NCR Atleos Keeps Pace With a Surge in Vulnerabilities
A High-Visibility Target in a Busier Threat Landscape
ATMs sit squarely in attackers’ sights. Theo Bowman knows that pressure well. He runs the vulnerability management program at NCR Atleos, which designs, builds, and services ATMs. Returning to Techstrong TV at Qualys ROCon 2026, he tells Alan Shimel what has changed over the past year.
The biggest shift is speed. Since Mythos arrived, Bowman says the priority has been finding exposures first and fixing them quickly. Disclosure counts keep rising. He notes that a recent Patch Tuesday topped a thousand vulnerabilities, and the next one looked much the same.
One Source of Truth Across Many Teams
Bowman’s group sets the timelines, while several other teams carry out the remediation work. Keeping everyone aligned is a core part of the job. Bowman describes the teams as one big family working toward the same goal of avoiding a breach. NCR Atleos was an early adopter of Qualys Enterprise TruRisk Management. It has used the platform for more than a year.
He values how ETM breaks findings down by CVE. TruConfirm adds a real-time view of whether the company is actually exposed. NCR Atleos also integrates Wiz with ETM. Each team sees only its own assets, but all of them pull from the same source of truth. That spares people from copying data between spreadsheets and tickets.
What a Practitioner Is Waiting For
As a member of the Qualys Product Advisory Board, Bowman saw an early InstaScan demo. He says it surfaced Patch Tuesday data for relevant assets within minutes, without a new scan. He is also eager for an external view that traces an attack path from the internet to a backend server.
Shimel closes by asking whether defenders are gaining ground. Bowman believes things are moving in the right direction. He points to better detection of chained lower-severity vulnerabilities and more ways to break those chains.
For anyone running a vulnerability management program today, his message is practical. Shared data, clear timelines, and faster detection help teams keep up when volume keeps climbing.
Transcript
Hey everyone, welcome back here to Techstrong TV, continuing our coverage of ROCon 26 in Austin. My next guest is a repeat. He's been on with us before in prior years.
He's been a fixture here at the Qualys conferences for a few years now. Yeah. I want to say hello to our friend, Theo Bowman.
Theo, it's great to see you, man. How you been? Great to see you again.
Yes. So I don't know how many people out here, maybe your family, right? " I don't know if everyone remembers you from- Right ...
I guess it was last year. Give people a little bit about you and yourself, where you work, what you do. Well, like I say, I'm Theo Bowman.
I work for NCR Atlas. Been there almost six and a half, seven years now. I run the vulnerability management program there.
So, yeah, so that- And for those people, I think a lot of people have heard of NCR. Right. Right?
National Cash Register, obviously. But they may not be familiar with the division. Is it Atheos?
Atleos. Atleos. Right.
Give people, what exactly is that? So we deal in ATMs. We service them, build them.
You build and design them as well. Yeah. And then service them.
Right. And obviously that is a high visibility target, right? People- Yeah ...
you got a target on your back with them. Yeah. People, yeah.
And if I remember correctly from our last conversation, you guys used the Qualys Vulnerability Management system. You were doing your scanning and your remediations. Have you transitioned into the whole Rock center and all of that?
Yeah. So we was maybe the second customer to actually get the ATM. Uh-huh.
Yeah. So we've been having it almost over a year now. And how's that worked out for you?
Oh, it's been good. It's been good. So it breaks down stuff by CVE versus QID, like VMBR.
The TruConfirm gives us real threat time to let us know if we exposed to a vulnerability or not. So yeah, it does good. Helps good.
Mm-hmm. Now of course, when I spoke to you last year, Theo, that was before Mythos came out, and the whole vulnerability thing changed around. Right.
Talk to me this year. Has Mythos had an impact in your day to day? Yes.
The impact is to find the vulnerabilities first and be on top of them early. And so there's a big rush for us to find the exposure, find it early, and remediate it quick. Absolutely.
