Qualys launches TruRisk Eliminate 2.0 with TruConfidence

Qualys has launched TruRisk Eliminate 2.0 with TruConfidence, adding a remediation intelligence and orchestration engine to its cyber risk platform.

The release focuses on automating how organisations decide, deploy and verify actions to reduce cyber risk across endpoints, cloud systems, applications and perimeter devices.

The new version is intended to address a growing challenge for security and IT teams as software flaws are discovered and exploited more quickly. Older remediation processes, which often depend on manual reviews, ticketing systems and separate tools, are struggling to keep pace with shrinking attack windows.

At the centre of the update is TruConfidence, the intelligence layer behind Qualys' broader push into what it calls Autonomous RemOps. The system combines several elements introduced in recent quarters, including an AI-based Patch Reliability Score, wave-based remediation managed by Agent Sara, peer-to-peer distribution and compensating controls informed by patch deployment data.

These functions are meant to help teams decide whether to patch, isolate, uninstall, apply a custom fix or use other controls when a patch is not immediately suitable. The product can also account for protections already in place, helping teams avoid duplicating actions across the same environment.

Qualys says the system draws on its experience from half a billion patch deployments, with rollbacks occurring in less than 0.1% of cases. It says 40% of those patches were deployed autonomously.

Broader reach

One of the main changes in TruRisk Eliminate 2.0 is its wider scope beyond agent-based endpoints. The product now extends remediation to perimeter devices, cloud assets and applications.

That is significant for assets that cannot run an agent and often leave security teams relying on manual workarounds. According to Qualys, those systems can now be addressed through Qualys scanners and integrations with existing security and IT tools.

The platform also aims to handle cases where patching is not the best first response. In those situations, TruConfidence can identify available compensating controls through third-party security tools already used by customers, helping reduce exposure while a permanent fix is assessed or prepared.

Operational checks

Another feature focuses on post-remediation monitoring. TruRisk Eliminate checks system health after actions are taken through integrations with partners including Dynatrace, looking for signs such as CPU spikes, memory problems and other conditions that could affect services.

If a remediation action fails or creates problems, an AI-based Patch Failure Analysis tool explains the cause and recommends a corrective step, including a rollback where needed.

The focus on reducing operational disruption reflects a long-running tension between security teams that want faster patching and IT operations teams that must keep systems stable. That tension has become more acute as automation and AI shorten the time between vulnerability disclosure and attempted exploitation.

"For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone," said Jon Nelson, Principal Advisory Director in the Security & Privacy practice, Info-Tech Research Group.

"Qualys TruRisk Eliminate gives security a viable path to drive remediation at machine speed, with patch reliability scoring, progressive rollouts, and patchless mitigation that reduce the risk of disrupting operations," Nelson added.

Market pressure

Security software suppliers have been moving beyond detection and prioritisation into tools that can carry out remediation with less manual input. That shift reflects pressure from customers facing larger vulnerability backlogs, more complex hybrid environments and tighter staffing levels.

Qualys positions the latest release as part of a broader operating model that links exposure data, prioritisation and remediation. The aim is to fix the minimum necessary, recognise controls already in place, choose the right remediation path, manage the rollout and verify that the action held.

TruRisk Eliminate 2.0 with TruConfidence is now generally available, and existing TruRisk Eliminate customers will receive it as a free upgrade.

"Autonomous exploitation requires equally automated remediation, but organisations' hesitation isn't about automation, it's a lack of confidence that it won't cause an outage," said Sumedh Thakar, President and CEO, Qualys. "That's why we're excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Centre (ROC) so organisations have the confidence to reduce cyber risk quickly while reducing outage concerns."