Cecil Perez, VP Europe Sales Qualys says Qualys has moved well beyond scanning. InstaScan, Agent Val and TruConfidence are meant to prioritize and fix risks automatically, with partners and MSSPs at the center of the plan.
Qualys wants to be seen as more than a vulnerability scanner. In an interview, Cecil Perez, VP Europe Sales Qualys explained how the company is turning its products into a platform that prioritizes and fixes cyber risks with as little manual effort as possible, and why partners, MSSPs and the German market play a central role in that plan.
Many people still know Qualys as the vulnerability scanning company. Wendt considers that picture outdated. According to him, Qualys now sees its job as helping CISOs and business units understand which risks they actually face and which they can afford to accept. Security, he said, has become a business problem: boards ask about it as a matter of course, and the era of manual processes is giving way to autonomous ones. AI agents are already implemented in the portfolio, and shadow AI is the next frontier, for which Qualys says it has a direct answer. In the third quarter, according to the company, Qualys expanded TotalAI with governance functions that discover AI agents and MCP servers and test against the OWASP Top 10 and EU AI Act standards.
From asset inventory to automated prioritization
The starting point is a complete asset inventory. The big task, Perez explained, is to handle assessments, risks and findings sensibly and to prioritize them automatically using business context. Three developments serve that goal.
InstaScan is a new product that directly shows who is affected by a new vulnerability. Qualys calls it scanless detection within minutes of an advisory being published. The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, each rated CVSS 4.0 9.2) show why speed matters. According to Qualys’ Threat Research Unit, 71 percent of the 156 million PHP installations with a known version run end-of-life or end-of-support releases that will mostly never get a vendor patch, and only 0.37 percent were patched within 24 hours of disclosure. Qualys is offering its services free for 15 days for up to 1,000 assets.
Agent Val adds a prioritization chain that automatically validates which findings can really be exploited. TruConfidence, part of TruRisk Eliminate 2.0, announced on October 14, covers remediation. Wendt described it as a risk score for remediation actions that is meant to avoid damage to operations and allow autonomous workflows, with a traffic-light display showing customers how well it works. According to the company, it draws on half a billion patch deployments with a rollback rate below 0.1 percent, 40 percent of them autonomous. The release adds that remediation now reaches perimeter devices, cloud and applications beyond agent-based endpoints, and that system health is monitored after each action through partners such as Dynatrace. CEO Sumedh Thakar argues that hesitation about automation stems less from the technology than from the fear of causing an outage. Wendt raised the same question: are patches reliable, and will they really work?
Channel: free certification, MSSPs in focus
Asked how the partner program changes as Qualys evolves from scanner to risk platform, Wendt said the company offers its channel certification and training free of charge, covering 100 percent of partners. Partners can build revenue streams on top, for instance by working with global system integrators such as Orange and Telekom under an SKU-based model. In Germany, Qualys currently has no distributor and is evaluating the option. Other EU countries already have one, and Turkey is being expanded. Wendt still sees white space for further partnerships.
Managed security service providers are one route to mid-sized companies that lack security staff. In the US, Perez said, MSSPs are less of a strategic focus, while Europe has more of them. Qualys offers them a specialized solution with a dedicated price list and describes itself as adaptable. AWS is also a partner and sells Qualys through its channel. A further building block is the mROC concept, the certified managed Risk Operations Center, which Perez called a core component for managing and correlating business risks. The mROC certification covers risk quantification, in contrast to a reactive SOC.
Numbers and outlook
The business figures support the strategy, according to the company. For the third quarter, Qualys reported revenue of $188.0 million, up 11 percent year over year, and raised its 2026 revenue guidance to $736.9 to $738.9 million. Thakar attributes this to growing adoption of the AI-native Risk Operations Center and a partner-first strategy. These are company statements, and the guidance is forward-looking. Whether customers will trust autonomous remediation in production is the practical test. The figures cited here are vendor-reported and have not been independently verified.
For 2027, Perez expects AI to dominate: threats will become faster and more complex, and companies need to keep pace. Security remains necessary. He sees Qualys in a good position because it develops technology from within instead of adding plug-ins. Automotive, finance and banking are among the key industries, and geographically Qualys wants to expand further.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de