Qualys Makes the Case for 24-Hour Remediation

Hey everyone. Welcome to our coverage of Qualys Rock On 2026. We're here at the Fairmont Hotel in Austin, Texas, and I have to tell you, I feel a little deja vu.

It's because I was here last week, of course, for the Cisco Webex conference. But we're on a different floor, different set. Really happy to be here.

We've covered the Qualys security conferences now for, 10 years or so, so it's not our first time. So I'd like to introduce you to our first guest kicking off our coverage this year, Vivek Bhandari. Vivek, welcome to Techstrong TV.

It's great to have you here. Thank you, Alan. Thank you for having me, and I'm looking forward to our conversation.

Absolutely. Before we jump into security talk- Yeah ... give our audience a sense of who you are, what you do in Qualys, kind of your background.

Oh, yeah. Absolutely. So, hi everybody.

My name is Vivek Bhandari. I am the vice president for product marketing and go-to-market strategies here at Qualys. I've been at Qualys for a little over a year, year and a quarter or so, but I've been in cybersecurity for well over 20 plus years, working at many different companies.

Mostly building cybersecurity products like web security, email security, anti-phishing. Big and small companies like VMware, Google, Cisco. And then building products, leading product management, and then more recently doing product marketing.

Really taking all the amazing innovations that our teams are building and positioning and messaging these for customers that directly helps impact their business objectives. Excellent. So Vivek, I should mention, you're hosting a panel here at Rock On.

Yeah. Tell the audience a little bit about your panel, maybe who your panel members are. Oh, yeah.

Absolutely. So yes, I am hosting a panel this afternoon, and my panelists are two gentlemen from companies I think everyone's probably heard about. Sony Music.

It's a global company. They sign a lot of these artists, and then they, of course, distribute music out through your favorite digital platforms, Spotify, Apple Music. So we've got Sony Music on and we've got Revvity, which is another enterprise.

And these two gentlemen effectively lead security teams where they're responsible for reducing the risk in the environment. And the conversation is going to be centered around what's really top of mind for a lot of the security folks today. In the age of frontier AI, as more and more exposures are coming out, vulnerabilities are coming out.

That's okay. Volume is one thing. That's not the challenge.

The challenge has been the attackers are now shrinking with AI, how quickly they can exploit these vulnerabilities. Yes. It used to take them weeks, Alan, months before, and now it's hours.

Because now with AI, you can so quickly identify an attack path to get to a vulnerability, weaponize it, and effectively infiltrate a network. And so the game really has shifted from the zero-day disclosures that we have talked about for decades now, like zero-day vulnerabilities. But now it is zero-day remediation.

From the time you actually detect these vulnerabilities in the environment, and if they are exploitable by the attacker, reachable with a valid attack path, how quickly can you fix them and mitigate your risk? And that's what we're going to be talking about in terms of how these companies have really championed and blazed the trails on dramatically reducing their time to remediate. Right.

Which has always been the end game. Yeah, no, meantime to remediation has always been a metric that we track, right? Exactly.

But Vivek, we were talking off camera. I first got involved in vulnerability management, I think, in 2003. Yes.

Qualys was a new company. Philippe Courtot had recently started, maybe two to three years before that. Right.

We had the same problem then. Even back then- Right ... we were finding more vulnerabilities- Yeah ...

than we were able to remediate. That's right. And the problem has only gotten worse in this post-Mythos world, right?

We now have 10X, 100X more vulnerabilities were being found. We're finding more vulnerabilities than we could issue CVE numbers, let alone put patches out. Absolutely.

Uh-huh. I think Sumed on the stage this morning- Yeah ... keynote, this month's Patch Tuesday, Microsoft was like 1,500.

Nearly 1,500, yes. And record-breaking. But it's been record-breaking every month since Mythos came out in April.

Yes, absolutely. So when does it stop? And it's not just Microsoft.

I'm not here blaming Microsoft for being insecure. Every software vendor. So across the board.

