Qualys ETM Audit Brings Agentic AI to Audit Readiness
From Technical Controls to Full Audit Readiness
Security threats get most of the attention, but audits are not going away. Anu Kapil expects AI to make compliance harder as new requirements arrive. Kapil is director of product management for compliance solutions at Qualys. She joins Alan Shimel at Qualys ROCon 2026 to introduce ETM Audit. The new product line is built for continuous audit readiness.
ETM Audit extends the Qualys ETM and Risk Operations Center platform. Qualys Policy Audit already covers technical controls. ETM Audit adds procedural controls, such as policies and expiring documents. Together they give teams a complete view of where they stand before an auditor arrives.
Agents That Share the Same Findings
Shimel calls this year’s event agentic native. Kapil explains how that plays out across the platform. Qualys now organizes its offerings around outcomes rather than individual product names. Agent Insta detects issues, Agent Val validates them, and Agent Sara fixes them.
Agent Audit picks up from there. It takes the fixed findings and maps them to compliance frameworks. Customers can also build their own agents in an agentic studio, with human approval built in.
Shimel argues that approving every agent action will not scale. He prefers a model he calls human at the helm. Kapil agrees. In her view, agents should prepare a plan and a summary for review. Teams can then let the agents carry out the work on their own. Otherwise, she says, the work might as well stay manual.
Keeping Up With Parallel Audits
Most enterprises run several audits at once. That leaves teams torn between responding to threats and preparing evidence. ETM Audit connects security data to those audits automatically. The goal is continuous audit readiness rather than a scramble each time an audit begins.
The product is not generally available yet. Kapil says many customers already serve as design partners and beta users. Others can contact Qualys to join the beta and share feedback. That input will help shape the product before its full release.
Transcript
Hey everyone. Welcome back here as we're wrapping up our day one coverage of Qualys Rock On. Our last guest of day one, this is her third time on Techstrong TV here, so it's great to have her back.
Anu Kapil. Anu, welcome back to Techstrong TV. Thank you.
It's my pleasure to be here. So we were talking before we started, the camera's rolling. I think the first time we interviewed you, you had literally just joined Qualys.
Yes. You were really new. And here we are two plus years later.
You were still doing product management, but your role has changed, the products have changed over those two years. Yes. Tell people a little bit kind of what your history here has been.
Yeah. So I've been with Qualys for a couple of years now. I moved to product management three years back.
I've been working with Policy Audit, that's our core product in compliance, and now I'm the director of product management here. I look at all the compliance product and very happy to be here talking about ETM Audit, that is our new line of products. And ETM Audit is an extension of our ETM ROC platform.
Mm-hmm. Which going to help customers be audit ready in 100% manner. Whereas Policy Audit today provides you just your technical controls, ETM Audit is also going to provide you your procedural controls, policies like, do you have these contractors, your documents are expiring, everything, like a complete audit readiness view.
So very excited for this new product line. Yes, it is. I was talking to Kunal earlier, and I was telling him, I really feel that at this year's Rock On, things are agentic native.
Yes. Right? I think in previous years we saw AI- Mm-hmm ...
starting to have an influence. I think we were working with generative AI for doing certain things, but now this is agentic native. Yes.
We're recognizing that not only are our customers using agents that we have to manage and secure and all of that, but Qualys themselves are developing agents- Yes ... that are going out and doing work. And of course, the bad guys- Yeah ...
are deploying agents that are malicious. So we're in this agentic age now, for sure. Yes.
How is that manifesting itself in the products? So all the products are very interconnected. We don't see it as product.
If you even see, we have moved from individual product names to how we can help customer with the outcomes. That is your AI speed detection with prioritization and remediation. And we have Agent Insta, Agent Val, and Sarah that completes this entire loop.
It's very tightly integrated. So, even with the audit readiness, your Agent Audit is going to use the same findings that have been fixed by your Agent Sarah, validated by Agent Val, detected by Agent Insta, is going to take all your findings, what's fixed, and map it to your frameworks and give you a continuous audit readiness. So you have this agentic studio where you can even build your own agent and use them for autonomous tasks, of course, with a human approval ingrained in that.
Oh, and that's an important thing, right? Human in the loop. Of course.
