RANSOMWARE: Ranzy Locker

On 25 October 2021, the FBI released a report documenting their findings about a ransomware variant known as Ranzy Locker. While Ranzy Locker has not been used as prolifically as Conti or Darkside, it does leverage some of the same old ransomware tricks to attack its victims. In conjunction with...

CSPM Evolution – Start Secure, Stay Secure

For the last several years, the Verizon DBIR report has identified misconfigurations, errors that are unintended actions by an internal party, as one of the top reasons for data breaches. This trend is further reinforced by the results of a recent survey conducted by Cybersecurity Insiders. They...

Qualys Cloud Platform (VM, PC) 8.18.1 New Features

The patch release of the Qualys Cloud Platform, version 8.18.1.0-1, includes new support for HashiCorp Vaults as well as for Virtual Scanner Appliance for OCI and OCI-Classic Platforms. Feature Highlights Support for HashiCorp Vaults – This release adds a new vault type that can be used to retrie...

The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches

Key Takeaways Malicious packages can steal cloud credentials during installation, before applications run. Stolen credentials turn developer workstations and CI/CD pipelines into gateways to cloud resources. Restrict installation scripts, minimize credential privileges, protect metadata access, a...

The Autonomous Engine Behind Remediation, and What Finally Makes It Safe

Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can 't match. Qualys's Enterprise TruRisk Management Platform closes that gap with autonomous remediation: exposures are prioritized by threat, business, and environmental context, then...

CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Now

Executive Summary CVE-2026-68820 is an actively exploited Windows vulnerability listed in CISA’s Known Exploited Vulnerabilities KEV Catalog, with a remediation deadline as suggested by CISA BOD 26-04. CISA BOD 26-04 introduces risk-based remediation timelines ranging from 3 to 14 days, increasin...

FedRAMP High Authorized: Qualys TotalCloud CNAPP – From Compliance to Defense

Qualys TotalCloud has achieved FedRAMP High Authorization, marking a major milestone in delivering validated cloud security and compliance assurance for high-impact federal and regulated environments. Key Takeaways Qualys TotalCloud CNAPP is a FedRAMP High Authorized that enables continuous,...

Oracle Critical Patch Update, April 2026 Security Update Review

Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 481 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families,...

Anatomy of an Autonomous AI Agent Risk: How Qualys ETM Connects the Dots on OpenClaw

Executive Summary An unauthorized OpenClaw AI agent was detected disguised as a routine package on a Windows Server host. The situation escalated into a priority incident when Qualys ETM analyzed and correlated four distinct signals. While none of these signals alone warranted urgent action, the...

Countering Current Geopolitical Cyber Threats With Qualys

Summary In response to the latest public sector threat intelligence on Iranian-linked threat activity, Qualys has released new intelligence capabilities within Qualys Vulnerability Management, Detection & Response VMDR to help organizations immediately assess their exposure. These updates extend...

TruConfirm: Autonomous, Agent-Led, Safe Exploit Validation for Real-World Risk Reduction

Key Takeaways CISOs still can’t answer the only question that matters: Is this exposure exploitable on this asset, in our production environment, against our controls, right now? The vulnerability firehose broke the old model: With 48,177 CVEs published in 2025, “critical” lists are too large to...

Compliance Without Coverage is a Risk: How to Close the Gaps with Qualys Policy Audit

Modern compliance and security programs often fail due to technology blind spots rather than weak policies or procedures. Today's IT environments, spanning hybrid, cloud-native, containerized, and legacy platforms, introduce complexities that traditional compliance tools can't fully address. When...

Qualys TotalCloud KCS Achieves Red Hat Vulnerability Scanner Certification

We’re excited to announce that Qualys TotalCloud Kubernetes and Container Security KCS has achieved the Red Hat Vulnerability Scanning Certification , reinforcing our commitment to unbiased, 6-sigma accurate vulnerability detection. By meeting Red Hat’s rigorous security standards, Qualys...

