ETM and the Risk Operations Center (ROC)
Enterprise TruRisk Management (ETM) and the Risk Operations Center (ROC) are related but distinct concepts. The ROC is an operating model for continuously measuring, prioritizing, and reducing cyber risk.
ETM is the platform that supports the ROC operating model. It does this by unifying security data, applying TruRisk™ scoring to prioritize risk, and adding the business context needed for risk-based decision-making.
What Is the Risk Operations Center (ROC)?
Security teams often collect findings from multiple scanners, cloud tools, and third-party products, without a consistent way to determine which findings matter most to the business. The Risk Operations Center (ROC) is the operating model organizations use to address this: a shared, continuous process for reducing risk across security, IT, and business teams, rather than a growing, undifferentiated backlog of findings.
A Security Operations Center (SOC) is generally centered on detecting and responding to active attacks and security events. A Risk Operations Center (ROC) is centered on identifying and reducing the exposures that could lead to an attack in the first place. In practice, the two overlap and complement each other rather than operating as strictly separate functions. One way to think about the emphasis of each: a SOC leans toward responding once something has happened, much like an emergency room, while a ROC leans toward continuously identifying and reducing risk factors, much like a preventive care program.
How the ROC Differs from a SOC
Both functions matter, and most organizations need both. They focus on different problems.
| Dimension | Security Operations Center (SOC) | Risk Operations Center (ROC) |
|---|---|---|
| Primary focus | Detecting and responding to active attacks and security incidents. | Identifying and reducing the exposures that could lead to an attack. |
| Core activity | Alert triage, incident response, threat detection. | Risk prioritization, exposure analysis, remediation coordination. |
| Orientation | Primarily focused on detecting and responding to security events. | Continuously focused on identifying, prioritizing, and reducing exposure and risk. |
| Success measure | Speed and effectiveness of incident response. | Measurable reduction in risk exposure and business risk over time. |
This is a conceptual comparison to explain the two functions. Most organizations run a SOC and a ROC together, using them for different, complementary purposes rather than choosing one over the other.
What Is Enterprise TruRisk Management (ETM)?
ETM is a cloud-based platform that supports the Risk Operations Center (ROC) operating model. It unifies asset and risk data from Qualys applications and third-party tools, applies the TruRisk™ scoring model, and gives security, IT, and business teams a shared view of what to prioritize.
1. Unified Asset and Risk Visibility
Consolidates asset and finding data from Qualys applications and third-party tools into one consistent view, instead of separate, tool-specific dashboards.
2. Data Aggregation and Normalization
Ingests data from Qualys sensors, cloud connectors, and third-party sources, then standardizes and correlates findings across sources to reduce fragmented, duplicate views of the same risk.
3. Risk-Based Prioritization
Uses TruRisk™ to rank risk based on multiple factors, including severity, exploitability, asset criticality, and business context, rather than treating every finding the same.
4. Risk Quantification
Connects technical findings to Business Entities and the potential financial impact defined for them, giving security leaders a way to describe risk in terms business stakeholders understand.
5. Continuous Risk Assessment
Updates TruRisk™ scores as new findings are ingested, assets change, and remediation occurs, so risk assessment reflects the current state rather than a point-in-time snapshot.
How ETM Powers the ROC
ETM supports the ROC's operating cycle by aggregating and normalizing risk data, applying TruRisk™ to prioritize it, and adding the business context needed to quantify impact. That prioritized, quantified view is what allows the ROC to coordinate action across security, IT, and business teams, instead of each team working from a separate list.
This is the same cycle described in How Enterprise TruRisk Management (ETM) Works: discovering assets and findings, prioritizing them with TruRisk™, validating exploitability, coordinating response, and tracking risk reduction over time. See that topic for a detailed walkthrough of each stage.
A simple way to picture the relationship: ETM is the diagnostic system that determines what needs attention and how urgently. The ROC is the operating model that coordinates action based on that diagnosis.
Why the ROC and ETM Matter Together
Organizations running a ROC powered by ETM can:
Gain a Single View of Enterprise Risk
Instead of separate, tool-specific dashboards, teams work from one consolidated view of assets and risk.
Focus Resources on the Highest-Impact Risks
Findings are prioritized by business impact instead of treated as an undifferentiated backlog.
Improve Cross-Team Collaboration
Security, IT, and business teams share the same risk data and priorities, instead of working from separate reports.
Communicate Risk to Executives and the Board
Risk quantification translates technical findings into business and financial terms leadership can act on.
Measure Risk Reduction Over Time
Continuous scoring makes it possible to show whether risk is actually going down, not just how many findings exist.
In short: ETM provides the risk insight and prioritization that helps the ROC coordinate action across the organization.
ETM, ROC, and CTEM
ETM, ROC, and Continuous Threat Exposure Management (CTEM) are three distinct but related concepts, and it helps to be precise about each.
CTEM: A Security Practice
CTEM is an industry framework, not a Qualys product. It describes a recurring practice of scoping, discovering, prioritizing, validating, and mobilizing action against exposures.
ROC: An Operating Model
The Risk Operations Center is how an organization structures people and process to run that practice continuously, bringing security, IT, and business teams together around a shared view of risk.
ETM: A Technology Platform
Enterprise TruRisk Management is the platform that gives the ROC the data, scoring, and business context it needs to operate.
ETM provides capabilities that help organizations operationalize CTEM through continuous visibility, prioritization, validation, remediation coordination, and risk measurement.