Zero-Day Remediation Meets Operational Resiliency | Qualys | Qualys
Summary: Qualys says CISA-known exploited vulnerabilities have risen 6.5x over four years while time-to-exploitation has collapsed to minus 7 days, meaning flaws are weaponized before organizations can patch them. Its TruRisk Eliminate 2.0, generally available October 1, 2026, adds an AI-Powered Patch Reliability Score, patchless remediation paths, Agent Sara-orchestrated remediation waves, and AI-guided rollback, with Qualys reporting 150 million patches deployed in the past year, 40 million fully autonomous, and a rollback rate below 0.1%.
Key Takeaway: If exploitation now precedes disclosure by a week, a monthly patch cycle leaves your estate exposed for the entire interval between weaponization and remediation, and the source forecasts roughly 59,000 CVE disclosures in 2026. The vendor's own rollback figure of under 0.1% across 40 million autonomous patches is the number to weigh against your tolerance for letting software patch production without a human in the loop.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026