Qualys CEO Sumedh Thakar Sees Autonomous Remediation Going Mainstream

Hey everyone. Welcome back here to our coverage of Rockon 2026 in Austin at the Fairmont. It's been a great two days.

We've spoken to so many people, and we've discussed so many things. My next guest is going to tie the bow around all of it, bring it all home for you to understand. I don't know if you recognize him.

It's Sumedh Thakar. Sumedh, of course, is the CEO at Qualys. He recently joined Qualys about 23 years ago.

So he's been here a bit. Sumedh, welcome back to Techstrong TV. Thank you, Al.

Always good to be with you. A pleasure. So first of all, congratulations on a great event.

Thank you. Another great... In many ways, I think this was the best, even going back to the QSC days and everything.

Yeah. Best event I've seen. I love the way it was laid out here.

I'm very happy to hear that. Yeah. And more importantly, I love the buzz, the energy- Yes ...

here today. It was palpable today and yesterday. Very good.

An interesting thing, I was talking to Ming Mitchell, CMO, earlier today. Yeah. And she was telling me that the composition of the people attending has really changed a bit.

Yes. A lot of C-level folks. Yes.

Right? A higher... Not that they're better than the rest of the people.

Yeah, of course. Yeah. But a lot of C-level, director level and above, number one.

Number two, a good percentage of the people here are not even Qualys customers. Yes. They're coming to find out.

Yes. Great opportunity, obviously, for Qualys. Is this on purpose?

Yes. This is definitely the evolution of when we moved from Qualys QSC, which was a more Qualys-focused event, to last year, we started to elevate this event to call Rockon, which is Risk Operations Conference. Was really about starting to elevate this as a more of an industry conference for risk management, so that different people, customers, not customers, partners, can come together and we can work together for the overall purpose of risk management.

Now, what was interesting is that we started the concept of a ROC and a risk operation center, and then the Rockon conference before Mythos came about. Yeah. And so after that, the buzz is really here even more because vulnerability management is back on a key agenda for all CISO.

Board members are asking that, and everybody knows that the math is not working in terms of the things being discovered versus things that we have to fix, which means operationalizing your cybersecurity program around risk management is really the focus. And so as we move to Rockon, we also kind of split the tracks in half the day to have a business track where CFOs, board members, CIOs, are out here talking about how to talk about risk to the board, how to talk about risk to your IT teams. And then there's a technical track.

And so because we kind of did that, we are seeing more people coming who are not Qualys customers. We are seeing more C-level executives are attending this for the business session because they are really trying to figure out, how do I communicate this with my CFO? How do I communicate this with my board members?

And so this is definitely, I'm glad to see that the message is resonating, and we're glad to see kind of what's changing in the way that people are doing things right now. So I'm very happy about that. Excellent.

I agree with you. Another thing I think unique to this year, though, you mentioned Mythos. AI's changed this whole thing.

And the case, a lesson I learned in doing venture-backed companies, sometimes it's better to be lucky than smart. Moving to a risk-based model- Yeah ... for vulnerability management right before something like Mythos hits is...

I don't know if you were smart enough to know Mythos was coming, but- Right. Well- ... it was definitely the right thing.

That's a great question. I get asked that all the time, is how do we come up with this ROC thing and remediation and all of that before Mythos came out? And I would say, obviously, nobody could have predicted the speed at which AI changed the world.

However, if you go back to the numbers the last few years, the gap between the number of exploits and things being detected was already widening significantly to the point where people couldn't fix it. Mythos just exponentially increased that gap. But we were already seeing that, I mean, look, at the very basic- The trend was there ...

if you have a million vulnerabilities, and you can only fix 10,000, you are taking a risk. Yeah. Now, the question is, are you taking it consciously?

Are you not taking it consciously? So we'd already started down that route of, like, a risk is not mitigated till it's actually remediated. Right.

So we could do dashboard tourism, we can build risk dashboards, but unless the process is going to that, of course, with Mythos coming about, but also the wider frontier models and SLMs, LLMs gaining traction is just helping us do a better job at figuring out that risk equation, what you should fix. And, I think it just turns out that the focus that we did with remediation before Mythos came out, the ability to do expert validation before Mythos came out. " And a lot of people didn't believe me at the time, and now we are down to- You're not the first person to shout that in the wilderness.

Right. People have been saying that for a long time. But when we did that, now 180 million patches deployed in the last 12 months, but 94 million of those are already autonomously deployed by customers.

