Qualys Moves Continuous Compliance to AI Scale

Hi, everyone. We're back here at Rock On Qualys, Austin 2026. We're live, and I'm really happy to have this next guest on.

It's her first time on Texteron TV. Her name is Joyce Francani, and Joyce has a very, I would say it's somewhat unique, right? We've seen people like this before, but for a while, we started seeing the CISO- Yeah ...

combined with the CIO. So you had the same person wearing two hats, CIO, CISO. We saw CISO combining CTO.

Yep. Right? And today, a lot of CTOs are field CTOs in that they're forward-facing.

Yeah. Much like the forward deployed engineers that we- Yes ... see with Palantir and so forth.

Joyce is part of this new breed. But you didn't call it, what did you call it? CTSO?

You had a name. Yeah. Chief Technology Security Officer.

But the acronym name that you use. CTSO. Just CTSO.

Yes. I love it. Yes.

So next time you hear CTSO, that's what we're talking about. Yes. Joyce, that's great.

When did you start with Qualys? I've been with Qualys for about six months. I started as a CTSO of Qualys in six months, but prior to that, I was a buyer of Qualys, as I- Real love customer.

Oh, yeah. So I was on the other side. I help with evaluating the tool, making sure that we did a proof of concept, there's a proof of value, and then brought the tool in.

Now, at Comcast and CVS Health, the tool was already enabled, but I help with scaling. I help with performing digital transformation, especially at CVS- Sure ... where I help with deprecating 12 point silo products, and then continue to scale Qualys portfolio across all of the endpoints that I was responsible for managing, which is over a million endpoints.

CVS Health is a Fortune 5. Sure. Right.

Right? Fortune 5, and the infrastructure is massive, right? Yeah.

So, all the servers, the in-house infrastructure, the cloud infrastructure, all of the applications. So, I was responsible for that. Excellent.

Yeah. So CVS was most recently before Qualys? Yes, most recent.

Yes. But as you mentioned, you've done work in the federal sector. Yes.

Yes. I've been in cyber for over 30 years. I've led programs for Lockheed Martin, L3Harris, Comcast.

I helped design the whole cybersecurity infrastructure for Xfinity Mobile. Uh-huh. Right?

And most recently, as you said, CVS Health. Love it. Yeah.

So I'm really happy to be here at Qualys, helping to perform a lot of engagement, executive engagement, right? And I'm really enjoying helping CISOs and CTOs with their security maturity strategy, security maturity roadmap, bringing my experience to the conversation- Sure ... and being a true partner.

And Alan, that's how I always treated my vendors. Really? Partners.

I treated my vendors as my partners, right? And my outcomes were stronger. Absolutely.

Mm-hmm. As a former vendor for long time, I appreciate that. You have no idea.

Oh, true. And it does, it makes it better. Mm-hmm.

The dynamics of relationships between vendors and customers, people don't realize a partnership trumps any of that. Oh, absolutely. 100%.

Agreed. 100. But I did challenge my vendors to also share with me what are they seeing in the industry.

Right. What are other healthcare organizations seeing? Because it's more than a vendor.

What are they doing? Exactly. Exactly, and so that's why I always treated them as a partner, right?

And my outcomes definitely were always stronger and better. That's why in this role, though, too, it's really, and you know because you've been in their shoes now. You're the one who's out here talking to dozens, if not hundreds of customers.

Hundreds. You can relay, without giving away trade secrets, obviously, but you can tell people, "Hey, this is what the state of the art is. " Yeah.

Exactly. Exactly. And I can also, again, integrate my experience.

"Here's how I did it. " Love it. " CVS is the largest pharmacy in the whole country, right?

In the country. And so yeah, me too. We all are.

And so helping to secure that infrastructure, right, and secure the data of our customers is really important. And we're not just talking about a large company. We're talking about PII, health, and HIPAA information.

Exactly. Exactly. Even more.

I want to pivot if you don't mind- Sure ... because you're going to be leaving us here and walking onto the- I am going to ... stage.

Stay tuned. Talk to us what you're talking about. I'm going to be discussing how to move away from static point in time compliance to continuous compliance.

And that's really critical in our space today. With AI development and with AI moving so quickly and agentic AI making decisions, you need to implement continuous compliance so that you can continuously monitor and enforce, right? Right.

And so, that's one of the topics I'm going to be discussing today. I love it. For so long, compliance was almost like the red-headed stepchild of security.

It represented the bare minimum you needed to do not to get in trouble, right? Mm-hmm. But now, in a post-MeSO world, more than ever, the emphasis is on governance and compliance.

Absolutely. Because things are going so fast. Mm-hmm.

And so many of us who've been in security, like you say, 30 years here, this is not business as usual for us. Now it is, but it's the new normal. It's not the old normal.

