Abstract
Exposure management has entered a new phase, says Brad Hibbert, COO and CSO at vulnerability and exposure platform provider Brinqa. After years spent building data foundations and automating prioritization, the discipline’s next chapter is validation — proving an exposure is actually exploitable rather than assuming it from a severity score. With AI now compressing the gap between a published CVE and a working exploit to mere minutes, Hibbert argues security teams need a two-step response: shield first and patch when possible, then verify the fix worked. He frames validation as CTEM’s fourth stage, where human pen testers and automated tools increasingly work side by side.
Security teams have gotten much better at finding problems. What they still struggle with, however, is knowing which ones to fix first and then proving the fix actually worked. Reducing, even removing, that gap, according to Brad Hibbert, Chief Operating Officer and Chief Strategy Officer at
Brinqa, is
where exposure management is headed next.
Hibbert, with more than 30 years in cybersecurity and enterprise software leadership, now runs product and strategy at Brinqa, a vulnerability and exposure management platform that unifies myriad security signals into a single source of truth. From that vantage point, he describes exposure management as maturing through three stages: data, decision, and action, with remediation and validation closing the loop.
As AI accelerates attack timelines and inflates the volume of “critical” findings, Hibbert argues that validated exploitability — not severity scores — is now the signal that matters most for prioritizing vulnerability management work.
From data to decisions to action
For Hibbert, everything begins with solid data. “If you’re going to make decisions and take actions, you have to start with a high-fidelity data foundation,” he said. Most organizations, he contends, spend significant time normalizing signals from scanners, cloud tools, and threat intelligence feeds into a single repository before they can act on any of it.
From there, programs move into decision orchestration — historically driven by algorithms and
CVSS scoring now increasingly reliant on AI simply because data volumes have outgrown manual triage. But Hibbert stressed this isn’t a staircase teams climb once and leave behind. “Once somebody moves from data orchestration to decision orchestration, I don’t think they’re done with phase one, because it’s a constantly evolving program,” he said. If anything, he adds, the recent wave of AI-generated vulnerability discoveries has pushed many organizations back to reinforce their data foundations rather than move forward.
That refinement is being forced by a mismatch between what’s rated critical and what’s actually being exploited in the wild. “The ones that they’re exploiting aren’t always the critical ones. And so, if you’re just looking for the critical ones, the ones that are getting exploited are below that waterline. So, you’re not even considering those in your prioritization,” Hibbert said. The fix, in his view, is prioritization built around reachability, exploitability, and business blast radius — rather than a static severity score.
What validated exploitability means for vulnerability prioritization
That pressure is intensifying as AI shortens the window between vulnerability disclosure and active exploitation; researchers have shown CVEs turned into working exploits within minutes of publication.
One response is a two-step remediation model rather than a straight race to patch. This involves first applying shielding technology or mitigating controls to kill the attack chain and buy time before a formal patch is coded, tested, and deployed through normal change windows. The measurement shift that follows matters as much as the tactic: less about patch velocity alone and more about quickly risk is reduced in an environment.
None of this works, Hibbert cautions, without trustworthy inputs. Handing prioritization decisions to AI raises the stakes on data quality, since a model is only as reliable as the exposure data it reasons over.
“Your AI is going to come up with decisions that have to be trusted decisions,” Hibbert explained. “To have trusted decisions on the AI, you have to be on top of a data layer that you have a lot of trust in as well,” a reminder that action orchestration still depends on the data foundation built in stage one.
At the center of this view is validated exploitability, which Hibbert places explicitly within the fourth stage of the closed loop
Continuous Threat Exposure Management (CTEM) framework created by Gartner to move methodically from reactive patching to ongoing risk reduction. “I think that next level of precision now is the fourth stage of CTEM, which is validation,” he said. “Which ones are actually validated? Which ones do you want to spend your time remediating?”
In practice, validation happens two ways: penetration testers either manually confirm whether a flagged CVE is reachable, given existing controls, or use automated validation tools. Brinqa recently announced
it purchased PlexTrac to integrate offensive security validation and penetration testing workflows into its enterprise exposure management platform.
Automation doesn’t sideline pen testers in Hibbert’s framing — it repositions them. “There’s a ton of value even today with having the manual pen testing teams,” he said, particularly for creative, adversarial thinking that automated agents don’t replicate well.
As validation agents mature, Hibbert expects pen testers to shift toward oversight and extend their reach without putting autonomous tools directly into production unsupervised.
Closing the loop: verification toward autonomous remediation
Validation isn’t only a pre-remediation gate. It belongs on the back end too to ensure a remediation team’s fix worked.
“Many times, you don’t close the loop on verifying after the fact that whatever change they made, it actually resolved the issue,” Hibbert said. He recommends tracking two metrics: deflection rate (vulnerabilities confirmed non-exploitable and diverted away from remediation teams) and fixed rate (issues confirmed genuinely resolved rather than just marked closed in a ticket).
Looking ahead, Hibbert sees autonomous remediation — AI agents making and executing remediation decisions independently — as the natural extension of this trajectory, though trust will build incrementally. “I think you’re going to start to see organizations building those layers of trust when it comes to autonomous remediation,” he said. Expect early use in low-risk, reversible actions before expanding into broader authority, always under human oversight, he added.
Asked what he wants security leaders to rethink, Hibbert returned to fundamentals: a strong data foundation, AI-driven decisioning built on that foundation, and outcome metrics centered on risk reduction rather than raw activity. “It should be about risk reduction, not the number of vulnerabilities found or patches deployed,” he said. “It’s something that can align all the different teams.”
