After RSA: The Six Phases of Autonomous Security Adoption in Exposure Management
by Brad Hibbert, COO & CSO//10 min read/
Well. You made it home from RSA. Flights are done. Meetings are over. You are finally back. And yet it is still in your head.
AI. Agentic. Autonomous.
You probably heard those words a few hundred times over the last few days. Every booth, every keynote, every conversation seemed to come back to the same place.
Now that you have a little distance from it, a more useful question starts to surface. What does any of this actually change about how security gets done?
Side Bar… Quick plug: If you missed our pre-RSA announcements, we’re focused on the pragmatic use of AI to drive outcomes, not just insights. See what we launched.
A quick grounding point before we get into it. Exposure management is the practice of continuously identifying, prioritizing, and remediating the exposures that represent real risk to your organization — not just logging what exists. The shift from periodic vulnerability management to continuous exposure programs is what continuous threat exposure management (CTEM) formalizes as a framework. The six phases below describe how that shift actually happens in practice.
There is real progress happening. AI is already helping security teams analyze risk faster, prioritize better, and cut through some of the noise. However, it is also where most of the conversation conveniently stops. Because identifying risk has never really been the end goal. The real challenge, and the part that has not improved nearly as fast, is actually getting things fixed.
The Execution Gap
Security teams today are not lacking information. If anything, they are overwhelmed by it. There is more data, more context, and more signal than ever before, and still, backlogs grow.
That disconnect comes down to something pretty simple: security does not own remediation.
The operating model has not really changed in years. Security pulls data together, normalizes it, prioritizes it, and then hands it off. From there it is IT, cloud, or engineering teams that actually have to do the work.
That worked well enough when the main problem was visibility. It does not hold up when the problem becomes execution, because now you have one team accountable for outcomes and a completely different set of teams responsible for delivering them.
That is where most organizations are today.
What is starting to change is not just tooling, it is the level of trust organizations are beginning to place in their data. When you have a large, high integrity data foundation and decisions start to become consistent and explainable, people begin to rely on it. Not immediately, but gradually.
You see fewer arguments about priority, fewer escalations, and less second guessing. Over time, the friction between security and operational teams starts to ease. And when that happens, something more interesting follows. The conversation shifts. Less time debating what matters. More time actually fixing it.
Security is not constantly defending its decisions. Engineering is not constantly pushing back. Both sides are working from the same understanding of risk, even if they do not always agree on every detail. That raises a bigger question: if organizations begin to trust data‑driven decisions at that level, what does that do not just to the exposure management program, but to the broader security culture of the business?
Because once trust shows up, execution tends to follow. And that is where things actually start to move.
Autonomous Security Is a Destination, Not a Feature — and Exposure Management Is the Path
There is a tendency right now to talk about autonomous security like it is something you can turn on.
It is not. It is a shift in how organizations operate.
Moving from security identifying problems to the business actually owning outcomes requires more than better tooling. It requires decisions that people trust and systems that fit into how work already gets done. Without that, automation just creates new problems faster.
Why This Is Hard
If better technology were enough, we would already be further along.
The real issue is trust:
Trust in whether the data is right.
- Trust in whether the prioritization makes sense.
- Trust between teams that historically have not always been aligned.
- And eventually, trust in letting systems take action where the conditions are clearly defined.
Most organizations have seen what happens when that trust is not there. Security flags something as critical, engineering pushes back, context is missing, ownership is unclear, and work gets stuck in the middle. Nothing about that process lends itself to automation. So before anything becomes autonomous, it has to become trusted. That’s why this transition happens in stages whether organizations plan for it or not.
How Exposure Management Programs Reach Autonomous Security
Across large enterprises, the progression tends to follow a similar pattern.
Phase 1: Visibility
Everything starts with aggregation. Pulling data together across scanners, cloud, identity, and application environments into a single view that answers the basic question of what exists and what is wrong. Necessary, but not where value is realized.
