Convert Cyber Risks into Business Impact – and measure them in Euros

Recently, on October 20th, 2026, in an interview with Carsten J. Pinnow, editor-in-chief and publisher of DATENSICHERHEIT.DE (DS), Sumedh Thakar, President and CEO of Qualys, made it clear, that in the Age of Artificial Intelligence (AI), hesitation can no longer be an acceptable option for executives: “If you just follow, you’ll only end up where everyone else already is,” emphasised Thakar.

The discussion then turned to Zero-Day Remediation and the challenge posed by the fact that AI is being used “on both sides of the front line,” and explored why board members should finally assess their cyber risks in concrete terms in euros rather than in terms of the presence of vulnerabilities.

Just over two decades ago, companies scanned their networks every 90 days and gave IT teams just as long to apply patches. Today, the window between the disclosure of a vulnerability and its exploitation has shrunk to a matter of just hours. AI models such as ‘Mythos’ find vulnerabilities faster than security teams can address them.

Thakar has witnessed this transformation at Qualys from the inside: He started as an engineer in 2003 – and now leads the company as CEO. Under his leadership, Qualys has evolved from a vulnerability scanner into a platform for risk management and automated remediation.

The two exchanged views on poor decisions and ‘smart bets’, discussed the race between attackers and defenders, and also what company management should be doing now.

The journey from an ‘engineer’ to the CEO

DS: You’ve been with Qualys since 2003 and have worked your way up from ‘engineer’ to the top of the company. What would you do differently today?

Thakar: On a fundamental level, I wouldn’t change a thing. Everything that has happened has brought me to where I am today – at the helm of a company that is growing and performing well. Nobody knows where a different path might have led.
Here’s an example: A year after I joined Qualys, I had a job offer from Yahoo in the bag. I turned it down, and here we are. Had I accepted it, I might well be wondering today whether I’d have become CEO of Qualys!
I’m very happy with where I am. But what I do do is look back at my decisions, consider the impact they’ve had, and think about what I’d do differently next time I find myself in a similar situation. That’s where my focus lies – on learning.

Betting on Remediation

DS: The Cybersecurity Landscape has changed radically. Which decision from recent years do you regret the most – and which, in hindsight, has proved to be wiser than it seemed at the time?

Thakar: I wouldn’t call it ‘regret’, but rather ‘learning opportunities’. When I started at Qualys, companies would run scans every 90 days and give their IT teams 90 days to fix any issues. Today, we start to worry if just one or two hours have passed since a vulnerability was disclosed.
One lesson from that time: For a while, we were chasing whatever was currently in vogue in the market. For example, we seriously considered building a firewall and even started doing so. Then we realised that wasn’t in our DNA. So we went back to what our customers actually need.

When I became ’Chief Product Officer’, we asked ourselves anew what the real challenge in vulnerability management was. The decision I’m still very proud of to this day is that we refocused the company on remediation. Back then, no other provider in our segment – let alone any company in the vulnerability scanner sector – was dealing with remediation.
Many people told us: ‘Nobody buys remediation from Qualys; that’s a different buyer, a different department.’ I was convinced that customers needed a way to actually fix problems, because the volume of findings was simply becoming too great. Today, when everyone is asking how they can keep up with the pace of attackers, this decision makes all the difference. We did it before the market needed it, and against the advice of others.

DS: My best decisions were also the ones that others advised against…

Thakar: Exactly. If you just follow others, you’ll only end up where they already are. If you want to lead, you have to do more or do something different. If I merely copy the competition, at best I’ll reach their level. The key is to always keep the outcome for the customer in mind. Anyone who chases after things that customers don’t even expect from us is on the wrong track.

Put an end to ‘Dashboard Tourism’

DS: Qualys is evolving from a vulnerability scanner into a platform for risk management and remediation. The focus is shifting from VMDR to ‘Enterprise TruRisk Management’ (ETM) and AI-powered autonomous remediation. What does this mean for your position in ‘exposure management’, for example compared to Tenable, Rapid7 or CrowdStrike?

Thakar: Securing a business requires many stakeholders. Different providers focus on different areas, and that’s a good thing: CISOs have a choice and can select the capabilities that suit their environment.
As a CEO, however, you look at the business as a whole – at turnover and profit. Then you realise that, beyond all the technology, cybersecurity is really about managing the risk of financial loss. Every provider talks about their risk score and their risk-based approach. In fact, there was a sort of ‘Dashboard Tourism’ – a score for the cloud, a dashboard for identities, another for something else. None of them answered the question: ‘How high is my overall risk – in other words, how many Euros or Dollars could I lose?‘

That is precisely what board members want to know: How high is the potential loss, and are we within our acceptable risk appetite? After all, how much I invest in reducing a loss depends on how large it is.

