Notifications
Clear all
Topic starter
02/08/2026 12:04 pm
TL;DR: Exposure validation is moving closer to identity, automation, and AI governance, not just attack simulation, according to SafeBreach. The company’s 2025 review says it expanded from breach and attack simulation into CTEM, added AI-driven analysis features, introduced MCP-based AI agent access to simulation data, and integrated PAM workflows for password rotation, while also reporting nine new CVEs and coverage for nine CISA alerts.
NHIMG editorial — based on content published by SafeBreach: SafeBreach 2025 Year in Review: Reflections from Co-Founder & CEO Guy Bejerano
Questions worth separating out
A: Start by separating the governance problem into distinct control domains.
Q: Why do exposure validation tools need identity and privilege controls?
A: Because the tools increasingly touch live attack paths, privileged workflows, and remediation data.
Q: When does password rotation automation create more risk than it reduces?
A: It creates more risk when rotation is disconnected from inventory accuracy, service dependencies, and offboarding state.
Practitioner guidance
- Map exposure findings to identity controls Link simulation output to specific IAM, PAM, and secret-management owners so attack paths trigger named remediation actions rather than generic risk tickets.
- Govern AI agents as privileged integrations If AI assistants or MCP-connected agents can access security telemetry, define their scope, logging, approval path, and revocation process before production use.
- Tie rotation automation to lifecycle data Automate password rotation only when inventory, dependency mapping, and offboarding data are current enough to prevent service disruption or stale access.
What's in the full article
SafeBreach's full review covers the operational detail this post intentionally leaves for the source:
- Breakdown of the new exposure validation platform components and how Validate and Propagate are intended to work together
- Specific AI-assisted capabilities such as remediation suggestions, troubleshooting assistants, and AI-generated scenarios
- Examples of PAM integration and password rotation automation across connected environments
- Details on the 2026 CTEM roadmap and the additional phases the vendor says it will address
👉 Read SafeBreach’s 2025 year-in-review on CTEM, AI features, and exposure validation →
CTEM and AI attack simulation: what changes for security teams?
Explore further
02/08/2026 1:09 pm
Exposure validation is becoming an identity governance problem, not just a security testing problem. Once validation platforms start touching PAM, attack paths, and AI-assisted analysis, they sit much closer to identity decision-making than traditional BAS tools. That changes the governance question from whether a simulation ran to whether the platform itself is authorised to observe, model, and prioritise privileged access. Practitioners should treat exposure validation as part of control assurance, not a separate technical silo.
A question worth separating out:
Q: What should organisations do when CTEM findings do not lead to remediation?
A: They should treat that as a governance failure, not a tooling issue. If exposure validation identifies a real attack path but no owner, deadline, or control change follows, the programme is not reducing risk. The fix is to bind findings to accountable teams, remediation SLAs, and tracked closure criteria.
👉 Read our full editorial: CTEM, AI testing, and NHI exposure validation in SafeBreach’s 2025 review
