Qualys InstaScan Closes the Vulnerability Detection Gap
New Exposures Cannot Wait for the Next Scan
A vulnerability disclosure does not wait for a maintenance window. That timing gap drives this Qualys ROCon 2026 discussion about scanless vulnerability detection. Himanshu Kathpal explains how InstaScan uses existing telemetry to identify potentially affected assets without launching another scan.
Kathpal, vice president of product management, platform and technologies at Qualys, joins Alan Shimel to explore the approach. Their conversation examines why scheduled scanning can leave security teams behind emerging threats. Faster detection gives remediation teams more time to act before an exposure becomes an incident.
Turning Existing Telemetry Into Timely Findings
InstaScan correlates new vulnerability disclosures with asset information already collected from Qualys and third-party tools. Instead of checking every machine again, it evaluates the software, versions, and context already available. Kathpal describes this as a way to surface relevant findings within the first hour of disclosure.
AI plays a central role in making that information usable. Different tools often describe the same application or operating system in different ways. Kathpal explains how normalization and contextualization help reconcile those differences. Agent Insta then continuously monitors disclosures and connects them with the organization’s inventory.
Confidence scoring is another important part of the process. Kathpal says findings must meet a confidence threshold before they are flagged. This helps address the false positives that previously limited similar approaches. Subsequent scanner results, agent data, and third-party feeds contribute additional evidence.
Prioritizing What Actually Needs Remediation
The discussion extends beyond scanless vulnerability detection to the decisions that follow it. Kathpal explains how Qualys Enterprise TruRisk Management considers protections already in place. Firewall policies, endpoint controls, and other safeguards can influence which findings deserve immediate attention.
He also describes TruConfirm’s role in validating whether a vulnerability can be exploited within a specific environment. That additional context helps teams distinguish theoretical exposure from a more urgent, actionable risk. The goal is a smaller, better-supported remediation queue rather than another long list of alerts.
For security leaders, the interview connects continuous visibility with practical risk reduction. Detection, prioritization, and remediation must work together rather than operate as separate steps. Kathpal and Shimel explore how AI can shorten that cycle while preserving confidence in the findings.
Transcript
Hi, everyone. We're back here live at Qualys Rock On in August. In August?
It's not August, it's October, but we're in Austin. And thanks for continuing our coverage today, and thanks for joining in. My next guest is Himanshu Kathpal.
Did I get that right? That's correct. Himanshu, I've interviewed Himanshu a bunch of times, actually.
But I've been doing these Qualys shows for a long time. Yeah. It's funny.
No kidding around. We were talking about it. Usually, you two come right after Kunal.
Yeah For whatever reason. I guess they make up their schedule. That's how the flow is.
Yeah. That's how they wrote it. But anyway, Himanshu, this camera here is on you.
Uh-huh. Tell the audience a little bit about your role and how you got here. My name is Himanshu Kathpal.
I'm the VP for products at Qualys. A big part of my role involves meeting cybersecurity leaders across the globe, talking about cybersecurity, talking about what Qualys is doing so that they can operationalize their cyber risk management in the AI era. I'm leading Qualys ETM, VMDR, ETM Identity, bunch of Qualys products so that we are ahead of the attackers, and we are making sure that our customers are safe, they are able to reduce their cyber risk.
I love it. How did you come to this? You've been at Qualys a while now.
Eleven years. Yeah, a long time. Yeah.
And you've seen a lot of changes in those 11 years. Yeah, absolutely. And it's been- Absolutely ...
and not just Qualys. Yeah. The whole security industry has changed.
Absolutely. But I think you know this. I've known of Qualys since 2002.
Yeah. Philippe Courtot, rest his soul. Yeah.
Founded the company. Yeah. I had helped co-found a company that was a competitor.
Uh-huh. " This is before there was a cloud. There was nothing.
Yeah. Philippe was keeping it in a server. Yeah.
