Lists Don’t Stop Attackers. Skills Do.

Our industry got very good at the first half of the job. I helped build that half.

We can find everything now. Every vulnerable library, every misconfigured bucket, every unpatched host. We deduplicate it, score it, rank it, assign it and track it against an SLA. We have dashboards our boards can read.

That work had to come first. You can’t fix what you can’t see, and you can’t fix everything at once. But it was the precondition, not the outcome. The exposure is still there.

Think back to the last exploited vulnerability that landed on your team. Within minutes you knew the affected assets, the owners and the fix. Then came the part no dashboard shows. Engineers dropped their work to figure out, by hand, whether it was real in your environment. Someone hunted for a change window. A ticket waited. And when the board asked “are we exposed?”, the honest answer was “we’re working on it.”

A ranked backlog is a to-do list. No attacker has ever been stopped by a well-sorted to-do list.

The half we left to people

Forrester senior analyst Erik Nost put it plainly:

For years, people filled that gap by hand: logging into hosts, reading code line by line, and chasing owners for answers. AI broke that arrangement. The time from disclosure to exploit is now measured in hours, and “a public exploit exists” no longer separates the urgent few from the rest. Attackers got machine speed. Defenders got a better-sorted queue and the same number of engineers. You can’t close a machine-speed gap with human-speed work.

Skill, at machine speed

Think about the best security engineer you’ve worked with. They aren’t valuable for memorizing CVEs. They know which questions to ask, where to look, and what evidence they need before they touch production. That judgment has always lived in a few people’s heads, and it has never scaled.

Today we’re launching AI Exposure Response, built to scale it. At its core are skills: that engineer’s judgment, written down so an AI analyst can apply it to every finding and show its evidence every time. We’ve packaged skills into ready-made analysts for hosts, code, open-source dependencies, web applications and container images. They work through the tools and change process you already have, on our exposure management platform or on the one you already run.

Every analyst works toward the same three questions:

Is it real? The analyst checks whether the exposure is exploitable in your environment. If it isn’t, the finding drops in priority with the proof attached.

Is it contained? If it is real, the analyst blocks it now with the EDR or WAF you already own, before the patch window.

Is it fixed, and can you prove it? The analyst carries the permanent fix through your change process, confirms it worked, and writes the evidence back.

Sometimes the right response is none

At one enterprise, an analyst investigated 612 prioritized findings. 535 of them, 87.4%, turned out not to be exploitable in that environment, each with its evidence attached. The analyst drove the other 77 to remediation.

Nearly nine in ten of that team’s most urgent findings never needed a fire drill. Every hour not spent on the 535 went to the 77 that were real. And engineering learns that when security asks, it matters.

And sometimes the right response is the one nobody was making. At another customer, our Web Analyst took 72 bug bounty reports that nobody owned. It mapped 54 of them to the source code behind them, and 28 are already remediated. Reports with no owner and no path to a fix now have both.

Why not just an agent

Reasoning about a CVE isn’t the hard part anymore. Running that reasoning on your production systems, thousands of times, with nobody watching, is.

That’s what the AI Exposure Response Harness is for. Every analyst runs inside it: isolated, held to the level of autonomy you set, audited and recorded, reversible, and centrally managed. A general-purpose agent can give you an answer. The harness gives you one you can stand behind. The 535 findings above dropped with an evidence trail your engineers and your auditor can follow.

What you’ll be measured on

For a decade, we measured security programs by what they could see: coverage, finding counts, SLA compliance. The next decade will measure what they can prove. If your program can’t answer “Is it real? Is it contained? Is it fixed?” within hours of the next exploited vulnerability, you don’t have a tooling problem. You have a list.

Finding and ranking got us here, and I’m proud of the part we played. But the goal was never a better list. It was risk that goes down.

At Seemplicity, we’ve spent six years in the gap between found and fixed. Today we’re shipping what we learned there, so the judgment of your best engineer can reach every finding you have.

When the next exploited vulnerability lands, I want your answer to the board to be: “We know where it’s real. It’s already contained. Here’s the proof.”

From lists to skills. From found to fixed.

Read the full press release here.