Qualys (QLYS) AI Agents Cut 89% of Vulnerability Alert Noise

Qualys (QLYS) gave its first cumulative reading of AI agents validating vulnerabilities in real customer environments on its November 9, 2026 earnings call: about 9 million exploit validations removed 89% of alerts as noise [1]. That is work customers no longer have to fix. Qualys has not separately disclosed any bookings or revenue the agents generate.

What Qualys sells and where the AI agents sit

Qualys is a cybersecurity software company that sells vulnerability management, asset management and compliance tools as cloud subscriptions. Customers deploy Qualys sensors on servers, endpoints and cloud workloads, which continuously collect asset and vulnerability data, and Qualys charges an annual subscription. Its flagship product is the vulnerability management and patching suite VMDR. In recent years the company has focused on upgrading existing VMDR customers to its risk management platform, ETM (Enterprise TruRisk Management).

The AI application discussed here, AI Cyber Risk Operations, is built into ETM and is a core product Qualys sells to customers. Several AI agents split the work of handling vulnerabilities:

• Agent Insta uses the software and asset inventory the sensors have already collected to determine which systems a newly published vendor vulnerability affects, without rescanning.
• Agent Val tests in the customer's live environment whether a vulnerability can actually be exploited, and moves alerts that cannot be exploited off the fix list.
• Agent Serra ranks the remaining items by risk and schedules patching in batches.

The users are customers' security and IT teams. The problem they face is picking the few vulnerabilities that truly need fixing out of a flood of alerts, and fixing them quickly.

From benchmark figures to customer usage

On the August 4, 2026 earnings call, the application was newly launched and described mainly through test figures. Qualys had just released Agent Insta and presented the three agents as one discover, validate and remediate workflow, saying new detections would appear within minutes of a vulnerability advisory [2]. The performance figures it gave at the time came from live benchmarking, and management acknowledged that many customers still needed to complete a proof of concept and then look at budgets [2].

By November 9, 2026, Qualys was citing actual readings from customer environments. Agent Val had performed about 9 million exploitability validations in total, and Agent Insta was completing detection on customer systems in an average of under 60 minutes after a vulnerability advisory [1]. The application and the division of work among the three agents did not change. What changed was the level of evidence: from demonstration figures to customer-side usage.

What the 89% figure measures

The denominator of the 89% figure is those roughly 9 million validations. Only 11% were confirmed exploitable; the other 89% were removed as noise, so customers' security and IT teams no longer need to schedule fixes for them [1]. In the company's words:

"Agent Val powered by TrueConfirm has already performed approximately 9 million exploit validation across customer environments and still 11% of those confirmed exploitable, eliminating 89% of that noise would have been otherwise consuming security and IT resources." [1]

The figure measures how much customers' fix lists shrank. It is a change in customer-side workload and should not be read as a cost saving for Qualys itself.

Several limits apply:

• The roughly 9 million count is cumulative with no stated start date, so it cannot be converted into quarterly usage and cannot be compared directly with the screening ratios from the August 2026 test environment.
• The 60-minute figure is an average detection time. Qualys did not say how many customers it covers or over what period, and gave no pre-adoption baseline.
• Both results are self-reported by Qualys and have not been independently measured.

Possible link to bookings and subscription revenue

The financial metrics these results could affect are bookings and subscription revenue, specifically the share of bookings from risk management platform products. One possible path: removing noise and shortening detection time gives existing VMDR customers more reason to add ETM and its companion automated patching module, which would eventually show up in bookings and subscription revenue for those products.

In August 2026, Qualys disclosed that ETM and its asset management product CSAM together made up 12% of total bookings and 14% of new bookings on a trailing twelve-month basis, up from 9% and 10% a year earlier [2]:

"First, ETM CSAM combined made up 12% of total bookings and 14% of new bookings on an LTN basis in Q2, up from last year's 9% and 10% respectively." [2]

That reading combines ETM with a non-AI product and is not tied to agent usage. Growth in those bookings could also come from the asset management product itself or from customers consolidating security tool purchases. Qualys has not separately disclosed bookings or revenue from its AI agents, so for now only a directional correlation is visible.

Bottom line and what to track

What can be confirmed is that Qualys's AI Cyber Risk Operations is running in customer environments and has moved most non-exploitable alerts off customers' fix lists. Qualys has not yet shown evidence that these agents translate into separately identifiable bookings growth. More direct evidence would be Qualys disclosing ETM's share of bookings or its number of customers on its own, with those figures rising alongside Agent Val's validation volume.

Application assessment

• AI Cyber Risk Operations | Business position: core business | Deployment stage: limited production | Scope: multiple businesses or regions | Value type: risk reduction

Sources

[1] Drillr · Qualys, Inc. (QLYS) · 2026-11-09 · Earnings call

[2] Drillr · Qualys, Inc. (QLYS) · 2026-08-04 · Earnings call