Qualys Uses Exploit Validation to Find the 1% That Matters
Risk Management in the Frontier AI Era
Shailesh Athalye has a new title at Qualys: chief product solutions officer. He joins Alan Shimel to close out Techstrong TV’s coverage of Qualys ROCon 2026. His session covered how customers manage cyber risk in the frontier AI era. Many rely on the Qualys Risk Operations Center, built on Qualys ETM.
Vulnerability volume keeps climbing. Athalye notes that some October Patch Tuesday flaws were exploited within 24 hours. Yet the share of vulnerabilities that get weaponized has stayed about the same. The challenge is finding that small fraction. Customers also want autonomous remediation, but they need confidence in each fix first.
Detect, Prioritize, Remediate
Athalye lays out three steps. First, detect at AI speed. InstaScan, launched at Black Hat, uses existing telemetry and a graph database to flag new vulnerabilities without a scan. Qualys is also building a dynamic SBOM to catch flaws that lack a CVE.
Second, prioritize the 1% that needs fixing within 24 hours. Exploit validation sends a benign probe from an external scanner. If the system responds, the risk is real rather than theoretical. Athalye says roughly 1% to 2% of findings get through. Many slip past WAFs left on default settings.
Qualys also checks whether existing controls, such as memory exploit prevention, are turned on. It then maps those controls to the vulnerabilities they help mitigate. That gives teams credit for protections already in place.
Confidence for IT and the Board
The third step is autonomous remediation with confidence built in. Large enterprises now want fixes within one to three days. Qualys TruRisk Eliminate shows how reliable a patch is before it runs and its impact afterward. That helps security and IT speak the same language. A patch should reduce risk without breaking systems.
Exploit validation also gives leaders a clear story for the board. They can show they detect threats as fast as attackers and patch before exploits arrive.
Transcript
Hey everyone, welcome back. We are wrapping up our Qualys Rock On coverage here in Austin for 2026. In some ways, we saved the best for last.
My friend, Shailesh Acharya, is here. Shailesh, I feel like I've watched you grow up at Qualys, to tell you the truth. We've probably been doing interviews now for, I don't know, four or five years.
I think more, Alan. Maybe more. Since we were kids, so maybe six years.
A long time. Yeah. And I've seen you also progress through the management ranks here at Qualys.
What's your title these days? Yeah. I'm promoted to chief product solution officer at Qualys, Alan.
That's fantastic. Thank you to our customers, obviously, and Sumedh and the entire Qualys fraternity, including supporters like you. Yeah, no, look, I am a fan, always a fan of yours.
First of all, congratulations on that. Thank you. But let's focus in here.
You actually presented yesterday. Yes. And what did you present on?
Yeah. Obviously, the number one topic in our customers' mind is how my cyber risk management should evolve in this frontier AI era. Qualys came out with our Risk Operations Center, Etm, or Enterprise Tool Risk Management.
Yep. So my topic was how some of the customers are already leveraging Qualys Rock to drive the risk management journey in this frontier AI era. And okay, tell us, how are some of them doing it?
Yeah, so it was very interesting, right? And who better than you, actually, to talk about and talk with. So first part is our customers are definitely seeing the surge of vulnerabilities as a reality, right?
Like last patch Tuesday, which happened just- 1,500 ... yeah, 1,500 plus vulnerability came out. Interestingly, the October patch vulnerabilities within 24 hours started getting exploited.
Yeah. But on the right-hand side, the customers still have these vulnerabilities open, which is going to happen. The vulnerabilities remain open.
But another sad, when the team came out, the weaponization percentage, the number of vulnerabilities getting actually weaponized, that's remaining same. Right. So it's not like more vulnerabilities are getting exploited.
So the customers have first problem as the needle in the haystack. Which 1% now my ever-growing surge of vulnerabilities I should know and should validate? Yep.
And then the second part is it's no-brainer. Customers do want to run their remediation management program in an autonomous manner. But they have two issues.
One is the confidence in my patch and remediation method, and second is essentially how can I balance what to be fixed now in 24 hours versus how the rest of the things could be actually patched or remediated in next 14 days, 21 days, et cetera. So the talk actually concentrated on how Qualys Etm allows our customers to drive all of the journey in three steps. First step is essentially you cannot patch anything if you cannot detect.
Nope. Yep. So how can you detect at AI speed?
The second part is how you can hyper prioritize those quickly enough to know your 1%. Those should be fixed in 24 hours. And then the third piece is the autonomous remediation with confidence built in it.
Right. Now, very interesting innovation, what we launched at Black Hat was InstaScan. Yes.
So what it concentrates on, customers have already been building their asset telemetry and adversary telemetry. Qualys now has ability to tap into that. We create a full graph database, so new vulnerability comes, there is no scan needed.
It already knows. It gets detected quickly. Shailesh, well before you were working in cyber, I had started a security company called Still Secure, and one of the products we pioneered was NAC, Network Access Control.
Okay. We took a very similar... Okay.