Risk management has three components:

1. Mitigation: ‘How much do I spend on controls, tools and staff to reduce the risk?‘
2. Acceptance: ‘There is no such thing as zero risk. What residual risk am I consciously willing to accept?‘
3. Transfer: ‘Anything I can neither mitigate nor accept, I transfer to a cyber insurer.‘

There was no platform that linked technical findings to potential business losses and derived concrete remedial measures from them. That is why, a few years ago, I developed the concept of the ’Risk Operations Centre’ (ROC). We need to operationalise risk management, rather than being caught off guard by every new threat. The ROC is not a Qualys product, but a general framework: Identifying technical risks, cross-referencing them with business losses, and quickly rectifying what can actually cause damage.

With AI – and since ‘Mythos’ – attackers are finding more vulnerabilities in less time. Companies must therefore resolve issues within a day, rather than within 30 days as was previously the case. This is only possible if they utilise AI themselves and have operationalised risk management and decision-making processes. Organisations that involve people at every stage and spend their time sending eMails and ‘Jira tickets’ back and forth will not be able to resolve issues within 24 hours. To achieve this, they need a ROC that brings together data collection, decision-making and implementation.

From Zero-Day Vulnerability to Zero-Day Remediation

DS: AI as attacker versus AI as defender – who wins? You have argued that ‘Mythos’ did not create a new threat, but rather shortened the timeframe – from 30 days to 24 hours. If the time to exploitation continues to shrink, can defenders keep up structurally? Or do products such as ‘InstaScan’, which promise detection within minutes of a breach being discovered, merely buy time in a race that the attackers are winning?

Thakar: In most cases, attackers are running a business. Like any company, they ask: ‘If a new technology helps us make money faster and with fewer people, why shouldn’t we use it?‘ They even compete amongst themselves to see who can breach a network first. As long as there is money to be made, or government interests are at stake, they will continue to refine their methods. We defenders must deploy similar or better technology. It’s a ‘Cat-and-Mouse Game’, and I don’t believe defenders will ever win it in the long run. Despite all the industry’s promises, we continue to see compromises.

What’s more, just because ‘Mythos’ finds ten times as many vulnerabilities, security budgets don’t increase tenfold. So we need to think carefully about where every Euro will lead to the quickest fix.

Where did the 30-day figure for critical vulnerabilities actually come from? It was based on the consensus that attackers took quite a long time to exploit a vulnerability due to manual processes. That is no longer the case. We simply need to be a little quicker than the attackers: If it takes them three days, we fix it in two. If it takes them two, we fix it in one. That is why the transition from ‘Zero-Day Vulnerability’ to ‘Zero-Day Remediation’ is so important: The most critical vulnerabilities must be patched within the first 24 hours of a patch being released!

To achieve this, Qualys relies on three interlinked AI-powered capabilities:

1. Detection within the first hour (‚InstaScan‘): If you want to fix issues within 24 hours, you can’t afford to spend two days on detection. During the last ‘Microsoft Patch Tuesday’, we identified our customers’ exposure 13 minutes after the announcement. That leaves a good 23 hours for prioritisation and remediation.
2. Validate rather than wait (‘Agent Val’): Why should we wait for attackers to carry out exploits against us? Using agent-based AI, we safely run the same exploits against our own systems and then know which ones work and which ones don’t. This whittles the list down within a few hours to the 0.1 per cent that really matter.
3. Remedy with confidence (‘TruConfidence’): The only reason organisations do not patch is the fear of downtime. From the approximately half a billion patches that have now been rolled out, we use AI and Machine Learning to determine which patches or mitigations can be safely applied at this time.

The figures show just how far customers have come: Over the past twelve months, 170 million patches have been rolled out in customer environments via Qualys. 94 million of these were deployed completely autonomously, without human intervention. This means customers are already closing their exposure within the first eight hours of a patch’s release. I remember well how many people said at the time that nobody would use it.

It is important that this remains affordable. If a solution costs hundreds of millions, companies would rather accept the risk or look for other ways. ETM is our implementation of the ROC concept. It considers not only vulnerabilities, but also misconfigurations and identities. In future, further indicators will be added, such as AI deployments or Post-Quantum Cryptography (PQC), which I spoke about at our ‘ROCon conference’. The aim is a framework that answers one question for the board, regardless of new technologies or threats: ‘Are our expenditure levels within our acceptable risk appetite, or do we perhaps need to invest five per cent more?‘ No one should aim for ‘Zero Risk’, as this causes the Return on Investment to fall very quickly.

