Qualys this week added a risk operations center (ROC) to its portfolio to make it simpler to identify potential threats to the business and centrally manage remediation efforts.

Announced at the Qualys Security Conference, the Enterprise TruRisk Management (ETM) platform enables organizations to collect data from both Qualys security platforms and its alliance partners, including Forescout, Okta, Microsoft, Oracle and Wiz.

Mayuresh Ektare, vice president of product management for Qualys ETM, said the platform provides organizations with an ability to holistically manage risk in much the same way a security operation center (SOC) is used to manage cybersecurity incidents. That platform will also provide the foundation for centralizing risk data in a way that eventually will make it simpler to apply artificial intelligence (AI) to risk data, he noted.

As the management of cybersecurity continues to evolve it’s clear many organizations are creating separate teams to first, hopefully, thwart cyberattacks and prevent security breaches using a ROC platform while another team focuses on responding to specific incidents, said Ektare.

The challenge organizations encounter today is they are often using 10 or more tools to try to identify and prioritize risk remediation efforts, he noted. All that data, which is often conflicting, first needs to be normalized. The Qualys ETM provides that capability without requiring a cybersecurity team to set up and manage their own data lake, added Ektare.

Qualys ETM also provides rule-based integrations with IT service management (ITSM) platforms such as ServiceNow and JIRA from Atlassian, to automatically assign tickets to the right remediation teams that are usually recruited from an IT operations team.

Cybersecurity teams can then more easily employ the TruRisk scoring tools that Qualys has previously made available by consolidating information from more than 25 threat intelligence feeds in a way that is designed to make it easier for organizations to prioritize their remediation efforts. Cybersecurity teams can then also take advantage of Qualys TruRisk Eliminate to patch or mitigate vulnerabilities, misconfigurations and other potential risks.

Organizations, of course, have had access to governance, risk and compliance (GRC) tools for years, but for the most part, they have proven to be too difficult to use, said Ektare. The Qualys ETM platform provides a single user interface through which all stakeholders can manage risk at a time when many organizations are consolidating their cybersecurity and risk management teams, he noted.

The cybersecurity culture within organizations naturally varies but as regulations become increasingly stringent it’s clear more organizations are going to be expected to be able to more proactively identify and eliminate potential issues to avoid stiffer penalties. Governments around the world have made it clear they expect organizations that collect data to be held accountable for how it is secured.

The challenge now is finding a way to provide cybersecurity teams with the right tools and platforms to achieve that goal. Otherwise, cybersecurity teams will find themselves once again being held accountable for events that are beyond their ability to control.