Qualys Brings Real-Time Telemetry to Cyber Insurance
Two Roles That Fit Together
Kimberly Manibusan leads global technology alliances and cyber insurance partnerships at Qualys. She spent 15 to 20 years in the insurance world before joining. She knows how underwriters assess risk and how brokers present it.
At Qualys ROCon 2026, Manibusan joins Alan Shimel for her first Techstrong TV appearance. They discuss how cyber insurance has changed and where Qualys fits.
From Checkboxes to Real Data
Manibusan describes today’s cyber insurance market as soft. Carriers have plenty of capital, so buyers hold leverage. Still, insurers now want to know how organizations deploy and manage AI. They see it as a new kind of risk.
Shimel recalls when insurers seemed eager to deny claims. Ransomware pushed the industry to change. Carriers now tell customers what they must do to earn coverage. They also protect their books of business by offering proactive risk services.
Static questionnaires were built before AI. A yes on MFA says little about how it is deployed. Insurers are turning to real-time telemetry and attestation instead. Shimel says that brings new honesty to underwriting.
Proving You Are a Better Risk
Qualys works with both sides. It is partnering with brokers and carriers to share telemetry. Qualys TotalAI helps underwriters see how organizations deploy large language models. That matters as standalone AI policies reach the market.
Customers can also use Qualys reports with their brokers. Strong mean time to remediate and a short window of exposure can earn better terms or rates. The key is meeting the SLA an underwriter expects. That turns a questionnaire answer into measurable proof.
Technology partners round out the picture. IoT, OT and mobile threat data flow into Qualys ETM. That shows insurers every asset class is covered. It also clarifies which risks to accept, mitigate or transfer through cyber insurance.
Vendors hoping to partner with Qualys have a simple starting point. Manibusan suggests coming to ROCon to meet the alliances team and Qualys leaders.
Transcript
Hi, everyone. Welcome back here to Techstrong TV, continuing our day one coverage of Qualys's RACCON here in Austin. I almost said August again.
I said August earlier. Austin, Texas, at the Fairmont Hotel. Our next guest is Kimberly Mada Buson.
Did I get that? You did. Okay.
I really- I just want to make sure we... I'd like to try to get names right. Kimberly, welcome to Techstrong TV.
It's your first time on here. Yes, it is. Well, welcome, and thanks for coming on.
Yeah. So you work for Qualys. I do.
Give us an idea, what's your title, what's your role, and what did you do? How did you get here? Yeah.
It's a great question. I'm a director of global technology alliances and in cyber insurance partnerships. So, it's a dual role.
Very exciting. We both manage our technology partnerships and our cyber insurance partnerships, which actually come together in a really nice way, right, as we address the market and how we're helping organizations mitigate risk. I spent, I'd say, about 15 to 20 years in the cyber insurance world, so working with insurance carriers and brokers.
So I'm well aware of how underwriters underwrite risk and how brokers represent that risk to their insurance underwriting teams and how they all work together to help organizations be a better risk, right? So, Qualys- Absolutely ... is in a good position to support this.
So 15, 20 years in cyber insurance, you've seen a lot of water under that bridge. Indeed. Talk to us a little bit about how the cyber insurance industry has really gone from being a, and don't take this the wrong way, but it's gone from being almost a circus act, right?
" And on the back end, they offset it with their cyber insurer or something. Yeah. To really becoming what I call the big stick in the cyber industry, right?
Enforcing good cyber hygiene. You've sat, you've had a first front row seat. How have you seen that play out?
Yeah, it's really tough. For cyber insurance, and any kind of insurance, you either have a soft market or a hard market. And where we are in the cyber insurance world right now is, it's a buyer's market.
It's soft. There's a lot of capital with all of these insurance companies. So asking these questions through the insurance process can be a little bit of a point of contention, right?
Sure. Now, there's a trend in terms of how that change in the landscape is happening, where it's starting to stabilize, and so insurers are starting to say, "We'd like to get more information about how you're leveraging AI. " This is a new risk for cyber insurers, not from a technology perspective, but AI being used in the organization.
There's some concerns about how it's being deployed, how it's being managed- Sure ... and quite frankly, how it's being identified in the assessment process for cyber insurance. Absolutely.
I've been involved in cyber a long time. One of the developments that I've seen over the years was cyber insurance, like so many other insurances, it was all fine and dandy till you had to make a claim, right? And then you find out all the little gotchas.
You didn't do this, you should've done that, you didn't notify us of this, and I'm very sorry. And a lot of people soured on the whole cyber insurance thing. But I think, as markets play out, that forced cyber insurance to change.
" Yeah. " And that, to me, that's where the script switched. Yeah.
That's where it flipped. Yeah. I think, also, the whole ransomware industry, I think, is what's made cyber insurance front and center.
Yes. Yeah, and cyber insurers are interesting, right? Because while they want to write as much coverage and give as much in terms of the coverage that they are underwriting, they also have to protect their books of business, right?