Phase 2: Prioritization
Next comes prioritization. Adding context, threat intelligence, exploitability signals, and business relevance to create a ranked backlog. This is where programs often think they have matured. It is also where they start to slow down. Because prioritization introduces interpretation, and interpretation introduces disagreement. If teams cannot understand or trust why something is ranked the way it is, they will not act on it.
Phase 3: Guided Execution
This is where things begin to click. Instead of just producing a list, the system starts connecting decisions to execution. Work is routed to the right owners, pushed into existing systems, and tracked against SLAs. Security is no longer just identifying problems. It is helping coordinate how they get resolved. This is usually the point where organizations start seeing real momentum.
Phase 4: Assisted Remediation
Once that foundation is in place, automation starts to show up in practical ways. Not sweeping, risky automation. Small, useful improvements. Tickets get created automatically. Context is filled in. Recommended actions are clearer. Workflows become more consistent. The goal here is not autonomy. It is reducing friction so teams can move faster.
Phase 5: Autonomous Remediation
Only after that does true automation start to take hold. Even then, it is selective. Certain actions can be executed automatically under defined conditions. Policies and guardrails are in place. Systems re‑evaluate decisions as environments change. This is not about removing humans. It is about letting systems handle what is predictable and repeatable so people can focus on what is not.
Phase 6: Continuous Risk Orchestration
At the far end of this, the model starts to look very different. You have a system that continuously evaluates risk, updates priorities, routes work, and takes action where it makes sense. At that point, exposure management becomes less reactive and more continuous. Not because there are more tools involved, but because execution is finally keeping up with insight.
And when execution becomes the focus, something else starts to shift. The center of gravity moves beyond security.
Who Will Ultimately Own Exposure Management
Today, most of this still sits within security budgets and is driven by the CISO. That is not going away. But I was recently speaking with a CISO (thanks Drew!) who indicated that to be truly evolved, exposure management needs to migrate more toward the operations teams.
Whether or not you agree that program ownership will shift more toward operations, there is no doubt that as the focus shifts toward execution, the value becomes much more operational.
Faster remediation, better SLA performance, and less friction between teams. That naturally pulls in IT and engineering as real stakeholders, not just downstream recipients.
Over time, this looks less like a handoff model and more like shared ownership, with security setting direction and operational teams driving execution.
What Comes Next
There is a natural instinct right now for vendors to respond by adding remediation features to their platforms. That alone will not solve the problem.
Remediation does not happen inside a single tool. It happens across systems, teams, and processes that already exist. The platforms that matter over the next few years will be the ones that can sit across that complexity and coordinate action, not just add another place to manage it.
Because ultimately, the goal is not better visibility or even better prioritization. It is making sure the right things actually get fixed. And that is a much harder problem than it sounds.
Hope you all enjoyed RSA this year. We will see how far the messaging really comes along by this time next year.
In the meantime, if you're curious where Brinqa sits in these six phases today, the Brinqa Platform page shows you exactly how we've built for it.
FAQs
The execution gap is the disconnect between identifying risk and actually fixing it. Security teams today have more data, more context, and more signal than ever — and backlogs are still growing. The reason is structural: security does not own remediation. Security identifies and prioritizes the work; IT, cloud, and engineering teams do the actual fixing. When those two groups are operating from different understandings of risk, execution stalls.
Closing the execution gap is the defining challenge for mature exposure management programs. It requires more than better tooling — it requires trust between teams, decisions that are consistent and explainable, and systems that fit into how work already gets done.
Most large enterprises move through a consistent progression as their exposure management programs mature. The six phases are:
- Visibility — aggregating data across scanners, cloud, identity, and application environments into a single view of what exists and what is wrong.
- Prioritization — adding threat intelligence, exploitability signals, and business context to create a ranked backlog. This is where most programs think they have arrived. It is also where they often stall.
- Guided Execution — connecting decisions to action. Work is routed to the right owners, pushed into existing systems, and tracked against SLAs. This is typically the first phase where real momentum appears.
