Qualys has expanded its global mROC Alliance with technology partners across mobile, operational technology, internet of things and identity security, adding Claroty, Lookout, NowSecure, Nozomi Networks and Okta to the programme.
The additional integrations are designed to pull telemetry from areas that traditional tools often struggle to measure, including mobile devices, industrial systems, medical equipment and user accounts. That data is fed into Qualys Enterprise TruRisk Management, where it is assessed alongside information from other parts of a customer's environment.
For security teams, the announcement reflects a wider push to consolidate fragmented risk data into a single view. Many organisations still manage vulnerabilities and exposures across separate products, each with its own scoring method, leaving security leaders without a common basis for prioritising remediation work.
Under the expanded set-up, mobile data from Lookout and NowSecure will provide visibility into device posture, operating system vulnerabilities and application-level risks. In operational technology and connected device environments, Claroty and Nozomi Networks will contribute passive asset discovery and vulnerability information for systems including industrial control equipment, medical devices and building management systems.
Okta will provide identity telemetry, including misconfigured accounts, over-privileged access and exposed credentials. The aim is to weigh identity-related risk alongside the systems those accounts can reach, giving customers a clearer picture of how an attacker might move through an environment.
Partner tracks
Alongside the technology alliances, Qualys has introduced two partner authorisation tracks within the Global mROC Alliance: Authorised mROC Advisor and Authorised mROC Delivery & Implementation Partner.
The existing mROC Partner designation remains in place for providers that run a customer's Risk Operations Centre as a managed service on the Qualys platform. Qualys said the three-tier structure is intended to cover strategy, deployment and managed operations, allowing customers to select partners for different stages of adoption.
The advisor track is aimed at partners that assess a customer's risk programme, set priorities based on TruRisk scoring, and design an operating model and adoption roadmap for a Risk Operations Centre. The delivery and implementation track is for partners certified to deploy Enterprise TruRisk Management, connect it to an existing security stack and establish operating workflows.
Qualys framed the changes as a response to a faster threat environment shaped by artificial intelligence. It argued that AI models are speeding up vulnerability discovery, while attackers can use similar tools to identify and exploit weaknesses more quickly than many security teams can respond.
The challenge is particularly acute in parts of the estate where agents cannot easily be installed and active scanning may not be practical. Phones, connected devices and industrial systems often fall into that category, while identity risk is frequently assessed in tools separate from infrastructure and endpoint exposure.
By combining those data sources into one scoring model, Qualys said chief information security officers get a unified risk score, a prioritised remediation list and a clearer framework for board reporting. Exposures that cannot be patched directly can also be tracked with compensating mitigations in the same workflow.
Qualys serves more than 10,000 organisations globally, including many large multinationals, and has been building its Risk Operations Centre model around the idea that cyber security should be managed as an operational discipline rather than as a collection of disconnected tools. The mROC programme is a partner-led extension of that model, aimed at customers that want outside help to design or run those processes.
In a statement, Cade Stephens linked the expansion to pressure created by AI-assisted attack methods.
"PHP2Shell was a wake-up call for the industry. The vulnerability existed for years, but AI dramatically changed the economics of discovery and exploitation, enabling adversaries to weaponise exposures at a speed that far exceeds traditional response cycles," said Cade Stephens, Vice President of Global Channels and Strategic Alliances at Qualys.
"Our expanded Global mROC Alliance brings together the power of the Qualys platform, strategic technology alliance partners, and a global ecosystem of highly trained Risk Operations Centre experts to help customers operationalise cyber risk management at scale and outpace threats in the age of AI," Stephens said.