The cybersecurity powerhouse is boosting its Threat Exposure Management Services program to help customers more effectively prioritize and remediate software flaws, amid the AI-driven surge in industry vulnerabilities.
Optiv is expanding its threat exposure management program to help customers more effectively counter the current AI-driven surge in industry software vulnerabilities—with a focus on offering better prioritization of exploitable flaws along with truly continuous validation of fixes, Optiv executives told CRN exclusively.
The expansion, announced Thursday, builds on existing vulnerability management business at the cybersecurity powerhouse with enhanced capabilities for managed exposure validation and cloud exposure management, according to Leawood, Kansas-based Optiv.
The aim is to help overwhelmed security teams with focusing on the exposures that actually pose the biggest risk to their businesses, in place of the futile strategy of attempting to eliminate every vulnerability, said Kathryn Hall, senior vice president of services at Optiv, No. 29 on CRN’s 2026 Solution Provider 500.
“There isn’t a customer or an enterprise in the world right now that isn’t completely underwater when it comes to their vulnerability management program,” Hall said in an interview. “There’s too many—and even leveraging a [severity] score is not enough to truly understand what the impact is to the business, if that vulnerability were to be exploited.”
As just one indicator of the vulnerability cascade facing businesses, Microsoft’s monthly release of software bug fixes included patches for more than 1,000 vulnerabilities in both October and November. That included a record high of 1,415 new CVEs (Common Vulnerabilities and Exposures) disclosed by Microsoft in October, according to a tally by TrendAI’s Zero Day Initiative.
By comparison, prior Patch Tuesday releases from Microsoft—including as recently as earlier this year—often did not exceed 100 CVEs for the month. That was prior to the arrival of new frontier AI models that are highly proficient at vulnerability discovery, such as Anthropic’s Claude Mythos and OpenAI’s GPT Cyber models.
For Optiv, the latest move to boost threat exposure management also advances its broader effort to connect proactive management of vulnerabilities with detection and response, including through its Agentic Security Operations offering that debuted in August.
‘Are We Exposed?’
Without a doubt, the availability of ultra-powerful AI models are both increasing the visibility into vulnerabilities that is possible, while also enabling attackers to chain together seemingly minor flaws in ways that can cause serious risk, Hall said.
At the same time, as vulnerability management practices fail to keep pace with the volume of findings, it’s clear that the old ways of prioritizing exposures are insufficient, she said.
Simply ranking vulnerabilities by severity scores no longer helps very much, since it does not tell you whether a weakness can truly be exploited or what an attacker could ultimately reach, according to Hall.
Executives and boards are increasingly asking a similar set of questions every time a major new vulnerability surfaces, she said: “Are we exposed? If yes, what’s the plan? How long is it going to take to address that? And if it is exploited, what can the attacker access internally?”
Thus, Optiv’s expanded program is designed at helping customers both to answer those questions and to reduce the time needed to address their most serious exposures, Hall said.
New Capabilities
Within Optiv’s expanded Threat Exposure Management Services program, capabilities for managed exposure validation help to determine which vulnerabilities are exploitable, as well as identifying potential attack paths and guiding remediation efforts, the company said.
Continuous penetration testing then checks that the fixes have truly addressed the exposures, Hall said.
Cloud exposure management capabilities, meanwhile, extend the approach to the public cloud environments that are continuing to see growing adoption by many customers, according to Optiv.
A key issue is that in the cloud, AI agents are significantly adding to the need to understand and manage exposures, Hall said.
All in all, the expanded Optiv services allow customers to manage exposures across both cloud and on-premises environments through a unified approach, the company said.
Optiv works with technology vendors across cloud exposure management, vulnerability management and exposure validation and continuous security testing to support the program, Hall noted.
The Power Of Expertise
There’s no question that truly delivering on exposure management requires a rare level of expertise across multiple security specialties, along with a deep understanding of each customer’s environment and constraints, said Ben Spencer, product director at Optiv.
For instance, some exposures cannot be easily addressed with a straightforward patch, requiring specialists who can identify other ways to disrupt an attack path, Spencer said.
In such cases, “what we need is a mitigation elsewhere—either up or down that chain of where attackers are getting in—or [a sense of] if they do get in, what they’re going to be able to exploit,” he said. “You need that higher-level conversation. And that’s what we’re aiming to provide from a service standpoint.”
Ultimately, for Optiv, “we’re coming in as a program. We’re going to help you mature all these functions. We’re going to give your team that time to go in and start dealing with some more of the structural issues,” Spencer said. “We’re going to be the ones providing that expertise.”