I wonder where that server was. Well, in cloud, cloud was not even a thing. Right, exactly.
There was no cloud. For all I knew, he was keeping it in his closet. Yeah.
That's funny. But over the years, the model has played out. Yeah.
But here's one of the things that has been constant since then. Yeah. Scanning.
Yes. People hate- Yeah. It's going to slow down my network.
Yeah. It's going to make latency. Yeah.
I got to do it during a window, a maintenance window. m. But you know what?
m. is not a real- Yeah ... not a real time where we're seeing the real traffic- Yes ...
and everything else. But nevertheless, getting people to scan regularly. Yeah.
Even though Qualys kind of pioneered automated scanning. Yeah. Scanning, working around schedules.
Yeah. People still... Fear it.
Yeah. But now you guys announced something new today. Yeah.
InstaScan. InstaScan. Tell me, what is it about?
You're absolutely right. And the reason why we were looking towards InstaScan was the disclosures that are happening that are not tied to a cadence. Even if you're the world's best agents in the scanner mechanism, you still work at a cadence.
You will still scan, let's say, at midnight. What if the disclosure- Exactly ... m.?
We are already 19 hours behind. Yep. And in a world where, in minutes, you're seeing exploits- Yeah.
Absolutely ... you can't afford that. The people who set the rules have already changed their goalposts.
Now they're asking for 24 hours remediation on external assets where the vulnerabilities are exploitable. That is where we are working for the last couple of years on something called InstaScan, which we just announced. So with InstaScan, all of your worries about having to scan again, worrying about the maintenance window, worrying about whitelisting, goes away.
Based on the existing UR asset, threat telemetry, we are going to correlate to the new disclosures that are coming out. All of this happens in real time manner. Based on your existing telemetry, we'll compare it against the new disclosures, and within the first 60 minutes itself, we'll tell you whether you're impacted or not.
That's fantastic. To give you a couple of real world numbers, last Patch Tuesday, even though our claim is 60 minutes, we were able to provide the information to the biggest bank of the United States in 13 minutes. Wow.
5 minutes. Wow. Now imagine, in the past, it took people a month- Oh, weeks, I know ...
to get their Patch Tuesday disclosure, right? Now you're getting it- And by the way, yesterday's Patch Tuesday disclosure was what? Yeah.
1,500. Yes. They shattered all records.
Crazy. Yeah. It's crazy.
So four and a half minutes. Yeah. 1,500.
Yeah. That is nice. Yeah.
I'm reminded, so besides the vulnerability scanner in my company that I founded- Yeah ... we were pioneering something called NAC. Yeah.
And with our network access control- Yeah ... we used to advertise scanless scans. Yeah.
Agentless scans. Yes. What it really was is we were going on a machine- Yeah ...
grabbing your registry- Right ... and keeping that registry. Yeah.
And then when you came back on the network- Yeah ... we would just compare registry changes. Yeah.
I didn't have to really scan it. Yeah. This is what your registry was.
Yeah. This is what your registry is. This is update.
It's a diff. Yeah. In some ways, this kind of reminds me of that.
It starts with that, but a majority of the workflow that we have changed is a lot of efforts has gone into building an AI model which enriches, normalizes, and contextualizes the data coming from Qualys and third party tools, because every tool is giving the information about the software's operating system in different format. 1. 1.
So the normalization of the data is where a lot of AI compute is being spent, a lot of models are being built. And then the backend agent that we have agent install that continuously analyzes every public disclosure which is happening. So it doesn't run at any schedule.
It continuously does it 24 by seven. So these are the two major differentiators that I would say, because now based on these agents, we are mapping the information that you currently have based on the industry standard CPs, the package URLs, and that, I would say, is the core innovation or the core intelligence that Qualys platform is able to add, not just based on the data. Let me see if I say this correctly.
You've almost turned the equation on its head. Yeah. Upside down, right?
