What Is Enterprise TruRisk Management
Qualys Enterprise TruRisk Management (ETM) is a cloud-based platform that measures, prioritizes, and reduces cyber risk across your organization. ETM collects asset and finding data from Qualys applications and third-party tools, adds threat intelligence and business context, and calculates a TruRisk score that expresses risk on a consistent scale.
With ETM, you can manage the full risk lifecycle in one place, from discovering assets and findings to validating remediation and reporting on risk reduction.
Watch the ETM Overview Video
Watch this video for a quick overview of ETM.
Why ETM
Most organizations use many security tools. Each tool reports assets and findings in its own format, with its own severity ratings. As a result, teams often receive large volumes of findings without a clear way to decide which ones matter most to the business.
ETM addresses this challenge in the following ways:
- One view of assets and findings: ETM consolidates data from multiple sources into a unified asset inventory and a single set of findings.
- Risk in business terms: ETM considers asset criticality and business context, so the same vulnerability receives a higher priority on a business-critical asset than on a test system.
- Focus on real threats: ETM uses threat intelligence to identify findings that are actively exploited or associated with ransomware.
- Measurable progress: ETM tracks the TruRisk score over time, so you can measure the effect of remediation and report on risk reduction.
The ETM Risk Lifecycle
ETM manages risk through a continuous lifecycle. Because new assets, vulnerabilities, and threats continually change your environment, the lifecycle repeats, and ETM updates TruRisk scores as new data arrives.
- Connect and onboard data: Connect Qualys applications, such as VMDR, CSAM, and Policy Audit, and third-party sources through connectors.
- Manage assets and findings: ETM normalizes, correlates, and enriches the data to build a unified asset inventory and a consolidated list of findings.
- Understand and quantify risk: ETM calculates TruRisk scores for findings, assets, business entities, and the organization, and compares them with your risk appetite.
- Prioritize risk: Identify the findings and assets that contribute the most risk, based on severity, exploitability, threat intelligence, and business impact.
- Validate risk: Confirm whether prioritized exposures are exploitable in your environment.
- Reduce and manage risk: Create risk reduction plans, assign actions, and validate that remediation is complete.
- Monitor and report: Track risk trends on dashboards and report progress to stakeholders.
Because new assets, vulnerabilities, and threats continually change your environment, ETM repeats this workflow and updates risk scores as new data arrives.
For more information, refer to Data Workflow.
Key Capabilities
| Capability | Description |
|---|---|
| Unified asset inventory | Consolidates assets from Qualys sensors, cloud connectors, and third-party tools that you connect through ROC connectors into one continuously updated inventory. |
| Findings management | Collects vulnerabilities, misconfigurations, and other security findings from multiple sources and organizes them in a common data model. |
| Business context | Groups assets into business entities, assigns asset criticality, and sets a risk appetite for each business entity. |
| TruRisk scoring | Combines the Qualys Detection Score (QDS) of each finding with the asset criticality score (ACS), the number and severity of detections, and internet exposure to calculate a TruRisk score from 1 to 1,000. |
| Risk quantification | Expresses the cyber risk of a business entity in monetary terms, based on business value and potential loss. |
| Threat intelligence (TruLens) | Displays trending and actively exploited vulnerabilities and the threat actors that target your industry. |
| Exposure validation (TruConfirm) | Uses safe, benign checks to confirm whether a prioritized vulnerability is exploitable on a live asset. |
| Attack path analysis | Traces the attack paths that lead to your critical assets. |
| Identity risk (ETM Identity) | Analyzes Active Directory and privilege escalation risk. |
| Risk reduction and response | Helps you create risk reduction plans, automate responses with rules and actions, and manage risk acceptance. |
| Agentic AI and ROCky | Provides AI agents that run security tasks on your behalf, such as CISA KEV monitoring and Patch Tuesday triage, and the ROCky Cyber Risk Assistant, which answers your questions about risk in natural language. |
Note: Some capabilities, such as TruLens, Agentic AI, and ROCky, require separate enablement. To enable these capabilities, contact your Technical Account Manager (TAM) or Qualys Support.
ETM for Existing Qualys Customers
If your organization already uses Qualys applications, such as VMDR or CSAM, ETM uses the data from these applications as a starting point. ETM adds data from third-party sources, business context, and threat intelligence to provide an organization-wide view of risk.
ETM organizes findings around CVEs, while VMDR continues to use QIDs. The underlying detection remains the same; only the way that ETM organizes and correlates findings differs.
For more information, refer to Connect Qualys Applications with ETM.
ETM and the Risk Operations Center
ETM is the technology foundation of the Risk Operations Center (ROC). The ROC is an operational framework that continuously measures, prioritizes, and reduces cyber risk. While a Security Operations Center (SOC) detects and responds to incidents, the ROC focuses on reducing risk before an incident occurs. ETM provides the data unification, TruRisk scoring, and risk quantification that the ROC depends on.
For more information, refer to ETM and the Risk Operations Center.