Most security organizations don't have a detection problem — they have a visibility problem disguised as a detection problem. After fifteen years of running IR engagements and SOC operations, I can tell you the pattern is consistent: the breach post-mortem almost never reveals a missing tool. It reveals fragmented context. The vulnerable asset was known to one team, the misconfiguration to another, the excessive identity privilege to a third — and no one could assemble the full picture before the attacker did.
That is precisely the problem Tenable's Chief Security Officer, Robert Huber, set out to solve internally, and his recent account of that journey is worth every CISO's attention. Tenable's shift to an AI-driven exposure management program wasn't a marketing exercise — it was a response to the same operational reality facing every enterprise in 2026: tool sprawl, data silos, an attack surface expanding faster than headcount, and now the compounding risk of rapid, often ungoverned AI adoption inside the business itself.
What makes Huber's lessons credible is that they address the failure mode I see most often in the field: security programs that generate mountains of granular technical metrics — CVE counts, scan coverage percentages, mean-time-to-patch — and then watch board members' eyes glaze over. The board's question is not "how many criticals did we close this quarter?" It is "what is our cyber risk exposure to the business units that generate revenue, and is it going up or down?" If your program can't answer that second question with evidence, it doesn't matter how many scanners you run.
This post breaks down the operational lessons from Tenable's experience and translates them into an actionable blueprint for building an exposure management program your business will actually trust.
The Core Problem: Tool Sprawl and Data Silos Are Risk Multipliers
The typical enterprise security stack in 2026 includes a vulnerability scanner, a cloud security posture management (CSPM) tool, an external attack surface management (EASM) platform, an identity governance solution, an EDR, a SIEM, a CMDB of questionable accuracy, and a spreadsheet someone's analyst maintains to reconcile it all. Each tool sees a slice of the attack surface. None of them see the whole.
The consequences are concrete, not abstract:
- Duplicate and conflicting asset inventories. Your EASM platform finds an internet-facing staging server your CMDB doesn't know exists. Your cloud team's CSPM sees workloads your vulnerability scanner can't authenticate to. Attackers only need one of those gaps.
- Risk scoring without context. A CVSS 9.8 on an isolated test VM gets the same queue priority as a CVSS 7.5 on the authentication server fronting your payment platform. Without asset criticality and exploitability context, remediation queues are noise-ordered, not risk-ordered.
- Unmeasurable program performance. When the CISO can't aggregate risk posture across silos, every board report becomes an anecdote. Anecdotes don't survive budget season.
Tenable's experience mirrors what I've seen across dozens of client environments: the tools weren't failing — the architecture of the program was failing. Consolidating the data, not adding another console, was the fix.
What Exposure Management Actually Is (and Isn't)
Exposure management — formalized in frameworks like Gartner's Continuous Threat Exposure Management (CTEM) and embodied in platforms such as Tenable One — is the discipline of consolidating fragmented security telemetry into a single unified view of cyber risk across the entire attack surface: traditional IT, cloud infrastructure and identities, web applications, containers, OT/ICS, and increasingly, AI systems themselves.
It is not a rebrand of vulnerability management. The distinction matters operationally:
| Vulnerability Management | Exposure Management |
|---|---|
| Finds CVEs on managed assets | Maps all exposures: CVEs, misconfigurations, identity risks, shadow assets, toxic combinations |
| Prioritizes by CVSS severity | Prioritizes by exploitability, asset criticality, attack-path analysis, and business context |
| Reports to security ops | Reports to the business in terms of revenue-bearing units and material risk |
| Point-in-time scan cycles | Continuous assessment and validation |
The attacker's view of your environment is a graph, not a list. They chain a low-severity misconfiguration to an over-privileged service account to an unpatched internal service. Exposure management is the defensive equivalent of that graph — it models attack paths, not isolated findings, and identifies the choke points where one remediation closes many paths.
The AI Dimension — Both Sword and Shield
Two AI-related themes in Huber's account deserve attention from defenders, because they represent the 2026 reality:
1. AI as an accelerant for the defender. The volume of exposure data in a modern enterprise exceeds human triage capacity by orders of magnitude. AI-driven correlation — deduplicating assets across sources, inferring asset criticality from observed behavior, enriching findings with exploitation intelligence, and surfacing the handful of exposures that actually create viable attack paths — is what makes a unified view operationally usable rather than just a bigger data lake. In our own MDR operations, the teams that win are the ones that automate the correlation layer so analysts spend their time on judgment, not joins.
