Qualys Tru Risk: QDS vs CVSS & EPSS Vulnerability Scoring | Qualys
Summary: Qualys introduced VMDR 2.0 with TruRisk, a scoring system that combines CVSS, EPSS, CISA KEV status, exploit code maturity, threat-actor and ransomware activity, dark web and GitHub sightings, and asset context into a Qualys Detection Score ranging from 1 to 100. Qualys reports that TruRisk rates less than 1% of vulnerabilities as critical and less than 7% as high, compared with CVSS ranking 51% of vulnerabilities high or critical, and notes that 92 of 832 CISA KEV vulnerabilities (11%) carry a CVSS score below 7.
Key Takeaway: CVSS alone puts 51% of vulnerabilities in the high or critical bucket, and 11% of CISA's known exploited vulnerabilities score below 7 on CVSS, so a patch queue built on severity ratings will bury real exploitation risk under volume. Qualys claims TruRisk cuts the focus list by up to 85%, which is the difference between a remediation backlog your team can close and one it cannot.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026