Qualys TotalAI: The Journey from LLM Scanner to Comprehensive AI Security Solution

Qualys describes the evolution and launch of TotalAI, an AI/ML security capability integrated into its platform, progressing from a proof of concept to an enterprise solution. The post covers building an LLM scanner aligned with OWASP LLM Top 10 and MITRE ATLAS, using a judge model for response evaluation, testing jailbreak attacks, fingerprinting AI assets via CSAM, adding VM coverage for AI workloads, scanning public model endpoints, and producing TruRisk-based scoring. It highlights differentiation from prompt-only scanners through platform integration and risk management, and outlines future work on multimodal attacks, guardrails, RAG/agentic workflows, cloud integrations, and internal model scanning.