Qualys TruRisk Eliminate 2.0 Puts Patch Reliability to Work

Hey, everyone. We're back here continuing day two coverage of our Rock on coverage in Austin. We've had a great two days.

We're talking to so many people about a lot of the new products being announced here. A lot of the new products, of course, building on the prior products. I want to introduce you to Lavish Jahan.

Lavish has been with us before. First of all, before I even get-- Let me introduce. Lavish, how are you?

It's good to see you. I'm good. I'm good.

Yes. Tell people a little bit what your role here is at Qualys and what you do. So talking about my role, there has been a shift.

So earlier I was mostly in compliance, but now I move to the remediation side of the house at Qualys. Okay. And I handle the product called TruRisk Eliminate.

I drive that, which covers all aspects of your remediation program. And that's what I'm doing these days. Excellent.

Remediation is front and center at this year's event. You've got to close the loop. You can see exposures, as many as you want, but you have to close the loop with remediation.

And that's the post-Methos world we live in, right? Since April 7th, right? It's no longer about finding vulnerability.

Yeah. That's easy. We've all seen the surge in number of vulnerabilities.

We've also seen a surge in exploits. We've seen a surge in everything. Remediation- Remediation actually becomes really important in these days, yeah.

And when we talk about remediation, it's really the scale of remediation, right? And the other thing to talk about is when we, I think Sumedh mentions it, a remediation banquet, a buffet, right? Because a lot of people hear remediation, and they think patching.

Yeah. It's common. And that is one way of remediating, but patching has its own set of issues, right?

You've got to test to make sure you don't break anything. You've got to roll it out and make sure it installs, especially when you're talking about an enterprise. It takes time, and time is one thing we don't have in this new world that we live in.

Obviously. So there are things you could do beyond patching that can buy you time, right? And that's really a lot of what the talk here has been.

You guys announced a new version of your product, right? Yeah. It's called True Confidence is part of it.

Tell our audience, Lavish, if you wouldn't mind sharing. As you rightly mentioned, patching has its own issues. Yeah.

Every IT ops person, every remediation person would agree to this, that they cannot just patch, right? Because patches can be disruptive in nature. And then there are too many things to patch, right?

There's not a single solution that is telling you what is the one person that you patch first or fix first using any sort of mitigation program, and how can you take care of your remaining backlog, right? That is where the IT teams are stuck these days. They need a solution that offers you much more than patching.

So let's say there's this one person, critical exposure. And critical exposure is on critical assets. You cannot just go ahead and patch it because you cannot have this downtime, right?

Right. So you've got to mitigate it or maybe apply something, custom mitigation, maybe isolate the asset for some time, or apply the security controls that you already have in your environment. Maybe, let's say, you're using Zscaler or other stuff.

So you need, as an IT person, you've got to have confidence in your approach that if I'm not patching, I can do this. And even if I have to patch, there should be some confidence that tells me that this patch is not going to be disruptive. Right.

0- Yep ... which gives you confidence at every step before the patch, before the remediation rollout, during the rollout, and after the rollout. And I explained to you like- Yeah, no, we understand.

I've been in security a long time, right? Yeah. One of the things I learned in my own experience over the last two, three decades, when we talk about true confidence, another word we could use is trust.

Yeah. Right? Because, look, patching was always available, right?

I remember- Yeah ... talking to large enterprises, Citibank, how long it took them to roll patches out, like from the Patch Tuesday patches. And that's coming from Microsoft, so you think they're already tested and everything else, right?

It still took them 90 days, three months, to roll out the patches. That's right. Now remember, new patches come out every month, every Patch Tuesday.

So by the time one patch rolled out, there were three new releases behind it. Yeah. Those patches might have been patched by the time a patch was done.

Yeah. And why? Because we never trusted- No confidence ...

patches, right? The confidence. No.

What was it going to break? How did it work? Did it really in fact fix the vulnerability or cure the vulnerability?

It's always been a question of trust and confidence. And that's just patching, as you said, right? And I said this buffet stuff.

There are things you could do. You could decide, I'm going to unplug the device. I'm going to take down that application.

I'm going to put up a firewall that will block that port. I'm going to block this IP, right? There's a host of things you can do- Yeah ...

that also buy you time. But again, if you don't have confidence in that, you don't trust in that- That's the thing ... then the time gets real short on you.

You feel the walls closing in like, I got to do something. And so that's why I think this is so important. Yes.

