Attackers can chain low-severity misconfigurations into an attack path in minutes, while audit prep still runs on manual evidence. Anu Kapil shows how to move from audit fire drills to continuous audit readiness with Qualys Policy Audit. Join us at ROCon Americas, October 13-15 in Austin, Texas: https://www.qualys.com/rocon/2026/americas Try Qualys ETM free for 30 days: https://www.qualys.com/free-trial-new/enterprise-trurisk-management This Black Hat USA 2026 session draws on more than 1 billion misconfigurations Qualys analyzed. Failing controls cluster in access control, permissions, identity, and audit logging across finance, healthcare, and government. The five-step cycle covers discover, prioritize, remediate, report, and monitor, with automated evidence collection and mapping to frameworks such as NIST, PCI, HIPAA, and GDPR. The demo covers AI-based policy creation and updates from CIS benchmarks or internal guidelines (with confidence scores and expert approval), AI-generated remediation scripts in Audit Fix, scheduled remediation jobs, and executive audit reports. Prioritization by score can cut findings by up to 98%, and about 1% of findings need attention first, according to Qualys data. Speaker: Anu Kapil, Director, Product Management, Qualys Chapters: 0:00 Intro: compliance still runs on manual work 1:06 What 1 billion misconfigurations reveal 2:10 How attackers chain low-severity findings 4:03 Why audit fire drills no longer work 5:12 The five-step continuous audit readiness cycle 6:53 AI-based policy creation and updates 8:18 Automated evidence and prioritization 9:55 Audit Fix: AI-generated remediation 10:59 Executive audit reports 12:32 Demo: policy update, remediation, and reporting #BlackHat2026 #Compliance #AuditReadiness

 31      0