Qualys Doubles Down On AI Agents In Cloud Security And Risk Operations

Qualys’ ROCon 2026 conference highlighted the vendor’s commitment to providing solutions for the three key aspects of cloud security.

1. 1. Risk operations instead of security operations. Qualys has always emphasized tackling business risk (uptime, availability, business criticality of infrastructure, and a minimized threat surface) instead of trying to fix every discovered vulnerability. At ROCon 2026, the vendor announced its plans to fortify its discovery, prioritization, and remediation triad in all of its solutions, including Enterprise TruRisk Management (ETM). Prioritization of resources and artifacts takes input from configuration artifacts (e.g., AWS configuration of EC2 instances, S3 buckets, Azure configuration of virtual machines, and Azure Blob Storage) but also from potential attack path maps and business users’ input. For example, ETM’s identity security posture management aggregates all aspects of identity risk and automatically generates a risk score for each human (business and admin user), agent, and machine identity — allowing for easier prioritization to then feed remediation actions.
   2. AI agents everywhere. Qualys announced several purpose-built AI agents to help with discovery, prioritization, and remediation. In addition, Enterprise TruRisk Platform, a component of ETM, allows end-user organizations to develop custom agents in the Qualys ETM solution by composing existing agents from other platforms (including Agentforce, ChatGPT, and Microsoft Copilot) as well as AI agent-aided low-code/no-code configuration. Users define agent objectives, tasks, and authorized tools — including MCP servers — without writing code. The agents remain owned by the organization and can optionally be shared through the Qualys agentic AI marketplace.
   3. Post-quantum security and cryptography revolving around cert management. In Certificate View, the vendor supports discovering and partially remediating quantum-vulnerable cryptography across its clients’ infrastructures by scheduling certificate rotation.

Qualys’ long-term ability to maintain cloud security differentiation hinges on the following factors:

• • Cloud infrastructure and entitlement management. How well can the vendor discover and integrate with on-premises environments to identity threats and privilege escalation?
  • SaaS security posture management and data protection. How can the vendor extend its current, mainly public cloud platform (AWS, Azure, or Google Cloud) and on-premises-centric portfolio to cover SaaS apps in more depth, including Microsoft 365, Salesforce, and ServiceNow?
  • True AI agent runtime, identity, and data protection controls. How well can the solution expand from its current coverage of Amazon Bedrock, Microsoft Foundry, and Google Gemini client-developed agent security to new, currently unsupported agent platforms, such as runtime, identity, and data protection controls maintained by Anthropic, OpenAI, and Perplexity?
  • Expanded and automated post-quantum security mitigation. Beyond cryptographic bills of materials and certificate rotation, can the vendor offer solutions for network traffic-based discovery of quantum-vulnerable asymmetric key exchanges and provide remediation at the infrastructure component level?

Forrester clients interested in discussing risk operations in cloud security should book an inquiry or guidance session with us.