{"id":134140,"date":"2025-10-23T08:00:00","date_gmt":"2025-10-23T07:00:00","guid":{"rendered":"https:\/\/www.intelligentcio.com\/me\/?p=134140"},"modified":"2025-10-21T10:37:11","modified_gmt":"2025-10-21T09:37:11","slug":"the-ceo-who-measures-risk-not-noise-qualys-sumedh-thakars-ceo-playbook","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/me\/2025\/10\/23\/the-ceo-who-measures-risk-not-noise-qualys-sumedh-thakars-ceo-playbook\/","title":{"rendered":"The CEO who measures risk, not noise: Qualys\u2019 Sumedh Thakar\u2019s CEO playbook"},"content":{"rendered":"\n

For someone who has spent most of their life in a tropical land, Pune, India, landing in Minneapolis in February with temperatures of -30 degrees Celsius can be daunting. Little did Sumedh Thakar realise that close to two decades later, he would become the CEO of Qualys, a cybersecurity company in the US.<\/p>\n\n\n\n

\u201cWe had to walk to the office across a frozen lake. It was a shock, and in hindsight I would say a crash course in resilience \u2013 observe quickly, adapt quickly and keep moving,\u201d recollects Thakar. For him, choosing computer engineering in a city known for its automotive sector wasn\u2019t an obvious route, but curiosity got the better of him. Thakar\u2019s first role was building pricing logic for an airline reservation system. \u201cThis was before I had ever taken a flight\u201d, added Thakar.<\/p>\n\n\n\n

While Thakar, CEO of a cybersecurity firm, doesn\u2019t see himself as a security visionary with grand plans, he\u2019s a pragmatist driven by curiosity. After starting his career at Patni Computers in Pune, he dreamed of working in the US, but the company he joined in California failed during the dotcom crash. <\/p>\n\n\n\n

\u201cGetting laid off isn\u2019t something that you discussed openly with people back home. Failure sticks to you in our culture,\u201d explained Thakar. Thus, the choice to join Qualys then wasn\u2019t a dream to build in cybersecurity; it simply was a serendipitous opportunity in front of him.<\/p>\n\n\n

\n
\"\"
Sumedh Thakar, CEO, Qualys <\/figcaption><\/figure><\/div>\n\n\n

However, the inflexion point came when internet banking was launched back home in India for the first time. Thakar realised then, despite the convenience it provided, his father preferred the cumbersome method of queuing up at the branch, as he did not trust the internet passwords.<\/p>\n\n\n\n

It crystallised a simple truth for me \u2013 technology only wins when people trust it. Cybersecurity would be the enabler of digital life,\u201d added Thakar. It was a decade ago that Qualys promoted a position that is now mainstream \u2013 there is no security without backup and no backup without security.<\/p>\n\n\n\n

Modern frameworks reflect that integrated posture. In 2017, Qualys introduced Active Protection, which utilises machine learning to detect and block ransomware targeting backups – a foundational step in protecting the very mechanisms of recovery.<\/p>\n\n\n\n

Today, AI sits across the platform, not just at the endpoint. The goal isn\u2019t only sharper detection; it is to reduce the cognitive load on defenders – to automate repetitive triage, suppress false positives, and surface the proper context so humans can make better decisions.<\/p>\n\n\n\n

\u201cPractically, we give customers a hacker\u2019s eye view of their estate so they can close likely pathways before adversaries exploit them. Crucially, we\u2019re leaning into agentic AI \u2013 goal-oriented, task-specific digital workers<\/em> that deliver outcomes, not open-ended chat,\u201d added Thakar.<\/p>\n\n\n\n

Within the Risk Operations Centre, Qualys has launched an AI marketplace where teams can \u201chire\u201d agents, such as a ransomware analyst, who will conduct a week\u2019s worth of evidence gathering, prioritisation, and remediation workflows under human oversight.<\/p>\n\n\n\n

\u201cAnyone who has tried to recruit a specialist for a two-week surge knows how impractical that is; digital workers let you scale capability immediately, while your scarce experts focus on judgments that genuinely need them,\u201d said Thakar.<\/p>\n\n\n\n

Along his career path, Thakar progressed from engineer to manager, to VP, and ultimately became the President and CEO of the company in 2021.<\/p>\n\n\n\n

\u201cAlong the way, we opened our Pune centre from a tiny space above a Blue Dart depot on JM Road; we interviewed candidates at a caf\u00e9 on the corner so the office wouldn\u2019t put them off. Today, a significant share of our innovation originates from Pune. The through-line is the same: seize the opportunity in front of you, learn fast, and focus on the societal value of secure, trusted systems,\u201d recollected Thakar.<\/p>\n\n\n\n

The math is simple: we all get 24 hours in a day. Thakar believes that to multiply impact, you must build and empower an exceptional team. \u201cEarly on, many of us try to do everything ourselves; you quickly learn you aren\u2019t brilliant at everything. And even if you were, you don\u2019t have the time to do everything. The shift is to hire people who are better than you in their domain, set a clear intent, remove blockers, and let them run. It is then that leadership becomes a force multiplier,\u201d explained Thakar.<\/p>\n\n\n\n

