Qualys

Qualys Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of disruptive cloud-based IT, security

10/14/2026

We’re excited to announce the official launch of Qualys’ TruRisk Eliminate 2.0!

2.0 is powered by TruConfidence, an AI-powered remediation and orchestration intelligence engine. It gives you the intelligence and confidence to run autonomous RemOps while keeping operations resilient.

In this current frontier AI era, vulnerabilities are being discovered faster than we can close them. The confidence gap is why the backlog keeps growing – TruRisk 2.0 closes that confidence gap by employing Agent Sara and TruConfidence, our remediation and orchestration intelligence engine.

Give your board confidence in security and business continuity with TruRisk Eliminate 2.0.

Learn more here: qualys.com/truconfidence-blog

.0

10/06/2026

Attackers are hitting public-facing applications before patches ship, and the federal rules have caught up. For high-impact systems, FedRAMP now expects vulnerability detection at least daily, with exploitability evidence for every finding.

Join Asma Zubair, Joseph Tyler and Shravan Dandage on October 7 at 9 AM PT for a walkthrough of Qualys TotalAppSec on the FedRAMP High Qualys Government Platform. They'll cover finding shadow APIs, testing what an authenticated attacker can reach, and turning scan results into evidence your AO will accept. Bring your questions for the live Q&A.

Save your spot: https://www.brighttalk.com/webcast/11673/676121

09/28/2026

Federal application and API estates are growing faster than most security programs can inventory them. AI is speeding up both sides: agencies are shipping more code, APIs and agents, and attackers are exploiting flaws before a patch exists.

Meanwhile, FedRAMP's 2026 vulnerability rules, NIST SP 800-228 and CISA BOD 26-04 now ask for the same three things: know what you expose, test it continuously and prove what's exploitable.

Join Qualys experts Asma Zubair, Joseph Tyler and Shravan Dandage on October 7 at 9 AM PT. They will discuss how federal teams close that gap with Qualys TotalAppSec, now FedRAMP High Authorized on the Qualys Government Platform.

What you'll learn:
→ How federal mandates reshape your application and API risk priorities
→ How to find shadow APIs and unmanaged web apps across cloud, on-prem and API gateways
→ How to test running apps for flaws that have no CVE, such as BOLA, BFLA, BUA
→ How to produce audit-ready evidence from inside the FedRAMP High boundary

Register now: https://bit.ly/4d4S9Nc

09/23/2026

AI compliance evidence can be obsolete before the audit even begins.

Your AI changes in production. Your controls do too. If the proof is a spreadsheet, screenshot, or quarterly review, it may already be stale.

Point-in-time proof can’t keep pace with AI. Governance needs live evidence:
> What changed?
> Which control applies?
> Is it working now?
> What risk remains?

In this clip, Vallabh Joshi, Principal Technical Product Manager, explains why traditional audits break down for AI.

Watch the full webinar to see how live telemetry becomes continuous evidence: https://bit.ly/4g3nbFQ

09/22/2026

Deploying security updates without understanding patch reliability introduces significant business risk, as seen with recent Microsoft KB updates causing widespread USB audio failures.

Qualys TruRisk Eliminate addresses this challenge by evaluating patch stability before deployment through AI-driven public sentiment and telemetry analysis. By identifying low-reliability updates early, IT and security teams can avoid blind deployments and implement a phased, ring-based rollout or patchless mitigations. This approach allows high-confidence patches to move quickly into production while reserving deep testing for higher-risk updates.

Ultimately, predictive scoring shifts patch management from reactive troubleshooting to a proactive, controlled process.

Read the full blog to learn how to deploy updates with confidence and minimize operational downtime: https://bit.ly/4rlOfFx

09/21/2026

As frontier AI models like Claude Mythos compress threat timelines, cyberattacks no longer unfold over weeks. Autonomous agents now discover, validate, and chain vulnerabilities in sub-second sequences. Traditional controls fall short when attackers reason through enterprise context to exploit unmanaged data leaks, prompt intents, and containerized AI capabilities.

If you manage cloud or AI workloads, defending against these sub-second sequences is critical.