Unlock the Boardroom with Cyber Risk: How the Qualys Enterprise TruRisk™ Platform Empowers CISOs

The Changing Landscape for CISOs " If you can't measure it, you can't manage it." - Peter Drucker This timeless adage by Drucker resonates deeply in today's digital era, where managing cyber risks has become a business-critical priority. According to a recent survey from Splunk, Today, nearly 50%...

Certificate Awareness & Automated Renewal with Qualys CertView

The Challenges of Managing Digital Certificates Everything we do in the digital world relies on certificates. Whether this is accessing services using our computer or phone, for work or for leisure—certificates are ubiquitous. However, for many organizations, managing digital certificates can pos...

AI Under the Microscope—What’s Changed in the OWASP Top 10 for LLMs 2025

As AI continues to evolve, so do the threats and vulnerabilities that surround Large Language Models LLMs. The OWASP Top 10 for LLM Applications 2025 introduces critical updates that reflect the rapid changes in how these models are applied in real-world scenarios. While the list includes...

De-risk Generative AI: Enterprise TruRisk Platform Advances to Secure AI and LLM Workloads

As we stand at the frontier of technological innovation, artificial intelligence AI and large language models LLMs are reshaping industries, driving automation, enhancing customer experiences, optimizing processes, and unlocking business opportunities for modern enterprises. However, this rapid...

Staying Five Steps Ahead of Cyber Risk

Organizations are continuously seeking effective strategies to protect their digital environments. With over 26,000 vulnerabilities discovered last year, Qualys Vulnerability Management, Detection, and Response VMDR offers a comprehensive solution designed to meet the needs of both security and I...

Advancing Cybersecurity Management With Qualys Cloud Agent

In the first part of our series, we discussed the significant enhancements in Reduced Activity Periods RAP and Enhanced Capabilities for VDI in the Qualys Cloud Agent. In this second part of the series, we continue our exploration into the other two pivotal enhancements of this upgrade: 1. Agent...

Closing the Visibility Gap: How Qualys Cloud Agent Passive Sensor (CAPS) Eliminates Blind Spots Without the Hassle

In modern networks, the most significant risks come from systems that fall through the cracks. Modern networks are full of unknown and unmanaged assets. Some are seemingly benign devices introduced by well-meaning employees or contractors that can turn rogue. While some of these may be genuinely...

Prepare Your Organization for Compliance with the NYDFS Cybersecurity Regulation

Cyberattacks are on the rise, with bad actors accelerating their nefarious exfiltration of valuable and confidential data from financial institutions, Federal agencies, healthcare organizations, and more. According to an IBM study, the Financial Services industry saw an increase in the cost of da...

The Rise of Managed Risk Operations: How the New Qualys mROC Portal Helps Partners Scale the Risk Operations Center

Key Takeaways The mROC Portal acts as a portfolio-wide command center, giving partners unified visibility into high-risk customer environments, active threats, and critical exposures to drive prioritized, portfolio-wide risk management. Partners can filter risk, drill into any customer, and take...

Bringing Continuous Assessment to Harbor: Scan on Push, Stay Secure Over Time

Key Takeaways Harbor environments often run separate scanners, such as Trivy at build time and Qualys at runtime, leading to repeated full-image rescans across hundreds of thousands of images and increasing compute usage, scan time, and operational costs. Integrating QScanner with Harbor eliminat...

5 Steps to Turn Compliance Checks into Audit Outcomes

Key Takeaways Audit readiness remains reactive in many organizations, even though security and compliance teams generate continuous findings, evidence, and control data across multiple systems. The real challenge is the gap between compliance activity and audit outcomes, where large volumes of da...

Active Exploitation of 7-Zip RCE Vulnerability Shows Why Manual Patching is No Longer an Option

A critical remote code execution RCE vulnerability in 7-Zip CVE-2025-11001 is now being actively exploited. The issue stems from improper handling of symbolic links within crafted ZIP files. When a malicious archive is extracted, 7-Zip may write files outside the intended directory, allowing an...

