Qualys is widening the data feeding its risk platform to the parts of the enterprise that traditional scanners struggle to reach: phones, industrial and medical devices, and user identities. The company has expanded its Global mROC Alliance to include five technology partners and added two new partner authorisation tracks, as it pitches a Risk Operations Center (ROC) as the answer to a rising flood of vulnerabilities.

Qualys says the new technology alliance partners are Claroty, Lookout, NowSecure, Nozomi Networks and Okta. Their telemetry will flow into Qualys Enterprise TruRisk Management (ETM), where TruRisk, the company’s scoring and prioritisation engine, assesses it alongside data from the rest of the environment. Qualys says this gives security chiefs a unified score, a prioritised remediation list and a view of risk they can report to the board.

The company frames the problem around the speed of AI. It argues that frontier AI models find software vulnerabilities faster than security teams can triage them by hand, that attackers have the same capability, and that finding more flaws only deepens the backlog when programmes are split across dozens of tools with separate severity scores. It adds that phones, connected devices, industrial and medical systems, and identities often cannot run an agent or tolerate active scanning, so their risk goes unmeasured.

By attack surface, the integrations work as follows, according to Qualys:

• Mobile (Lookout and NowSecure): continuous visibility into device security posture, operating-system vulnerabilities and app-level risks found through binary analysis, including flaws in embedded third-party software development kits. These feed the same TruRisk score as servers and laptops.
• OT and IoT (Claroty and Nozomi Networks): passive asset discovery and vulnerability data for industrial control systems, medical devices and building management systems. Exposures that cannot be scanned or patched are made visible and prioritised, with compensating mitigations tracked in the same workflow.
• Identity (Okta): posture data on misconfigured, over-privileged or exposed accounts and credentials. An at-risk account is weighed against the systems it can reach, so teams can fix the exposures an attacker would use to move laterally.

The invite-only alliance now certifies partners in three roles. The two new ones are the Authorized mROC Advisor, certified to assess a customer’s risk programme, set TruRisk-based priorities and design the ROC operating model and roadmap, and the Authorized mROC Delivery & Implementation Partner, certified to deploy ETM, connect it to the customer’s existing security tools and partner telemetry, and stand up ROC workflows. The existing mROC Partner role covers running a customer’s ROC as a managed service, from prioritisation through remediation and reporting against service-level agreements.

Cade Stephens, Qualys’s vice president of global channels and strategic alliances, said: “PHP2Shell was a wake-up call for the industry. The vulnerability existed for years, but AI dramatically changed the economics of discovery and exploitation, enabling adversaries to weaponize exposures at a speed that far exceeds traditional response cycles. Our expanded Global mROC Alliance brings together the power of the Qualys platform, strategic technology alliance partners, and a global ecosystem of highly trained Risk Operations Center experts to help customers operationalize cyber risk management at scale and outpace threats in the age of AI.”