How much will a business save if they do this with that new strategy, approach it from that new strategy?

Look, I think automation always helps bring costs down typically, right? And so building the confidence in the automation is going to help you achieve broader scale at a lower cost, right? And I think that's where organizations, if cybersecurity, especially in the vulnerability management side, you could fix 10,000 findings and make no impact to your risk of a breach.

Or you could fix like 30 and that could actually be a major impact.

And so you can see the cost difference trying to fix 10,000 as an emergency patches versus 30 is a big difference and the outcome is very different.

So I think overall, I believe that organizations can really tighten their spend into more measurable outcomes if they take the approach of the risk operation center versus, you know, it's very disruptive for dev teams and IT teams when they have to keep dropping what they're doing.

and keep applying security patches.

So I think an approach that says, look, the less than 1% vulnerabilities cause high risk.

What is your advice to business leaders to be prepared for the future?

The first is, when we look at shortening that reaction time to get vulnerabilities into place to protect stuff, how do companies build the right infrastructure to do that? The second is how do they do an effective understanding of what is at risk? Because we can't continue the bum blast of patch management that we have at the moment.

Really interesting couple of topics to cover here.

So again, coming at it a little bit from a business perspective is we've already been there now for the past few years where we just cannot fix everything that is being discovered by all the tools that you have.

Which means that as a business, you have a certain focus, you have a certain budget set aside for fixing things from a security perspective, and you are making choices on which ones to fix and which ones to not fix.

And by the way, procrastinating and not fixing is also a choice.

And what is the impact of that choice? This choice is about figuring out risk management, essentially.

Think of it like that.

Governance can't exist without metrics to understand are we hitting our marks? Where do we find that governance? How do we set that governance?

But how would you say companies are approaching this?

Look, I think the word you use is the most appropriate word, which is risk.

At the end of the day, there is no 100% solution for anything.

And so all it is about hedging your risk and balancing that particular risk.

And obviously, the reason why we are not patching everything that comes out is there continues to be a fear of an outage.

And in the very broader picture, 50,000 feet, I would say that we need to move into a world where our applications are resistant to patching and we don't have to worry about outages where you can patch anything and everything and there are built-in mechanisms that will balance out in case there is an issue, right? We're not quite there yet.

I would say, however, compared to 20 years ago, Now, a lot of people moving into the cloud with containerized environments and pods and cloud backups and different regions.

So would you say that there's more scrutiny now on vendors in companies and where they could potentially offload some of those vendors, for example? Yeah.

yeah

because even before frontier models came out people were barely able to fix five percent of what they were finding now with the findings going up there it's even lower so even that five percent is becoming a lot so instead of theoretical uh prioritization with scores Can you actually just run and exploit and test if your other controls are blocking it or not? So that becomes the second pillar, which is can I hyper-prioritize? If it's 1% based on theoretical stuff, it's like 20% of that 1% is actually exploitable in your environment because you paid money for firewall, you paid money for EDR.

So now you have that.

And then the third pillar is I need to get it remediated.

So once I reduce, so autonomous remediation, step number one, fix the least.

More you fix, more chance something will go wrong.

So hyper-prioritization helps that.

What are some of the results you're seeing?

But from your perspective, what is it? What's the hype about? What are people potentially overstating, and what does it mean for the industry? I know it's a broad question, but it's a pretty broad topic at the same time.

Great question, right? I think let's look at AI in the broader picture of we're leveraging this across the board in every aspect of our life, and, and we're just at the beginning of the journey, right? So I think wh- what we see is organizations, companies, governments, everybody's looking to leverage AI more and more as a transformational technology.

And there's a lot of significant potential advantages.

I think the current conversation sometimes back and forth about token usage and stuff like that and, and measuring the cost of humans and, and weighing them against the cost of tokens and stuff like that, I think that's just part of that initial journey.

But I think that as everybody is looking at leveraging AI to transform businesses, uh, we're definitely gonna move in this direction.

And so feels like it's like the digital transformation that has been happening the last few years, and cloud was like the last big thing, and AI is now even bigger, and it's quicker and faster, right? So I think if you kind of anchor yourself around the fact that AI is going to be leveraged in digital transformation of businesses moving forward, and you'll be able to talk to your bank and ask questions, uh, to an AI chatbot to know, you know, what your balance is and what your investment is.

