Automate Asset Isolation: Your Last Resort to Meet Remediation Deadlines

Summary

Qualys has introduced TruRisk Eliminate, a platform designed to automatically isolate hosts that fail to meet vulnerability remediation deadlines. This tool addresses common issues like non-existent or delayed patches, or failed remediation attempts, by quarantining the affected host from the network. It integrates with the Qualys Cloud Agent, eliminating the need for EDR integration and providing auditable logs for compliance.

Full text

Table of ContentsThe Exposure Window Nobody Plans ForThe Remediation RealityWhy Automate Isolation?Use Case: Isolating a Host After an Exceeded CISA KEV DeadlineImplementationThe Bottom LineFrequently Asked Questions (FAQs) Executive Summary Remediation deadlines slip for reasons outside your control: a patch does not exist yet, a patch is delayed, or a remediation attempt fails. The outcome is the same either way: the host stays unpatched and stays on the network. TruRisk Eliminate closes that window by isolating the host automatically the moment your deadline passes, executed natively through the Qualys Cloud Agent with no EDR integration required. This post covers the trigger criteria, the QQL query behind a CISA KEV use case, and the audit record that isolation produces. The Exposure Window Nobody Plans For When a vulnerability deadline is set, the clock starts. But deadlines slip for different reasons: a patch doesn’t exist yet, a patch is delayed, or a remediation attempt fails outright. Whatever the cause, the outcome is the same: the host stays unpatched and stays on the network. Asset isolation quarantines the host from the network the moment a defined policy is met, so it cannot be reached or exploited while remediation continues. TruRisk Eliminate is the Remediation Intelligence platform that reasons about vulnerability risk in real time and takes autonomous action to close risk windows instantly. When a remediation deadline passes with the vulnerability still open, Eliminate triggers host isolation, automatically quarantining the host the moment your deadline passes, without manual intervention. Isolation becomes your last resort, executed instantly when remediation pathways fail. The Remediation Reality When a patch is months away and a deadline is days away, isolation is your last resort remediation strategy. Traditionally, that meant EDR tools, extra licensing, and a coordination cycle measured in days. Eliminate executes host isolation natively through the Qualys Cloud Agent, using the criteria you define. The deadline passes, the host is quarantined, and your team keeps working the patch. Why Automate Isolation? Speed closes the exposure window The moment your criteria is met, such as a passed deadline, Eliminate isolates the host automatically Compliance proof demonstrates accountability Every isolation is logged with full context: which rule triggered it, when, which host, and why. You can show auditors, your board, and your insurers a complete record of timely, defensible risk decisions. The timeline speaks for itself. Consistency at scale enforces your policy uniformly Automated rules apply identical criteria across every host in scope. Every host on your network follows the same isolation timeline. Predictable enforcement, measurable outcomes, auditable results. Use Case: Isolating a Host After an Exceeded CISA KEV Deadline Scenario: Your organization tracks CISA KEV vulnerabilities with a 14-day remediation window. If a vulnerability breaches that deadline and remains unpatched, the host must be isolated to prevent exploitation. The Query: vulnerabilities.status:[ACTIVE,NEW,REOPENED]AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s"AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE What This Does: vulnerabilities.status:[ACTIVE,NEW,REOPENED] — Only unresolved vulnerabilities vulnerabilities.riskFactor.cisaKEVDueDate < “now-1s” — The KEV deadline has passed (as of this moment) vulnerabilities.riskFactor.cisaKnownExploits:TRUE — The CVE is confirmed on the CISA KEV list When this query matches a host, Eliminate automatically triggers the Isolate Host remediation path. The host is quarantined within seconds and removed from the network while your team works on patching or persistent mitigations. Each isolation is logged the moment it occurs, providing the security team with an audit-ready record rather than a manual, case-by-case reconstruction. Implementation Isolation executes through the Qualys Cloud Agent, with no EDR integration required. For the full configuration steps, see Automate Asset Isolation in the Qualys documentation. The Bottom Line Patching is your first line of defense, backed by other remediation options — Mitigate, Customize, Run Custom Script, Fix, and Uninstall. But sometimes none of those paths are available, and isolation is your only option. Triggered the instant your criteria are met, automated isolation means you isolate the risk before it can be exploited. TruRisk Eliminate is the Remediation Intelligence platform that makes that call for you: reasoning about risk, executing autonomously, and writing the record as it happens. Exposure closes. Compliance is proven. Risk is reduced. Ready to eliminate the exposure window on your highest-risk vulnerabilities? Start Free Trial Note: Vendor patches may not be available for all vulnerabilities. TruRisk Eliminate is the Remediation Intelligence platform that provides both vendor patch deployment and patchless remediation capabilities. Patchless remediation is available exclusively to TruRisk Eliminate customers and is not included with Legacy Patch Management or VMDR. Frequently Asked Questions (FAQs) What is automated asset isolation? It is a last-resort remediation path that quarantines a host from the network the moment a defined policy is met. For example, a CISA KEV deadline passing while the vulnerability remains unpatched. Does isolation replace patching? No. Isolation contains exposure while the team continues patching or applying persistent mitigations. It is used when Fix, Mitigate, Uninstall, or Run Custom Script cannot meet the deadline. Do I need a separate EDR tool to isolate hosts? No. TruRisk Eliminate executes isolation natively through the Qualys Cloud Agent. How does this help with CISA KEV compliance? A QQL rule can isolate any host with an ACTIVE, NEW, or REOPENED KEV finding whose due date has passed. Each action is logged with rule, time, host, and reason for audit-ready evidence. Is isolation available with VMDR or Legacy Patch Management? Patchless remediation capabilities, including this isolation path, are available exclusively to TruRisk Eliminate customers. Related

Entities