Agent Val Now Validates the Entire Attack Surface: From Network to Host

Summary

Qualys has enhanced its TruConfirm exploit validation service by introducing Cloud Agent-Based TruConfirm. This new capability extends exploitability validation from network-exposed assets to endpoint-resident vulnerabilities, including local privilege escalation, browser exploits, and kernel-level flaws. By leveraging existing Qualys Cloud Agents, the service aims to provide comprehensive proof-based validation across the entire attack surface, addressing the challenge of rapidly escalating CVE disclosures.

Full text

Table of ContentsThe CVE Classes That Live Beyond the Networks ReachOne TruConfirm, Two Engines, Complete CoverageHow Cloud Agent-Based TruConfirm WorksETM, TruRisk, and Agent Val: Evidence-Driven Risk OperationsWhat This Means for Security TeamsFrom Possibility to Proof Across the Entire Attack SurfaceFAQ Powered by TruConfirm — Exploit Validation That Now Runs on the Network and the Host Executive Summary Qualys TruConfirm now validates exploitability across the entire attack surface, not just the network. Cloud Agent-Based TruConfirm brings the same proof-based validation model to the endpoint, closing the gap on local, kernel, browser, and post-authentication CVEs that network scanning alone could never reach. AI-assisted vulnerability research has compressed the time between disclosure and active exploitation, leaving security teams with more findings than they can possibly investigate or remediate. The core question is no longer, “What is vulnerable?” Rather, it is, “Which of these findings are actually exploitable in my environment, against my controls, right now?” That’s the question Qualys TruConfirm was built to answer. Instead of asking whether a vulnerability could be exploitable, TruConfirm proves whether it has been. Since we launched about a year ago, scanner-based TruConfirm has done exactly that at scale, safely validating exploitability in enterprise environments across: Coverage for more than 1,800 CVEs 8 million+ validations 100s of enterprise organizations With coverage expanding continuously as the Qualys Threat Research Unit adds new payloads. “Every validation method has a vantage point. The network was only one of them — the endpoint was always the other half of the attack path.“ -Himanshu Kathpal, Vice President, Product Management, Platform and Technologies Every validation method has a vantage point, though, and the network is only one of them. A meaningful share of the CVEs security teams worry about most don’t live on the network. They live on the endpoint. That foundation is not changing. Scanners remain a first-class validation engine and a core strength of Enterprise TruRisk™ Management (ETM). What is changing is the breadth of attack-surface coverage. TruConfirm now extends exploit validation beyond network-exposed assets to endpoint-resident vulnerabilities that traditionally could not be validated remotely. Now, with this launch, we’re giving TruConfirm a second vantage point. Cloud Agent-Based TruConfirm brings the same proof-based validation model directly to the hosts, delivered through the Qualys Cloud Agent that’s already running across our customers’ environments. Cloud Agent-Based TruConfirm delivers host-level exploit validation for local, kernel, browser, and client-side CVEs that network-based validation cannot reach. This allows teams to now validate the entire attack path, from entry to impact. The CVE Classes That Live Beyond the Network’s Reach Scanner-based TruConfirm earned its place as one of the most trusted capabilities inside Qualys Enterprise TruRisk Management (ETM). It excels at validating remotely exploitable vulnerabilities in networking hardware, perimeter services, and enterprise platforms that are reachable over the wire. That remains a core pillar of the product. Some of the most damaging CVE classes, however, live deeper inside the attack path and structurally require local execution to validate. These include: Local privilege escalation chains that require an authenticated session on the host itself, working through kernel pools, driver IOCTLs, and privilege-token chains. Browser and client application exploits, including V8 type confusion, use-after-free bugs, and Office macro chains, that execute inside a process context that only exists on the endpoint. Linux and Unix kernel-level vulnerabilities that require local kernel execution to validate at all. Post-authentication and insider-exploit classes that need a privileged local session that a network scanner simply does not hold. Blind local remote code execution exploits that produce no network-observable signal. The only way to confirm it ran is a callback from inside the endpoint. Without endpoint-level proof, these vulnerabilities often sit in the same queue as every other critical-rated CVE. Patch teams see identical scores yet have no evidence that distinguishes issues that can actually be executed from those that cannot. Effort goes toward risk that doesn’t exist in practice, while the CVEs that do matter wait their turn. And as AI-assisted vulnerability research accelerates the discovery of exactly these endpoint-resident classes, that visibility gap keeps widening for anyone without a way to validate on the endpoint itself. Cloud Agent-Based TruConfirm is built to close that validation gap. It brings proof-based validation into the endpoint itself and extends TruConfirm coverage from external-facing assets to the full organizational attack surface. One TruConfirm, Two Engines, Complete Coverage In this evolution, TruConfirm operates through two complementary engines that work as one capability. Scanner-led TruConfirm validates remote- and network-exposed vulnerabilities from the network perspective. Cloud Agent-Based TruConfirm validates endpoint-local and post-authentication vulnerabilities from the host perspective. Because it leverages the Cloud Agent already deployed across our customers’ servers, laptops, cloud instances, and containers, there’s no new infrastructure to stand up, no credentials in flight, and nothing additional to install. Validation logic is delivered as a signed manifest, and the agent checks in on a regular cycle, roughly every 15 minutes, to pick up new TruConfirm assessments as they become available. Scanner-based TruConfirm continues to handle everything it does today: remote- and network-exposed CVEs, validated the same way, at the same scale. The endpoint side simply picks up where the network’s reach ends. How Cloud Agent-Based TruConfirm Works Cloud Agent-Based TruConfirm runs the same three-stage workflow that defines TruConfirm’s safety and rigor. It simply executes that workflow on the endpoint where local exploits occur. Step 1: Environment assessment. Before anything else happens, the agent profiles the host: OS and kernel version, loaded drivers, running services, installed software and browser versions, patch status, user privilege context, and whether compensating controls like EDR or EPP are present and active. Validation proceeds only when conditions indicate that exploitation is actually feasible on that specific asset. Step 2: Safe proof-of-concept execution. A purpose-built, benign proof-of-concept runs locally to test whether a vulnerability can actually be exploited on that endpoint. No shellcode executes, no sensitive data is touched, and no persistent change is made to the system. This mirrors the safety discipline scanner-based TruConfirm has always applied, adapted for on-device execution. Step 3: Deterministic proof generation. The agent captures hard evidence, such as privilege-escalation outcomes, process lineage changes, kernel-state modifications, or controlled DNS and HTTP callbacks. A finding is only marked exploitable when observable proof backs it up. No assumptions, no probability scores, just evidence. Validated findings then flow directly into ETM. Exploit-confirmed vulnerabilities rise in TruRisk priority, remediation queues reorder automatically, and dashboards reflect what’s actually exploitable rather than what a severity score assumed. ETM, TruRisk, and Agent Val: Evidence-Driven Risk Operations Because TruConfirm is native to Enterprise TruRisk Management, every validation signal flows directly into your risk operations. Exposure data from Qualys scanners and third-party sources is ingested into ETM. TruRisk applies threat intelligence and business context to build a prioritized view of risk. TruConfirm then validates which of those exposures are exploit

Entities