Most engineers think…
Most people treat vulnerability scanning and patch deployment as two completely separate workflows: scan in tool A, export a CSV, create a ticket in tool B, patch manually, scan again to verify. That works at 50 assets. It falls apart at 5,000.
Qualys VMDR is built on the idea that detection and remediation live in the same platform. The vulnerability finding already knows which patch fixes it, which assets need it, and what the risk score is. Patch jobs, deployment rings and zero-touch automation turn that knowledge into automated action — closing the CVE-to-patch gap from weeks to hours.
① Why integrated patching — one platform, zero handoffs
Traditional remediation has a fatal gap: the scanner knows what is vulnerable but the patching tool does not know the risk score, and the ticketing system knows neither. Teams export CSVs, lose context, and the mean-time-to-remediate stretches into weeks. Qualys VMDR collapses that gap by keeping vulnerability data, threat intelligence, risk scoring and patch deployment in one platform.
When VMDR detects a vulnerability on an asset, it immediately looks up the patch correlation — the exact patch or configuration change that fixes it. Security and IT share the same dashboard, so remediation starts without a handoff. According to Qualys, teams using the integrated workflow reduce remediation workload by roughly 70%.
The integration is bidirectional: once a patch job finishes, VMDR re-scans the target and closes the vulnerability finding automatically, giving a clean audit trail from detection to verified fix.
What is the primary benefit of integrated patching in Qualys VMDR?
② Patch jobs — create, schedule, deploy and verify
A patch job is the core unit of remediation in Qualys Patch Management. You create one by selecting a vulnerability (or a group of assets) from the VMDR dashboard, choosing the correlated patches, defining a target asset tag or IP range, and setting a schedule or triggering it on demand. The Qualys Cloud Agent on each target receives the job, downloads the patch from a configured distribution point, installs it, and reports back status.
Key job options to know
- Patch window: time-of-day or day-of-week restriction so patches only deploy during approved maintenance windows.
- Reboot behaviour: suppress, force, or prompt the user — critical for server vs desktop policy differences.
- Rollback: for supported patches, Qualys can store pre-patch state and roll back if verification fails.
- Job status dashboard: shows Success / Failed / Pending per asset in real time, so you know immediately which devices need a retry.
Patch jobs can be scoped by asset tags, making targeting dynamic: add a new server with the right tag and it automatically falls into the next scheduled job.
A scheduled or on-demand task that deploys one or more patches to a target asset group via the Qualys Cloud Agent. Controls patch window, reboot behaviour and rollback.
An automated patch job that triggers the moment Qualys detects a qualifying patch, with no human click. Linked to Prioritization report criteria such as Critical CVEs with active exploits.
A staged rollout wave — Ring 1 (pilot), Ring 2 (broad), Ring 3 (full estate) — that limits blast radius if a patch causes a regression.
The Qualys Knowledge Base mapping that links every CVE to the specific patch (KB, package, advisory) that closes it, so VMDR knows what to deploy without manual lookup.
Hardcoded IP lists in patch jobs break the moment an asset is rebuilt or re-addressed. Use Qualys dynamic asset tags (by OS, cloud tag, business unit) so the job target stays accurate automatically. In cloud environments where IPs change constantly, tags are the only scalable approach.
A new database server just received the 'Linux-Prod' asset tag. Which patch job configuration automatically includes it in future deployments?
③ Deployment rings and zero-touch patching
Deployment rings let you stage a patch rollout in waves rather than pushing to your entire estate at once. Ring 1 (the pilot ring) targets a small group of representative assets — typically a handful of test machines or a low-criticality department. After a soak period and a pass/fail check, Ring 2 expands to a broader group, then Ring 3 rolls out to the full production estate. If a patch causes an issue in Ring 1, you halt before the damage spreads.
Zero-touch patching goes one step further: it removes the human trigger entirely. You create a zero-touch patch job linked to a Qualys Prioritization report criteria (e.g. 'any Critical severity vulnerability with an active exploit in the wild'). As soon as Qualys detects a new patch that matches the criteria for a current or future vulnerability, the job fires automatically — no one has to log in and click Deploy. This is especially valuable for fast-moving threats like zero-day exploits where speed of patching directly limits exposure.
In practice, organisations combine both: a zero-touch job targets Ring 1 immediately, then a scheduled job promotes the same patch to Ring 2 and Ring 3 after the soak period passes clean.
Zero-touch and Critical severity both increase urgency — but never justify skipping a pilot ring. A patch that cures a CVSS 9.8 vulnerability can still crash a specific Java runtime or break a custom service. Ring 1 soak exists precisely because urgency and safety are independent dimensions.
▶ Watch a Critical CVE get patched end-to-end
Follow one CVE from VMDR detection to verified closure. Press Play for the healthy path, then Break it to see the classic failure.
Your zero-touch patch job triggers on Ring 1 assets and the patch causes a service crash. What is the correct next step?
