Qualys TruRisk Eliminate 2.0 AI Closes Vulnerability Gap With Machine-Speed Patch Deployment

Qualys announced TruRisk Eliminate 2.0 with TruConfidence, a new remediation intelligence and orchestration engine designed to power Autonomous RemOps. According to Help Net Security, this release marks a shift toward autonomous operations in the frontier AI era. The engine combines advances in remediation intelligence and orchestration to help organizations eliminate cyber risk at machine speed while maintaining business resiliency and continuity.

How it unfolded

• Qualys released TruRisk Eliminate 2.0, integrating the TruConfidence engine to automate remediation workflows.
• The update builds on previous capabilities introduced over the past two quarters, including AI-powered scoring.
• Agent Sara now orchestrates intelligent wave-based remediation, leveraging peer-to-peer distribution and compensating controls.

Who is affected

Security teams managing complex environments face increasing pressure as AI accelerates vulnerability discovery and exploitation. According to Help Net Security, traditional remediation processes relying on manual decisions and tickets are no longer sufficient for current exploitation timelines. Jon Nelson of Info-Tech Research Group noted that security and IT operations teams can no longer close the gap alone, as exploitation windows have shrunk from weeks to hours.

The fix

Qualys states that TruRisk Eliminate helps organizations reduce exposure with the least disruptive remediation paths. The system accounts for existing controls to avoid duplicate protections. It utilizes patch reliability scoring, progressive rollouts, and patchless mitigation to minimize operational disruption. These features are designed to verify that remediation succeeds without interrupting business operations, addressing the critical constraint of remediation speed in modern security environments.

What made it possible

The shift toward autonomous remediation addresses the growing disparity between rapid vulnerability exploitation and slower manual patching cycles. Security teams must now evaluate existing controls, select safe remediation paths, and manage deployment risks across complex environments simultaneously. This approach relies on intelligent orchestration to prioritize fixes based on actual risk rather than simple vulnerability counts. By integrating remediation intelligence with deployment automation, organizations can maintain security posture without relying solely on human intervention for every patch decision.

What to do and how to stay safe: Qualys

• Review current remediation workflows to identify bottlenecks caused by manual ticketing or handoffs between security and IT teams.
• Evaluate existing compensating controls to determine which vulnerabilities are already mitigated, reducing the need for immediate patching.
• Monitor patch deployment success rates and rollback frequencies to ensure automated processes do not disrupt business operations.
• Assess the reliability scores of pending patches to prioritize deployments that offer the highest security benefit with the lowest operational risk.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is TruConfidence?

TruConfidence is the cyber risk remediation and orchestration intelligence engine that powers Qualys TruRisk Eliminate 2.0.

How many patches has Qualys deployed to build this engine?

The engine is built on data from half a billion real-world patch deployments, according to Help Net Security.

What is the rollback rate for these deployments?

Qualys reports a rollback rate of less than 0.1% for its patch deployments.