The New Speed of Cyber Risk: From Knowing to Acting | QualysSumedh w Intro

📅 Sep 24, 2026 Qualys, Inc. 14 MIN 17 VIEWS 4 SEGMENTS · 2 SPEAKERS

Boards are asking how you will fight autonomous AI exploits. Qualys CEO Sumedh Thakar explains zero-day remediation: detect, prioritize, and fix critical findings within 24 hours. Follow Qualys on BrightTALK for more Cyber Risk Series talks: https://www.brighttalk.com/channel/11673 Explore the Qualys Enterprise TruRisk Platform: https://www.qualys.com/etm Build your Risk Operations Center (ROC) today: https://www.qualys.com/roc In this Cyber Risk Series keynote, Sumedh Thakar traces the shift from scanning every 90 days to a world where attackers use AI to reverse engineer patches within hou...

What Sumedh Thakar said

Written from the verified transcript and checked against it. Every figure links to the moment it was said.

Sumedh Thakar, CEO of Qualys, argued that the shift from zero-day vulnerabilities to zero-day remediation is being driven by AI, which both accelerates attackers' ability to reverse-engineer patches and offers defenders new tools. He outlined a three-pillar approach: fast detection, prioritization, and remediation within 24 hours. Thakar identified the critical bottleneck as the gap between vendor advisory release and detection in customer environments, which currently takes days. He introduced 'Insta Scan,' an agent AI capability that continuously monitors inventory and advisories, enabling near-instant exposure detection. He cited a real test: during a recent Patch Tuesday, Qualys posted detections in 13 minutes for over 1,000 vulnerabilities. He also mentioned two other agents: 'Agent Val' for exploit validation and 'Agent Safiation' for remediation, positioning these as 'three musketeers' to achieve 24-hour remediation.

Key takeaways

Thakar claims Qualys posted detections for nearly 1,000 Patch Tuesday vulnerabilities within 13 minutes of Microsoft's advisory release.
He aims to reduce the advisory-to-detection gap to under 60 minutes, calling it 'the golden hour'.
He defines 'zero-day remediation' as fixing or deploying patches within 24 hours of an advisory.
Thakar asserts that attackers are reverse-engineering patches faster, shifting the threat from unknown to known vulnerabilities.

Numbers and commitments

Figure	What it refers to	Type	At
24 hours	Target time to remediate after a vendor advisory	timeline	0:22
13 minutes	Time to post Patch Tuesday detections after Microsoft advisory	metric	7:33
60 minutes	Target for posting detections after advisory release	timeline	4:06
one or 2%	Portion of findings that need urgent fixing	metric	4:06

Chapters

0:00Introduction and context
0:22Shift to zero-day remediation
4:06Three pillars of security
7:33Golden hour and Insta Scan

Host 0:00 ↗

All right, so now we're ready to get rolling and I'm going to have the honor of welcoming Sumedh Thakar. He's the president CEO of Qualys. I noted the conversation we had together earlier. He's going to explore why closing the gap between exposure and action is becoming a business imperative and what it takes to build a security operation that can keep pace. Sumedh, over to you.

1 more exchange in this transcript

Cite this transcript

APA, MLA, BibTeX

APA

Thakar, S. (2026, September 24). The New Speed of Cyber Risk: From Knowing to Acting | QualysSumedh w Intro [Interview transcript]. Qualys, Inc.. CEOInterviews.AI. https://ceointerviews.ai/interview/2926986/

MLA

Sumedh Thakar. "The New Speed of Cyber Risk: From Knowing to Acting | QualysSumedh w Intro." Qualys, Inc., 24 Sep. 2026. Transcript, CEOInterviews.AI, https://ceointerviews.ai/interview/2926986/.

BibTeX

@misc{thakar2026_2926986,
  author       = {Sumedh Thakar},
  title        = {The New Speed of Cyber Risk: From Knowing to Acting | QualysSumedh w Intro},
  howpublished = {Interview transcript, Qualys, Inc.. CEOInterviews.AI},
  year         = {2026},
  month        = {sep},
  url          = {https://ceointerviews.ai/interview/2926986/},
  note         = {Speaker-attributed transcript with timestamps}
}

▶

Key Quotes (2)

“The big change that has happened is that the boards are asking the question. How are you going to fight autonomous AI based exploits? If your answer is you're going to do manual remediation or manual work, that's not really what they're looking for. Management wants to know that you're going to respond with autonomous AI exploits with autonomous AI based remediation. So we talked a little bit abou”

▶ 1:05

“We are moving from the concept of a zero day vulnerability more towards the idea of zero day remediation and what does that mean? I'm more of an optimist about the AI models and so when I look at it I feel that as these models get better there are more open source models as well, every software development shop will have access to use these models to detect their own vulnerabilities before attacke”

▶ 2:22 CONTROVERSIAL

Mentioned in this interview

Cisco CSCO: Listed as an example vendor whose advisories are monitored.

