Qualys CPO Pinkesh Shah on Prioritizing Cloud Security Risk with AI

Cloud security teams can find more vulnerabilities than they can fix. Qualys Chief Product Officer Pinkesh Shah’s approach is to narrow that queue to risks that matter in a specific environment, explain why they matter to the teams responsible for remediation, and offer workable ways to reduce exposure. The emphasis is on prioritization and context, with AI helping sift through growing volumes of security data.

Shah discussed the approach at the Qualys Cybersecurity Conference in London. He has spent more than two decades in the industry, including product leadership roles at McAfee, Exabeam and BeyondTrust. At Qualys, he oversees product design, marketing and product teams.

Measure risk by impact

Counting vulnerabilities can create an unwieldy list without telling teams which items are most likely to cause harm. Shah says a risk management platform should assess findings against their real-world impact, so security staff can focus on the subset that deserves prompt attention.

He illustrated the gap with a hypothetical inventory of 2.8 billion vulnerabilities across a network. In his example, only 7% might represent serious risk. The figures show his point about filtering and prioritization; they are not presented as a measured result from a named customer deployment.

That distinction matters in large environments, where a raw finding count can obscure differences in exploitability, asset importance and exposure. A vulnerability on a sensitive system may demand a different response from the same issue on a lower-impact machine. The value of risk scoring depends on whether it helps teams identify those differences and direct limited remediation time accordingly.

Turn findings into action

Prioritization only helps if the people who can fix an issue understand what to do and why it matters. Shah says security teams often pass large lists to IT operations without enough context. Operations staff then have to judge the urgency and determine a remedy while managing their existing workload.

Useful communication needs to connect each finding to its rationale and provide specific guidance for addressing it. Security leaders also need to translate risk into terms that business leaders can use when evaluating security spending. That creates two related communication tasks: helping technical teams act on findings, and giving executives a clear account of what the work is intended to reduce.

Shah frames remediation as a choice among routes with different tradeoffs. Patching may be appropriate, but it can carry operational costs or disrupt a service. In some cases, checking that an antivirus rule is active may reduce exposure while a patch is planned. The right choice depends on the risk, the asset’s role and the effect of making a change.

His example is a CFO’s laptop containing sensitive data, which he says should take priority over an ordinary employee’s machine. The broader point is that remediation decisions should account for asset criticality, rather than treating every item in a vulnerability queue as equivalent.

AI helps with scale, but brings its own risks

Shah described AI as a way to sort through vulnerability volume, configuration errors and expanding digital footprints across operating systems, applications and cloud environments. He cited an average of around 45 days for an organization to patch a known vulnerability after an exploit becomes available, compared with around 20 days for that vulnerability to be weaponized. The difference leaves a period in which exposed systems may remain at risk.

In this account, the central challenge is the scale and spread of exposure, rather than AI alone. AI systems can themselves introduce vulnerabilities, Shah acknowledged. He recommended rigorous testing, validation and monitoring of those systems, alongside sound data governance and AI ethics practices.

AI-assisted risk analysis can help identify which findings are material in a particular environment, including combinations of issues that may be missed by conventional vulnerability management. But its usefulness depends on the quality of the underlying data and the relevance of its recommendations. Teams still need to validate findings and decide whether a suggested action fits their systems and operating needs.

Cloud migration carries old and new exposure

Moving workloads to the cloud does not erase weaknesses in existing infrastructure. Shah says vulnerabilities and configuration problems can follow applications and systems from on-premises environments into cloud deployments. Migration therefore requires teams to account for inherited exposure as well as risks that come with cloud services themselves.

Examples of cloud-specific issues include misconfigured S3 buckets, open ports and virtual machines left running after development or testing. Each can widen the number of systems an organization needs to track and protect.

SaaS adds another layer. Services such as Box, Slack, Zoom and Office 365 hold data and permissions that can be mismanaged. Shah’s recommended scope is a unified view of risk spanning on-premises infrastructure, cloud resources and SaaS applications. Separate tools or teams may each see part of the picture, while exposure can arise from how those parts connect.

Controls that support cloud adoption

Shah outlined several practical safeguards. Organizations should configure and harden virtual machines carefully because weaknesses in a reusable setup can spread across hundreds or thousands of instances. They should also identify sensitive data, including personally identifiable information and protected health information, and ensure it is protected from unintended public access.

Reusable “golden images” and infrastructure code deserve similar attention. If a template contains a vulnerability or insecure setting, every instance created from it can inherit the same problem. Maintaining secure baseline images and configurations can reduce the chance that a known weakness is replicated throughout an environment.

Shah also pointed to security benchmarks and standards, including CIS, CSA, NIST, PCI and ISO 27001, as ways to assess cloud posture and find gaps. The organizations he described can use these references to check whether configurations and practices meet the expectations relevant to their systems. Assessments need to feed into ongoing remediation, especially as cloud resources and application permissions change.

AI-powered risk insights can add another layer by surfacing combinations of vulnerabilities across cloud and SaaS environments. The aim is to help teams rank those scenarios for action, rather than rely only on isolated findings. As with any automated analysis, organizations need to check that the identified risks are accurate and that recommended changes suit the assets involved.

Continuous visibility beyond a single assessment

Shah also discussed Qualys’s 30-day access offer for its risk management platform, which he said was designed to help Qualys and non-Qualys customers assess internet-exposed assets against UK NCSC vulnerability management guidance. The setup included an NCSC dashboard, vulnerability management, external attack surface monitoring and patch management. He said customers could discuss paid options to continue after the trial period.

More broadly, Shah described platform support as a continuing process: maintain risk visibility across on-premises, cloud and SaaS systems, and automate checks against standards such as CIS benchmarks. A one-time assessment can identify issues at a point in time, but it cannot show whether new resources, configuration changes or emerging vulnerabilities have altered the picture.

The operational test for AI-supported cloud security is whether it helps teams connect exposure to impact, assign fixes with enough context, and choose remediation that fits business needs. Shah’s framework puts those steps together: measure risk, communicate it clearly and reduce it through an appropriate action. Its effectiveness will depend on the accuracy of risk analysis and the organization’s ability to keep its view of assets and configurations current.