Really. Absolutely, it's important. So as Sumedh mentioned yesterday also, that we are getting a lot of exposures these days.

Yeah. And this surge is skyrocketing. What we need is a solution that tells me that, okay, IT ops, fix the minimum.

And that, too, you have ten ways to do this. You have isolation, mitigation, third party applications. You do it, and the rest, I will tell you how to fix it.

An agentic approach that tells you that out of the 99% which is left, 60% can be fixed with automation or using our high reliability patches. Because we assess every patch when it comes to our catalog for the reliability scoring. We traverse through all the social signals, and we then correlate it with the Qualys telemetry, right?

Because we know we have like 3,000 plus customers. We know who are rolling back the patches. We have around 10,000 VMDR customers.

We know which vulnerabilities are getting reopened. If a vulnerability is getting reopened, it means the patch was rolled back. Right.

So we know from the telemetry which patches are not good, and we know the patches from social signals also that has issues. So combining these two, we know the patch reliability. So we can easily tell that, okay, since we know the inventory, we know the exposure, we know that if it is a non-critical asset, and if there is a high risk vulnerability, if it is coming from a browser or any standalone application, and there is a high reliability patch available for it, just put it under automation.

Don't even ask me. Right. So all the Chrome patches, all the Firefox updates, all the Adobe updates, they should be auto patched.

You would think. But if you have confidence, trust- If you have confidence, and that confidence we are giving by the reliability scoring. I love it.

So that's how using the asset context, the exposure context, and the remediation options context. It's not just patch. Deploy the mitigation if there is no patch available.

All the win verified trust, SMBV1 vulnerabilities, the quote unquote vulnerabilities, they don't have a patch available from the vendor itself. And we have seen the life of these vulnerabilities is like ten months, seven months in customer's environment. Why do you keep this risk open?

We have mitigations for you. Deploy those. And even when patch is available, for all the Tuesday patches that come up, we have mitigations available for all.

So if you don't trust a patch, or if we are calling it as a high reliability patch or low reliability patch, deploy the mitigation there. If we are calling it as a high reliability patch, deploy it with confidence. That is the confidence we are giving to the users, and that's where the true confidence layer comes in.

Also, I would like to touch upon a point, the resiliency part. So all we were talking about is the pre-deployment thing. Right.

Let's talk about during deployment. So today, the during deployment part is just observed on the basis of successful patches. If the patches got deployed successfully, if 95% of the patches got deployed successfully, I am good.

Right. That's what IT ops think. But we add one more resiliency layer on top of it.

So if the patches got deployed successfully, but there is no regression observed, then only call it successful deployment. So those regressions also we are checking by partnering with application performance monitoring tools like Dynatrace. Mm-hmm.

Right? So we have recently- So observability. Yesterday, Dynatrace was with us.

Yes. We were talking about. Sure.

So what happens now is you deploy the patches on your test fleet, Dynatrace comes 24 by seven monitoring. It will check if there are any CPU spikes, service disruptions, et cetera, are observed. And if they are observed on your test fleet, it will block the deployment there itself.

Onto the production. It will not go to prod. Right.

That is the kind of confidence IT teams has. So today, without these app performance monitoring tools, what happens is you deploy it on test fleet, then there is a cooling period of 24 to 48 hours where IT team checks or using their NOC tools if something is happening on the asset, and then they go and manually deploy- Right ... on the next ring.

So we give that confidence wherein your deployment starts, it will automatically block if something happens. And this is part of building confidence. Yeah.

Right? Is look, I start trusting that the system will pick up if something is wrong, if something's going to break. And that's important.

Yeah. 0 and all of this true confidence, it's something that's earned, not given. Okay.

Yeah. Definitely. And I think it's an important thing.

We're about out of time, but let me ask, for people who want to get more information who aren't here, where's the best place to go get it? Where can they go get more info? Okay, so they can go to Qualys website.

com. 0. 0 and get your own personalized report, which tells you what is the 1% that you need to fix with various options, and how can you fix the remaining 99% with the remediation waves, low operational impact, high operational impact, patch less options.

One report personalized for you. I love it. Yeah.

My friend, congratulations on the new role. Thank you. This is a really important- Yeah ...

piece of the Qualys product line. Oh, yeah. Definitely.

It's going to be a good ride. This is the hottest thing right now. Absolutely.

Hey, we're live here. We are. The hottest thing we're at is Rock on.

Yes. We're in Austin. We got more coming later today.

You're watching Techstrong TV.