Success Story
Global Insurer Cuts Through Cyber Risk Noise
How a leading insurance firm prioritized the risks that matter most for business resilience.
Global insurance and asset management
150K
Employees
International
Executive Summary
A global leader in insurance and asset management, serving 95 million customers worldwide, with 150,000+ employees and operations across 50+ countries. The organization focuses on driving efficiency, managing risk, and delivering secure, reliable services at scale.
Pull Stats
~50K+
assets
40%
faster risk identification across siloed tools
15+
data feeds connected, normalized, and deduplicated
Business Background
The company is a global leader in insurance and asset management, operating across life, health, property & casualty insurance, and investment management. With a strong presence in Europe, Asia-Pacific, and North America, the company operates within a complex cybersecurity environment that demands robust protection for sensitive financial, medical, and personal data as well as region-specific regulatory and compliance protection laws.
Customer Environment
~50,000+ on premise servers protected with Qualys Agent for inventory, vulnerability and misconfiguration assessment
~10,000+ cloud servers, deployed in multi cloud provider environment (AWS, Azure, GCP)
Qualys customer since 2010 with on-going module adoption to maximise the value of the Qualys Platform
Use Cases
Continuous Asset Discovery & Normalization
This organization leverages ETM to aggregate asset inventory and exposure data across Qualys scan results, on-premises tool feeds (EDR, CMDB), CSV pentest results, and data from 10 external connectors. Qualys ETM normalizes asset identifiers (IP, MAC, hostname, business unit) and deduplicates, producing a single pane of truth showing asset ownership, criticality, and exposure status.
Risk Scoring & Prioritization Engine
Qualys ETM evaluates the coverage of vulnerability scanning across 400k assets, evaluates the TruRisk severity on each asset, by incorporating contextual factors like asset criticality, business context, financial impact, internet exposure, industry-specific threat intelligence, compensating controls, and exploit validation. As a result, the security team can prioritize remediation, using both risk level and SLA metrics to drive the efforts.
Automated Triage & Playbook Triggering
Through its integration with ServiceNow, prioritized risks are automatically mapped to SOAR playbooks for remediation via ticket creation for asset isolation or patch orchestration. Penetration test results imported via CSV are flagged when they require manual review for more complex exploits.
Qualys Solution
This global enterprise organization has hundreds of thousands of assets generating millions of potential alerts. Traditional prioritization methods fell short. Even when filtering critical vulnerabilities based on CVE scores, the team was still left with hundreds of thousands of issues and little business context to guide decisions.
Using Enterprise TruRisk Management, the team shifted from counting vulnerabilities to understanding risk.
Assets were evaluated in context—business criticality, ownership, and service-level expectations—allowing the team to clearly identify which exposures posed real risk to the organization.
The difference was dramatic. From more than 12 million findings across roughly 400,000 assets, narrowing the scope to critical vulnerabilities on business-critical assets reduced the list to just over 200 issues that required immediate action. With further refinement based on exploit validation, pentest results, and remediation effort, the team could focus immediately on the risks that mattered most.
Benefits
This organization leverages QualysEnterprise TruRisk Management as a central system for aggregating risk signals across its environment. Vulnerability and misconfiguration data from Qualys VMDR and Qualys Policy Audit are combined with asset inventories from CMDB, 3rd party vendors detections, and pentesting results. By leveraging threat intelligence from Qualys native as well as more than twenty-five threat intel feeds, TruRisk scores are calculated everywhere, providing Global and Business Entity risk level visibility.
By bringing these internal and external inputs together, ETM provides a single, unified view of risk that goes beyond technical findings to incorporate business context and financial impact. This consolidated view allows the security team to assess exposure holistically, rather than managing disconnected tools and data sets.
Prioritized Remediation:
Qualys ETM aligns technical severity with business risk and real-world exploitability, reducing the noise and enabling security teams to focus scarce resources for maximum impact
Unified View of Cyber Risk:
Qualys ETM aggregates and prioritizes exposures based on asset ownership, criticality, and exploitability, combining severity with contextual factors like asset criticality, business context and financial impact, internet exposure, and compensating controls.
Standardizes Risk Communication:
Qualys ETM assesses the financial impact of exposures alongside industry-benchmarked threat intelligence. Its executive-ready reporting enables clear, actionable risk discussions up to the board level to drive alignment across the organization.