneer of cloud-native cyber risk management, helping organizations measure, communicate, and eliminate cyber risk. The Qualys platform and its solutions power the Risk Operations Center (ROC), unifying asset visibility, exposure management, risk prioritization, and remediation to help organizations continuously reduce risk across hybrid, multi-cloud, endpoint, and AI environments. Qualys equips security and IT teams for the Frontier AI Era with AI-speed detection, hyper-prioritization, and autonomous remediation. Trusted by more than 10,000 organizations globally, including most of the Fortune 100, Qualys helps customers transform cybersecurity into a measurable business function that strengthens resilience and drives business outcomes. For more information, visit www.qualys.com. Media Contact: Rachel Yap Winship