Qualys has launched TruRisk Eliminate 2.0 with TruConfidence, an AI-powered remediation intelligence and orchestration engine designed to help enterprises reduce cyber risk through automated remediation while maintaining business continuity.
The platform supports Qualys’ vision for Autonomous RemOps, an approach that brings vulnerability remediation, risk intelligence and IT operations together to help organisations respond to threats at machine speed.
As artificial intelligence accelerates vulnerability discovery and exploitation, security teams face increasing pressure to remediate exposures before attackers can exploit them. Traditional processes that rely on manual decisions, ticketing systems and hand-offs between security and IT operations teams can struggle to keep pace with these shorter response windows.
Qualys said its experience deploying more than 500 million patches, with a rollback rate of less than 0.1% and 40% of patches deployed autonomously, has informed the development of TruRisk Eliminate.
“For years, security teams found vulnerabilities, and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone,” said Jon Nelson, principal advisory director in the Security & Privacy practice at Info-Tech Research Group.
He added that automated remediation, supported by patch reliability scoring, progressive rollouts and patchless mitigation, could help organisations address vulnerabilities while reducing the risk of operational disruption.
AI-driven intelligence for remediation decisions
TruConfidence brings together capabilities introduced by Qualys over the previous two quarters, including its AI-powered Patch Reliability Score, wave-based remediation orchestrated by Agent Sara, peer-to-peer distribution and compensating controls informed by data from real-world patch deployments.
The system is designed to assess existing security controls before recommending remediation, helping teams avoid duplicating protections already in place. It then identifies the appropriate course of action, manages deployment and verifies whether the remediation has succeeded.
The approach is intended to shift vulnerability management from patching every identified issue towards selecting the most effective action for each exposure, taking into account existing safeguards and the potential impact on business operations.
Extending remediation across hybrid environments
TruRisk Eliminate 2.0 extends remediation capabilities across perimeter devices, cloud environments and applications, in addition to agent-managed endpoints.
Depending on the exposure, organisations can patch vulnerabilities, apply mitigations without a patch, uninstall affected software, isolate assets or deploy custom fixes. Assets that cannot run an agent can be addressed through Qualys scanners and existing security and IT integrations.
Where patching is unavailable or unsuitable, TruConfidence assesses existing protections and uses third-party mitigation intelligence to identify compensating controls. These can be applied through security tools already deployed across perimeter and endpoint environments, allowing organisations to reduce exposure while planning or validating a permanent fix.
The platform also monitors system health after remediation through integrations with partners such as Dynatrace. It tracks potential service-impacting conditions, including CPU spikes and memory issues. If a fix fails, its AI-powered Patch Failure Analysis capability identifies potential causes and recommends corrective action, including rollback where appropriate.
Balancing automation with business continuity
Sumedh Thakar, president and CEO of Qualys, said organisations’ hesitation around automated remediation often stems from concerns about service outages rather than automation itself.
“Autonomous exploitation requires an equally automated remediation, but organisations’ hesitation isn’t about automation; it’s a lack of confidence that it won’t cause an outage,” Thakar said.
He added that TruRisk Eliminate with TruConfidence aims to turn remediation intelligence into action through the Qualys Risk Operations Center (ROC), helping organisations reduce exposure while addressing concerns about operational disruption.
The launch reflects a broader cybersecurity challenge as enterprises seek to shorten the time between vulnerability discovery and remediation without compromising the availability of critical systems. By combining risk assessment, remediation orchestration and post-deployment monitoring, Qualys is positioning Autonomous RemOps as a way to connect security priorities with operational execution.
Availability
Qualys TruRisk Eliminate 2.0 with TruConfidence is now generally available, with a free upgrade for existing TruRisk Eliminate customers. The company is also demonstrating its Autonomous RemOps approach and its integration with the Risk Operations Center at ROCon Americas 2026, held on 14–15 October in Austin, Texas.