The job is about building clarity, alignment, and enablement: be precise about the outcome, ensure everyone shares the same picture of success, and create the conditions for talented people to execute effectively.<\/p>\n\n\n\n

\u201cThat also means being comfortable with approaches that aren\u2019t yours, provided they serve the goal – and having the discipline to step in only when intent and outcome diverge,\u201d said Thakar. However, what keeps him going is the race that never ends. When one paradigm is stabilised, the next arrives.<\/p>\n\n\n\n

\u201cIt is AI today, which will soon turn to quantum. Attackers evolve, so defenders must evolve faster. That perpetual motion keeps the work meaningful. There\u2019s always a hard problem to solve, and when you solve it well, the upside is societal: safer payments, trusted identities, resilient services that people can rely on,\u201d explained Thakar.<\/p>\n\n\n\n

It is Thakar\u2019s pragmatism that shapes how he reads this current wave. He explained that we\u2019ve gone from the cycle of client-server to virtualisation to cloud. In this AI-native era, companies compose AI services to deliver outcomes instead of writing everything from scratch.<\/p>\n\n\n\n

It\u2019s a fork in the road: incumbents that bolt AI onto old architectures will be outpaced by those willing to re-architect around it.<\/p>\n\n\n\n

Today, attackers run like businesses \u2013 they have targets, cadences and incentives. Artificial Intelligence lowers its cost to probe millions of assets and identify weak links that can lead to breaches. However, defenders too can wield the same leverage. \u201cThe approach is to inspect the environment exactly as an adversary would, close the most probable paths first and then use agentic AI to shoulder the heavy lift so experts focus on decisions that move risk,\u201d explained Thakar.<\/p>\n\n\n\n

\u201cI was never excited by open-ended chat for operations; goal-driven agents that produce measurable outcomes are the step-change. Pair those agents with governance and human-in-the-loop control and you get speed and<\/em> safety: what to fix, in what order, with what evidence –  executed faster than a human-only team can manage,\u201d added Thakar.<\/p>\n\n\n\n

None of this is carte blanche for chaos. Thakar argued for speed with guardrails: strong governance, clear ownership, visible metrics. Of the growing regions, for Qualys, META is both an ever-increasing revenue contributor and a co-creation zone. The company brings global lessons and also learns about local requirements, including sovereignty, speed, and sector context.<\/p>\n\n\n\n

In a region that\u2019s economically, technologically and politically dynamic, he sees the Gulf investing heavily in secure growth.<\/p>\n\n\n\n

\u201cA company is its people, so consequential missteps usually stem from three areas. First, vision: I wasn\u2019t clear enough about the destination. Second, alignment: I assumed a shared picture when it didn\u2019t exist – tell ten people to draw \u2018the big tree in grandma\u2019s backyard\u2019 and you\u2019ll get ten different trees. Third, people: I didn\u2019t hire early enough, or I hired for skills rather than fit, resilience and learning velocity,\u201d he added.<\/p>\n\n\n\n

No one makes a decision believing it\u2019s wrong; only outcomes render that verdict. The discipline is to learn fast, be transparent about reality and move forward with tighter alignment and stronger teams. \u201cWhen hiring, I\u2019d rather hear a candidate walk me through a failure\u2014what they learnt and how it changed their practice – than hear they\u2019ve \u2018never failed\u2019. In cyber, as in life, resilience compounds,\u201d said Thakar.<\/p>\n\n\n\n

His advice to tech leaders: don\u2019t fight the wave, lead it. Challenge teams to rethink architecture, workflows and operating models for AI-native execution. Tie investments to risk-based outcomes, what threats are removed, which controls are automated, which costs are taken out, and measure them.<\/p>\n\n\n\n

\u201cPush for speed with strong governance. People get comfortable; part of the CEO\u2019s job is to keep the organisation constructively uncomfortable so it doesn\u2019t get left behind. Our own natively built agentic-AI capabilities within the Risk Operations Centre came from that constant internal challenge,\u201d Thakar concluded.<\/p>\n","protected":false},"excerpt":{"rendered":"

For someone who has spent most of their life in a tropical land, Pune, India, landing in Minneapolis in February with temperatures of -30 degrees Celsius can be daunting. Little did Sumedh Thakar realise that close to two decades later, he would become the CEO of Qualys, a cybersecurity company in the US. \u201cWe had […]<\/p>\n","protected":false},"author":4338,"featured_media":119094,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[20273,14804,19391],"tags":[22,1530,908,562,2988,184],"class_list":["post-134140","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-c-suite","category-cybersecurity","category-hot-topic","tag-cloud","tag-cybersecurity","tag-digital-transformation","tag-middle-east","tag-qualys","tag-uae"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/134140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/4338"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=134140"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/134140\/revisions"}],"predecessor-version":[{"id":134142,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/134140\/revisions\/134142"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/119094"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=134140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=134140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=134140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}