Topic starter
02/08/2026 12:04 pm
TL;DR: Exposure validation is moving closer to identity, automation, and AI governance, not just attack simulation, according to SafeBreach. The company’s 2025 review says it expanded from breach and attack simulation into CTEM, added AI-driven analysis features, introduced MCP-based AI agent access to simulation data, and integrated PAM workflows for password rotation, while also reporting nine new CVEs and coverage for nine CISA alerts.
Editorial analysis by NHI Mgmt Group, based on content published by SafeBreach: “SafeBreach 2025 Year in Review: Reflections from Co-Founder & CEO Guy Bejerano”.
Key questions
Q: Where does exposure validation fail when it starts driving remediation workflows?
A: It fails when teams treat test results as harmless observations instead of privileged inputs.
Q: Why do AI-assisted security analysis workflows need tight access governance?
A: Because the value of AI-assisted analysis depends on the sensitivity and trustworthiness of the data it can read.
Q: How should organisations govern PAM-linked automation in exposure management?
A: They should treat any platform that can influence privileged changes as part of the remediation authority chain.
Practitioner guidance
- Define privileged boundaries for validation tooling Document which simulation outputs, remediation triggers, and identity changes a validation platform may influence, and require explicit approval for anything that affects privileged accounts or rotations.
- Inventory AI access to security data Map every AI-assisted workflow that can query attack simulation results, including MCP-connected agents, and record the data sources, scopes, and logging attached to each.
- Separate observation from remediation authority Ensure the team that runs exposure testing is not automatically able to trigger password rotation, privileged updates, or other state-changing actions without governance review.
Bottom line: Exposure validation is evolving into a governance issue because the tools now influence prioritisation and remediation, not just test outcomes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:09 pm
CTEM is becoming an identity-adjacent governance problem, not just a testing model. Once exposure validation feeds prioritisation and mobilisation, it starts to touch who can see results, who can act on them, and which systems can change privileged state. That broadens the control surface from simulation accuracy to identity governance around the workflow itself. Practitioners should treat CTEM as part of access governance, not a separate security island.
A question worth separating out:
Q: What does the move from BAS to CTEM change for security teams?
A: It changes the purpose of testing from proving exploitability to managing exposure over time. Security teams must connect discovery, prioritisation, and mobilisation to identity and privilege controls, or the programme stays tactical while the risk picture keeps changing.
👉 Read our full editorial: CTEM, AI testing, and NHI exposure validation in SafeBreach’s 2025 review