" Yeah. "I know what your assets are. I know what you're running on those assets.
" So I have that continuous telemetry feed into a database. Yes. Instead of getting a vulnerability and then running it against the machines, there's no need.
Yeah. " Yeah. I look at my telemetry, pick out the devices that match that profile.
Uh-huh. Remediate. Precisely.
And the best part is- Brilliant ... and the best part is when your next scanners, either via scanners or agents or your third party feeds coming from CloudStrike or your manual pen test results, we merge that data. It's all great.
So that the information becomes more as what- It's all telemetry. Yeah, it's all telemetry. Why now?
How come we couldn't do this before? We were trying to do it, but the problem earlier was around the ratio of false positive. We do not want to release something that would create a false sense of urgency.
But now with AI, the models are so trained that now we have a confidence score behind each finding. If it passes the threshold of our confidence score, only then we flag the vulnerability. Otherwise, we skip it.
And that is more important right now because, as I was earlier saying, the people who are setting the rules have changed their goalposts. Right. If you have to do 24 hours remediation, you cannot spend 12 hours just for the detection.
No. You have to detect and prioritize within the first hour so that your patching team has 23 hours to actually fix it. So we were talking with Kunal earlier.
Yeah. And we talked about true confidence. True confidence, yes.
But that's always been the problem here. Yeah. People, they weren't sure of was there a false positive?
Yes. Was it, do I really need to do this? Yeah.
And it's amazing that with AI, we're able to do this now, right? Yeah. We can say, "I can tell you for sure," or with a very, very high degree- Absolutely ...
that this is where you are. Yeah. And so this is a case where AI is truly helping us- Yes, exactly ...
bring something that we haven't been able to do before. Correct. And now within ETM, we do not stop at the detections.
What we do is any of your- Yes ... existing mitigations that you have already applied, because as a company, you would have invested billions in your firewalls, your EDR controls, your host-based controls, your identity controls. So all of these controls are taken into consideration.
Then we map it to the CVs and the vulnerabilities that you have. If there is a control that is going to protect you from a vulnerability, we provide you that information, lower the score of that finding so that it doesn't come into your priority list. Got it.
For example, if it's a memory related vulnerability, you already have memory protection enabled in your EDR. Why prioritize and fix it on immediate basis? That is taken into consideration.
And then the last part before you actually remediate is the part where we actually validate whether something can be exploited in your environment or not. Because you might have configured something. How do you really know if that configuration is correct or not?
Is there a way that attackers can bypass my configuration and still exploit a vulnerability in my environment? So with True Confirm, we do that. We try to exploit a vulnerability in your environment in a benign way.
If we are able to do it and go to an extent that we are able to confirm that attacker will be able to exploit it, we flag that vulnerability as exploitable. Got it. This ensures that you are prioritizing only bare minimum things.
On average, people do prioritize only less than 1% with Qualys now. Less than 1%. Wow.
And then with True Confidence, which Kunal was talking about, they got the confidence to patch it as well. So the dream of that 24 hours remediation is now becoming a reality with Qualys. Repeat that word again.
Dream. Dream. It's been a dream- Yeah ...
for 25 years. Crazy. Absolutely.
I lived to see it. Yeah. This is all available now or very shortly.
It's all available now. On the website right now. It's on the website.
It's in production. We have hundreds of customers already leveraging it. In fact, the funny thing is, we had this product advisory board yesterday where we invite our key customers, the CSOs, the security leaders.
So I was giving a demo of InstaScan, and while I was giving a demo, the Patch Tuesday disclosure happened, and within the first five minutes, it got flagged on the customer's environment. That's amazing. And then he gave a demo for me.
Yeah, that's beautiful. Yeah. What a great time to be in this business, man.
Exactly. I love this. Thank you so much.
InstaScan. com right now. Hey, we're live.
We still got more to go here on day one. Stay tuned. You're watching Techstrong TV.
Thank you.
