Automate Asset Isolation to Meet Remediation Deadlines

The Exposure Window Nobody Plans For

When a vulnerability deadline is set, the clock starts. But deadlines slip for different reasons: a patch doesn’t exist yet, a patch is delayed, or a remediation attempt fails outright. Whatever the cause, the outcome is the same: the host stays unpatched and stays on the network.

Asset isolation quarantines the host from the network the moment a defined policy is met, so it cannot be reached or exploited while remediation continues.

TruRisk Eliminate is the Remediation Intelligence platform that reasons about vulnerability risk in real time and takes autonomous action to close risk windows instantly. When a remediation deadline passes with the vulnerability still open, Eliminate triggers host isolation, automatically quarantining the host the moment your deadline passes, without manual intervention. Isolation becomes your last resort, executed instantly when remediation pathways fail.

When a patch is months away and a deadline is days away, isolation is your last resort remediation strategy. Traditionally, that meant EDR tools, extra licensing, and a coordination cycle measured in days.

Eliminate executes host isolation natively through the Qualys Cloud Agent, using the criteria you define. The deadline passes, the host is quarantined, and your team keeps working the patch.

Why Automate Isolation?

Speed closes the exposure window

The moment your criteria is met, such as a passed deadline, Eliminate isolates the host automatically

Compliance proof demonstrates accountability

Every isolation is logged with full context: which rule triggered it, when, which host, and why. You can show auditors,  your board, and your insurers a complete record of timely, defensible risk decisions. The timeline speaks for itself.

Consistency at scale enforces your policy uniformly

Automated rules apply identical criteria across every host in scope. Every host on your network follows the same isolation timeline. Predictable enforcement, measurable outcomes, auditable results.

Use Case: Isolating a Host After an Exceeded CISA KEV Deadline

Scenario: Your organization tracks CISA KEV vulnerabilities with a 14-day remediation window. If a vulnerability breaches that deadline and remains unpatched, the host must be isolated to prevent exploitation.

The Query:

vulnerabilities.status:[ACTIVE,NEW,REOPENED]
AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s"
AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE

What This Does:

• vulnerabilities.status:[ACTIVE,NEW,REOPENED] — Only unresolved vulnerabilities
• vulnerabilities.riskFactor.cisaKEVDueDate < “now-1s” — The KEV deadline has passed (as of this moment)
• vulnerabilities.riskFactor.cisaKnownExploits:TRUE — The CVE is confirmed on the CISA KEV list

When this query matches a host, Eliminate automatically triggers the Isolate Host remediation path. The host is quarantined within seconds and removed from the network while your team works on patching or persistent mitigations. Each isolation is logged the moment it occurs, providing the security team with an audit-ready record rather than a manual, case-by-case reconstruction.

Implementation

Isolation executes through the Qualys Cloud Agent, with no EDR integration required.

For the full configuration steps, see Automate Asset Isolation in the Qualys documentation.

The Bottom Line

Patching is your first line of defense, backed by other remediation options — Mitigate, Customize, Run Custom Script, Fix, and Uninstall. But sometimes none of those paths are available, and isolation is your only option. Triggered the instant your criteria are met, automated isolation means you isolate the risk before it can be exploited.

TruRisk Eliminate is the Remediation Intelligence platform that makes that call for you: reasoning about risk, executing autonomously, and writing the record as it happens. Exposure closes. Compliance is proven. Risk is reduced.

Ready to eliminate the exposure window on your highest-risk vulnerabilities?

Note: Vendor patches may not be available for all vulnerabilities. TruRisk Eliminate is the Remediation Intelligence platform that provides both vendor patch deployment and patchless remediation capabilities. Patchless remediation is available exclusively to TruRisk Eliminate customers and is not included with Legacy Patch Management or VMDR.

Frequently Asked Questions (FAQs)

What is automated asset isolation?

It is a last-resort remediation path that quarantines a host from the network the moment a defined policy is met. For example, a CISA KEV deadline passing while the vulnerability remains unpatched.

Does isolation replace patching?

No. Isolation contains exposure while the team continues patching or applying persistent mitigations. It is used when Fix, Mitigate, Uninstall, or Run Custom Script cannot meet the deadline.

Do I need a separate EDR tool to isolate hosts?

No. TruRisk Eliminate executes isolation natively through the Qualys Cloud Agent.

How does this help with CISA KEV compliance?

 A QQL rule can isolate any host with an ACTIVE, NEW, or REOPENED KEV finding whose due date has passed. Each action is logged with rule, time, host, and reason for audit-ready evidence.

Is isolation available with VMDR or Legacy Patch Management?

Patchless remediation capabilities, including this isolation path, are available exclusively to TruRisk Eliminate customers.

Related