Aim Before You Automate: Pointing SOC Workflows at the Exposures That Matter

If you'd asked me a year ago whether security teams would let AI agents patch production systems on their own, I'd have said not yet. Now plenty of them are doing it, or seriously planning to. That puts a harder question on the table: how much do you trust the data those agents act on?

Automation can already act faster than any analyst. The harder part is making sure it acts on the right things, because a fast workflow pointed at the wrong exposures just creates new problems faster. Before you automate remediation, you need exposure data you trust enough to act on. This is a core challenge security teams are batting with, so I sat down with Mac Clark, senior partner engineer on Torq's tech alliance team, to dig into what this looks like in practice.

Here’s an overview of what we covered.

Why does agentic AI automation raise the stakes for exposure data?

Most security teams have a safety net they’ve never thought much about, and agentic AI automation takes it away. An agent reasons from whatever data it's given and acts at machine speed, so one bad or conflicting input turns into the same bad decision repeated across the environment – much faster than any person could make it.

For as long as most of us have worked in security, a person sat between the data and the action. An analyst would look at a finding, sense something was off and catch it. Nobody wrote that into a process, but it was there. That person quietly absorbed the duplicates, the stale findings and the tickets routed to the wrong team.

Mac said it well: an agent doesn't pause and squint at the data. When the data is wrong, a patch takes down a revenue-generating service mid-afternoon, the team spends a week closing findings that never mattered, and leadership gets a risk-reduction report that doesn't reflect reality.

Putting a person back in front of every decision won't work either. Microsoft's September 2026 Patch Tuesday brought a record 966 CVEs, up from 79 in March, according to Brinqa Research's Patch Tuesday analysis. That's more than any team can curate and act on by hand.

Why do security teams hesitate to automate remediation?

Most organizations already own tools that can remediate automatically. They hesitate because they don't trust their exposure data enough to let those tools run without a person checking first. So everything waits for a human and a change window, including low-risk fixes that never needed either.

The SANS 2026 Exposure Management Survey shows how common that is: 32% of organizations still start remediation with an analyst manually creating tickets. Meanwhile, critical exploitable findings drift hundreds of days past SLA.

Mac called trusted exposure data the permission to automate, and I think that's exactly right. Bad data breaks automation in predictable ways. Duplicates mean an agent does the same work three times, or closes one copy and assumes the problem is gone. Missing ownership means nothing can be routed, so the work falls back to a person. Missing business context is the dangerous one, because the agent can't tell a test box from the system that runs your storefront.

What makes exposure data trustworthy enough to automate?

Building that trust starts with the data foundation, and there are four pieces to get right:

• The first is unified data. In the SANS survey, 44% of organizations pull exposure findings from six or more systems, and only 16% have fully centralized that data. The real risk often lives in the connections between silos, like an identity issue that touches an application and the cloud infrastructure serving it. Pulling those findings together and removing duplicates, without losing the original source records, is the first job of unified exposure management. Those source records become your audit trail when someone asks why an automated fix ran.
• The second is business context, applied automatically and continuously. Which applications generate revenue? Where do PII and PCI data live? Scanners can't answer that, and it's the piece most often missing.
• The third is threat context at the level of your environment. Threat intelligence tells you what's being exploited in the wild. You also need to know whether a finding is exploitable on this asset, under these conditions.
• The fourth is ownership, probably the single biggest factor in whether you can act at all. When a zero-day lands and nobody knows who owns the affected system, nothing moves. Attribution has to keep up as new assets appear, and AI-driven exposure management helps fill the holes. If 10 of 12 attributes match assets a team already owns, you can assign the new one with confidence.

How do you decide which remediation to automate?

How much oversight a remediation needs depends on what it touches, and your exposure data should be able to tell you. Patching an engineer’s laptop and patching the system that runs your ordering platform shouldn’t go through the same process.

Applying a patch usually takes minutes. What slows things down is everything around it, from confirming the finding is real and tracking down the owner to opening a ticket and waiting for someone to pick it up. As Mac put it, most response time is decision time and handoff time, and that's what solid vulnerability prioritization shortens.

The teams getting real automated vulnerability remediation results work this way. Remediation activities with no impact to business operations, a clear owner, and a known fix are automated and recorded. Fixes on assets that matter too much to touch blind get staged for approval, so the approver's job shrinks to saying yes. Complex cases stay with an analyst, with AI assembling the context so they start from an answer.

That's how automated actions become decisions you can explain to an auditor, a change board or a CISO. You won't automate everything, and you shouldn't try. Moving from three in ten actions automated to five or seven in ten takes a huge load off the people trying to keep up.

The payoff shows up in the numbers: customers like Nestlé now identify critical vulnerabilities more than three times faster for same-day patching, while Cambia Health cut remediation times by 50%.

Does automated remediation replace change management?

Automation doesn’t have to work against your change process. With trusted data behind it, change management actually gets easier. Low-risk assets with clear owners and no business-critical flags can move through a standard pre-approved change, applied the same way every time, while business-critical remediation waits for its approved maintenance window.

Brinqa can pull those windows from your configuration management database (CMDB), so a fix on a revenue-critical system runs Saturday morning inside its window instead of Tuesday afternoon. Mac was clear that you should be wary of anything claiming it replaces change management outright.

How does exposure management fit into an automated SOC?

Once the data is trusted, exposure management takes on a different role in the SOC. It becomes the decision plane, determining what matters, who owns it and how much autonomy each remediation gets. Orchestration platforms like Torq become the action plane that carries out those decisions and reports back, closing the loop.

We're officially in football season now, so that's how I explain the way Brinqa and Torq work together: Brinqa is the playbook, and Torq is the team on the field running the plays. You can have the fastest team in the league, but with the wrong playbook you just run the wrong plays faster.

This is the bigger shift. For years, exposure management fed reports and ticket queues. With Brinqa and Torq, Brinqa acts as the exposure management platform: it unifies the findings, adds business context and ownership, and surfaces the overdue criticals that are exploitable and internet-facing. Brinqa SmartFlows hands them to Torq, which patches what's cleared for automation, stages the rest for approval with an AI-written assessment, and writes back to Brinqa when the fix lands.

Watch a brief demo of how Brinqa and Torq work together:

Where should you start with automated remediation?

The best place to start is with the remediation you’re already confident about. Bring your key data sources together, automate the low-risk tier first, and expand as trust in the data grows. No data foundation is ever totally complete, so don't wait for yours to be perfect before the first workflow goes live.

A useful first test: name the assets you'd be comfortable patching today without a meeting. If your data can't answer that, start there. The goal I keep coming back to is simple. A zero day should just be another day, because the plays are already called. You know what's exposed, who owns it and which fixes can run on their own.

Watch the full webinar with Torq to see the workflow in action.

FAQs