④ CVE-to-patch correlation — tracing the full remediation path
The intelligence that makes integrated patching work is Qualys patch correlation: for every detected CVE, the platform identifies the specific Microsoft, Linux, or third-party patch (by KB number, package version or advisory ID) that closes it. This mapping is maintained in the Qualys Knowledge Base and updated as vendors release new patches — so when a new CVE drops, the correlated patch appears in VMDR within hours of the vendor advisory.
From the VMDR dashboard, an analyst can click a vulnerability finding, see the correlated patch, inspect which assets are missing it, and launch a patch job — all without leaving the screen. The AI Patch Reliability Score (introduced in early 2026) adds another layer: it predicts the likelihood a patch will cause a regression in your environment so you can flag risky patches for extra ring testing before rolling out broadly.
After deployment, VMDR triggers a verification scan. If the CVE finding disappears, the patch job is marked Success and the audit record is closed. If the CVE persists, the job is marked Failed and the asset stays in the remediation queue with an alert for the team. This closed-loop model — detect, correlate, deploy, verify — is what separates VMDR from bolt-on patching tools.
Vikram at a Pune fintech firm faces this
A Critical CVE for a widely-used Windows library appears on 840 assets. The IT team is waiting for a change-approval ticket before they will touch anything, so estimated patching time is two weeks.
The vulnerability and patching workflows are siloed: Security raises a ticket in a separate tool, IT manually identifies the patch, and change-approval adds days of delay.
VMDR already correlates the CVE to its patch and knows all 840 affected assets. No manual lookup is needed. The delay is process, not technical.
VMDR Dashboard ▸ Vulnerabilities ▸ Affected Assets ▸ Remediate ▸ Create Patch JobCreate a zero-touch patch job pre-scoped to a Ring 1 pilot of 20 assets with a 24-hour soak window, then auto-promote to Ring 2 (250 assets) and Ring 3 (full 840) on a clean pass. Total automated elapsed time: under 72 hours for full coverage.
VMDR re-scans after each ring completes — CVE findings disappear from all 840 assets; the audit trail shows CVE closed, patch deployed, no regressions reported in Ring 1.
A patch job marked 'Success' means the installer returned exit code 0 — it does not guarantee the vulnerability is gone. Qualys triggers a re-scan post-job. Check the VMDR dashboard: if the CVE finding still shows on an asset after the re-scan, the patch did not fully remediate it and needs investigation.
What does the Qualys AI Patch Reliability Score (2026) predict?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the difference between a scheduled patch job and a zero-touch patch job, and when would you use each? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Patch Job
- A scheduled or on-demand Qualys task that deploys one or more patches to a target asset group via the Cloud Agent, with controls for patch window, reboot behaviour and rollback.
- Zero-Touch Patching
- An automated patch job that triggers without human intervention the moment a qualifying patch is released, based on criteria defined in a Prioritization report (e.g. Critical CVE with active exploit).
- Deployment Ring
- A staged rollout wave (Ring 1 pilot, Ring 2 broad, Ring 3 full estate) used to limit the blast radius of a bad patch before it reaches all production assets.
- Patch Correlation
- The Qualys Knowledge Base mapping that links every CVE to the specific patch (Microsoft KB, Linux package or third-party advisory) that closes it.
- Asset Tag
- A dynamic label in Qualys that groups assets by OS, cloud provider, business unit or any attribute — used to target patch jobs without hardcoding IP lists.
- AI Patch Reliability Score
- A Qualys AI feature (2026) that predicts the probability a specific patch will cause a regression in your environment before you deploy it, helping prioritise extra ring testing.
- Patch Window
- A time-of-day or day-of-week restriction on a patch job that ensures patches only install during an approved maintenance window, protecting critical services from unplanned downtime.
- Verification Scan
- An automatic VMDR re-scan triggered after a patch job completes to confirm whether the CVE finding is closed on each targeted asset — the definitive proof of remediation.
📚 Sources
- Qualys — VMDR with Patch Management product page. qualys.com/apps/vmdr-patch
- Qualys — Patch Management datasheet: integrated patching, patch jobs, zero-touch automation. cdn2.qualys.com/docs/mktg/qualys-patch-management-datasheet.pdf
- Qualys — VMDR with Patch Management solution brief. cdn2.qualys.com/docs/mktg/qualys-vmdr-with-patch-management-solution-brief-v230119.pdf
- Qualys Docs — Zero-Touch Patch Job: creating automated patch jobs from Prioritization reports. qualysguard.qg2.apps.qualys.com/portal-help/en/vm/threat/zero_touch_patching.htm
- Qualys Blog — AI-Powered Patch Reliability Scoring: predict patch impact before you deploy (Feb 2026). blog.qualys.com/product-tech/2026/02/18/new-ai-powered-patch-reliability-scoring-predict-patch-impact-before-you-deploy
- Qualys Docs — Patch Management: patching from VMDR, job options and deployment. docs.qualys.com/en/pm/latest/
What's next?
Got patching down? Next, go deep on Qualys TruRisk scoring — how VMDR calculates asset risk from CVSS, threat intel, exploit maturity and business criticality — and why the default CVSS score is rarely the right priority signal.