Qualys introduces Agent Val to help organisations move beyond assumption-based vulnerability management, using AI-driven validation to identify exploitable risks and drive faster, more effective remediation.
Qualys, a leading provider of cloud-based IT, security and compliance solutions, has launched Agent Val within Enterprise TruRisk Management (ETM) to bring safe, agent-led exploit validation and autonomous risk remediation to the Risk Operations Centre (ROC). Agent Val represents a fundamental shift in vulnerability and exposure management from assumption-driven prioritisation to evidence-based execution, accelerating response, reducing wasted effort and delivering measurable reductions to cyber-risk.
Research shows that known exploited vulnerability volume has grown 6.5 times in the past four years, while the percentage of critical vulnerabilities still open at Day 7 has increased – proof that manual remediation has hit a hard ceiling. To make matters worse, the time to exploit has now shrunk to minus one day, meaning attackers are exploiting them before patches exist. For CISOs, the challenge is closing the gap between vulnerabilities that look severe on paper and those truly exploitable in production environments, so teams are not wasting valuable time remediating low-impact issues and missing other dangerous exposures. Organisations need proof of exploitability, not assumptions, to move faster and reduce risk with confidence.
Agent Val, powered by TruConfirm, serves as the Agentic AI orchestration layer within ETM. It coordinates and identifies high-risk exposures, validates exploitability in production using business context and asset criticality and feeds confirmed results directly into ETM to drive prioritised remediation and measurable risk reduction with minimal manual effort, shifting security teams from chasing volume to reducing verified risk.
Agent Val enables organisations to:
• Validate real exploitability – Agent Val analyses exposure signals across assets and determines what should be validated first based on attacker relevance, business context and exposure. Then, it uses TruConfirm to safely test exploitability in the live environment, providing evidence-based confirmation of whether an exploit path is open, blocked by controls or unreachable. The result is a 90%+ reduction in remediation noise, so security teams can stop chasing findings that cannot be exploited.
• Mitigate confirmed risks – Once risk is confirmed, ETM prioritises that exposure to the top of the remediation queue and extends response beyond patching deployment with mitigation controls and isolation, where patching is not feasible. This enables targeted mitigation to reduce exposure quickly, resulting in 70% faster time-to-remediate on confirmed exploitable findings and allowing engineering teams to prioritise exposures that matter.
• Prove risk reduction – After mitigation, Agent Val runs validation again using TruConfirm to verify that the exploit path is closed, controls are working and risk has been reduced. With over 1,600 CVEs covered, Agent Val provides unmatched coverage with no new sensor footprint required. Teams now have proven exploitability evidence captured for board reporting to show measurable risk reduction.
“Having a vulnerability does not equal risk,” said Sumedh Thakar, President and CEO of Qualys. “What matters is whether an attacker can successfully reach and execute an exploit path in your environment. As exploit timelines shrink and adversaries use AI to move faster, the industry can’t keep running on assumptions. Agent Val in ETM moves the Risk Operations Centre (ROC) from ‘we think’ to ‘we know’ to ‘it’s been taken care of’ with minimal manual effort, giving the power of AI back into the hands of defenders to drive measurable risk reduction at scale.”