Across the board, as you say, yes. So to me, this presents a fundamental shift in the security puzzle. Finding vulnerabilities isn't the issue.

Fixing them is. And when we talk about remediation, a lot of people think of patching. Yeah.

Patching's one piece of it. Right. But in order to apply a patch, you first have to test the patch.

Does it break anything else? Right. Does it indeed fix the vulnerability?

How hard, or how do you have to deploy it across an enterprise? How many nodes does it go on? All of these things.

Yeah. In your panel today, you don't use the word patching. You use the word remediation.

That is correct. Let's distinguish that for the audience, when we talk the difference between patching and remediation. Really good point there.

So I think before we talk about the remediation buffet. Because there's more to it than just patching. Right.

I think as you said, the volume of these vulnerabilities has gone up, and we've always sort of never fixed everything, right? There's always a debt, there's always a growing backlog. But did you know, Alan, that of all the CVEs and vulnerabilities that get discovered and disclosed, how many actually get weaponized by attackers?

Like 2%, 1%, or less. Absolutely nailed it. Yeah.

About half a percent. Yeah. So of all these, I think in '25 we had nearly 50,000 CVEs.

Just a few hundred got weaponized. Yeah. And so out of the ones that get weaponized, which are really the ones that attackers have using to exploit, not everything is exploitable in a customer's environment.

Right. Because you have compensating controls. You have firewalls and WAFs and EDRs and other things in place- Segregation ...

which can block it. So not everything that is exploitable also needs to be fixed right away. So when we talk about remediation, there's a distinction to be made, and that's why I think this is the dawn of 24-hour remediation.

You don't have to fix everything that you find right away, but you have to fix, in today's day and age, that is truly exploitable in your environment. So you might find a million of these with the latest scan, but it might be just a few hundred that are truly reachable with an exploit path, that an attack path that an attacker can use. So now you found the ones that are creating all the risk.

Now how do we remediate? Back to the question, the fourth part of the question. Patching has always been, but patching is not always the right answer.

I think the first step is to go mitigate it. And mitigation means you don't have to deploy a patch. There can be many different approaches to mitigation.

And so the first thing, do the minimum. Find the least ones that you need to fix first, which are creating all the risk. Apply a mitigation if there is a mitigation.

If there is a reliable patch, apply the reliable patch. And a lot of the mitigations or non-patching options can include things like custom scripts, uninstall. You see a lot of the times out of date, out of sale software that's there that's creating risk.

And so there's a whole buffet of remediation that Qualys provides for customers that ensures that you can actually take the remediation action confidently. Because guess what? What is more scary for a business or a security leader when they're trying to remediate?

An outage. Outage, yeah. Because if you make a change and it causes an outage in a business critical application- The old story ...

and imagine if I'm a retail or some other business. Is the cure worse than the disease? Exactly.

Now that outage can be far more damaging, and so nobody wants an outage. And so the confidence of what remediation you apply becomes really important and at the heart of being able to remediate things faster. Yeah.

And this has always been the problem. We don't want to apply a patch till it's thoroughly tested to make sure it doesn't break anything bigger. That's right.

Let me play devil's advocate a little here. Yeah. You're right.

Less than 1% of vulnerabilities are weaponized. Yeah. I would posit that the reason for that is the same reason we couldn't find more vulnerabilities.

There's only so many bad guys in the world, and how fast can they weaponize? Yeah. In a post-Mythos world, time from vulnerability discovery to exploit in the wild has gone from months, weeks, or maybe never- Yeah ...

to hours, minutes, and even seconds. That's right. Right?

At the same time the AI finds the vulnerability, it could kick off a cycle to exploit it and weaponize it. Right. So we're going to be, and we already are probably, in a world where I think that half percent number unfortunately is going to go up.