We had a vulnerability manager. Okay. So we had a scanner, but that was going to, with NAC, as you logged on, I had to make sure you were safe- Mm-hmm ...
before I let you in the network. Correct. Or I quarantined and patched you.
Correct. Now, we couldn't do a vulnerability scan. Mm-hmm.
This had to be done in seconds, milliseconds. What we used to do was something very similar. We would actually just read your registry.
Right. Find out what versions of everything you had. Yes.
Keep a DB of that, and every time you logged on, diff. Yep, compare it. Do a diff of your registry.
Yes. See, and then when a patch came out or a new version of the AV came out, or something came out, we knew. Yeah.
We knew what you had. I didn't need to scan you. Exactly.
I just moved you right to quarantine, patched you, and sent you back to the network. Exactly. It's funny, all those years ago.
Yeah. It's a loop, right? Yeah.
Like absolutely. We're doing something very similar. Yeah.
In fact, we are also creating the dynamic SBOM out of it. Really? Yeah.
That's fantastic. That's good. Yeah, so how that's going to help in next quarter is to also detect vulnerabilities which might not have a CVE.
And there's a lot of that now. Yeah. Because they're coming so fast and furious that- Correct ...
CVE assignability has kind of fallen behind. Yes, 100%. And then the second part, what we started doing, as this surge has been growing, same like Mythos and the other models, we actually launched the exploit validation capability.
So it allowed us to run from external using our own external scanner. Mm-hmm. Send actually a benign exploit validation probe, and if your system responded, then that means you are exploitable.
That you're exploitable, yeah. Yeah. Then it's no longer a theoretical prioritization.
It's real. Now it's real. It's a binary answer, and that's been a big hit.
Sure. Because that, and that data from that true conform or exploit validation is actually in line with the percentage of actual vulnerabilities getting exploited, 1%. Really?
So it's- So most of the customers, we are seeing around about 1 to 2% of these getting through. That's great. And guess which security control the exploit validation is going through?
Default WAF settings. Really? Yeah.
50% of these default WAF settings- Are going through WAF ... out there. Well, I mean, the fact of the matter is, WAF, I remember when WAF first came out, right, it was a godsend for a lot of people.
But it hasn't been- Yeah. Yeah ... you know.
And people don't configure it. The AI stuff just went through it, right Dave? Correct.
Exactly. And then the second part of that is, look, like a lot of our customers, the industry has done investment in security tools, security control, prevention tools, right? Like could be CrowdStrike, could be Palo Alto, et cetera, Zscaler, et cetera.
So we are now starting to tap into validation of if their features are enabled or not. Let's say your CrowdStrike policy of memory exploitation prevention is enabled or not. We check that, and if it is there running, then we actually map it to some of the vulnerabilities which it would mitigate the risk for.
So all we are trying to tell customers, "Hey, you don't really need to patch. " Got it. I love it.
Shailesh, let's talk about what has the customers been saying about it? Yeah, I think one of the parts, look, like, I mean, we've been big proponents of, I mean, Sumedh's been visionary, like came out with patch management years back. In fact, very interestingly, on April 7 when Mythos story broke out, I think Sumedh had pasted sometime in March, um- He said it up on the- Yeah ...
on the keynote yesterday. Yeah. He had said it on LinkedIn that, hey, probably the days of manual remediation are dead.
Yep. The part where we are seeing a lot of traction is actually remediation. Like it used to be leveraged by medium scale customer, lower enterprise customer.
" So what customers been saying that it is allowing us to now balance the security with IT ops with this true confidence, what we put in in our eliminated solution. That essentially are telling them before patch is applied, how reliable is the patch? " That part is making the security teams talk the same language as what IT wants to talk, right?
Like, hey, this patch should not break my system. I think that's been the feedback from customers. And then the second feedback is this directly actually maps to what I can show it to my executives and board, because they are asking me- What they understand.
Yeah, 'cause what they understand, for sure, the board understand like two things, right? Like, hey, AI is accelerating these threat and attacks. What are we doing to secure from it?
Yeah. So they're able to now go back and actually map it like, hey, we are detecting as fast as attackers are detecting. Now they're happy about it.
Hey, we are patching it before attackers have mechanism to exploit it. I love it. Shailesh, we're about out of time.
You're our last interview here. So that's gonna wrap up our Rock coverage for 2026. Yeah.
But hey, who knows by next year what title you're gonna have then. You might be running the whole company. Always a pleasure to see you, man.
Keep doing what you're doing. Thank you so much, Alan. Okay.
And for continuing to support us, continuing to support the community. We do. Really appreciate it.
All right. Thank you so much, everybody. That's gonna wrap up our Qualys Rock On for 2026 here from Austin, Texas.
We will be, well, we'll be back on Techstrong TV live tomorrow. Next week we are covering Couchbase in Fort Lauderdale of all places. But for now, on behalf of everyone at Qualys and the Techstrong TV team, thanks for joining us.
