Cloud attackers move at AI speed, so detection and response have to as well. Shrikant Dhanawade walks through Qualys TotalCloud, from real-time detection to autonomous remediation, with a live attack-path demo. Join us at ROCon Americas, October 13-15 in Austin, Texas: https://www.qualys.com/rocon/2026/americas Try Qualys ETM free for 30 days: https://www.qualys.com/free-trial-new/enterprise-trurisk-management In this Black Hat USA 2026 session, the Qualys cloud security team explains why most cloud incidents trace back to identities and data, why periodic scans are not enough, and how correlating configuration drift with runtime telemetry surfaces the events that matter. The TotalCloud portfolio covered includes CSPM, CIEM, cloud workload protection, container security, cloud detection and response (CDR), application and AI security posture management, SaaS security posture management, and DSPM. The demo follows a misconfigured security group and a suspicious service account change on one EC2 instance, correlated into an attack path. Agent Val validates the sequence and flags potential ransomware, and Rocky builds a remediation playbook from a plain-English prompt. Qualys Flow adds 300+ out-of-the-box playbooks. In the example funnel, 12,000 findings narrow to about 100 that need action today. Speaker: Shrikant Dhanawade, Director, Product Management, Cloud Security, Qualys Chapters: 0:00 Intro 1:17 What Qualys cloud data shows: identities and data 2:30 Why cloud needs autonomous detection and response 3:49 Attack example: credentials leaked on GitHub 5:38 Filtering events down to what is anomalous 7:48 Playbooks, Qualys Flow, and Agent Sara 8:46 TotalCloud capabilities overview 10:48 Demo: risk scoring and configuration drift 12:59 Demo: anomalous behavior and the attack path 14:04 Demo: Agent Val flags potential ransomware 14:49 Demo: Rocky builds a remediation playbook 16:11 Cyber risk agents and the ROCon invite #BlackHat2026 #CNAPP #CloudSecurity

 33      0