Advisories
Qualys TruRisk Autonomous Remediation Cuts CISA KEV Fix Time to 14 Days
Qualys has added an autonomous remediation engine to its Enterprise TruRisk platform, slashing the average time to patch CISA‑KEV vulnerabilities from 1 month 19 days to 14 days. The system prioritizes exposures, validates fixes, and deploys them in controlled waves, eliminating over 90 % of remediation noise.
What Happened
Qualys announced the integration of an autonomous remediation engine into its Enterprise TruRisk Management Platform, designed to close the gap between rapid vulnerability exploitation and slow manual ticketing.
Impact
The new workflow reduces remediation noise by more than 90 % across 1,600+ CVEs and cuts the time to remediate CISA‑KEV vulnerabilities to 14 days, compared with the industry average of 1 month 19 days.
How It Works
Exposures are first ranked by threat level, business value, and environmental context. Validated by TruConfirm and Agent Val, only confirmed risks move to TruRisk Eliminate, where patch reliability is scored and deployments are staged in waves within user‑defined guardrails.
What to Do
- Enable the autonomous remediation feature in your TruRisk configuration.
- Define guardrails that match your organization’s risk tolerance.
- Review patch reliability scores and adjust deployment cadence accordingly.
- Monitor outcome metrics to verify exposure reduction over time.
Key Takeaways
By removing human latency from the remediation pipeline, defenders can shift from activity‑based metrics to evidence‑based exposure tracking, ensuring that critical patches are applied before attackers can exploit them.
Related vulnerabilities
CISA Expands KEV Catalog with Four New Exploited Vulnerabilities
CISA has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering critical flaws in Adobe Commerce, Microsoft Windows, and N‑central. The update highlights the agency’s push for rapid remediation of high‑risk flaws and reinforces BOD 26‑04’s prioritization rules for federal agencies.
Read briefing
CISA Adds New KEV: N‑Central Authentication Bypass Exploited
CISA has just added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog after confirmed real‑world exploitation. The flaw lets attackers bypass authentication in N‑Central via an alternate path, granting full control of the asset. Federal agencies are now required to patch it immediately under BOD 26‑04, and any organization should treat it as a top‑priority fix. CISA is also calling on the community to submit other actively exploited CVEs for catalog inclusion.
Read briefing
Qualys Demonstrates Enterprise-Scale Autonomous Remediation in 2026
Qualys has shown that autonomous, AI‑driven remediation can operate at enterprise scale, reducing the time from vulnerability discovery to patching to under 90 seconds. The approach relies on AI‑speed detection, hyper‑prioritization, and a patch reliability score to ensure rapid, reliable fixes. SecOps teams should evaluate integrating these capabilities to meet tight remediation windows such as CISA’s three‑day mandate.
Read briefing
CISA Adds New Chromium V8 Type‑Confusion CVE to KEV Catalog
CISA has incorporated CVE‑2026‑85046, a type‑confusion bug in Google Chromium’s V8 engine, into its Known Exploited Vulnerabilities list after confirmed active exploitation. The move reinforces the agency’s BOD 26‑04 mandate for rapid patching of high‑risk flaws on publicly exposed assets. Federal agencies must now prioritize remediation, while all entities are urged to adopt a risk‑based approach to vulnerability management.
Read briefing