TruConfirm: Ending Vulnerability Guesswork with Proof inside ETM

The document presents Qualys ETM 2.0 with TruConfirm and Agent Val, a production-safe exploit validation approach that moves vulnerability management from probabilistic scoring to evidence-based risk reduction, arguing that only about 1% of 2025’s 48,177 CVEs are weaponized and focusing validation on 1,600+ high-impact CVEs. Embedded in the ETM Risk Operations Center, Agent Val selects what to validate while TruConfirm proves exploitability or effective controls using direct response, cryptographic proof, and out-of-band callbacks, feeding verified results into ETM workflows to elevate TruRisk, prioritize remediation, and close the loop without new sensors; TruConfirm is planned for general availability by H1 2026.