Customers will gain enhanced visibility through the risk operation center driven by Qualys in the era of AI.

Foster City, California, November 9, 2026 / PRNewswire / -- Cloud-native network risk management company Qualys, Inc. ( NASDAQ : QLYS ) Today, we announce the expansion of our global mROC project by incorporating strategic technology alliance partners across key attack vectors – mobile, OT / IoT , and identity domains, including Claroty, Lookout, NowSecure, Nozomi Networks, and Okta. Telemetry data from these partners will bring the risks of some of the least measured aspects of enterprises into the Qualys Enterprise TruRisk Management ( ETM ), enabling organizations to gain a comprehensive understanding of network risks in their environments.

Qualys indicates that the speed at which AI models can detect software vulnerabilities has surpassed the ability of any security team to keep up through manual triage, and so do their competitors. However, most security efforts are still scattered across dozens of different tools, each with its own severity rating system, without a unified view of which risks are actually exploitable. In this environment, discovering more vulnerabilities only exacerbates the backlog problem. The company states that the issue is further compounded by the fact that some of the fastest-growing areas of attack surfaces are also the least measured. Mobile phones, connected devices, industrial and medical systems, as well as identities, often cannot run traditional proxies or withstand proactive scanning; therefore, their risks are either not measured at all or remain within their respective independent tools, each with its own separate rating system.

Through the expanded technical alliance, the telemetry data from partners will flow into Qualys ETM. It will then be evaluated by the proprietary scoring and prioritization engine TruRisk of Qualys in conjunction with enterprise-wide data. Qualys indicates that this will provide the Chief Information Security Officer with a unified TruRisk score, a prioritized list for remediation actions, as well as a defensible risk overview that can be reported to the board of directors.

Qualys indicates that organizations can measure the risks of the following main attack vectors within Qualys ETM.

• Mobile ( Lookout and NowSecure )— Continuously provides visibility into the security landscape of mobile devices, operating system vulnerabilities, and application layer risks. These application layer risks are identified through advanced binary analysis, including vulnerabilities in embedded third-party SDK. By incorporating these risks into a unified TruRisk scoring system, organizations can assess and prioritize mobile exposures alongside traditional endpoints such as servers and laptops.
• OT and IoT ( Claroty and Nozomi Networks)Integrates passive asset discovery and vulnerability data from operational technologies ( OT ) and the Internet of Things ( IoT ), covering industrial control systems, medical equipment, building management systems, etc. Those exposures that cannot be scanned or patched will become visible and be given priority, while compensatory mitigation measures will also be tracked within the same repair workflow.
• Identity ( Okta )– Incorporate identity posture telemetry data, such as configuration errors, overly high permissions, and exposed accounts and credentials. Accounts at risk are evaluated along with the systems they have access to, so that the team can prioritize fixing the exposed points that attackers might use for lateral movement.

New Partner Authorization Path for the Global mROC Alliance

Qualys also announced the launch of two new partner authorization pathways: Authorized, mROC, Advisor, Authorized, mROC, Delivery, and Implementation Partner. The company stated that these new pathways will provide customers with faster and verified methods to establish risk operation centers (ROC) in order to better cope with the surge in vulnerabilities discovered by AI as well as opponents empowered by AI.

This globally exclusive mROC alliance, which is only open to invited members, will now conduct certifications for three types of partner roles, enabling customers to choose the right partners at each stage of ROC's implementation process – from strategy to deployment to fully managed operations:

• Authorized mROC Advisor (New addition)Upon certification, it is possible to assess customers' risk projects, define priorities based on TruRisk, and design the customers' ROC operation models as well as adoption roadmaps.
• Authorized mROC Delivery & Implementation Partner (New addition)Upon certification, it is possible to deploy ETM and integrate it with the customer's existing security technology stack, including third-party detection results and telemetry data from technology alliances, as well as establish a ROC workflow.
• mROC PartnerUpon certification, it is possible to operate the customer's ROC in the form of a managed service based on ETM, covering everything from priority sorting to repairs, as well as reporting based on SLA.

Qualys, Vice President of Global Channels and Strategic Alliances, stated: "This vulnerability has existed for many years, but recent developments have significantly changed the economics of detecting and exploiting it, allowing adversaries to weaponize exposed vulnerabilities at a much faster pace than traditional response cycles. Our expanded global alliance brings together the strengths of various platforms, strategic technology partners, and experts from risk operations centers with high-level training to help customers implement network risk management on a large scale and stay one step ahead of threats in this era."

More resources

• Read the blog article: "The Expanding Attack Surface Requires a New Operational Model"
• Watch video: " Qualys x Partners: Converting Vulnerabilities into Business Risks Discussion"
• Learn more about Qualys Global mROC Alliance.
• Follow Qualys on LinkedIn, Instagram, and X.

About Qualys

Qualys, Inc. (NASDAQ : QLYS) is a cloud-native network risk management company that helps various organizations measure, communicate about, and eliminate network risks. Qualys states that its platform and solutions support risk operation centers (ROC), providing unified asset visibility, exposure management, risk prioritization, and repair processes to help organizations continuously reduce risks in hybrid environments, multi-cloud setups, endpoints, and AI environments. Qualys claims that the company supports cutting-edge AI era security and IT teams through AI speed detection, ultra-priority sorting, and autonomous repair capabilities. Qualys indicates that over 10,000 organizations worldwide (including most Fortune 100 companies) trust its services; the company helps customers transform network security into a measurable business function to enhance resilience and drive business outcomes. For more information, please visit www.qualys.com.

Media contact: