Qualys TruRisk Eliminate 2.0 is now generally available, adding an AI-assisted system designed to help security teams choose and deploy vulnerability fixes without causing unnecessary disruption. Qualys announced the update on October 14, 2026, during its ROCon Americas event in Austin. The centerpiece is TruConfidence, a remediation intelligence engine that assesses the protection already in place, recommends an appropriate response and checks whether systems remain healthy after changes.
The release addresses a difficult operational trade-off: leaving vulnerable software untouched creates exposure, but applying fixes indiscriminately can interrupt services. Rather than claiming every problem needs a software patch, Qualys is packaging several responses into one workflow. Its October 14 announcement confirms the release, while independent coverage from Express Computer outlines the launch.
TruConfidence shifts attention from finding issues to fixing them
Most vulnerability programs can produce long lists of affected systems. Deciding what to do with those findings is harder. A patch may require downtime; another security control may already lower the risk; and a device at the edge of the network might not support an installed management agent. These are different operational problems, even when they appear on the same dashboard.
TruConfidence attempts to connect those decisions. According to Qualys, it considers existing defenses before selecting between patching, mitigation, software removal, isolation or a custom fix. The distinction matters for organizations that manage websites, APIs, applications and cloud workloads together. BitCodeSolution’s guide to common cybersecurity threats explains why exposure cannot be judged by a vulnerability count alone; its cloud security guide explores the controls around shared and distributed infrastructure.
Qualys previously combined patching, mitigation and isolation under the TruRisk Eliminate product. Its September product release notes document that earlier consolidation. The October update builds on it with an intelligence and orchestration layer, rather than introducing patch management from scratch.
Agent Sara coordinates staged changes, with checks afterward
An AI agent named Sara coordinates the remediation plans through waves and progressive deployment groups. Low-risk changes can proceed through earlier groups before a wider rollout. More sensitive systems can be held for closer review, and Qualys says its workflow respects customer-defined approval and maintenance policies. This is an important difference between recommending a fix and giving software unrestricted authority to make one.
Once a change has been applied, the system monitors operational signals such as memory use and CPU behavior through integrations including Dynatrace. If a change does not work as intended, patch-failure analysis can identify possible causes and suggest corrective action. Qualys also describes rollback support. The company’s technical explanation of TruConfidence provides further detail on the decision, execution and verification stages.
This emphasis on maintaining service health will be familiar to backend and infrastructure teams. A security change that interrupts an application’s database or network access still has a business cost. BitCodeSolution has separate guidance on network security patterns for backend engineers and reliable network configuration practices for readers who want the operational background.
Coverage extends beyond managed endpoint computers
Qualys says the new release reaches cloud environments, perimeter devices and applications, including equipment that cannot run its endpoint agent. For those assets, it uses scanners and existing security or IT integrations to coordinate work. That matters because a network appliance and a company laptop rarely accept fixes in the same way.
The product also recognizes that patching is not always immediately possible. A configuration change or compensating control may reduce exposure until a permanent fix is available and tested. However, a temporary mitigation should not be mistaken for proof that a vulnerability has disappeared. Organizations still need a record of what was changed, what risk remains and when to revisit the decision.
For smaller organizations, much of that thinking applies even without an enterprise remediation platform. Site owners can review a WordPress security checklist, evaluate WordPress security plugins and compare data security tools as part of a broader defense plan. Those guides concern different tools and environments; none should be read as a direct substitute for Qualys’s enterprise product.
What the performance claims do — and do not — establish
Qualys cites experience across more than 500 million patch deployments, with under 0.1% rollback and 40% deployed autonomously. Those figures are company-reported historical metrics, not an independently verified outcome for every customer adopting version 2.0. A rollback percentage also does not, by itself, show whether the system identified every serious exposure or whether a particular business avoided downtime.
Prospective users should ask for evaluation results that reflect their own infrastructure: the accuracy of prioritization, approval settings, compatibility with critical applications, recovery behavior and evidence of successful fixes. Teams running a mixed cloud estate can use BitCodeSolution’s comparison of business cloud storage options as adjacent reading on control and security requirements, although storage selection is separate from vulnerability remediation.
Availability and what happens next
Qualys says TruRisk Eliminate 2.0 with TruConfidence became generally available on October 14 and is offered as a free upgrade to existing TruRisk Eliminate customers. It was demonstrated at ROCon Americas on October 14–15. That confirms product availability; it does not establish independent success rates across all supported integrations or disclose the total cost for new customers.
The release illustrates a practical shift in enterprise security: vendors are trying to shorten the distance between discovering a weakness and making a safe, documented change. Whether the approach helps a particular organization depends on its approval processes, asset coverage and tolerance for automated actions. The relevant question for buyers is not simply how fast an AI agent can act, but whether its decisions are auditable and its results can be verified.
Frequently asked questions
What is Qualys TruRisk Eliminate 2.0?
It is an enterprise vulnerability-remediation product update announced on October 14, 2026. TruConfidence adds AI-assisted selection, orchestration and verification of remediation actions across hybrid environments.
Does TruConfidence always install a patch?
No. Qualys says it can also recommend or coordinate compensating controls, mitigations, software removal, asset isolation or custom fixes when patching is not the best immediate option.
Is TruRisk Eliminate 2.0 available now?
Yes. Qualys says the release became generally available on October 14, 2026, with a free upgrade for existing TruRisk Eliminate customers. New customers should confirm licensing and integration requirements directly with the vendor.
