Qualys, Inc. (NASDAQ: QLYS) has made TruRisk Eliminate 2.0 generally available with a new TruConfidence intelligence and orchestration engine designed to help security and IT teams reduce cyber exposure while limiting the operational disruption that can accompany patching and other remediation work. The company said the upgrade is available at no additional charge to existing TruRisk Eliminate customers.
TruConfidence combines capabilities Qualys introduced during the past two quarters, including a Patch Reliability Score, wave-based remediation orchestrated by its Agent Sara tool, peer-to-peer distribution and compensating controls. Qualys said the engine uses intelligence from its record of half a billion patch deployments to select a remediation path, stage a rollout and verify the outcome.
The product addresses a familiar tension in vulnerability management: security teams need to close high-priority exposures quickly, but IT operations teams must avoid changes that cause outages or performance problems. Qualys positions the update as an Autonomous RemOps operating model that joins remediation intelligence with the controls used to carry out a fix.
That distinction matters in hybrid environments, where an exposure can sit on an endpoint, a perimeter device, a cloud workload or an application and the safest response may differ by system. The company said the engine is meant to make that response a controlled operational process rather than a sequence of isolated remediation decisions.
According to the company, TruRisk Eliminate can now act across perimeter devices, cloud environments and applications as well as agent-based endpoints. Available actions include patching, applying a mitigation when a patch is unavailable, uninstalling software, isolating an asset or applying a custom fix. Assets that cannot run an agent can be addressed through Qualys scanners and existing security and IT integrations, the company said.
The engine is also intended to avoid treating every finding as a new manual ticket. Qualys said TruConfidence first accounts for protections already in place, then identifies compensating controls through customers’ existing security tools when an exposure remains. That approach is meant to let teams reduce exposure while they plan or validate a permanent remediation, rather than leaving an issue open until a patch is ready.
Operational checks are a central part of the design. After a remediation action, Qualys said the platform can monitor system health through integrations for indicators such as CPU or memory issues. Its Patch Failure Analysis capability is designed to explain a failed outcome and recommend a corrective action, including rollback, according to the company. The source does not provide independent performance results for the new engine.
Qualys said the new version is generally available now. It described the release as a free upgrade for current customers but did not disclose separate pricing, a rollout timetable for all capabilities or customer deployment results. The company will demonstrate its RemOps approach at its ROCon Americas event in Austin, Texas, on Oct. 14 and 15.
For enterprise security and operations teams, the immediate benefit is a more structured way to automate remediation while retaining controls around rollout and system health. Traditional workflows often separate risk identification, ticketing, change execution and verification across different teams and tools. Qualys’ competitive test will be whether its reliability scoring, compensating controls and post-change monitoring give customers a practical alternative to that fragmented process without introducing a new source of operational risk.