Qualys executive explains why patching remains a persistent security challenge

An interview with Qualys executive Kunal Modasiya examines why organizations still struggle with vulnerability patching. He notes that remediation often requires multiple patches or configuration changes, and that mission-critical revenue systems can block urgent updates. The discussion also covers risk-based prioritization, the importance of the interval between exposure and exploitation, and appropriate use of automated patching in production.

In a Help Net Security interview, Qualys’s Kunal Modasiya, a senior vice president and general manager, explains that remediation is rarely a single patch. A fix can demand several updates or configuration adjustments, which complicates large-scale rollouts. Business owners may also refuse downtime for revenue-critical applications, even when a security update is ready.

Modasiya adds that past patch deployments have sometimes produced unexpected side effects, extending outages. He argues that executive and board backing matters, and that security teams should frame requests around financial consequences. He also says AI may assist testing and pre-rollout checks, while deployment choices should weigh risk reduction against potential disruption.