Human approval. Now, I spend a lot of time talking about this, as you would imagine. I think as part of this agentic native kind of move that we're making, and things start moving at AI scale, it becomes very hard for a human to approve every single- Yep ...
a move by an agent, by a platform like this. And so that human in the loop that has to approve every step forward doesn't scale. Yeah.
And I think we need to move, humans have to abstract one layer up. I call that human at the helm. Mm.
So rather than in the loop, they're managing the whole process here, but things can move. Yeah. And if humans see something, they can step in.
That's true. Right? I think that's, again, an important evolutionary step that kind of sets us free to go faster, to automate more, to move at AI scale.
Absolutely. I totally agree. Even when we say human approval, we cannot have Agent One coming back.
No. Then it's not really autonomous. Ideally, agents prepare a plan, give you a draft summary, kick off other agents, you just review it, like as a summary, at the start of the day, and let the agent call other agents, do the action in autonomous manner.
Otherwise, it's not going to kick up, right? You would rather do it manually. So that's how we envision how the agentic studio and agents are going to help you do that.
I think that's an important thing to remember. Yeah. You mentioned another thing, Anu, and that is, rather than this like siloed product line, things are now starting to come together sort of organically, holistically in terms of this is what we use to solve this issue, or this is what we use in this area.
It's a new way of looking- Yes ... at solutions. Yeah.
Right? " Right. But now we're really getting to the point where we're selling solutions integrated.
Absolutely. Totally agree. In your role, how does that change your role?
Or how does it make it better, worse? I think it's making it better rather than just coming up with a new feature or a new product that customer may not use, and nobody wants to buy a new product every single day. Everything fits very organically into ROC.
ROC gives you a vision of how the entire platform should be. Where is your risk prioritization detection, and at the end, where your compliance fits. So it's all organically coming together so that you don't have to look at products individually or in a siloed manner.
It's very tightly integrated. And we look at how customers want it, how they're going to keep up in the AI era, because now things are changing really fast. Yeah.
It's changing. You have to keep up. And manual things, manual actions, siloed processes, tools, they can't keep up with that.
So- Agree. Now, you've demoed this, actually probably beta... Well, let me back up.
The product is not available today. It'll be out by the end of the year. Yes.
We want to be clear about that. Yeah. But you are already showing the product to customer advisory boards, demoing it at the sessions today.
What's the feedback been like? We have been getting the feedback since last one year when the vision of the product was defined. Now the product is already going to be out there very soon.
Customers are very interested because I do understand security vulnerabilities attacks, but audits are not going anywhere. And with AI, compliance is just going to get harder. You have to keep up.
And with AI, new requirements coming, more and more requirements are going to come up. So you have to have a product which builds in everything together, so you can focus on your vulnerabilities and attacks, while a product like ETM Audit, blended into your ROC strategy, can autonomously make sure that you're always audit ready, and you don't have to bring teams together anytime there is audit. And most of the enterprises don't have one audit.
They're always running multiple audits in parallel. So it's very difficult for the teams to keep up, whether they focus on your attacks or cyber threats, CISA, all of these changes, or they focus on the audits. So that's why people are looking for a solution like ETM Audit where they don't have to have siloed product that your security solution is here, but your compliance or audit is somewhere else.
So ETM Audit brings your security data, automatically connects that to your audit, and makes sure that you're always audit ready instead of just one day of audit when the audit shows up. I love it. If people out here are interested in this, we mentioned it'll be out by the end of the year.
Where can they follow along to know when it's out and read more about it? So a lot of our customers are already our design partners and our beta customers. And what we have been saying, you can contact the sales, you can contact us.
We would like to onboard you and get your feedback on the early beta product and see how that can help and how we can improve the product while we plan to go G next year. We love it. Anu, I hope to see you for your fourth interview soon.
Of course. All right. Hey, that's going to wrap up our day one coverage here at Qualys Rock On.
As I've said a few times, to me the theme is agentic native. And it's not just Qualys. I think we're seeing it across the board in cyber, in technology, and even broader in just our everyday lives.
Yeah. We're going to be back tomorrow. We've got another full day of Rock On coverage.
Stay tuned for that. But for now, this is Alan Shimel. We're out.
Thanks for watching Techstrong TV.