2. AI as a new, rapidly expanding attack surface. The business is adopting AI — copilots, LLM-integrated SaaS, internally developed agents — faster than security can inventory it. Every one of those deployments introduces new identities (often non-human, highly privileged), new data flows, new third-party dependencies, and new prompt-injection and data-leakage risk. An exposure management program that doesn't extend to AI assets and their identities is already incomplete on day one. Huber's point about mitigating the risk of rapid AI adoption is a governance requirement: you cannot protect what your program refuses to see.
From Technical Metrics to Business Risk: The Communication Shift
This is where most programs die, and where Huber's most transferable lesson lives. Boards and executive committees do not fund what they cannot understand, and they do not understand scan statistics.
The shift Tenable made — and the shift I push every client CISO to make — is from activity metrics to exposure metrics tied to business units:
- Instead of "we remediated 4,200 critical vulnerabilities," report: "exposure across our three revenue-generating business units decreased 22% this quarter; the remaining concentrated risk sits in two internet-facing systems supporting Unit X, with a funded remediation plan completing in six weeks."
- Instead of "patch compliance is 87%," report: "the attack paths an adversary could use to reach our payment processing environment have been reduced from 14 to 3, and all three require privilege we now alert on."
This requires your exposure data to be tagged to business context — which systems support which revenue streams, which identities can reach them, which third parties connect to them. That tagging work is unglamorous and absolutely non-negotiable. It is also the work AI-assisted correlation can accelerate: inferring asset-to-service mappings from observed traffic and identity relationships rather than relying on a manually maintained CMDB that was stale the day it was exported.
Executive Takeaways
Because this news item is programmatic guidance rather than a discrete technical threat, the value for defenders is organizational. Here are the recommendations I'd give any client building or repairing an exposure management program in 2026:
-
Consolidate before you buy. Inventory every tool that produces asset or exposure data — scanner, CSPM, EASM, identity governance, EDR, CMDB — and map what each one uniquely sees. Your first deliverable is a unified asset inventory with a single source of truth. If you cannot reconcile your asset counts across tools within 10%, you have found your first exposure: your own inventory.
-
Adopt a CTEM-style operating cycle. Scope the attack surface by business priority, discover exposures continuously (not on scan schedules), prioritize by exploitability and attack-path impact — not raw CVSS — validate that prioritized exposures are actually exploitable and reachable, then mobilize remediation with named owners and deadlines. Five phases, run as a loop, measured each cycle.
-
Prioritize choke points, not findings. Use attack-path analysis to identify the small number of remediations — a misconfigured identity role, an exposed management interface, a flat network segment — that collapse the largest number of viable paths to critical assets. This is how a team of five outperforms a team of fifty working a raw vulnerability queue.
-
Extend the program to AI assets and non-human identities now. Inventory every sanctioned and unsanctioned AI/LLM integration, the service accounts and API keys they use, and the data they can reach. Treat non-human identities with the same rigor as privileged human accounts — least privilege, rotation, monitoring. In most environments we assess, this is the fastest-growing blind spot.
-
Rebuild your board reporting around business units. Tag assets to the revenue-generating units they support and report exposure trend per unit: is risk going up or down, where is it concentrated, what is the funded plan to reduce it, and by when. Retire raw CVE counts from executive reporting entirely — they measure activity, not risk.
-
Validate the program with adversarial testing. An exposure management program that is never tested is a hypothesis. Run purple-team exercises and targeted penetration tests specifically against the paths your model says are closed. If the red team walks through a "remediated" path, your validation phase has a gap — fix the loop, not just the finding.
Implementation Roadmap: The First 90 Days
For organizations starting from a fragmented state, this is the sequencing I've seen work:
Days 1–30 — Inventory and unify. Catalog all exposure data sources. Deploy or configure your unified exposure platform (e.g., Tenable One or equivalent) to ingest scanner, cloud, identity, and external attack-surface data. Deliverable: one reconciled asset inventory and an honest gap list.
Days 31–60 — Contextualize and prioritize. Tag assets to business units and criticality tiers. Enable attack-path analysis. Reprioritize the remediation backlog by exploitability and path impact. Deliverable: a top-20 exposure list your IR lead and your infrastructure lead both agree on.
Days 61–90 — Communicate and validate. Build the first business-unit-level risk report and deliver it to one executive stakeholder for feedback before going to the board. Commission a scoped validation exercise against your highest-confidence "closed" paths. Deliverable: a board-ready risk narrative and a tested program loop.
The organizations that succeed treat exposure management as an operating model, not a tool deployment. Tenable's internal journey — consolidating silos, applying AI to correlation and prioritization, governing AI adoption as attack surface, and reframing metrics as business risk — is a template, not an anomaly. The board's question hasn't changed: are we exposed, and is it getting better? Build the program that can answer it with evidence.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.