Original Coverage & Source Attribution: www.securityinfowatch.com
Risk operations center concept
Thakar discussed the Risk Operations Center (ROC) as a way to make risk management more systematic and proactive. He described the ROC as a concept rather than a Qualys product, focused on bringing risk signals from different vendors and tools together to provide a broader view of organizational exposure.
Organizations can continue selecting the tools best suited to individual use cases while combining their information to determine which risks matter most to the business, he said.
The approach complements traditional Security Operations Centers (SOCs), which focus on security operations and active threats. A ROC provides a broader framework for operationalizing risk management and helping organizations make decisions based on the potential business impact of security issues.
Thakar also emphasized the importance of a vendor-neutral approach, allowing organizations to evaluate information across their security environments rather than relying on a single tool or vendor.
Balancing automation and risk
The discussion also addressed autonomous remediation and the role of artificial intelligence in security operations. Thakar said organizations need sufficient intelligence and confidence in automated actions to reduce the likelihood of outages when applying fixes.
He acknowledged that no approach can guarantee zero outages. Instead, organizations must evaluate whether the risk associated with autonomous remediation is comparable to or lower than the risk of outages caused by human-led updates.
Thakar described this as an area where greater intelligence can help build confidence in automated remediation.
Ultimately, he said cybersecurity teams cannot fix every issue they identify. Organizations must decide which risks to mitigate, which to accept and which may be transferred through cyber insurance.
“Fundamentally, all we’re trying to do here is manage the risk,” Thakar said.
He encouraged chief information security officers to communicate cybersecurity investments in terms of how they reduce potential financial losses for the business, rather than focusing primarily on individual tools and capabilities.
Visit SecurityInfoWatch on YouTube to watch the full interview.
