Qualys, Inc. (NASDAQ: QLYS) has announced TruRisk Eliminate 2.0 with TruConfidence, a new remediation intelligence and orchestration engine that powers its vision for Autonomous RemOps. The company describes this as a new category for the frontier AI era.

The launch builds on Qualys’ experience of deploying half a billion patches with less than 0.1% rollback. Of these, 40% were deployed autonomously. TruRisk Eliminate combines autonomous remediation, remediation intelligence and orchestration. It aims to help organizations eliminate cyber risk at machine speed while maintaining business resiliency and continuity.

The announcement comes as AI accelerates vulnerability discovery and exploitation. As a result, the ability to remediate risk has become a critical constraint. Security teams must decide what needs to be fixed. They must also account for controls already protecting the environment and select a safe remediation path. In addition, they need to manage deployment risk and verify that remediation succeeded without disrupting operations. Traditional processes built around manual decisions, tickets and point solutions were not designed for this level of speed or complexity.

Jon Nelson, principal advisory director in the Security & Privacy practice at Info-Tech Research Group, highlighted the shift in timelines. “For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone,” he said. He added that Qualys TruRisk Eliminate gives security a viable path to drive remediation at machine speed. According to Nelson, patch reliability scoring, progressive rollouts and patchless mitigation reduce the risk of disrupting operations.

TruConfidence is the remediation and orchestration intelligence engine that turns TruRisk Eliminate into an operating model for Autonomous RemOps. It brings together capabilities Qualys introduced over the past two quarters. These include the AI-powered Patch Reliability Score and intelligent wave-based remediation orchestrated by Agent Sara. They also include peer-to-peer distribution and compensating controls, with intelligence drawn from half a billion real-world patch deployments.

Together, these capabilities help organizations reduce exposure with the least disruptive remediation. They also avoid duplicate protections already provided by existing controls. This sets the core operating loop: fix the minimum, credit existing controls, choose the right remediation path, control the rollout and prove that it held.

TruRisk Eliminate with TruConfidence first enables remediation across the entire hybrid attack surface. It now reaches perimeter devices, cloud and applications, not just agent-based endpoints. Teams can patch, mitigate without a patch, uninstall, isolate or apply a custom fix wherever the exposure lives. Assets that cannot run an agent are remediated through Qualys scanners and existing security and IT integrations. Therefore, nothing is left waiting on a manual workaround.

It also helps reduce exposure when patching is not the answer. TruConfidence first credits what existing security controls already protect, so teams avoid duplicate coverage. When exposures remain, built-in third-party mitigation intelligence identifies available compensating controls. It then applies mitigations through security tools customers already run on their perimeter and endpoints. This reduces exposure while a permanent fix is planned or validated. In practice, it moves organizations from “wait for a patch” to “taking the right available action.”

Finally, the platform supports operational continuity after remediation. After every action, TruRisk Eliminate monitors system health through integrations with partners such as Dynatrace. It watches for CPU spikes, memory issues and other service-impacting conditions. When a fix does not hold, AI-powered Patch Failure Analysis explains why it happened. It then recommends a corrective action, such as a roll-back.

Sumedh Thakar, president and CEO of Qualys, said hesitation around automation often comes down to confidence. “Autonomous exploitation requires an equally automated remediation, but organizations’ hesitation isn’t about automation, it’s a lack of confidence that it won’t cause an outage,” he said. He added that the release moves beyond patching to turn remediation intelligence into action with the Risk Operations Center (ROC). The goal is to help organizations reduce cyber risk quickly while reducing outage concerns.

Qualys TruRisk Eliminate 2.0 with TruConfidence is now generally available. Existing TruRisk Eliminate customers receive a free upgrade. The release supports the company’s vision for Autonomous RemOps.

Related post

View all