So there is no doubt that there is no going back from some form of autonomous patching now. I think there's only going forward with it, not going to doing more. Yeah.

Exactly. I wanted to come back to the AI piece of this, though, because I've been talking for folks who have been following the coverage the last two days. I said this year at Rockon is really the year of native agentic AI.

Native agentic. Yeah. Now, I saw you in Vegas at Black Hat.

Yeah. Just a couple months ago. Was it three months?

Yeah. Feels like it was a year ago. Yeah.

It was three months ago. Yeah. But three months ago was the first time I saw you guys said AI Rock.

Yes. And now I call it AI Agentic Native. Yeah.

Talk to me about that. Well, I think AI being leveraged for significantly improving outcomes and security is a major boon to the defenders right now. And so, in general, SOC is after breach has happened.

You're looking at tons and tons of log data and threat intel to see if somebody's in the environment. I felt like there was an opportunity to build out a ROC where we were looking at risk management proactively. And if you look at the different processes that you have to follow in risk management, that is like you have to detect it, you have to add a business context, then you have to see the exploitability, then you have to send it to the remediation team.

So much of that has the potential of being simplified significantly with AI. And building out the new risk operations platform with ETM gave us the opportunity to build in AI natively in all of these workflows instead of building something and then slapping those things off later. So it just turned out that our time at which we started developing the ROC new platform for ETM was also the time when agentic AI had come about.

So we were able to create the concept of a AI SOC, where agentic SOC is helping you automate and autonomously do a lot of the workflows of the SOC. The same concept applies to risk operations. A lot of components of the risk management decision making process can be done by agentic AI and with a human in the loop or without a human in the loop.

And that's why I saw the opportunity to do something unique, and that's why that Agentic AI Rock is super important and super critical for anybody who wants to do risk management. Because ultimately, if the goal is that the shrinking timelines are pushing us to get the vulnerability remediated within 24 hours of the advisory, this is impossible to do it fully with a human approach. Yeah.

There's no way. So agentic AI has to help or do the whole thing itself. And so, that's really where we are excited about, that the Agentic AI Rock is something very unique in the way that it's helping that on the risk management side, whereas the AI SOCs are doing it more after the breach has happened.

I want to look at this, though, through a lens of economics. Yeah. Because look, at some level, risk is about money.

Yeah. Right? " Yes.

Right? How much is it going to cost? How much money is at risk?

The economics of remediation, if we can call it that, is something you're really- Yeah ... a professor on. Yeah.

Talk to us about that. And now it comes down to the economics of what you're talking about, is ultimately, nobody has... Cybersecurity is a risk management exercise.

Yeah. And you are managing risk for the business. And when you manage risk, you are mitigating some risk by investing money, you are accepting a bunch of risk.

Just by the fact you're not fixing everything, you're accepting risk. And the rest of the risk has to be transferred to cyber insurance company. That's the high level equation.

And with Mythos, with the volume going up, with the speed coming down, that has become even more critical that you know you're not going to fix everything, which means you're accepting the risk. And so now how do we become much smarter at knowing where we can accept the risk, where we cannot accept the risk, where we can mitigate, but then do all of that within that 24 hour period, right? And so the risk operation center is, that's why I always say it's like more than a CTEM.

A CTEM is just another dashboard, which is important dashboard. It's just one dashboard. But a CTEM that is not fixing, is not very helpful.

At the same time, a CTEM that doesn't bring the business context is also not very helpful from a business perspective. So the ROC is about the ability for us to have CRQ, CTEM, and remediation operations together. And so with that, if we can have that economic equation where more automation is getting rid of a lot of the risk safely and with confidence, then we don't need to rely on having to hire humans, et cetera, to do that kind of stuff, right?

But that's a journey that we are on. And so, we're working with different customers, partners to kind of go in that direction. Have we gotten to the point where you could formulize it, like have a formula of- Yeah ...

this is what my risk translates to money. Here's what it costs me to remediate. Here's what it costs me to remediate with humans- Yeah ...

versus AI. Yeah. And I could make this equation and make a decision based upon that.

Yeah. There's no industry standard formula because every organization's cost structure and how much it costs for remediation, et cetera, is a factor of the technology debt that they have, actually, right? Yeah.

