Qualys Builds Confidence in AI-Powered Remediation

Hey everyone, we're back here live at Qualys's Rock on in the Fairmont Austin. We've had a great first day. I was looking forward to this next guest because I speak to him every year, whether it's RSA or Black Hat or Rock or the Qualys conferences.

Always a great interview, always a good person to talk to. He's my friend, Kunal. You say it.

Mudasiah. Kunal Modasiya. Kunal, welcome back.

How are you? I'm good. Thank you for having me.

It's so hard- Glad to be here ... it's so hard to get you on here. You're being pulled in a million different...

You're the most popular man at Qualys. Looks like it is. I'm getting pulled into different directions.

That's all the time. One of these may be our customer. No, I see.

I see people love you. It's a good thing, my friend. It's a good thing.

Thank you. Thank you for having me. My pleasure.

And likewise, all the time I enjoy having a candid conversation with you. Absolutely. So looking forward to it.

Kunal, I want to start off, not everyone has seen you on here before who's watching now. Give them your position, your background, how you got here. Yeah, for sure.

So, my name is Kunal Modasiya, and I'm senior vice president of product management here at Qualys. This is my eighth year at Qualys, and I am boomerang. This is my second time through to at Qualys.

Yeah. And as a part of my role, I have opportunity to lead all of the products here at Qualys, which includes working through the innovation, vision, strategy, go-to market. So, a lot of things to do, a lot of exciting things.

And we leverage our Qualys Rock on conference, plus the Black Hat and RSA to announce all of those innovations. And I work very closely with our customers globally. So every other week, I'm out traveling to meet customers and partners, because that's where rubber meets the road.

Yeah. Look, I live the same life and we both lived it a long time, right? That's the way it is.

I wanted to talk, Kunal, specifically today, about new product announcement at Rock on. Sumedh kicked things off this morning- Yeah ... and made the announcements.

You were there. Tell our audience about the new products. Totally.

Look, I mean, a bunch of the key innovations that we have announced today, and throughout the day, the product managers are announcing it. 0 version with a true confidence. Right.

That's new. That's new. That's brand new.

0- Right ... with a true confidence, which is AI powered remediation, intelligence, and orchestration engine. So this is the massive launch that we have done at this conference, and super excited to see the response from our early adopter customers and whoever we have been briefing, whether it is media, analyst, or customers, super excited.

Absolutely. Look, Kunal, I don't think you need to be a rocket scientist to understand that sometime around February or March, this whole agentic thing got real. Yeah.

Right? November, December, before that, the generative AI, those releases that came out, a leap forward. And then in February, March, or maybe it was the release of OpenClaw or around then, just agents exploded.

Everyone's using them for good and bad. Yep. To me, what I'm seeing here at Rock on from Qualys is the embodiment of that, right?

When you first announced Rock, first announced, not True Confidence, but TruCloud and of course now it's TrueAI. And TruConfirm and True Risk, and yeah. It was with a tip of the hat to AI, if you will, right?

Hundred percent. Acknowledging generative AI, certainly in a tip of the hat. 0 stuff is, I almost want to call it native agentic.

Would that be fair, or? Hundred percent, and you're spot on. You're spot on.

0 with a true confidence. Yes. And this is where I want to give our audience a quick overview of what the new launch is about and why are we calling it as a true confidence, right?

Yeah. So Alan, look at this. Finding the vulnerabilities is happening with the traditional tools since ages.

At one point, you were doing this in your time. 25 years ago. 25 years ago, right?

So finding the vulnerabilities has always been relatively easy. There are tools out there, there are startups which are going to help you find more exposures, more disclosures, more vulnerabilities. But the key question that always remains is that how do I reduce the risk?

How do I quickly fix them? How do I quickly remediate them so I reduce the material business risk to my organization as opposed to counting the vulnerabilities? So as we were thinking about, especially in the AI frontier model era, now the explosion of vulnerability has increased.

So there is no way that you can keep up the remediation at the speed of a disclosure. Mm-hmm. As we are talking to more and more customer, Alan, what we realize is that why they are not able to remediate at the speed and the scale that is needed in the AI frontier era.

And the key thing was blocker was never the automation. No. Automation was always available back in 25 years.

