AI-Powered Asset Criticality Scoring: Smarter, More Objective Risk Prioritization in Qualys CSAM
Not every asset in your environment carries the same level of risk, but identifying which assets matter most has traditionally depended on manual tagging and static rules, leaving critical gaps in visibility and prioritization. Qualys CyberSecurity Asset Management (CSAM) uses AI to close those gaps by automatically identifying and scoring the assets that matter most, helping ensure your TruRisk Score reflects actual business risk rather than assumptions or guesswork.
What’s Changing
The problem with manual scoring
Today, the Asset Criticality Score (ACS) is largely dependent on tagging. An asset inherits its criticality from tags such as subnets, and when multiple tags apply, the highest assigned value takes precedence. Untagged assets default to a criticality score of 2. Because ACS is a key input to the TruRisk Score, this default can quietly distort the broader risk picture. As a result, a significant portion of the inventory may be assigned the same mid-level criticality regardless of its actual business importance, while truly critical assets can remain under-prioritized simply because they were never tagged.
The AI-powered fix
Qualys now uses an AI model to assign ACS automatically for assets that don’t currently have a criticality score, removing the guesswork and bias from manual assignment. This isn’t a black-box replacement for your judgment, but it’s designed to work alongside it.
Key Benefits:
- More accurate risk scoring from day one: Untagged assets no longer default to a flat, potentially misleading score — AI ACS evaluates each asset’s actual characteristics instead.
- Full transparency: Every AI-generated score is clearly labeled “powered by AI ACS,” so you always know how a score was derived.
- You stay in control: Human-in-the-loop feedback lets you correct or overwrite any AI score, and that feedback helps refine future scoring.
- Always current: AI ACS is computed after roughly a week of data collection on an asset, and your TruRisk Score recalculates weekly to reflect the latest scoring.
- Turn it on or off anytime: AI ACS can be toggled at will, with changes applied on the next TruRisk calculation cycle.
How It Works
Once enabled, viewing and validating AI-driven scores takes just a few clicks:
- Navigate to CSAM > Inventory > Assets > Host.
- View the score — select an asset and click its ACS score, shown as “powered by AI ACS.” You can submit feedback directly from here.
- Drill into asset details — from the Quick Action menu, click View Details, then click TruRisk Score to see the score now reflecting AI ACS, or Risk Calculation to see exactly how the score was derived.
Search Assets with AI ACS
Two new QQL tokens make it easy to filter your inventory based on how criticality was determined:
| Token | Purpose |
|---|---|
| hasAiCriticalityScore | rue returns assets whose ACS was calculated by AI ACS; false returns assets still using tag-based ACS. |
| aiCriticalityScoreConfidence | Filters assets by the confidence level of the AI ACS prediction. Supported values: HIGH, LOW. |
Confidence You Can Trust
An AI prediction is only useful when you know how much to trust it. That’s why every AI ACS score comes with a Signal Flag indicating how complete the underlying asset metadata was at prediction time:
| Signal Flag | What It Means |
| High | The asset had sufficient metadata to support a reliable prediction. |
| Low | The asset had limited or incomplete metadata, so confidence in the prediction is reduced. |
Behind the scenes, the model draws on 12 signals for each asset, spanning exposure indicators (like critical open ports), hardware capacity (like total memory), and contextual attributes (OS, hardware category, environment, domain role, and operational status), to produce a criticality score from 1 (unimportant) to 5 (customer-identified critical). It’s especially strong at flagging your most critical assets accurately, minimizing false alarms where it matters most.
Getting Started
AI ACS is available with a CSAM subscription and is enabled on request by your Qualys Account Team. Once enabled:
- Open the CSAM application and go to Configuration.
- Under Configuration > Asset Criticality Score, select AI ACS and click Save.
AI ACS will begin scoring your currently untagged assets, and you’ll see the “powered by AI ACS” label appear as scores populate.
Note: AI ACS currently supports assets that are not tagged; tag-based scoring continues to apply where tags already exist.
Info: AI ACS is optional. You can choose to use AI ACS or continue with your existing manual tagging methods, and you can switch between the two at any time.
For full configuration details and advanced usage, check out the documentation in the Qualys Tech Docs.
If you need help planning your rollout, contact your Technical Account Manager (TAM) or Qualys Technical Support.
Contributors
- Arpan Shrivastava, Manager, Data Science, Qualys