Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Qualys introduced Agent Grant, described as the first agentic AI for identity, inside its Enterprise TruRisk Management platform to measure and reduce identity risk across Active Directory, Entra ID, Okta and other cloud identity providers. Qualys states...
Microsoft's January 2026 Patch Tuesday resolves 115 vulnerabilities, including eight critical and 106 important-severity flaws, and addresses three zero-day vulnerabilities - one exploited and two publicly disclosed. Adobe released 11 security advisories...
Qualys announced it was named a Leader and Outperformer in the 2025 GigaOm Radar Report for Cloud-Native Application Protection Platforms, an evaluation that covered 18 vendors. GigaOm placed Qualys TotalCloud in the Innovation / Platform Play quadrant,...
This Qualys guide distinguishes continuous threat exposure management (CTEM), a five-step Gartner-endorsed framework for identifying, prioritizing, validating, and remediating exposures, from a risk operations center (ROC), which it describes as an...
Qualys announced TruConfirm, an exposure validation service embedded in its Enterprise TruRisk Management (ETM) platform, which uses an agentic AI workflow called Agent Val to safely test whether exposures are actually exploitable in live production...
Microsoft's February 2026 Patch Tuesday addresses 61 vulnerabilities, including five critical and 52 important-severity flaws, and covers six zero-day vulnerabilities exploited in the wild across components such as Exchange Server, Windows NTLM, Windows...
Forrester's Q1 2026 Wave for Cloud-Native Application Protection Solutions evaluated 14 providers against current offering and strategy criteria, including partner ecosystem and customer feedback, and named Qualys one of only three Leaders. Qualys received...
Qualys reports that cloud compromise now runs through authentication rather than exploitation, with adversaries using the legitimate open-source scanner TruffleHog to find exposed credentials and confirm they are still live by calling AWS APIs such as...
Microsoft's March 2026 Patch Tuesday addresses 93 vulnerabilities, including eight critical and 75 important, and covers two publicly disclosed zero-day flaws along with nine Microsoft Edge issues patched earlier in the month. Adobe released eight...
Qualys describes application security entering a new phase shaped by reasoning-based vulnerability detection, citing Anthropic's Claude Code Security (announced February 2026) and OpenAI's Aardvark, which became Codex Security and entered research preview...
Qualys' Threat Research Unit identified CVE-2026-3888, a local privilege escalation flaw in default installations of Ubuntu Desktop 24.04 and later, where an unprivileged local attacker can reach full root through the interaction of snap-confine and...
Qualys describes a five-step model for continuous audit readiness in which security findings are linked to control and asset context, prioritized by control criticality and risk signals, and remediated through automated workflows. The post states that...
MCP, the open standard Anthropic introduced in late 2024 to connect AI agents to external tools and data, has grown to over 10,000 active public servers within a year and been adopted by OpenAI, Google DeepMind, and Microsoft. Qualys TotalAI now offers...
A Qualys research study analyzing over one billion CISA KEV remediation records across 10,000 organizations from 2022 through 2025 found that manual remediation failed to keep pace with attackers 88% of the time on the most critical, actively weaponized...
Qualys is delivering TruLens, a capability first outlined at ROCon Houston in 2025, inside its Enterprise TruRisk Management platform, backed by 120+ analysts in the Qualys Threat Research Unit. It builds peer cohorts by Geography, Industry, and Size,...
Qualys introduced the managed Risk Operations Center (mROC) Portal, a multi-tenant console for partners delivering managed services on its platform, formerly known as the MSSP Portal. Built on Qualys Enterprise TruRisk Management, it adds portfolio-wide...
Qualys describes its Gateway Service, included with the VMDR license, as a local caching and proxy layer between Cloud Agents and the TruRisk Platform so patch payloads are fetched once rather than downloaded individually by every asset. The post cites...
Qualys describes a pattern in which a cloud misconfiguration flagged as medium severity on a Tuesday is logged and queued behind 63 other tickets, then remains untouched three months later as automated provisioning workflows build on top of it and expand...
Qualys describes AI-Powered Scan Optimization in its TotalAppSec product, which profiles each application to build a tailored detection plan and drops scan times by up to 80% without skipping checks. The blog cites APIs carrying 83% of all web traffic, an...
Qualys reports that over the last 12 months enterprises deployed more than 8 million Google Chrome patches, with Visual C++ and .NET among the most delayed applications and an average mean time to remediation for complex apps of 5 months and 10 days. Of...
Qualys announced that its TotalAI product has achieved FedRAMP Moderate Authorization and is available on the Qualys Cloud Platform, removing what the post calls the main barrier to deployment for civilian agencies, DoD components, and defense contractors....
Qualys announced that its Enterprise TruRisk Management platform can ingest findings from AI code security tools such as Anthropic's Claude Code Security and OpenAI's Codex Security, which export structured findings as CSV with severity, location, weakness...
Qualys TotalCloud has achieved FedRAMP High Authorization, aligned to 421 NIST SP 800-53 High controls, for cloud, container, and application environments. The announcement frames the platform against CISA's Binding Operational Directives BOD 22-01, which...
Qualys' Threat Research Unit disclosed CVE-2026-46333, a logic flaw in the Linux kernel's __ptrace_may_access() function that lets an unprivileged local user read sensitive files and run commands as root on default installations of several major...
Qualys is extending its EOL/EOS Software Detection, previously available through CyberSecurity Asset Management for hosts, into container images and Kubernetes environments via its Kubernetes and Container Security product. The company says critical...
Qualys added peer-to-peer patch distribution to its Cloud Agent for Windows 6.5, letting endpoints share patch content locally instead of each pulling it from a centralized CDN. Qualys cites cuts of up to 92% in patch propagation time and 99%+ in WAN...
Qualys said it joined Anthropic's Project Glasswing and OpenAI's Trusted Access for Cyber programs by invitation, to explore the security implications of advanced AI systems and support their responsible deployment. Qualys, which reports more than 200...
Qualys introduced TruConfirm, TruLens, and Agent Val, a set of tools that validate whether vulnerabilities are actually exploitable by replicating attacker behavior with benign payloads rather than running malicious exploits. The company cites figures...
The OWASP Foundation released the eighth edition of its Top 10 Web Application Security Risks, its first major update since 2021, built on analysis of more than 175,000 CVE records and 589 Common Weakness Enumerations. Two new categories entered the list,...
Qualys published a practitioner's guide mapping its TotalAppSec platform to the OWASP Top 10 2025 categories, arguing that most AppSec programs are strong on documented web layers and known-vulnerability signatures but weaker on API authorization,...