For a decade the vulnerability management pitch was simple: find more. Qualys’s Oct 14 launch quietly admits finding is no longer the constraint. Fixing is. And fixing is gated by one thing: fear of breaking production.
Qualys announced TruRisk Eliminate 2.0 with TruConfidence, a remediation intelligence and orchestration engine. It is generally available now, with a free upgrade for existing TruRisk Eliminate customers. Qualys pitches it as the engine behind “Autonomous RemOps,” which it calls a new category, and is demoing it at ROCon Americas, Oct 14–15 in Austin (Qualys via PR Newswire).
The number is the pitch. Qualys says it has deployed half a billion patches with less than 0.1% rollback, and that 40% of them went out autonomously. That is vendor data, and the denominators matter. Rollback across what mix: OS versus third-party apps, laptops versus servers, which change windows? Still, it is the right number to lead with. CEO Sumedh Thakar says hesitation “isn’t about automation, it’s a lack of confidence that it won’t cause an outage.” Correct diagnosis. Every patch committee in the Fortune 500 runs on that fear.
What actually changed in 2.0. TruConfidence packages capabilities Qualys shipped over the past two quarters: an AI Patch Reliability Score, wave-based remediation orchestrated by Agent Sara, peer-to-peer distribution, and compensating controls. The new reach matters more. Remediation now extends past agent-based endpoints to perimeter devices, cloud and applications, via Qualys scanners and existing security and IT integrations. Actions include patch, patchless mitigation, uninstall, isolate, or a custom fix. After each action, health monitoring through partners such as Dynatrace watches for CPU spikes and memory issues, and Patch Failure Analysis recommends a corrective step like rollback.
Qualys describes the loop as: fix the minimum, credit existing controls, choose the right path, control the rollout, prove it held. The “credit existing controls” step is the interesting one. If your EDR or perimeter tooling already blocks the exploit path, urgency changes. SOCs do that reasoning in spreadsheets today. Productizing it is useful. It is also politically loaded, because it hands IT a documented reason to defer a patch.
Category or branding? Autonomous RemOps sits next to Qualys’s Risk Operations Center framing. Endpoint management suites and exposure-management vendors already sell pieces of this loop. A category earns the name with a metric buyers can hold a vendor to: time to remediate for KEV-listed vulns, with no change ticket in the loop. Qualys didn’t publish that number here. That is the one we’d want.
Flip the vendor stat too. If 40% of half a billion patches went out autonomously, 60% didn’t. That gap is the market. The free upgrade tells you how Qualys plans to close it: expand inside the installed base, which it puts at more than 10,000 organizations including most of the Fortune 100 (per Qualys). TruRisk Eliminate adoption and pricing were not disclosed in the release. For QLYS holders, remediation attach on top of the scanner footprint is the lever to watch on the next call.
The urgency framing is everywhere this month. Info-Tech Research Group’s Jon Nelson, quoted in the release, says exploitation timelines are now measured in hours. Whether or not you buy the frontier-AI narrative, the old split, security finds and IT patches on a weekly cycle, does not survive a same-day KEV.
What we’d ask Qualys. What share of last quarter’s critical and KEV findings across customers could have been auto-remediated without a change ticket? What is the rollback rate for servers alone, not blended? Which compensating controls does TruConfidence credit, from which vendors, and how stale can that signal be? Does health verification work without Dynatrace? And who signs off when Agent Sara picks the next wave?
The read. Scanners are not the moat anymore. Confidence is. Qualys is selling the ability to say yes to automation without a 3 a.m. outage call. If those rollback numbers hold in your environment, that is worth more than another dashboard. Make them prove it on your servers first.