In this ROCon APAC 2025 keynote, Qualys President & CEO Sumedh Thakar reframes modern cybersecurity around a single imperative: stop chasing the attack surface and start managing the risk surface. Building on real-world trends, Sumedh explains how expanding attack surfaces, AI-accelerated exploitation, shrinking budgets, and rising business expectations demand a shift from dashboard-driven visibility to operationalized, outcome-driven risk reduction. This session explores: • Why attack surface management alone can’t scale in an AI-native world • How exploit timelines have collapsed — and why manual remediation is dying • The business reality: risk must be measured in financial terms, not CVEs • Moving from visualization to prioritization to automated mitigation • The role of the Risk Operations Center (ROC) in unifying measurement, communication, and elimination • How AI agents can reduce millions of findings to a fixable few • Why CISOs must communicate risk in the language of revenue, loss, and value-at-risk Sumedh also introduces the evolution of ETM, automation-led remediation, and the future of AI-native cybersecurity operations — all grounded in practical examples and clear business alignment. Watch all ROCon APAC 2025 sessions: https://www.youtube.com/playlist?list=PLFHSz1fBN1FY5D6p4KrBPCwb9tdBlLtbT

 49      1