Yeah. It is available today. But a confidence before even applying the remediation, a confidence in finding out what is the right strategy, whether it is a patching, whether it is mitigation, whether it is a undeployment, uninstalling the software.

Where is the confidence? And- I'd use a different word than confidence. Trust.

Trust. And the trust factor, the confidence factor that, hey, is the patching right strategy? What happen if the patch I applied and after that if my business is disruption, if my critical banking application goes down?

So there was a confidence was almost zero, and that is why people were not doing the remediation at a scale. Right. 0, with a true confidence that is powered by AI-powered remediation intelligence and orchestration engine now brings the true confidence in remediating the risk at a scale and a speed that is needed in a AI model era.

So let's talk about that. Yeah. To me, this is the issue on everyone's plate.

It's AI scale. It's not that we couldn't find vulnerabilities before. Of course we could.

We couldn't do it at this scale. There were only so many people working on research. There were only so many people working on patches.

Quite frankly, there were only so many people working on exploits that would take a vulnerability and take the time to write an exploit for it, that you could use. So even though we might have found hundreds of vulnerabilities, a small percentage of them had real exploits. But now we live in a world because of AI scale, not every vulnerability, but most every vulnerability, you can have an exploit written.

There you go. And this is where the urgency kicks in. And that's what I'm getting at, yeah.

Exactly. You're spot on. And now because the attackers, the adversaries are able to take an advantage of the AI model and write those exploits in hours and launch the attack faster, the only way to keep up to the speed is to remediate faster.

And if you don't do it, remember, those adversaries are going to get into your environment and they are going to create a massive breach risk and get your business down. Yeah. Take it down.

By exploiting, take it down. Right? Absolutely.

So that's where that sense of urgency is there now. Yeah. Now, when the sense of urgency is there, but still people are not remediating at a scale, and this is where more and more we spoke with the customers, they never brought the automation as a blocker.

They never. All they said is that Is this patch a high reliability patch? If I apply, what happens?

Can I do the ring-based job? Oh, but I don't want to do the patching. Can I apply some mitigation?

Can I apply some network segmentation at the firewall level in my data center rather than deploying the patches? Where do they gather all of that intelligence with confidence? With the confidence that before the remediation and after the remediation, there will be operational resiliency, that my business application will not crash down.

Absolutely. 0 with the true confidence. But you said something that's really important, I want to make sure the audience understands.

Not all remediation is patching. There you go. And that's an important thing, because I remember years ago, it would take 90 days at a large enterprise, a large bank, to roll out a patch for a Microsoft Patch Tuesday.

90 days. By the time that patch rolled out, three more Patch Tuesdays had passed. In today's world, AI scale, we can't afford that.

So when we talk about remediation, you hit on some of it. Network segmentation at the firewall. There are other remediation.

You could, using IP addresses and switches and everything else, you can make the asset not reachable. 100% agree. There's a- So I'll tell you, when it comes to remediation, what organization need is a very comprehensive strategy in a place, and you are right.

Patching is not always the right solution. No. And when you want to patch it, it involves the multiple team, multiple assets owners, multiple different department.

So it gets into the cross-department dynamics. Yes. But when you look at the remediation, to your point, patching is one part, but before that, can I apply some temporary mitigation by turning off the code, turning off the service, or bringing down that IP address, put it in a private zone?

All of those mitigation you can apply. Second, let's say for example, you have outdated Java version software. 0, whatever.

Okay? And nobody is using in your organization today, but it is deployed. Right.

And it has some exploit vulnerability applicable. Instead of patching it, if nobody's using it, and there is no risk to any of the application because nobody's using it- Right ... okay, why would you not uninstall that?

Because uninstalling that would actually help you reduce your license cost- Clean it up ... clean up your tech debt, and reduce the risk. Absolutely.

Now think about it. When you think about remediation, uninstalling the outdated software is equally important. You should not neglect.

If nobody's using it, no application is using it, it's not even accessing last one year- Good enough ... just uninstall it. Listening to you, I'm thinking of my wife- I see ...

in the garage. We got boxes we haven't opened in years. There you go.

And I say, "What? It's taking up room. If you don't even know what's in here anymore, we have-" There you go.

" Exactly. Exactly. And then- It's the same thing ...

same thing. And then think about it. Let's say you have a application which is vulnerable to the new exploit.