Join Qualys VPs Himanshu Kathpal and Abhishek Singh for a tactical walkthrough on preparing your environment for the post-Mythos era.

What you will learn:
> Machine-Speed Vulnerability Engine: Eliminate detection windows, validate real exploitability, and neutralize zero-days instantly at runtime using scanless InstaScan, exploitless TruConfirm, and patchless patching.
> Denying the Premise at the Edge: Extend passive sensing via the Qualys Browser Plugin to stop shadow AI exposure and prevent sensitive data leaks to external models.
> Breaking Runtime Privilege Chains: Monitor MCP server tool calls and audit intent ex*****on across Qualys TotalAI and Container Security to block lateral movement.

Move beyond theoretical exposure and protect your production environment at true machine speed.

Register here: https://bit.ly/4hiTbGF

09/17/2026

Finding vulnerabilities is just the starting point. The real challenge is knowing which exposures put your business at risk—and what to do about them.

What truly separates modern security programs is what happens post-detection: how quickly you can verify, prioritize, and remediate actual exploit paths. Evaluating an exposure management platform requires looking beyond continuous asset discovery toward continuous validation of real-world exploitability.

It also demands a solution that offers patchless mitigations and bridges the gap between security and IT at machine speed. Based on insights from Info-Tech Research Group, the true test of a platform is whether it empowers your organization to act on what it finds.

Read the full blog to discover the 4 key questions every team should ask before choosing their platform: https://bit.ly/4cPF9Lb

09/17/2026

AI turned the 30-day patch cycle into a 24-hour problem. NFCRM-1:2025 assumes you've already adapted.

Saudi Arabia's NCA mandates government, CNI operators, and designated entities to manage cyber risk continuously — discover, prioritize, treat, validate. No gaps.
But the timing is unforgiving as AI-assisted attackers now compress discovery-to-exploit from weeks to hours.

Periodic scans, spreadsheet reviews, and disconnected dashboards can't prove continuous risk reduction across hybrid environments. NFCRM demands a AI-native Risk Operations Center (AI-ROC) and legacy tools simply can't answer for it.

See how Qualys Enterprise TruRisk Management operationalizes continuous cyber risk management with AI-ROC model and Haseen-ready evidence:

https://www.qualys.com/forms/whitepapers/navigating-saudi-arabia-nfcrm-1-2025

09/16/2026

When threat actors leverage AI to exploit vulnerabilities in minutes, operating on weekly assessments leaves your organization exposed.

Join us on September 23 for Cyber Risk Series: Mind the Gap – From Disclosure to Detection to get actionable insights from our experts. When the threat landscape changes in an instant, how quickly does your organization need to know, and what has to change for you to get there?

Across a morning of sessions, you'll hear from:

Sumedh Thakar, President and CEO, Qualys
Alex Pinto, author of the Data Breach Investigations Report, Verizon
Theresa Lanowitz, Principal Analyst, Cybersecurity, Omdia
Jeff Crume, PhD, Adjunct Professor, NC State University
Andrey Lukashenkov, Chief Product & Growth Officer, Vulners
Sean Martin, Journalist, Technologist, ITSP Magazine

Save your seat today: https://bit.ly/3UJX3sE

09/16/2026

Your cloud provider isn't responsible for securing your self-hosted AI. You are.

Moving models to the cloud doesn't eliminate AI risk; it just builds bigger, harder-to-see silos. True AI coverage demands end-to-end AI governance across the entire software lifecycle:

• Code & Build: Catch shadow AI before they deploy.
• Runtime: Continuously monitor live cloud workloads.
• Adversarial: Stress-test against active threat vectors.

In this webinar snippet, Abhishek Singh breaks down how Qualys Total AI unifies your AI footprint into one familiar risk management workflow.

Want the deep dive? Check out the full webinar: https://bit.ly/4g3nbFQ

Where are you seeing the biggest visibility gaps in your AI stack right now? Let us know in the comments below.

Address

Foster City, CA

Telephone

(800) 745-4355

Website

Alerts

Be the first to know and let us send you an email when Qualys posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share