The Future of Cloud Security: A New Act for Cyber Risk Operations

Qualys, the leader in Cyber Risk Operations, is proud to be recognized in Latio Tech’s 2025 Cloud Security Market Report as a leader in both CTEM and the Cloud Security Ecosystem. This acknowledgement by Latio Tech reinforces the strength of our strategy—anchored by the industry’s first Risk...

Bringing the Power of Agentic AI for Identity Risk, Adaptive Threat Prioritization, and Exposure Exploitability Validation

Qualys Enterprise TruRisk Management ETM extends the power of risk operations with agentic AI — Introducing ETM Identity, TruLens for industry-based threat prioritization, and TruConfirm exposure exploitability validation to accelerate your remediation. Every year at our yearly conference, now...

How to Prevent NPM Supply Chain Attacks in CI/CD Pipelines with Container Security

Introduction Containerized applications power the backbone of modern software delivery. But with speed comes risk. Vulnerabilities and embedded secrets can slip through the cracks long before they hit production. The result? Alert fatigue, noisy false positives, and critical exposures that disrup...

Navigating SEBI’s Cloud Security Requirements: A Guide for Regulated Entities

Overview: Who is impacted: The Securities and Exchange Board of India SEBI is the primary regulatory authority for the securities market in India. It was established to protect investor interests and promote market development, but its guidelines also impact cybersecurity professionals at regulat...

Outdated Tech, Rising Risk: How Federal Agencies Can Eliminate Tech Debt and Reduce Cyber Risk

Amid shrinking budgets and workforce pressures, your agency, like many across the federal government, is likely grappling with the growing challenge of technical debt tech debt. Tech debt, the accumulation of outdated or under-maintained technology, can slow progress and put your agency’s mission...

Remediate WMI Class Corruption Errors with Qualys TruRisk™ Eliminate

When Windows Management Instrumentation WMI classes fail, it can disrupt critical security operations by causing vulnerability scans to miss important data and compliance reports to lack accuracy. These issues may lead to gaps in visibility, making it harder for security teams to maintain a...

Qualys Named an Overall Leader in CNAPP by KuppingerCole

We’re proud to share that Qualys has been named an Overall Leader in the 2025 KuppingerCole Leadership Compass for Cloud-Native Application Protection Platforms CNAPP—achieving leadership positions in both product and market presence. This recognition validates our commitment to delivering truste...

How DevOps Can Move Fast and Stay Secure with TruRisk

Don’t Spend Your Time Fixing Too Many Vulnerabilities In modern DevOps, speed is everything—and so is security. But for most teams, the two feel constantly at odds. The reality? You’re probably spending valuable time fixing vulnerabilities that don’t actually matter. Moreover, there’s always the...

Steps to TruRisk™ – 1: Shift to Priority-Driven Strategies

“If you know the enemy and know yourself, you need not fear the result of a hundred battles.” — Sun Tzu Security and IT teams are drowning in alerts, scrambling to patch everything they can, yet breaches still happen. Not all vulnerabilities pose the same risk. While reducing totals may seem like...

Decoding OWASP – A Security Engineer’s Roadmap to Application Security

In a time where over 60% of data breaches are linked to software vulnerabilities and a single overlooked software vulnerability can expose sensitive data, the imperative of robust application security cannot be overstated. The 2023 IBM Security Cost of a Data Breach Report highlights that...

CVSSv4 Public Preview Announcement

On June 8, 2023, at the 35th Annual FIRST Conference in Montreal, the public preview of CVSSv4 was announced. The Common Vulnerability Scoring System CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities. Since its initial release in 2004, CVSS h...

Don’t forget about risk remediation of your macOS assets

Employees love for Macs has propelled tremendous growth for Apple. According to a recent study by Parallels, 55% of businesses use Mac devices themselves or explicitly approve of their use within the company. It is hard to believe Macs have been around for almost 4 decades. Largely introduced to...

