Core ETM Concepts

Qualys Enterprise TruRisk Management (ETM) connects technical security findings to business impact, enabling teams to quantify risk, prioritize remediation efforts, and make informed risk decisions. Understanding ETM begins with a set of foundational concepts that define how risk is measured, contextualized, and managed. These seven concepts are the building blocks of the ETM model.

Assets

An asset is anything in your environment that has value and could be attacked, including physical devices, virtual machines, cloud resources, web applications, databases, and user accounts. 

ETM's unified asset inventory pulls data from Qualys scanners, cloud connectors, agents, and third-party tools into one continuously updated list. This gives you a single view of everything you need to protect your assets. 

Findings

A finding is detected of a security issue associated with an asset, such as a vulnerability, misconfiguration, or policy violation. Findings assess the potential risk to your environment and are the basis of risk prioritization in ETM.

ETM collects findings from multiple sources, such as Qualys security tools or third-party security solutions. ETM consolidates these findings into a unified ecosystem, normalizes them, and enriches them with Qualys Threat Database intelligence and business context for comprehensive risk assessment.

Risk

Risk is a measure of the potential harm an asset could face from a threat. This harm can include data loss, downtime, financial loss, or other business impact.

Risk is different from findings. A finding identifies a security issue such as vulnerability, misconfiguration, or policy violation. Risk measures the potential impact of that security issue on an asset, considering factors such as asset criticality, threat intelligence, business context, and exploitability.

ETM quantifies risk by combining findings, threat intelligence, asset context, and business impact into a unified risk model, resulting in a TruRisk score. TruRisk score enables organizations to compare and prioritize risks across assets, applications, business units, and environments using a consistent scale.

Example: A finance team's laptop is missing a critical security patch. The missing patch is the finding, the chance that an attacker exploits it to reach that laptop is the risk, and the payroll data exposure that would follow is the impact. ETM combines all three into a TruRisk score, so this laptop ranks above a test laptop with the same missing patch, and you know which one to fix first.

Business context

Business context adds organizational meaning to asset data by defining the role an asset plays within the organization. It provides information about asset ownership, criticality, and the potential operational and financial impact if the asset is compromised.

Without a business context, vulnerabilities may appear equally important. By adding business context, ETM helps you prioritize risks based on their potential business impact on your organization and focus attention on the risks that matter most.

Threat Intelligence

Threat intelligence provides insights into current and emerging threats, including how attackers exploit vulnerabilities in real-world environments.

Through TruLens, ETM enriches security findings with threat intelligence to identify vulnerabilities that are actively exploited, associated with ransomware, or otherwise pose a significant and immediate risk to your organization.

For more information, refer to TruLens.

TruRisk

TruRisk is ETM's risk-scoring model that quantifies cyber risk by combining vulnerability severity, exploitability, threat intelligence, asset criticality, and business impact into a unified measure of risk.

TruRisk Score helps organizations consistently compare and prioritize risks across assets, applications, business units, and environments using the same scale. A higher score indicates a higher level of risk and a greater need for remediation.

By translating technical security data into a business-aligned risk score, TruRisk enables security teams to focus on the assets and findings that pose the greatest risk to the organization.

For more information, refer to TruRisk.

Risk Reduction

Risk reduction is the process of lowering organizational overall risk by addressing vulnerabilities and other factors that contribute to cyber risk.

In ETM, risk reduction is driven by identifying and prioritizing risks with the greatest potential business impact. By focusing remediation efforts on high-risk findings, critical assets, and actively exploited exposures, organizations can reduce risk where it matters most.

ETM uses TruRisk score to measure risk and help track the impact of remediation efforts over time. This enables security teams to prioritize actions, measure progress, and demonstrate how remediation contributes to reducing overall organizational risk.