Tru Confirm: Exploitability Validation in Qualys ETM 2026 | Qualys

Summary: Qualys announced TruConfirm, an exposure validation service embedded in its Enterprise TruRisk Management (ETM) platform, which uses an agentic AI workflow called Agent Val to safely test whether exposures are actually exploitable in live production environments. Qualys cites 48,177 CVEs published in 2025 and states that only 1% of reported CVEs are ever weaponized, with TruConfirm focusing validation on 1,600+ weaponized CVEs; TruConfirm is planned to be generally available by H1 2026.
Bottom line: If only 1% of the 48,177 CVEs published in 2025 are ever weaponized, remediation effort spread across the other 99% is engineering time spent on exposures attackers will never use, while the paths that do execute stay buried in the backlog.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026