Yeah, and I think that compliance always has such a negative image because of the auditing, auditors, right? " That term, auditing, is negative in itself, right? Yes.

But continuous compliance is a bare minimum now. Again, with the way the AI development and agentic AI is, it's continuously making decisions. So how do you then govern, monitor, govern, and ensure compliance with those agentic AI models, right?

So to me, this is all a question of AI scale. Mm-hmm. If the vulnerabilities are coming at us at AI scale, and now as we heard Sue Mann talk about this morning, we're moving remediation to AI scale.

Yes. Compliance can't afford- Compliance remediation. Yep ...

right. But compliance, therefore, can't afford not to be- No ... at AI scale.

Exactly. Right? Because otherwise, it just'll be buried.

It'll be buried. And Alan, I believe in still continuing with the security brilliant basics. Mm-hmm.

Right? Design security into your architecture, build security into your architecture, test, and secure deployment, right? Mm-hmm.

Same thing with continuous compliance, right? Understand what frameworks are applicable to your organization. Yep.

Is it NIST? Is it HIPAA? Is it PCI?

Right? Understand your frameworks. Understand if you have more than one framework that you are responsible for implementing in your organization, what are those overlapping controls?

Mm-hmm. Right? And then how do you automate and build it into your pipelines, build it into your workflows, build that into your architecture, so that you're designing and building it in, right?

And then the continuous compliance part of it is the monitoring and enforcing, right? But I really believe, and I'm an architect at heart, is designing and building it in, and I still think that that is the brilliant basics, right? Secure development lifecycle, DevSecOps.

Well, now it's DevSecAIOps. Yes, it is. com.

We know this. Exactly. Yeah.

com 15 years ago. I saw DevOps and the whole kind of new way we're going to develop and deploy software as a chance to create some past mistakes in security that it wouldn't be bolted on. Right.

That it wouldn't be the caboose, that it would be holistically built in. You want to talk about shift left, you want to talk about all of that, but it's about being built into the whole process from get-go, so that we're not playing catch up. That we're not trying to bolt this stuff on.

It's more expensive as well, Alan. Because you're redesigning, rebuilding. It's a lot of overhead for the team.

Assuming it works, even. Right. So let's talk, we only have a few minutes left, but let's talk specifically about what Qualys is doing in terms of continuous compliance.

Yes. So Qualys, we have capabilities because our agent, our cloud agent, is already deployed on the endpoint. Our cloud agent, we can enable continuous compliance through that same cloud agent.

So you don't have to deploy another agent on your device. That one agent that we do all of our identity management, our vulnerability management detection and response, we have now continuous compliance. And so our agent can help with monitoring and enforcing those policies, and doing automated evidence collection, which is state-of-the-art.

That's next gen. So you don't have to continually- Talk to us more about that ... take snapshots, upload PDFs, take snapshots.

I was responsible, my vulnerability management program, we had to provide evidence every month to our PCI attestation company. Right. And so that was a whole manual effort.

Now, with our continuous compliance capability, you can hook your APIs into wherever your evidence is stored, and we can grab that in an automated way through the API, upload it into the tool, and it's ready for the auditors. And that is reducing significant overhead. That is implementing more trust.

Implementing trust that your team that's collecting that evidence isn't modifying that evidence. The integrity of that evidence remains sound. And so, that alone is huge.

It's huge. I once built a business just around collecting PCI- Evidence. Mm-hmm ...

and compliance. Making them fill out the forms they had to fill out. I automated that- And it's also really important to know that this is also helping with continuous compliance of all the controls.

Yes. Again, that framework, if you're in scope for HIPAA, PCI, SOX, those controls can then be, if you have more than one, collapsed so that you have one consolidated list of controls that you're working from. But then it'll also help you reduce overhead by the redundance.

Right? Sure. And so it's grabbing evidence once, but satisfying many.

Sure. And that's why I love that it's all on our agent. That's a large scale.

Yes. That a large scale. That's why I love that it's on our agent, because our agent, once you deploy that, you can run all these capabilities from that one agent.

So, we're really excited about that. I love it. One last easy question, then I'm going to let you get ready for you to get on stage.

Yeah. Where can people find out more about continuous compliance on Qualys? Oh, sure.

com. You can get a hold of me, Joyce Rankani, on LinkedIn. There you go.

Yeah, and I'd be happy to give you a demo and share with you the benefits of even implementing it in a scaled way. Rome wasn't built in a day. No.

But we can implement it in a scaled way so that you continue to develop trust with your own internal team. I love it. Joyce.

So great meeting you. Welcome to TechStrugg TV. Thank you.

Good luck to Qualys. Thank you. Joyce Rankani, Chief Technology Security Officer, CTSO, here at Qualys.

We're going to take a break. We've got more live coverage coming at you. Stay tuned.

Thank you.