Hi everybody. I'm Steve Laskkey. I am the editorial director for Endeavor Business Media for the Security Group, and I am the guest of Qualys this week in Austin for their RockCon conference, which is talking about risk mitigation in the cybersecurity world and specifically for AI. And nothing could be more apropos or timely than that. And I am very privileged today to have Sumedh Thakar. Sumedh is the president, CEO of Qualys, where he leads the company's vision, strategic direction and execution. A cybersecurity engineer and a longtime Qualys executive, Thakar joined the company in 2003 and rose through the engineering and product leadership roles before becoming president in 2019 and CEO in 2021. He previously served as their chief product officer, overseeing engineering, product management, cloud operations, DevOps and customer support, and was very instrumental in expanding the company's cloud platform beyond vulnerability management into a broader portfolio of security and compliance capabilities. And today he's focused on transforming how organizations manage cyber risk as artificial intelligence accelerates both attacks and defensive operations.
So, Sumedh, your opening address today was very enlightening, very apropos, and you know, it actually shows that I knew what I was talking about when I put your questions together because we're pretty much in alignment here. So, you know, you've argued that cybersecurity needs to move beyond simply identifying vulnerabilities towards understanding which exposures represent actual exploitable business risks. So, what has to change inside security organizations for that shift to happen, and why has the industry been so slow to make that happen?
Well, first of all, Steve, thank you very much for coming to our conference. The RockCon conference is really about a risk operations conference, and what we focus on is sort of bringing industry folks together here across our customers, partners, to talk about how do we move forward in this world of AI in being able to operationalize our risk management. And so the question that you ask is really at the crux of what we do in cybersecurity, and cybersecurity is a risk management function for the business. At the end of the day, what we're trying to do is within, you know, obviously a limited budget as was given to cyber folks, within that budget, where should we spend that money to get the maximum benefit for the company? Now, what is a benefit from a cyber perspective when you talk about ROI for cyber? And it's not that we didn't have an attack. That's not really how we look at it. It's basically being able to think in terms of the loss to the business. And if we can say, look, by investing a million dollars in cybersecurity, we are protecting an $80 million possible loss that the business could have.
And you know, and through the sessions I sat through this morning, I mean, the whole tenor of the conference has really been, you know, let's forget about trying to sell cybersecurity and let's concentrate on telling folks what your risk is and what you're going to lose from a monetary, reputational and business perspective if you don't get your stuff together.
Absolutely. Because risk management is that's what it is, right? It is not a guarantee that something's going to happen. It is about looking at what the risk is. And the risk is not just the inherent risk of the particular device. It's also the environment that that particular device is in. Or you know, when we talk about physical security buildings, you know, does just keeping if you leave a door or a window open, does it definitely mean that you're going to have a loss? No. It depends on the threat environment around. Maybe you are in areas where you leave your door, window open, you have absolutely no worry about loss. You don't have to worry about it. There are other situations where you have to think through like, hey, their threat environment is actually, you know, built in a way that is actually not very harmful for us. And so I feel like everything we do in cyber needs to anchor to the clarity of by doing this, how are we reducing and how much risk are we reducing? And I think that's where understanding that we don't need to fix everything, you know, we just need to fix the stuff that actually matters to the business. And that's been sort of my focus the last few years is the idea of coming up with the risk operation center. The Rock has been about how do we help people operationalize risk management where it becomes more automatic, it becomes more programmatic, and is something that we are not always surprised and shocked every time something new comes up.
You know, and you know, I find your talk about the risk operation center, or the Rock as you call it, a fascinating subject because, you know, it's a complement to the traditional SOC or GOC that folks in our industry at the enterprise level are using. So, you know, what problems does a Rock solve that today's SOC doesn't, as far as vulnerability management and security risk teams aren't solving, and what do you ultimately see the Rock becoming as a new pillar of enterprise security operations?
