Qualys TotalAI Brings Shadow AI Into View

Hi, everyone. We're back. We're live.

We're in Austin for Qualys' Rock On, a 26th event. It's great to be back. We've been covering the Qualys event, I'm thinking back to years in San Francisco when it was held during RSAC, and that was years and years ago.

We've had a great morning so far, continuing into the afternoon. Our next guest has been with us before at Qualys Rock On last year, as well as at KubeCon, a couple of years ago. Abhishek Singh.

Abhishek, first of all, welcome back to Techstrong TV, and thank you for coming back. It's great. Beyond the name, tell people your position at Qualys and what you do.

Thank you for having me. My name is Abhishek Singh, and I'm the Vice President of Product Management for Total Cloud and Total AI products. Okay.

Let's start there. Total Cloud is something we spoke about, was it two years ago now, or last year? Initially, when I started at Qualys, I was doing container security.

Yes. No, I remember that at KubeCon. But when did Total Cloud come out?

Total Cloud has been there for a while, but I got Total Cloud recently. Okay. But Total Cloud has existed for many, many years.

In fact, we were the original authors of the CIS benchmarks. I remember. Yeah.

So Total Cloud- That old, yeah. existed in some shape or form very early. That's true.

Philippe used to work with the CSA folks. I do remember that. For our audience who maybe are not familiar with Total Cloud, how would you describe it?

So Total Cloud is an implementation of CNAPP. CNAPP is the Gartner-coined acronym of what it takes to secure cloud. Yes.

And like I said, we started early. We had a quick start with CSA and original authors of CIS benchmarks, but somewhere we fell within the cracks, right? So recently we have made a lot of progress, so we are seen as a credible player in the CNAPP space.

We are ranked top three by Forrester in the whole CNAPP category. Yeah. Excellent.

" So when we saw AI show up initially, and Qualys was again very early. We tend to be early in a lot of technologies. We saw AI being deployed on-prem, so people were concerned about cost and deploying it on-prem, and we started scanning their models and on-prem stuff.

But we have seen the migration of usage towards cloud. So a lot of modern AI workloads are primarily running on cloud. It's a managed service by either SaaS providers or cloud providers.

The usage has really gone from on-prem back to cloud, and that creates that synergy of even containers and cloud and AI being the same thing. So we see a convergence of CNAPP, AppSec, and AI in cloud. I want to be clear, though.

When you say you're seeing the AI moving back to cloud, that's not necessarily running frontier models with tokenization and stuff. Some folks started setting up AI locally using some of the open-weight models and stuff. Yeah.

And they were running that in their closets, right? In their server rooms, in their data centers. Now they're starting to move these models to the cloud with the idea of is it's still cheaper to do that than it is to run straight off a frontier model, and all of the security implications of that as well.

Not necessarily, right? So we've seen all kinds of usage. So you can take your open-weight models, move them to cloud, but cloud also packages a lot of the frontier models, right?

So if you go to Amazon Bedrock, for example- Sure ... you're able to use Anthropic Cloud or bring your own open-weight model. Well, using Bedrock, right, like a harness.

Yes. We could plug in multiple models and use the right model for a specific job. But I do think that that's the future of what people are going to do.

I don't think anyone's going to use just one model anymore. I think we're going to see these multi-model with smart harnesses, if you will, that allow it to go. Now, that presents its own security issues.

Is that something you guys are looking at as part of Total Cloud, and- Yeah, so Total Cloud- Total Cloud, excuse me. Yeah. Total Cloud obviously looks at the whole cloud, and it's growing at a very fast pace, faster than Qualys' greater growth.

But if you look at the AI segment, it's exploding. So within cloud, AI itself is growing at a very fast pace. And Total AI is about, again, AI has a lot of implications for security, how attackers are using AI, how defenders are using AI, but Total AI is about how do you secure your use of AI?