- Assisted Remediation — automation in practical, low-risk forms. Tickets are created automatically, context is filled in, workflows become more consistent. The goal is reducing friction, not replacing judgment.
- Autonomous Remediation — selective automation under defined conditions and guardrails. Systems re-evaluate decisions as environments change. Humans remain in control; repetitive, predictable work is handled automatically.
- Continuous Risk Orchestration — the full model. Risk is continuously evaluated, priorities updated, work routed, and action taken where appropriate. Exposure management becomes a living program rather than a periodic exercise.
Most organizations are somewhere between Phase 1 and Phase 3. The gap between where they are and where they want to be is rarely a technology problem — it is a trust and process problem.
Prioritization stalls programs for one reason: it introduces interpretation, and interpretation introduces disagreement. Once you move beyond raw data into ranked backlogs, every decision can be questioned. Security says this is critical. Engineering says it is not. Context is missing. Ownership is unclear. The work gets stuck.
The organizations that move past this have one thing in common: they have built a data foundation that is consistent and explainable enough that people stop arguing about the list and start working through it. That shift — from debating priorities to acting on them — is what Phase 3 (Guided Execution) makes possible. Without it, better prioritization just creates a better argument.
Because without it, automation makes the problem worse, not better. Autonomous systems act on decisions. If the underlying data is questioned, if the prioritization logic is disputed, or if the teams responsible for remediation do not trust the assignments they receive, automating that process just creates wrong actions faster.
Trust has to be established at each layer before automation can be introduced at the next. Teams need to trust the data before they will trust the prioritization. They need to trust the prioritization before they will act on automated assignments. And they need to trust automated assignments before they will accept autonomous action. Skip a layer and the whole model collapses back into manual work and escalations.
This is why autonomous security is a destination, not a feature. You cannot install trust. You have to build it, which is why the transition always happens in phases — whether organizations plan for it or not.
Today, most exposure management programs sit within security budgets and are driven by the CISO. That is unlikely to change entirely. But as programs mature and the focus shifts from identifying risk to remediating it, the value becomes increasingly operational — faster remediation cycles, better SLA performance, less friction between teams. That naturally draws IT and engineering in as real stakeholders, not just downstream recipients of security’s findings.
The more evolved model looks less like a handoff — security identifies, operations executes — and more like shared ownership. Security sets direction and defines risk priorities. Operational teams drive execution. Both sides work from the same understanding of risk.
Whether formal program ownership migrates toward operations over time is an open question. What is not open is that execution-focused programs require genuine operational buy-in, not just compliance.
Vulnerability management is the foundational practice of identifying, assessing, and remediating software vulnerabilities across an organization’s assets. It has been the backbone of enterprise security programs for decades, and it remains necessary.
Exposure management is the broader, continuous evolution of that practice. Where vulnerability management focuses on what vulnerabilities exist, exposure management asks which exposures represent real risk to this specific organization — incorporating asset criticality, business context, threat intelligence, exploitability signals, and compensating controls to produce a prioritized, actionable picture of risk.
The practical difference shows up in execution. Vulnerability management produces a list. Exposure management produces a program — with ownership, workflows, SLA tracking, and the remediation infrastructure to actually get things fixed.
The dominant theme at RSA 2026 was AI — agentic AI, autonomous security, AI-driven everything. Every booth, every keynote, every conversation circled back to the same vocabulary.
What the conversation largely missed is that identifying risk has never been the hard part. Security teams are not struggling because they lack data or analysis. They are struggling because getting things actually fixed — across teams that do not share accountability, in environments that change faster than remediation cycles — is a fundamentally different and harder problem than prioritization.
The most significant shift coming out of RSA is not a new AI capability. It is a growing recognition that the next phase of security maturity is about execution, not just insight. The platforms and programs that close that gap — by building trust between teams, connecting decisions to action, and letting systems handle what is predictable so people can focus on what is not — will define the next few years.
