We Solved Visibility. Now We Have to Solve the Work

I recently heard something from a customer that has stuck with me.

They loved having all their exposure data in one place and actually being able to act on it. But they also admitted that the transition was more overwhelming than they expected.

For years, their teams had managed vulnerabilities within individual security tools. Different findings lived in different places, with different workflows and different ways of deciding what mattered.

Then they brought those findings together.

What many of us in cybersecurity would consider a godsend – finally, one place to understand exposure across the environment – initially felt like a lot.

And that caught me off guard.

Having spent part of my career as a vulnerability management practitioner, I had always thought about consolidation from the other direction: Of course I would have wanted everything in one place. Fewer tools to navigate. A more complete picture. One place to understand what needed attention.

I hadn’t really considered what it feels like for some to make that transition after years of managing vulnerabilities inside individual tools and workflows.

That conversation made me realize something: there is an important difference between finally being able to see everything and being prepared to operate on everything you can see.

Our Tools Used to Define Our Operating Model

For much of the history of vulnerability management, our tools helped define our operating model. A scanner found vulnerabilities, and we worked the vulnerabilities in the scanner. Another security technology produced another set of findings, and another workflow developed around those findings.

Over time, practitioners became remarkably good at navigating that fragmented environment.

But the environment changed.

Cloud, applications, identities, infrastructure, and an expanding security stack dramatically increased the number and variety of signals organizations need to understand. Now AI is accelerating both sides of the equation—how quickly weaknesses can be identified and how quickly attackers can potentially act on them.

The old model doesn’t scale simply because we give practitioners a bigger dashboard.

And I think that’s an important distinction as our industry talks about exposure management. Aggregation is necessary. But aggregation without context is not transformation.

The Questions Have to Change

Putting every finding into one place can actually make the problem feel bigger before it makes it feel smaller.

The real value comes from what happens next.

Once we can see the exposures, we need context. The questions have to change:

What’s the Fix?

What actually needs to happen to reduce the exposure – not simply acknowledge the finding?

Why the Fix?

Why does this matter now? What threat, business, and environmental context makes this worth prioritizing over everything else competing for attention?

Where’s the Fix?

Where does remediation need to happen, and how does the work get into the systems and workflows where teams already operate?

Who’s the Fixer?

Who actually owns the remediation – and how do we get the right context and action to that person without security becoming the human routing layer?

Those are fundamentally different questions from the one vulnerability management was originally designed to answer:

What vulnerabilities do I have?

The practitioner’s job is evolving from managing findings to orchestrating exposure reduction.

That’s a much bigger change than replacing one security tool with another.

From Managing Findings to Orchestrating Exposure Reduction

Having sat on both sides of this – first as a practitioner and now spending my days talking with security teams – I think we sometimes underestimate the operational change involved.

Bringing fragmented workflows and exposure data into one place is a powerful first step.

But the real transformation happens when that visibility becomes action – when the platform can provide the context to help determine what needs to be fixed, why it matters, where the fix needs to happen, and who needs to fix it.

That means technology has to do more of the work practitioners have historically been forced to do manually: normalize signals, eliminate duplication, add context, determine ownership, prioritize intelligently, mobilize the right teams, and ultimately help drive remediation through completion.

That’s also why I believe AI’s most important role in exposure management isn’t simply helping us analyze more data.

It’s helping practitioners carry less of the operational burden created by that data.

It’s why we talk about moving beyond exposure management toward Agentic Exposure Action – connecting exposure data, threat intelligence, and business context to help answer those four critical questions: What’s the Fix? Why the Fix? Where’s the Fix? Who’s the Fixer?

Because knowing you have a problem is not the same thing as solving it.

From Findings to Fixes

The more customer conversations I have, the more convinced I become that this evolution matters.

Practitioners don’t need another place to manage an enormous backlog – they need the backlog to become smaller.

They don’t need another place to investigate every finding – they need the context to help determine which findings deserve their attention.

They don’t need a prettier way to coordinate remediation – they need that coordination to happen for them.

The opportunity now is to help them act on what matters without being overwhelmed by everything else. And, maybe that’s the most important evolution happening in our space.

We spent years helping practitioners find more.

Then we helped them see more.

Now we need to help them do more – without asking them to manage more.

Because the future of vulnerability management isn’t about giving practitioners more information to manage –  it’s about removing the work between knowing and fixing.