That's a great question. And it's something I get all the time from CISOs because the industry has come from having a SOC. And I think like with any security exercise, your focus always first is to react to a breach and make sure that you have the right procedures and processes and people in place to react. And that's where the SOCs came about was the idea that if somebody does get into my environment, how am I going to react to that? And SOCs are absolutely needed in that case. However, now once we have gotten better at the SOC, the question then becomes, well, how do we proactively prevent someone from coming into the environment? And that, to my mind, is about assessing and mitigating the risk of somebody getting into your environment. And that's where the risk operation center fundamentally a bit of a different approach. It's more long-term approach. It's not a short-term let's get the current incident resolved. It's about planning, understanding your risk, where your crown jewels are, and how do we build it in a way that you can actually complement the SOC because you want to do your best to make sure nobody gets in, but you also want to make sure that if somebody does get in somehow, you have a way to protect yourself from that as well. And so the SOC and the Rock in my mind are different architecture, different mindset of the people, but they work with each other. And it's ultimately the same goal, right? And I give the very basic example as I did in my keynote is that about when you buy a car, you know, your car has amazing airbags and the airbags are there if you hit something, you have great airbags that will protect you, right? And that's your SOC is if something happens, somebody gets in, you can protect. But just because you have an airbag doesn't mean you are going to buy a car with no brakes, right? You want to do proactive risk management. If you think you're going to hit something, you're not going to be like, 'Oh, that's fine. I have airbags. Let me go hit it.' You're going to be proactively looking to also brake. And I think that's the same because you have brakes doesn't mean you're not going to buy a car without airbags. And I think that's the Rock and the SOC, which is you need both and they both together help the organization ensure that they don't end up in a loss.
Super. All right. Another thing we've talked about was the zero-day detection that it's no longer enough.
And that the real challenge is zero-day remediation. So how realistic is it to expect organizations to safely remediate previously unknown vulnerabilities autonomously?
And particularly when those actions could affect mission-critical systems.
Right. I think when you ask me how realistic it is, there is an implication that there is an option or a choice, and I don't see that as a choice because the attackers are controlling the narrative here. Right. And I would say that, look, I mean, remediation has always existed, but it has been very manual because of the fear of a potential outage if you do something right. And in the past, like I said, it's always about the threat environment. In the past, people had 30 days to fix things because attackers were not fast enough to get in and do something with. Attackers using AI, they are able to exploit and do exploits in a few hours. And so now if you're waiting for 30 days to fix something, there's a huge mismatch compared to how it was earlier. And so that's where the opportunity right now is, is that if we want to be in a situation where attackers, as they exploit these vulnerabilities within hours, and we want to be in a place where we protect ourselves and we make sure that we don't get compromised, we need to react in a similar time frame by reducing the risk by fixing the right things, etc. And that I don't see happening without some form of autonomous AI-based automation has to be part of it. Now, I do think that when you talk about risk, you're always hedging the risk of a security compromise versus the risk of a business outage, and you don't want the security fix to cause a business outage. So that hedging always happens, and I think that's going to continue. And so that's where the moving in the direction of saying how do we bring confidence into our autonomous remediation, so where we can start on a roadmap where 10, 15, 20% starts to get, you know, autonomously fixed, and then the rest of it is a roadmap item where, you know, I don't know if you'll ever get to 100% autonomous remediation, but I think even getting to 70, 80% in the next couple of years is a big win for organizations.
Right, it's got to be something that's going to be business tolerant.
Right. And that's the thing, like if we can give the business, like the reason why people don't patch is just because they don't have the confidence that it won't create an outage. If, however, I can create a paradigm or a mechanism where I can give them much higher confidence in the patch, they are much more likely to patch it quickly and autonomously, right? And that's the focus for us is, you know, when we talk today about True Confidence as an example, is the idea that we can give them the real confidence in the fact that yes, you can fix this and it will not cause an outage for you.
Okay. So answer me this though. So, Qualys is reported that customers deployed roughly 150 million patches over the past year.