I think in the history of humanity, criminals and attackers have always followed wherever the money is, right? When it, if it was cash, you know, they would rob trains.

What do we mean by remediating things autonomously, and how much decision-making should businesses realistically be handing over to AI?

But from your perspective, what is it? What's the hype about? What are people potentially overstating, and what does it mean for the industry? I know it's a broad question, but it's a pretty broad topic at the same time.

Great question, right? I think let's look at AI in the broader picture of we're leveraging this across the board in every aspect of our life, and, and we're just at the beginning of the journey, right? So I think wh- what we see is organizations, companies, governments, everybody's looking to leverage AI more and more as a transformational technology.

And there's, uh, a lot of significant potential advantages.

I think the current conversation sometimes back and forth about token usage and stuff like that and, and measuring the cost of humans and, and weighing them against the cost of tokens and stuff like that, I think that's just part of that initial journey.

But I think that as everybody is looking at leveraging AI to transform businesses, uh, we're definitely gonna move in this direction.

And so feels like it's like the digital transformation that has been happening the last few years, and cloud was like the last big thing, and AI is now even bigger, and it's quicker and faster, right? So I think if you kind of anchor yourself around the fact that AI is going to be leveraged in digital transformation of businesses moving forward, and you'll be able to talk to your bank and ask questions, uh, to an AI chatbot to know, you know, what your balance is and what your investment is.

I think in the history of humanity, criminals and attackers have always followed wherever the money is, right? When it-- if it was cash, you know, they would rob trains.

What do we mean by remediating things autonomously, and how much decision-making should businesses realistically be handing over to AI?

Uh, what does that tell you about the sentiment and how quickly sentiment is shifting with regard to software names right now?

Yeah.

Leslie, first of all, thanks for having me.

You know, clearly the volatility in the overall software sector, as we have seen, has been high.

And generally, uh, my assessment is that investors as well as marketplace is understanding that different software companies across different industry sectors as well as whatever value they provide have different durable value.

Okay.

For example, when you look at cybersecurity, uh, cybersecurity, we are seeing the interest in the cybersecurity software because of AI is higher than ever before.

Um, do you see this as something that makes the incumbent cybersecurity companies more important, or does it make them, uh, you know, does it show some of the flaws and potential weaknesses of the existing structures?

Mm.

That's more fatiguing than, "Hey, we were actually able to do a lot of this stuff." And so I think the ability to have agentic AI, and this is something that we have done a little bit differently, where we talk about kind of having agentic AI named Cyber Risk Agent on the platform, where, like, there are six agents available.

Each agent has a name and a persona, and they have a skill set in cyber.

So today, talk to any CISO, Patch Tuesday is still there.

People have to take care of Patch Tuesdays.

We have Agent Sarah, who's a Patch Tuesday agent.

So the way the CISOs look at that is, "I have a team of ten, and now I'm augmenting them with six AI agents so that my team now is spending less of their time doing these kind of tasks, and they are leveraging Agent Sarah to do a lot of the tasks that, uh, needed to be done." And so in that sense, it's actually we're able to get better outcomes quicker with agentic AI.

Yeah

So from your vantage point, how is it that Qualys solves for that problem? And what is your differentiation out of the 10 other vendors that are offering similar capabilities?

Yeah, let me talk industry level, right? Not stepping a little bit above what Qualys does, but let's address that.

This problem of alert fatigue was addressed a few years ago with the introduction of the concept of a SOC, right? So you have a security operations center, you're pulling in tons and tons of alerts from many different tools and log data and applying threat intelligence.

And then you have your MDR and teams and you have your...

XDRs and same solutions essentially making up the security operation center to triage and detect and respond to something that has already attacked your network.

And I think what does happen now is with so much digital infrastructure being deployed and so much software being deployed, the number of findings from the risk perspective, not necessarily from somebody's in your environment, is also going the same direction.

what used to be a handful of vulnerabilities that you would find and you would just fix now has gotten to the point where the risks that are coming through, the risk factors that are coming through are so huge in numbers.

So one, do you have any sort of view on what that means, having a hyperscaler compete in the cloud security arena and also anything that they could do given Google has their own LLN, their own hardware, and really, I guess, from an optics perspective, it feels like, you know, a security offering layered on top of cloud kind of resonate with their customers.