Qualys has introduced new capabilities for its TotalAI solution, built on the Qualys Enterprise TruRisk Platform, aimed at helping organizations manage enterprise AI risk throughout the AI lifecycle. The company said the enhancements enable organizations to discover, test, monitor and govern AI deployments while supporting policy requirements for safe AI use in the U.S. and European Union.

According to Qualys, enterprise AI adoption has accelerated beyond the security controls traditionally used to govern IT environments. Organizations are deploying AI models, AI agents and Model Context Protocol (MCP) servers while attackers are also using AI to accelerate attacks. The company said security leaders need visibility into where AI is running, which models could expose data or be manipulated, how AI agents are connected and whether security controls are effective.

TotalAI integrates AI risk into the Qualys TruRisk scoring system, allowing organizations to assess AI risk alongside vulnerabilities, cloud assets and container environments.

Grace Trinidad, research director at IDC, said AI is changing how organizations approach exposure management. "AI is outrunning the controls built to govern it, and security teams can no longer treat that risk as a separate list to be scanned and closed."

She added that organizations integrating AI risk into continuous exposure management across discovery, assessment, runtime visibility and governance will be better positioned to adopt AI securely and at scale.

Qualys said the expanded TotalAI platform provides visibility into shadow AI, cloud AI services, AI agents, models, MCP servers, AI containers and browser-based AI use across an enterprise. It also includes governance capabilities for AI agents and their integrations by allowing organizations to monitor and control tool calls made over MCP. Kernel-level eBPF instrumentation provides runtime visibility into AI workloads executing on servers.

The platform also provides audit-ready reporting for security, engineering and governance, risk and compliance teams by documenting AI assets, identifying issues and prioritizing remediation using TruRisk scores.

To support earlier risk detection, TotalAI identifies AI vulnerabilities, misconfigurations and exposed secrets during development and in software pipelines. It also tests AI models for prompt injection, jailbreak attempts and unsafe outputs before deployment.

Qualys said the platform also performs adversarial testing against both large language models and MCP servers. The testing includes prompt injection, jailbreaks, tool poisoning, server-side request forgery (SSRF) and rug-pull scenarios, mapped to the OWASP LLM & MCP Top 10 and the EU AI Act. The company said TotalAI scans MCP servers directly rather than only governing access to them.

Sumedh Thakar, president and CEO of Qualys, said organizations increasingly need to demonstrate AI governance to executives and regulators. "TotalAI gives enterprises a single, unified way to assess, govern, and secure AI risk continuously — not through periodic snapshots, but with the real-time clarity and discipline Qualys is known for." To learn more, visit our booth #2333 at Black Hat USA 2026.