Driving CISA Compliance with Qualys

How CyberSecurity Asset Management with External Attack Surface Management Improves Compliance for the Protection of National Infrastructure Since 2018, the Cybersecurity and Infrastructure Security Agency CISA of the U.S. government has focused on reducing risk and building resilience to cyber a...

Cloud Security Improves, But Much Work Still Remains to Be Done

As cloud computing adoption accelerates among businesses, InfoSec teams are struggling to fully protect cloud workloads due to a lack of visibility into these environments, and to hackers’ increasingly effective attacks. That’s the main finding from SANS Institute’s “Cloud Security: Defense in...

Qualys Policy Compliance Notification: Policy Library Update

The Qualys library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from...

Autonomous Remediation Is Already Running at Enterprise Scale

The following is a guest blog by ITSPmagazine, based on their interview of Qualys President & CEO Sumedh Thakar at Black Hat USA 2026. Sumedh Thakar has watched the same clock compress for 23 years. He joined Qualys as an early software engineer on the scanner, when organizations scanned once eve...

Automate Asset Isolation: Your Last Resort to Meet Remediation Deadlines

Executive Summary Remediation deadlines slip for reasons outside your control: a patch does not exist yet, a patch is delayed, or a remediation attempt fails. The outcome is the same either way: the host stays unpatched and stays on the network. TruRisk Eliminate closes that window by isolating t...

CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine

The Qualys Threat Research Unit TRU has identified a Local Privilege Escalation LPE vulnerability in snap-confine CVE-2026-8933. This flaw allows an unprivileged local user to gain full root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The issue stems from a security...

Why Every Enterprise Needs a Risk Operations Center (ROC)

Enterprise security has long optimized for speed of response over prevention of risk. At Qualys, we recognized early that this left half the problem unsolved, and we have spent years building the operational frameworks to close that gap. The Risk Operations Center is the result. Here is a scenari...

Cybersecurity Predictions for 2026 Signal the Maturation of Risk-First Security Models

Key Takeaways Cyber risk management gets operationalized in 2026. Leading organizations move beyond visibility and frameworks to govern risk through prioritization, simulation, and deliberate action. Attack-path modeling matures into execution. Static views give way to dynamic, decision-driving...

Your VMDR Year in Review: Making Security Progress Visible and Actionable

Security Teams Rarely Stop to Reflect When a security program is working well, very little seems to happen. That is by design. There is no alert for the incident that was prevented. No visibility into the attack path that was quietly closed. No recognition for the vulnerability that was fixed...

Agent Grant: From Identity Signals to Measurable Risk Reduction

Executive Summary Identity is now the 1 attack surface. Agent Grant in Qualys ETM Identity uses agentic AI to measure and reduce identity risk across AD, Entra, Okta & other cloud IdPs/IDaaS. It operationalizes identity risk by turning messy Active Directory & identity-risk signals into validated...

Navigating Change: Evolving Your Exposure Management Strategy in a Post-Kenna World with Qualys

Key Takeaways Cisco is ending support for it vuln management product formerly Kenna Security by June 2028 Risk-based vulnerability management RBVM used to be adequate, but is no longer sufficient Exposure assessment platforms allow you to assess risks from all organizational risk surfaces SOC...

What is Patch Management Automation and Why It Matters

Executive Summary Environments rarely stay as orderly as they begin. New workloads, faster releases, and growing attack surfaces stretch manual patching beyond its limits. The real risk emerges in the widening gap between spotting a vulnerability and fixing it. Automated patch management closes...

What It Takes to Design Trust into Event-Driven Architectures with Amazon EventBridge

How disciplined design turns Amazon EventBridge from an open event bus into a system of verified trust. Event-driven architecture has become essential for achieving agility in the cloud. Yet as integrations multiply, so do the hidden pathways that adversaries can exploit. Amazon EventBridge helps...