Qualys Launches InstaScan For Vulnerability Detection Within Minutes Of Disclosure

Qualys has launched InstaScan, a new capability within its Enterprise TruRisk Management (ETM) platform designed to detect vulnerabilities within minutes of their public disclosure rather than waiting for scheduled scan cycles.

The tool is powered by Agent Insta, an AI-driven cyber risk agent that continuously monitors newly published vendor security advisories and threat intelligence from Qualys and third-party sources. It correlates emerging vulnerabilities against an organisation’s live asset inventory and telemetry to identify impacted systems and surface detections automatically.

Qualys describes the approach as “scanless scanning” – detection triggered by new advisories and asset changes rather than fixed scan schedules.

Shrinking window between disclosure and exploitation

The launch comes against a backdrop of accelerating vulnerability volumes. In the first seven months of 2026, 46,048 CVEs were published, nearly matching the total for all of 2025.

Verizon’s 2026 Data Breach Investigations Report (DBIR) identified vulnerability exploitation as the leading breach entry point for the first time, accounting for 31 per cent of breaches. The report also found that AI is compressing attacker timelines from months to hours.

Qualys’ own research paints a stark picture on the defender side. Among KEV-linked vulnerability instances that were ultimately remediated, the median time from detection to closure held at nine days, even as KEV-linked workload grew 78 per cent year over year.

The company argues that defenders’ nine-day remediation window now sits uncomfortably against attackers operating in hours, while the queue of vulnerabilities to address grows faster than conventional programs can process it.

How InstaScan works

Agent Insta monitors newly published security advisories and threat intelligence feeds on a continuous basis. When a new vulnerability is disclosed, it correlates the advisory against an organisation’s existing asset inventory, exposure data and threat telemetry held within the Qualys platform.

Where it identifies impacted assets, the system surfaces confidence-scored detections without requiring a traditional vulnerability scan to be run. Across its initial set of supported technologies, Qualys says InstaScan covers 90 per cent of detections within minutes of an advisory being published.

The detections are AI-normalised and carry confidence scores, which Qualys says allows downstream prioritisation, validation and remediation workflows to act on them immediately rather than waiting for a conventional scan to confirm the finding.

Principal Cybersecurity Analyst at Omdia, Theresa Lanowitz, commented: “Qualys InstaScan moves threat intelligence from telling you what already happened to detecting exposure the moment it emerges; that’s proactive detection.”

“As threat intelligence becomes a core variable in how organisations quantify risk, InstaScan gives Qualys a direct way to feed that signal into the platform,” Lanowitz added.

From detection to remediation

Qualys positions InstaScan as the first step in a broader agent-driven workflow that spans detection through to remediation. The confidence-scored detections it produces feed into TruRisk for prioritisation, and are designed to give validation and remediation workflows a trusted signal to act on without delay.

President and CEO of Qualys, Sumedh Thakar, noted: “The speed of vulnerability exploitation has changed. A slow vulnerability management program is now the biggest vulnerability an organisation has.”

“We’re entering a new era of vulnerability, one where detection is continuous – driven by live intelligence instead of scan cycles,” Thakar added. “Built on the Qualys platform, InstaScan helps organisations identify and reduce risk the moment new vulnerabilities are disclosed.”

The broader threat landscape

The numbers underpinning the launch point to a structural shift in how vulnerabilities are weaponised. The Verizon DBIR finding that exploitation has overtaken other breach vectors is a departure from previous years, in which credential theft and phishing had dominated as initial access methods.

Qualys’ nine-day median remediation figure for KEV-linked vulnerabilities reflects the time organisations are taking even for known exploited flaws that carry mandated remediation timelines. The company argues that this gap, once manageable, has become untenable as AI-driven tooling accelerates the speed at which threat actors can develop and deploy exploits.

The 78 per cent year-over-year increase in KEV-linked workload also points to growing pressure on security teams, who face a rising volume of vulnerabilities that demand attention while operating with finite resources and fixed staffing levels.

Availability

InstaScan is available now within Qualys ETM. The company is demonstrating the technology at Black Hat USA.

Further information on Qualys ETM is available at qualys.com/etm.

Last Updated on August 4, 2026 by Nick Ross