Turning Millions of Risks Into One Actionable List | Qualys
Summary: Qualys introduced TruConfirm, TruLens, and Agent Val, a set of tools that validate whether vulnerabilities are actually exploitable by replicating attacker behavior with benign payloads rather than running malicious exploits. The company cites figures including roughly 48,000 new CVEs disclosed in 2025, a 52% rate of CVE exploits bypassing default web application firewall protections in independent testing, and a negative seven-day average time-to-exploit.
What's compelling: Qualys states that less than one percent of critical vulnerabilities in the average enterprise are actually weaponized, and cites one Fortune 50 customer whose 62.5 million live findings shrank to a confirmed exploitable set with remediation cost falling from $3.12 million to $31,000. If that ratio holds, most triage and remediation cycles are spent on exposures that were never going to result in a breach.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026