Stop Patching Everything!

In this live episode of "Full Tech Ahead" from Qualys’s 2026 Americas risk operations conference, host Amanda Razani interviews keynote speaker Sumedh Thakar, President & CEO of Qualys. Drawing on his 23 years at the company, Thakar emphasizes a shift from reactive vulnerability counting to proactive business risk management.  With AI accelerating both threat actor exploit speeds and the sheer volume of discovered software flaws—evidenced by nearly 1,400 Microsoft CVE findings in a single release—organizations can no longer attempt to patch everything. Thakar points out that typically less than 1% of vulnerability findings pose an actual risk of financial loss to a business.  To survive machine-speed attacks where vulnerabilities must be fixed within 24 hours rather than through slow committee approvals, he advocates establishing a Risk Operations Center (ROC) powered by AI-based autonomous remediation.  This framework isolates the critical 1%, preserves IT and developer bandwidth, optimizes security budgets, and future-proofs the enterprise against emerging shifts like quantum computing. **Key Quotes** - "Just yesterday, the patches from Microsoft had almost fourteen hundred CVE findings... Really, the big message from the conference has been that you just cannot fix everything, and you need to be able to figure out what actually causes risk to your organization." - "Typically less than one percent of the vulnerability findings actually create risk to the organization. So how do we get to that risk quicker, faster?" - "You could fix ten thousand findings and make no impact to your risk of a breach, or you could fix like thirty, and that could actually be a major impact." - "You cannot fight AI without using AI... The question is, what's the economic equation in which you're going to use AI to fight AI?" **Takeaways** - Target the Critical 1% Over Raw Volume: Remediation teams are overwhelmed by thousands of daily CVE disclosures, yet over 99% do not lead to material business loss. Moving from reactive "fight-or-flight" patching to a Risk Operations Center (ROC) framework allows leaders to bypass raw vulnerability counts and strictly prioritize the 20 to 30 flaws that actively threaten critical assets. - Eliminate Ticketing Delays with Autonomous Remediation: When adversaries weaponize AI to chain exploits together in hours, legacy workflows involving dashboards, ticketing queues, and approval committees are obsolete. Achieving a 24-hour remediation window requires trusting AI-driven autonomous remediation to match the speed of offensive AI. - Reclaim Engineering Bandwidth and Slash Costs: Disrupting IT and development teams with emergency patches for 10,000 minor findings drains productivity without reducing breach likelihood. By treating only the top 1% as emergencies and folding the remaining 99% into routine, scheduled software upgrade cycles, organizations can give developers back hours of weekly productivity to focus on core business innovation. - Future-Proof via a Unified Risk Formula: Technologies never truly vanish (e.g., 70% of airline reservation systems still run on mainframes), while new paradigms like quantum computing loom ahead. Regardless of whether the threat vector is cloud, AI, or quantum encryption, the core risk operational formula remains constant: identify where the technology sits, assess potential business loss, prioritize high-impact exposures, and dynamically shift security budgets to match the active threat landscape. Find Amanda Razani on LinkedIn.  https://www.linkedin.com/in/amanda-razani-990a7233/ Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/ Visit the FTA website: https://fulltechahead.com/ Check out the Substack Channel: https://fulltechahead.substack.com/