So if you're a company like AIG or Chubb, you have to be cognizant of your entire portfolio and making sure that the entire portfolio is a good risk, right? There may be some bad risks, but there could be some good risks. So proactive services, while somewhat fairly new, these are value-added services that insurance carriers will bring to the marketplace through people like Qualys or others that offer risk mitigation services, technologies that help overall cybersecurity posture, and resiliency, quite frankly.
And I think now, more than ever, cyber insurers are leaning on folks like Qualys and others in the cybersecurity marketplace because they need not only to use that as a value-added service to mitigate the risk, but they also use telemetry to assess that risk, right? So they're looking at real-time data- Absolutely ... as opposed to a static questionnaire that typically represents a yes/no, right?
Right. If they say, "We have MFA," that's great, you have MFA, but it's really about how MFA is deployed, right? So a lot of these questionnaires are checkbox questionnaires that were really built for the times when AI wasn't really in play.
Now that AI is in play, you're going to see a lot of cyber insurers lean on more of a real-time data telemetry- Telemetry ... and attestation of where their cybersecurity posture is and how they're able to mitigate those risks. You know what, it makes for better risk underwriting, but it also brings, I'm trying to think of the right word.
Not the word of God, but it brings honesty to the whole process. You can't just, "Oh, yeah, fill that out. Yes, yes, yes.
" Yeah. And I got my policy, and then you find out after a claim, and back to what I said before, that after a claim is made, the investigation shows that you said no, and it was really yes. And now I'm not covering you.
And then you say, "Oh, that cyber insurance is full of crap," right? " Well, because you lied on the application. And I'm not saying everybody lies on their application.
I- I'm sorry. But you understand there was that dance- Yeah ... where you weren't really...
Now there's no more. It is what it is. " Is Qualys a tool of the cyber insurance agents, carriers, excuse me, to make sure that you are doing what you're supposed to be doing?
Or is Qualys a tool that the end users use that gives the cyber insurers a greater degree of confidence that you practice good cyber hygiene? I would say both, right? In both cases.
I think there's opportunities, and we're in the process of partnering with a number of insurance brokers and insurance carriers that we offer our telemetry in some way, shape, or form, so that they can understand the risk of that organization. Our total AI product is allowing for underwriters to get a better sense of what the deployment of these LLMs are. That's really important as underwriters start to underwrite AI, right?
They have standalone policies right now that they're issuing in the marketplace that solely focus on the use of AI. So I think there's an opportunity for Qualys to, obviously, partner with the insurance carriers. But also, from the organization standpoint, Qualys customers can use the reports that Qualys has to demonstrate to those brokers and insurers that they are a good risk, right?
So, for example, if they can demonstrate their MTTR and their average window of exposure is within an SLA that's compliant to what the insurance underwriter is trying to underwrite to- They may get better coverage terms, or they potentially could get better rates because they're demonstrating, to your point, that they are a better risk. I love it. We're almost out of time, but I want to come to the other piece of your role, which is not just cyber insurance carriers, but tech partners, technology partners.
I was in business dev and corp dev for a long time. I'm familiar. But for our audience, how does that role play out?
I think it's a blend, right? So when we think about technology partnerships within Qualys, there's an ecosystem of all of our partners that help support our enterprise true risk management platform, right? So we are partnering with a number of our partners here that address areas that Qualys never will, right?
So we have IoT, OT partners. Sure. We have partners that are developing mobile threat detection data that can be fed back into our platform, ETM.
Sure. All of those are very valuable data points to bring into the risk management platform to aggregate that and prioritize that, right? So when you're looking at, what am I doing with all of my signals, wherever they're coming from, put into ETM, they can demonstrate to their cyber insurance companies or their brokers more so, that they've covered all of the asset classes that they need to, and this is the risk that they have managed.
And more so, what do they want to transfer to the insurance companies, right? Yeah. We heard Sumed talk this afternoon or this morning about risk management.
There's risk acceptance, risk mitigation, and then there's risk transfer to those cyber insurers. Right. I think the technology partners play an important role of helping mitigate the risk and help transfer that risk.
There are a lot of vendors, besides end users, there's a lot of vendors who watch what we do. Maybe they want to partner with Qualys on this. What's their best on-ramp?
What's their best way to get involved? Well, come to ROCON, one. It's a great event, and I would say there's a lot of opportunities to network with leaders and folks like myself, just to get a sense of what's happening with Qualys and how we're partnering with the various different partners and technology partners to make our organizations and our clients better risk.
Excellent. Kimberly, we're about out of time. Yeah.
It goes quick. Thank you so much. Thank you so much.
It was my pleasure. Yeah. Keep doing what you're doing.
It's important work, and it's a great time to be doing it. Appreciate it. Okay.
I think we've got one more interview coming today on day one. And we'll be back tomorrow with a whole full day of day two. But you're watching Techstrong TV.