Now, we've heard a lot of stories in the media about the Vulnerpocalypse, and how are we going to keep up? Are you falling behind with the amount of vulnerabilities out there, or are you able to at least tread water with what you were doing before? I think our teams at NCR Atlas, we do a pretty good job with patching and remediating vulnerabilities.
Like we are, you could say we just one big happy family trying to all get to the same goal, make sure we don't get popped. So we do a pretty good job. But the amount of vulnerabilities is insane.
So like last patch Tuesday, it had over a thousand- A thousand ... yes, vulnerabilities. And this one is the same, and you just see it increase every month.
Yeah. So. So, and if you can't answer this, no, and I appreciate that.
Yeah. But you're in charge of a vulnerability management program. Mm-hmm.
Who runs the remediation? Is that your department? Is that a help desk department?
So in other words, generally security helps find vulnerabilities, prioritize vulnerabilities, but a different department does the remediations. Right. So we oversee the remediations, but the other teams, we have several other teams that actually goes out and do the remediations, and we just try to make sure they stay within the timelines that we put out there for the remediations.
Yeah. Got it. Now, one of the beautiful things about using the Qualys Rock system is that multiple teams can use the same platform, so I don't have to cut and paste it from here, put it in a spreadsheet there.
You know what I mean? Send it in Slack, whatever. Everybody logs in, whether you're in the remediation team, the vulnerability management team, the scanning, whatever.
Everybody's using one platform. Is that how you guys do it there, or are you still using different kind of- Yeah, so we use Wiz, and we integrate Wiz with ATM. Sure.
Right? Yes. And so we have different teams that use Qualys, but they only have access to their assets, and so they're getting it from the source of truth.
Even though we have ticketing systems and all that, they actually get it firsthand from a source of truth, and we just direct them on what they need to do. Right. Excellent.
Now, they were talking, I happened to be in for Sumedh, the CEO of Qualys', keynote. They mentioned that Tru, is it TruView? TruConfirm, TruLens.
0, they announced updates to that today. Right. I don't know if you saw it, or maybe as a good customer, you've already been working on it.
No, waiting on getting it. Yeah. What's the biggest, "I can't wait for this," to have this?
So they have, can't wait to have Instant Scan. Yeah. So Instant Scan is where you don't have to wait for the scan to run.
It already has all the data that it needs, so when the vulnerability becomes available, it tells you right there within three minutes. So they demoed it, today in, I'm part of the PAL, Product Advisory Board. So they demoed it.
By the time, patch Tuesday was released yesterday, within three minutes it had all the vulnerability data for the assets. And so that's good. The other thing I'm waiting on is the external NATTI.
Yeah. Yes. Yes.
So I'm waiting on that. So they can see from the external scanners, the attack path, right to the backend server from external. So I'm waiting on that.
That's going to be really exciting. Been asking for that for a while. Have you?
Yeah. Well, I'm glad to see that's coming out for you then. Let me ask you a question.
So looking at what happened this past year with Mythos, and now seeing what companies like Qualys are doing with Rock and Instant Scanning and really speeding up remediation- Mm-hmm ... do you think we're getting better at overall at securing our networks, about the same, or worse? It's definitely going in the right direction.
Yeah. Right? It's getting better.
Especially, they're coming up with the chaining of lower vulnerabilities. Mm-hmm. Detecting those, knowing what those are, and being able to break those chains.
And so it's getting better. So that's what I think about that. Yeah.
Yeah. Good, man, because you know what? It's people like you who are out here dealing with this stuff every day that are the real kind of warriors, right?
That we could use to see, okay, what's working, what's not working. Right. Well, I want to thank you for popping in.
As usual, you got- Yeah ... your finger on the pulse of things here. Mm-hmm.
And I hope to see you next year. Yeah. Appreciate it.
All right. All right. Thank you.
Theo Bowman, NCR At- Atleos ... Atleos. Atleos, yes.
Here on Techstrong TV. We're going to take a break. We'll be back with more.
Stay tuned.