So if they have a much more modern technology, they're able to take care of some of the stuff much quicker, faster. But at the very high level, the equation is pretty straightforward, right? Your security budget is a certain percentage of your IT- Budget spend ...

spend. And so now you have this budget, and you know you cannot fix everything. So the basic question is: What is the thing that you can fix within this budget that's going to reduce the risk the most?

So how many people can answer that question? Very few. People are doing a lot of different things and applying controls.

" Because we all know in the world of vulnerability management especially, you can fix 10,000 CVEs and make zero impact to the risk of a breach, or you could fix 33- One ... or one, whatever it is. Right.

And completely... And so that's where the main thing is, if I'm going to spend this dollar, where is the best that this dollar can be spent? And can that spend also, it's not just a volume question.

Can that spend also help me reduce the exposure time and by bringing more confidence in it? And by the way, that's not an AI thing. This is the same battle we've been, how do you get the most bang for the buck?

Yeah. With your- AI is just helping you, that equation. And sometimes the tokens are too expensive, sometimes they're not.

But yes, that's the- So it is that. The next piece of that, though, is that, so we're doing the remediations. Time is becoming more critical.

Yeah. Like you said, I was in a room listening to your press conference. Yeah.

If you could call it that. It used to be okay to wait 30 days. Yeah.

What's the big deal, right? Yeah. Now, it's gone from days to hours to minutes to seconds.

Yeah. That affects the economics here as well. Absolutely.

I think you're right. The economics of what you need to spend is directly related to the adversary's ability, right? And so if back in the day when attackers were taking quite a bit of time to create exploits from vulnerabilities, 30 days was a reasonable period because you were hedging on the fact that a 30-day open exposure was not enough time for an attacker to make a meaningful damage.

Now that exploitation timelines are reduced and adversaries have changed their window of exploitation, we don't have a choice as defenders, but to find a way to reduce that exposure ourselves, right? Right. And so I think that's where that drives the economics.

Now, does that mean if the volume of vulnerabilities has gone up 10 times, the cyber budgets have gone up 10 times? No. So the question becomes even more important is that- But that risk ...

given that this has gone up, I still have this amount of budget. What's the best way I can deploy this budget so I get the maximum risk reduction? And then there's side bets, if you will, right?

Yeah. Side bets of, look, no matter how many vulnerabilities we have, what percentage are actually exploited? Yes.

A tiny, tiny- Yeah, like less than 1% ... percent. Right.

5%. 5% that separates the winners from the losers. Exactly, right.

And that's where we could leverage AI to be able to get to that pretty quickly- Yeah ... by understanding context of the business. Because even if it's exploitable, doesn't mean it's actually exploitable in your environment.

And by the way, even if it's exploitable in your environment, doesn't mean you will have a loss that is meaningful, right? So that's the conversation of attack surface management or risk surface management. Absolutely.

Last question, I'll let you go. We're sitting here, it's October 14th, I think. Yeah.

Already? Yeah. October 14th, 2026.

I don't know where ROCON is next year, but it'll be around this time of year. Yes. What do you think is the biggest change by next year?

I think we're going to see a significantly more uptake of autonomous remediation next year. " So they have to have some form of a response where it's an approach that has a roadmap for autonomous remediation. And so I think that more and more organizations are going to get to the point where they're like, "Hey, this year we're going to looking at 20% to 30% autonomous remediation.

" And so I do expect that more and more conversations around risk management and more conversations around the confidence in autonomous remediation. That's one of the reasons why we released this ROCON, the concept of true confidence, right? Right.

Because the only reason we don't patch and remediate is because we don't have the confidence- Sure ... it will not cause an outage. So if we can bring that confidence back to say, "Look, I could do this remediation, and it will not cause an outage," then we will have more people seeing uptake of autonomous remediation.

And the only gating factor is not that automation did not exist. The only gating factor is that trust in the automation was low. So by bringing that layer of remediation intelligence on top of that, we're now able to provide them more confidence in autonomous remediation.

And of course, the more autonomous remediation we can do, we are shrinking the ability of that particular adversary to do more damage. Maybe they cannot exploit certain vulnerabilities that they need for the chain. So I do think that as we get here next ROCON, more people are going to be interested in the cyber risk quantification piece and then the autonomous remediation piece as we move along.

Absolutely. Thank you so much. Okay.

Thank you. It's always a pleasure to see you. Thank you.

Hey, I hope you've enjoyed that one. We've got a few more coming up here today at ROCON before we close out our coverage. But for now, we're going to take a break.

You're watching Techstrong TV.