And when your use of AI spans cloud and workforce, workloads, on-prem, container hosted, cloud hosted, SaaS hosted, we secure all of that. So we make sure that you know where your AI usage is, whether it's workforce or workload, and then you're able to feel safe about it. And that's the point of Total AI to, again, AI discovery and making sure it's safe and governed properly.

So governance is a key aspect of our positioning of how we are planning to go to market with Total AI. I love it. So Total Cloud, you mentioned Total AI a couple of times.

I just want to make sure we define Total AI for the audience. How would you define it? So AI is definitely a platform play, and what I mean is it's a sprawl.

AI is everywhere. So when customers are on a platform like Qualys, they are going to the platform vendors of choice and asking them what is the AI story? Because again, it's going to be a silo of its own.

It deserves the same risk treatment as traditional workloads have. Sure. So they expect their platform providers to do it.

And it's meaningful because, like I said, there are so many silos in AI. Some AI is running in the browser, some is running in containers, some in SaaS. So how do you bring all that together and make sure AI used across the board is governed well?

And that is the mandate for Total AI. It allows for people to ensure that they're aware of where AI is in the organization, and it's governed in a secure way. Fair.

So you're tracking what people are using AI for. But when we look at the use of AI in these organizations, there's this whole shadow AI, that's what people call it, shadow AI. How do you account, right?

Some part of me says there must be this much that the company knows about, and there might be this much that they don't. We don't know what models you're using that may not be the approved model. We don't know what you've got on your personal AI accounts.

And I'm not saying people are evil, or they're doing, but this is just the way-- We had the same thing with cloud. Remember, we used to have shadow IT. We have shadow AI now.

How does Total AI account for that? So that's the part we are strongest in, and it's also a free gift from Qualys. So just being part of the platform gives us visibility and telemetry sources from across the board, right?

So there are some people in the industry that will cover posture management for AI. It's called AI SPM. Mm-hmm.

But it strictly relates to how AI is being configured in the cloud. Being Qualys, we not only can do that, but we have presence in 100 million server endpoint and laptop endpoints. So that presence gives us visibility into how the clients are configured, how a workforce is using through the browsers, how developers are using through their IDs.

So that gives us a very comprehensive coverage across self-hosted, cloud hosted, SaaS hosted AI, and we can really discover the shadow AI for you. You don't have to assume. You can be in the know because Qualys has those tentacles in all kinds of places.

Again, it's a very siloed and it's a sprawl problem, but because of Qualys, we get visibility into all those aspects. I love it. Is Total AI a subset of Total Cloud or two separate things?

So currently, it's two separate products to be purchased separately. But we often see synergy. In fact, what we see is that Total AI becomes the land for Total Cloud.

So people who are on other cloud provider products, they still want to go with Qualys for Total AI, right? So that becomes our land for Total Cloud. And once they're using Total AI, we have to configure the connectors to get all the cloud stuff.

So that kind of creates a vehicle for us to upsell Total Cloud to them. I love it. Excellent.

Where can people go get more information? On our website. So, a couple of things, right?

So if you're an existing Qualys customer, VM/VA customer, you will see a light bulb moment for you. You click that, it will automatically show you what AI we have discovered for you. No action needed, no software to install, nothing needed.

Easy. That's very easy. We also have a website where anyone who doesn't even have any Qualys product can scan a QR code, and they can actually sign up for getting a free report of their external attack surface, an AI attack surface.

Really? What that gives you is a map of how your AI footprint looks like. So what attackers are doing is they're mapping your AI footprint from the outside, and Qualys is giving you that free report without any software installation.

And that's kind of the beginning of the conversation with Qualys, which is a great way to get started. Where can we get the QR codes? The QR code will be flashed as part of my session.

Oh, and when you're here today. com, can they get it? Yeah.

The QR code lands you on a Qualys portal. Got it. So if you just search for AI attack surface report, you should be able to find the website.

I love it. Abhishek, thank you three times. It's a pleasure.

Thank you. We're live. We're at Qualys Rock On.

We'll be back in a moment.