Qualys has released TruRisk Eliminate 2.0 with TruConfidence, which it describes as a remediation intelligence and orchestration engine designed to support more automated vulnerability and exposure remediation across hybrid environments.
The company said the update is intended to help security and IT teams respond faster as artificial intelligence accelerates vulnerability discovery and exploitation timelines, putting pressure on remediation processes that rely on manual workflows, ticketing systems and multiple point tools.
Security teams “must not only determine what needs to be fixed, but also account for controls already protecting the environment, select the appropriate, safe remediation path, manage deployment risk across increasingly complex environments and verify that remediation succeeded without disrupting business operations,” the company said.
“For years, security teams found vulnerabilities and IT operations teams patched them. That handoff was built for exploitation timelines measured in weeks. With frontier AI, those timelines are now measured in hours, and neither team can close that gap alone,” said Jon Nelson, principal advisory director in the Security & Privacy practice at Info-Tech Research Group. “Qualys TruRisk Eliminate gives security a viable path to drive remediation at machine speed, with patch reliability scoring, progressive rollouts, and patchless mitigation that reduce the risk of disrupting operations.”
According to Qualys, TruConfidence consolidates features introduced over the past two quarters, including an AI-based Patch Reliability Score, wave-based remediation orchestrated by “Agent Sara”, peer-to-peer distribution, and compensating controls informed by patch deployment data. The company said its approach is aimed at reducing exposure while avoiding duplicated effort where controls already exist.
Qualys said TruRisk Eliminate 2.0 extends remediation beyond agent-based endpoints to “perimeter devices, cloud, and applications” and can apply actions such as patching, mitigation without a patch, uninstalling, isolating systems or applying custom fixes. The company said assets that cannot run an agent can be remediated via Qualys scanners and integrations with existing security and IT tools.
The company also positioned the update as support for situations where patching is not possible or not the preferred option, saying TruConfidence can account for existing security controls and apply third-party compensating controls through tools customers already operate.
To reduce operational risk, Qualys said TruRisk Eliminate can monitor system health after changes through integrations including Dynatrace, using indicators such as CPU and memory behaviour to detect potential service impacts. It also cited “Patch Failure Analysis” intended to explain failed changes and recommend corrective actions, including rollback.
“Autonomous exploitation requires an equally automated remediation, but organisations’ hesitation isn’t about automation, it’s a lack of confidence that it won’t cause an outage”, said Sumedh Thakar, president and CEO of Qualys. “That’s why we’re excited to introduce TruRisk Eliminate with TruConfidence, moving beyond patching to turn remediation intelligence into action with the Risk Operations Centre (ROC) so organisations have the confidence to reduce cyber risk quickly while reducing outage concerns.
Qualys said TruRisk Eliminate 2.0 with TruConfidence is generally available and provided as a free upgrade for existing TruRisk Eliminate customers. The company said it will demonstrate its approach at ROCon Americas 2026 in Austin, Texas, on October 14-15.