DS: Looking back over the last 20 years, it’s always been a ‘Cat-and-Mouse Game’…

Thakar: Always, and it will stay that way. What’s more, we’re constantly adding new technology, but the old rarely disappears. Today, an AI agent can book a five-day trip to Hawaii at the touch of a button. At the same time, around 70 per cent of airlines’ reservation systems worldwide still run on mainframes. On top of that are ‘Linux’, web applications, APIs, mobile apps and now AI. As a security manager, I have to secure each of these layers. If PQC is added tomorrow, that doesn’t mean the cloud and AI will disappear. Our risk management must therefore constantly evolve to mitigate risks at a reasonable cost.

The Security Team 2030

DS: If AI identifies, prioritises and rectifies vulnerabilities – what will be left for the human security team to do? What will a CISO’s organisation look like in five years’ time, and what does that mean for the much-lamented skills shortage?

Thakar: It’s impossible to predict the future. Five years ago, nobody would have been talking about ‘Mythos’. One thing, however, hasn’t changed: CISOs were looking for ways to protect their organisations with the latest available technology back then, just as they do today. Attackers will exploit every technical opportunity, and defenders must evolve just as quickly.
There has been a skills shortage in cybersecurity for as long as I can remember. Added to this is a high level of burnout, because the work is stressful. The good news is that, with AI, organisations can scale up more quickly and bolster their existing teams with agent-based workflows that deliver results faster.

The better defenders are at addressing relevant vulnerabilities, the more attackers will switch to other methods: AI agents, identities or simple misconfigurations. A fully patched system is of little use if the default login is still active. No matter what technology emerges – be it AI, the cloud or PQC – the ROC always asks the same four questions.

1. Inventory: ‘Where is the asset located?‘ Very few people know this.
2. Assessment: ‘What problems are there with it?‘
3. Prioritisation: It’s impossible to fix everything. ‘What matters most to my business?‘
4. Remediation: I actually have to fix it.

A vulnerability may be highly exploitable. What matters is whether it leads to a genuine loss of business or remains merely a technical exploit. That is why the ROC and a risk-based approach are becoming increasingly important. CISOs must speak to the board in the language of business: ‘How high is the potential risk, how much are we spending to mitigate it, and how do we transfer the remainder to a cyber insurer?‘ Companies have long been managing financial and geopolitical risks. Cyber is one of them. Keeping pace with attackers through new technology – and doing so within a business context – will be a constant challenge for us.

Recommendations for senior management: It’s time to define risk

DS: Cyber threats, increasing regulatory requirements, fiercer competition, leadership responsibilities and a volatile economic environment place significant demands on CEOs and senior managers. How should executives approach risk management to strengthen their organisation’s long-term resilience? What practical recommendations do you have for decision-makers?

Thakar: I like that this question brings the topic down to the business level. My recommendation to everyone is: Take a close look at the Risk Operations Centre framework, because you need to operationalise your risk management. In concrete terms, this means:

• Empower the CISO to talk about business risks rather than technical risks. The key question is: ‘How high is our current risk relative to our acceptable risk appetite?‘ And if it exceeds that: ‘How do we bring it back down below it?‘
• Do not chase every headline. Board members should not question CISOs about every single vulnerability reported in the news. They should ensure that their CISO has the necessary support for reporting that links current risk to the business and sets out a path for managing residual risk.
• Focus on operational resilience. The organisation must be able to manage risks without causing operational disruptions itself. A risk management framework structured in this way will also withstand future threats and technologies.
• Define risk. Anyone who fails to define their risk is, by definition, fighting an infinite risk. That is why so many feel they have never done enough. Only once a risk has been defined do I know: How high the potential loss is, how much I am spending to reduce it, and how much I am transferring to a cyber insurer.

Further information

DATENSICHERHEIT.DE, 08|04|2026
Cyberrisiken schneller eindämmen: Qualys erkennt Schwachstellen in Minuten

DATENSICHERHEIT.DE, 06|28|2026
Neuer CNAPP-Standard als Basis der Hyper-Priorisierung und autonomen Behebung im Cloud-Maßstab

DATENSICHERHEIT.DE, 07|20|2025
Fehlender Geschäftskontext: Trotz erhöhter Investitionen ausgebremstes Cyberrisiko-Management