Qualys’ ROCon 2026 conference highlighted the vendor’s commitment to providing solutions for the three key aspects of cloud security. 

    1. Risk operations instead of security operations. Qualys has always emphasized tackling business risk (uptime, availability, business criticality of infrastructure and minimized threat surface) instead of trying to fix every discovered vulnerability. At ROCon 2026, the vendor announced its plans to fortify its Discovery, Prioritization, and Remediation triad in all of its solutions, including Enterprise TrueRisk Management (ETM). Prioritization of resources and artifacts takes input from configuration artifacts (such as AWS configuration of EC2 instances, S3 buckets, Azure configuration of virtual machines and Azure blobs storage), but also from potential attack path maps and business users’ input.  For example, ETM’s Identity Security Posture Management (ISPM) aggregates all aspects of identity risk and automatically generates a risk score for each human (business and admin user), agent, and machine identity – allowing for easier prioritization to then feed remediation actions. 
    2. AI agents everywhere. Qualys announced several, purpose-built AI agents to help with discovery, prioritization and remediation. In addition, Enterprise TruRisk Studio, a component of ETM, allows end user organizations to develop custom agents in the Qualys ETM solution by 1) composing existing agents from other platforms (including Agentforce, ChatGPT, Microsoft Copilot) and 2) AI agent aided low-code/no-code configuration. Users define agent objectives, tasks, and authorized tools, including MCP servers, without writing code. Agents remain owned by the organization and can optionally be shared through the Qualys Agentic Marketplace. 
    3. Post Quantum Security and Cryptography revolving around cert management. In Certificate View, the vendor supports discovering and partially remediating quantum vulnerable cryptography across its clients’ infrastructures by scheduling certificate rotation.   

 Qualys’ long-term ability to maintain cloud security differentiation hinges on the following factors: 

    • CIEM. How well can the vendor discover, integrate with on-prem environments to identity threats and privilege escalation? 
    • SSPM and data protection. How can the vendor extend its current, mainly public cloud platform (AWS, Azure, GCP) and on-prem centric portfolio to cover SaaS apps in more depth, including M365, Salesforce, ServiceNow? 
    • True AI agent runtime, identity and data protection controls. How well can the solution expand from its current coverage of AWS Bedrock, Azure Foundry, and Google Vertex client-developed agent security to new, currently unsupported agent platforms, such as Anthropic, OpenAI, and Perplexity runtime, identity, and data protection controls? 
    • Expanded and Automated PQS mitigation. Beyond Cryptographic Bill of Materials (CBOMs) and certificate rotation, can the vendor offer solutions for network traffic-based discovery of quantum vulnerable asymmetric key exchanges and provide remediation at the infrastructure component level? 

 Forrester clients interested in discussing risk operations in cloud security: Please book an inquiry or guidance session with us. 

Share