Possibly. You're absolutely right, because AI has democratized the ability to weaponize more of the long tail, so as to speak. It's the same AI that is 10X-ing, 100X-ing vulnerability of discovery- Can help ...

is 10X-ing the weaponization apparatus. Right. So the only answer has to be it has to 10X, 100X our remediation- Correct ...

abilities as well. And how do we do that, right, Alan? I think that's what- Well, that's the big question.

That's the question, and I think that's what a lot of the people are figuring out now. I imagine the budgets aren't growing for a lot of the security managers that are responsible for finding and fixing these. It's not like they can go and hire an army of experts to do that.

And so what is the right answer? Nobody's saying that the answer is hire more. No.

Right? Budgets are not growing that fast. Well, if attackers are using AI to combat, we have to use AI to be able to defend.

And so using AI to speed up remediation confidently, keep in mind, without causing a disruption, is the simple strategy here. Yeah. And that's effectively what Sumedh also announced in the keynote today, this true confidence.

Because the challenge, as I said, with always remediating is confidence, right? If I make a change, will it break things? And that's why we wet our patches in staging and QA before we deploy them into critical servers and endpoints.

But what if you had the confidence before actually deploying the change that it is not going to cause an outage, it's not going to cause a reboot, and there's a very quick way to recover in case there was a minim blip, like recover from backup or rollback. Now you can more confidently execute these remediations at AI speed. Right.

And it's this dance. In many ways, it mimics biology. Yeah.

Right? Viruses exploit something in the host, right? Yeah.

It allows them, and then the host system, I'm talking about biological viruses- I like analogy, yeah. not computer viruses. But you know what I mean.

This has been the story of life, right? Life's a predator and prey. The prey get better hearing.

The predators become faster. Yeah. They get better eyesight.

It's this constant sharpening, iron on iron, if you will. Absolutely. That's what we're seeing here, right?

As AI is disrupting each step of our security cycles- Yeah ... there's this dance, right? So now we're going to remediate better.

We are going to remediate better. The bad guys are going to try counter to that, right? I don't know what that counter is as I sit here.

But there'll be a counter to it, and we'll counter that. We'll counter. It's this dance.

But there's a lot of things that are in control of the defenders, right? So for example, one of the things we have seen, and we'll talk about this with customers that have been able to dramatically shrink the remediation, is you look at the legacy processes and tooling that we have in place. Now, it's a paradigm shift.

We have to reduce this remediation from weeks to maybe 24 hours for some of these riskiest ones. How are you going to achieve that with the same process and tooling? You can't.

And so the answer here is a lot of these customers have been able to make it significantly more efficient by standardizing on the same platform that is helping you identify, detect, prioritize, and fix these, even if it is supporting multiple teams. So you can have your security teams detect and prioritize it, and then your IT operations teams apply the mitigation of the patch through the same platform. So you don't have to move the data across different tools, remap it, and spend a whole lot of time on spreadsheets and different tickets while also keeping your change management records up to date through the right ITSM ticketing and the integrations we have.

And so that's what we saw with these customers. That's what we'll basically share with your peers today, how they consolidated on a standard platform to go from detection, prioritization, and remediation to dramatically shrink the time to remediate, right? And that's- That's what the numbers show, yeah ...

one of the easy things that customers can do. All right. Well, good luck on your panel this afternoon.

Will. It was great. Well, you know what we didn't mention, for people who want to get more information on this whole remediation, give them a URL.

You're the product marketing guy. You must know it, right? Give them a where can they go.

Yeah, absolutely. And thank you. This is really good.

I think today you will see on the Qualys website we did launch True Risk Eliminate. 0 with true confidence. That talks about all the things we do, not only with our agent-based, but without the agent, right?

Where the agents cannot be deployed, like edge devices, scanner-based remediations to edge devices, activating controls on third-party security devices. We can do all of that. com.

There's a detailed blog, and that will give you all the details that we can do, along with also the case studies on the customers we'll be talking to. Excellent. Thank you.

Thank you, Alan. Appreciate you having me. All right.

Hey, this kicks off our coverage of this year's Rockon. We're going to be back with more. We're live.

Stay tuned.