Source: Qualys Security Blog
Author: Sean Martin
URL: https://blog.qualys.com/qualys-insights/2026/09/29/autonomous-remediation-enterprise-scale-black-hat-2026-sumedh-thakar
ONE SENTENCE SUMMARY:
Qualys CEO Sumedh Thakar argues security outcomes now demand AI-speed detection, hyper-prioritization, and autonomous remediation measured in seconds.
MAIN POINTS:
- Scanning and fixing cycles shrank from 90-day windows to roughly 90 seconds.
- Core security questions remain constant: inventory, assess, prioritize, and remediate.
- “Dashboard tourism” occurs when teams watch metrics instead of fixing issues.
- CISA’s three-day remediation directive pressures agencies toward faster execution.
- Zero-day response expectations increasingly assume a 24-hour containment or remediation window.
- Autonomous, AI-driven exploitation requires automation rather than expanding headcount.
- AI-speed detection must precede remediation, or 24-hour goals become unattainable.
- Hyper-prioritization focuses on real exploitability within existing controls, not theoretical scores.
- Autonomous remediation favors minimal effective changes, using mitigations or patches when necessary.
- Qualys uses AI-based patch reliability scoring and has autonomously deployed tens of millions of patches.
TAKEAWAYS:
- Measure security performance by exposure window, not vulnerability counts.
- Automating detection-to-fix is essential as disclosure and exploitation timelines compress.
- Exploitability testing can radically reduce the actionable vulnerability backlog.
- Prefer compensating controls when sufficient; apply patches only when required and dependable.
- CISOs should brief boards in business-risk terms via a Risk Operations Center model.