Red Hat RHT: Listed as an example vendor whose advisories are monitored.

Microsoft MSFT: Microsoft is the vendor whose advisory API was used to test detection speed.

Agent Val: Qualys agent that performs exploit validation to confirm actual exploitability.

Agent Safiation: Qualys agent that handles remediation, one of the three musketeers.

Earlier, on the same topics

“The best way for you to protect yourself against any exploitation is to make sure that you fix your misconfigurations and you patch your systems. It's just that if attackers are reverse engineering patches to create exploits and attack you within the first 24 hours of a new patch coming out, you don”

zero-day remediation · Sep 08, 2026 at 6:16 →

“40 million of those 150 million are already autonomous patches with zero human touch being used. Customers are saying if it's a laptop and it's a Chrome vulnerability, don't even scan for it. Just automatically apply an update. So the customer is able to tell their board that on our employee endpoin”

May 01, 2026 at 55:35 →

“Autonomous remediation is not the future. Autonomous remediation is already here and the forward-looking organizations today are already deploying millions and millions of patches autonomously with almost no outages.”

Jun 18, 2026 at 19:55 →

“Risk management is all of our business — that is what cyber security is about; insurance is a key part of risk management, and you must ask how much risk you can mitigate, accept, or transfer to a cyber insurance company. Ninety‑nine percent of people don't think like that, and that's where The Rock”

risk management · Aug 23, 2025 at 13:50 →

Every Sumedh Thakar interview →

More interviews with Sumedh Thakar

Fix What Matters: Qualys CEO on Prioritizing Cyber RiskOct 20, 2026 · SecurityInfoWatch.com · 19 min
Cybersecurity, Cricket, and the Mindset to Win | SF UnicornsSep 24, 2026 · Qualys, Inc. · 20 min
Mythos Turned 30 Days Into 24 Hours | Qualys' CEO Sumedh ThakarSep 08, 2026 · KBI Media · 42 min
Qualys: Fight Autonomous AI Exploits With Autonomous RemediationAug 14, 2026 · Dark Reading · 10 min
Black Hat USA 2026: 40 Million Patches Deployed Autonomously | QualysAug 12, 2026 · ITSPmagazine · 11 min
Sumedh Thakar, Qualys | Black Hat 2026Aug 06, 2026 · SiliconANGLE theCUBE · 25 min

All Sumedh Thakar transcripts →

About Sumedh Thakar

Sumedh Thakar, president and CEO of Qualys, has recently discussed the accelerating pace of cyber threats and the need for organizations to shift from traditional vulnerability management toward risk-based prioritization and faster remediation. At Qualys’ ROCon conference in Austin, Texas, he spoke with Steve Lasky of Endeavor Business Media about moving security teams beyond counting vulnerabilities to understanding which exposures represent actual business risks, and he emphasized the importance of building confidence in automated patching to avoid business outages. He also argued that with attackers using AI to reverse engineer patches within hours, organizations no longer have the 30 days they once had to fix critical vulnerabilities, and he advocated for what he called “zero-day remediation” — detecting and addressing critical findings within 24 hours of an advisory’s release. In other appearances, Thakar addressed the impact of the Mythos vulnerability, describing it as accelerating an existing threat rather than creating a new one, and he noted that boards are now asking how companies will counter autonomous AI-based exploits, with manual remediation no longer a sufficient answer. He also discussed the role of AI in both attack and defense, suggesting that improved models could help software developers detect vulnerabilities before attackers do, potentially reducing zero-day risks. Additionally, Thakar participated in a fireside chat at Black Hat 2026 comparing cricket and cybersecurity, where he highlighted Qualys’ early involvement in promoting cricket in the United States and drew parallels between calm execution in sport and effective security strategy.

All Sumedh Thakar appearances → Qualys, Inc. on YouTube →