Qualys launches first agentic AI-powered Risk Operations Center for cyber defense

Qualys is introducing two major innovations to Enterprise TruRisk Management (ETM), the industry’s first Agentic AI-powered Risk Operations Center (ROC), designed to streamline and accelerate autonomous cyber risk management. Qualys unveiled a marketplace of Cyber Risk AI Agents delivering real-time risk insights across all attack surfaces, prioritized by business impact. It also launched the new Cyber Risk Assistant, an intuitive, prompt-based interface, that translates complex exposure data into clear, context-driven actions.

The new agentic AI capabilities reduce risk and operational costs by autonomously remediating with speed, scale, and accuracy to power a smarter, more efficient ROC.

Marketplace of Ready-to-use Cyber Risk AI Agents

Organizations can deploy pre-built or custom no-code Cyber Risk Agents to automate specific tasks and deliver targeted outcomes through the Qualys Agentic AI marketplace. These specialized Cyber Risk Agents work independently as a skilled digital workforce, enhancing your security team’s capabilities. The marketplace features core Agents such as:

·         Agent Nova: Qualys’ Agent Nova automatically discovers external assets and exposures without requiring manual intervention or dashboard monitoring. It prioritizes scans based on high-risk indicators like open ports, outdated software, and known vulnerabilities, using threat intelligence tailored to the organization.

·         Agent Vikram: Agent Vikram continuously monitors multi-cloud environments for exposure gaps, using context-aware decision-making to remediate them intelligently and securely. It closes gaps through autonomous discovery, smart scan selection, and automated remediation—detecting unknown assets and applying the optimal method (API-based, agent-based, snapshot, or perimeter) based on workload type.

·         Agent Chang: With Agent Chang, compliance becomes continuous and proactive – reducing risk, streamlining audit prep, and eliminating last-minute surprises. It automates evidence collection and real-time mapping to compliance frameworks like ISO, NIST, PCI-DSS, and FedRAMP across all in-scope assets.

·         Agent Nyra: Qualys’ Agent Nyra provides threat-informed risk prioritization. It autonomously monitors real-time adversary behaviour and delivers tailored threat intelligence. It alerts teams to relevant threats and can trigger automated response actions, like patching or mitigation.

·         Agent Sara: Agent Sara is an expert in all things related to the Patch Tuesday lifecycle. It streamlines the entire MSPT process by automatically detecting and prioritizing high-risk vulnerabilities, such as CISA KEVs and ransomware-linked threats, and mapping them to the correct patches. When patches can’t be applied immediately, Agent Sara automatically identifies and applies temporary mitigations to keep systems secure, while end-to-end automation helps IT teams reduce risk, meet SLAs, and simplify Patch Tuesday management.

·         Agent Sophia: Traditional scan-and-report methods leave critical gaps in vulnerability management. Agent Sophia changes this with a self-healing, autonomous system that uses multiple AI agents to discover, prioritize, and remediate vulnerabilities across the IT environment—guided by human oversight and governed by safety policies.

·         Build Your Own AI Agent – Security teams can create custom, no-code, pretrained AI agents tailored to their specific business needs. These agents can be trained to perform specialized tasks autonomously and reused as needed.

“Cybersecurity has never been able to keep pace with the volume of enterprise exposures due to human-scale prioritization and remediation,” said Tyler Shields, principal analyst at Enterprise Strategy Group (ESG). “Integrating Agentic AI into the Qualys platform marks a major leap—from reactive response to real-time risk reduction. With autonomous remediation and intelligent prioritization, this type of innovation enables faster risk reduction, more efficient resource usage, and greater accuracy in recommended actions. This evolution shifts security teams from tactical responders to strategic agentic AI orchestrators, bringing us closer to a future of self-healing cybersecurity.”

Cyber Risk Assistant

The new Qualys Cyber Risk Assistant is a prompt-driven interface that helps teams navigate the risk journey, translate millions of exposures, and deliver context-aware risk insights with autonomous operations. The Cyber Risk Assistant helps teams convert complex exposure data into clear, actionable insights with autonomous execution.

“Qualys Agentic AI, embedded into Enterprise TruRisk Management is transforming how organizations manage cyber risk and powering a smarter, more agile Risk Operations Center,” said Sumedh Thakar, President and CEO of Qualys. “It’s ushering in a new era where CISOs can augment their security teams with intelligent AI agents that perform autonomous analysis and take decisive, high-impact actions to reduce risk faster, more strategically, and with greater efficiency