Now, instead of isolating or blocking the entire machine out of network, which could actually lead to some business disruption or employees' productivity, instead, they should think about how do I block only the suspicious application or the application which is at a risk? So when you think about the remediation, you have to think through as a comprehensive risk reduction strategy- Yep ... and not just the patching.

Patching is just a one part of it. Absolutely. And I think that really is the important thing.

We only have a few minutes left. 0, how people can get on the on-ramp here to start testing it out. I was talking earlier about shadow AI, and I know Qualys is now offering free.

You can get a report about what AI is- That's my team only, and I came up with an idea of giving the shadow AI free. What a great idea. Just- But I want to talk about the True Risk Eliminate, the new features- Go ahead ...

and what's on the ramp path for my customers. 0 with the true confidence has four major new capabilities that we are adding it. One, as you said, agentic AI, the Agent Sarah.

Yes. I saw the pictures. Yeah.

As you see, a lot of display ads and all of- There's a few agents. Sarah's one of them. Sarah is one of them.

And so Agent Sarah helps you in planning the different remediation strategy, whether the patching is right one or mitigation or isolating or uninstalling the software. You need a digital worker who can help you gathering the intelligence and planning. At AI scale.

At AI scale. And then Agent Sarah then comes and takes your permission by clicking a few things, and then Agent Sarah will orchestrate and execute those remediation at scale while you are grabbing a coffee or while you are on PTO. Good.

So that's the first major capability, which is Agent Sarah. The second capability is that organizations have a network devices like a load balancer, firewall, IPS, IDS, where typically they don't deploy the endpoint agent. So sometimes then patching is not an option because it may reboot the machine, and nobody wants to reboot their firewall.

Right. Because it's going to cause the network outage for an organization. 0, we are able to apply the custom mitigation.

No patch. Custom mitigation that our team has researched and developed for the network devices without requiring the reboot. Now they can mitigate the risk on a network devices.

So that's the second major capability. Mm-hmm. The third major capability that we have added is the AI-powered remediation intelligence with a patch reliability score and a patch failure analysis.

What does it do? Before we recommending you deploy the patches, we give you the AI-powered reliability score that whether this patch, how reliable it is: low, medium, high. Based on that, Agent Sarah again will recommend you that, hey, it's a high confidence, high reliability patch.

You should deploy it on your Chrome browser and all, because even if Chrome browser is crashing, there is zero impact on the business. Right. And the last one that we are announcing is the operational resiliency element, where we are announcing the partnership with the Dynatrace, which is our launch partner.

So Dynatrace is a application performance- Familiar. We, they're a customer of ours. Yeah.

They are your customers, right. So what we are doing is now before... And again, this goes back to the true confidence theme.

Before customers are deploying the patches with our Dynatrace integration, we are taking the system health parameter on which machine we are applying the patches, for example, network, CPU, memory, and many other hygiene parameter. Then we roll out the patch in a ring base. We deploy first on the lab.

And then we go to the Dynatrace and we ask post-patch again the operational metric and say that, "Hey, before and after, is it causing any instability? " Right. Then if it is true, then we move to the production environment.

This is where we are helping you maintain the operational resiliency by partnering with the Dynatrace. And if we notice that after the patch is deployed, something is wrong with the indicators that are coming from the Dynatrace AI, then we start rolling back. 0 with the true confidence.

All of our existing True Risk Eliminate customer, which are 3,500-plus customer worldwide, they get a free upgrade. When I say free, they are absolutely free. For our existing True Risk Eliminate customer, it's free, it's included.

So for them, we are a SaaS company, so it automatically will be updated in the next two weeks as we announce. We are going GA by end of this month. Love it.

All of that is live. The press release for this is out. com right now.

com and you get to see everything. So yeah, super excited with the Eliminate launch- I am, too ... with the true confidence.

Remember, automation was never the blocker. Trust us. It was the confidence.

Trust. Confidence and trust. It was the same thing.

We originally tried to do IPS from IDS. It was the same thing. They wouldn't let us block the traffic.

There you go. They were afraid they were going to block good traffic. There you go.

There it is. Vinod, my friend, always a pleasure. Thank you so much, Alan.

Always a pleasure. Thank you. Hey, this is one of my favorite interviews every year at Qualys, so I hope you're enjoying it.

We're live here at QualysCON. We're going to be back with more. Stay tuned.