Patching Isn’t Enough: CISA’s FIRESTARTER Advisory and What It Means for Your Network

2026-04-27/by Wayne Lloyd, Federal CTO, RedSeal

CISA doesn’t issue Emergency Directives lightly. When ED 25-03 landed last week — mandating immediate action for federal agencies and urging all U.S. organizations to respond — it came with a warning that should stop every security leader cold:

Patching your Cisco ASA/FTD devices will not remove this threat.

FIRESTARTER is a persistent backdoor specifically engineered to survive firmware updates and device reboots. The nation-state APT behind it — UAT4356/Storm-1849, the same group responsible for the 2024 ArcaneDoor campaign — designed it to stay resident on your perimeter firewalls long after you think you’ve remediated. Once installed, it gives attackers persistent remote access and control of the most critical chokepoints in your network.

This is not a patch-and-move-on situation.

What Makes FIRESTARTER Different

Most vulnerabilities follow a predictable response arc: identify, patch, verify, close. FIRESTARTER breaks that arc at the last step.

Initial access was gained by chaining two zero-days — CVE-2025-20333 (a buffer overflow enabling remote code execution) and CVE-2025-20362 (a missing authorization flaw) — to fully take over vulnerable Cisco ASA and FTD devices. But the real danger isn’t the initial exploit. It’s what happens next.

Once FIRESTARTER is installed, it persists. Organizations that apply Cisco’s patches without first confirming the backdoor has been removed may believe they are clean while the attacker retains full access. Silently. Indefinitely.

And the target isn’t a workstation or a server. It’s your perimeter firewall — the device that controls everything entering and leaving your network.

The Pattern Every Security Leader Should Recognize

This is not the first time UAT4356 has done this. ArcaneDoor in 2024 targeted the same device category using different Cisco zero-days. Two years later, the same actor, the same target, a more sophisticated persistence mechanism.

Nation-state APTs are systematically targeting perimeter network infrastructure because these devices are high-value, under-monitored, and — when compromised — provide a persistent, trusted foothold for long-term espionage. FIRESTARTER won’t be the last campaign in this pattern.

The Questions You Need to Answer Right Now

If your organization runs Cisco ASA or FTD devices, five questions require immediate answers:

Where are all my Cisco ASA/FTD devices — including cloud, branch, and remote deployments?
Which are publicly accessible and therefore highest priority for investigation?
If one is compromised, what can an attacker reach from it?
Is my isolation actually enforced — or just intended?
After patching, can I prove the threat is gone — not just hope the firmware update was enough?

How quickly you can answer these questions determines how effectively you respond. For organizations without continuous network visibility, each of these questions could take days to answer. Days you don’t have.

How RedSeal Helps

RedSeal customers aren’t starting from scratch when an advisory like this lands. They already have a continuously updated digital twin of their entire hybrid network — every Cisco device, every version, every connection, every potential attack path.

With RedSeal, you can immediately identify every affected device, understand the blast radius of a potential compromise, validate that isolation measures are actually working, deploy custom checks based on CISA’s indicators of compromise, and verify — with evidence — that your remediation closed the door.

Not as a one-time audit. Continuously.

That’s the difference between reacting to FIRESTARTER and being prepared for whatever comes next.

Don’t Wait for the Next Directive

CISA issued this emergency directive because the threat is real and active right now. If you’re not sure how exposed you are — or you’re not confident your response is complete — let’s talk.

RedSeal can show you exactly what’s at risk in your environment and help you respond with confidence.

Schedule a conversation with our team

THE CISO’S PLAYBOOK: Answering the Board on Mythos: A Field Guide to Preemptive Exposure Management

2026-04-22/by Jane Paolucci, CMO

The clock just got faster

Boards are not asking about Mythos because it is a new buzzword. They are asking because AI has done something that changes the math of security programs: it has compressed the window between vulnerability discovery and active exploitation from weeks to hours.

That shift reframes the executive conversation entirely. The question is no longer whether your organization is secure in some static sense. It is whether your security program can operate at the pace of the threat, and whether you can prove it.

The joint guidance from the Cloud Security Alliance and the SANS Institute, The AI Vulnerability Storm: Building a Mythos Ready Security Program, is candid about where things stand today: today’s models have not yet defeated well-hardened defenses. AI is already being used to identify weaknesses, map connections across environments, and accelerate the path from discovery to exploitation. Those capabilities are advancing faster than most security programs are adapting. The result is a threat landscape where the window for deliberate response is shrinking and where context and velocity matter more than raw detection volume.

Vulnerability management alone cannot answer that challenge. If you cannot quantify exposure and show reduction over time, you are not prepared to walk into that boardroom.

Board level answers in a new age of threats

When a board member asks whether you are prepared for Mythos, they are not requesting a threat briefing. They want to know three things:

Can you see how your environment can be attacked right now? Not in theory — based on actual connectivity, current configurations, and real control gaps.
Are you prioritizing based on business impact? Or are you treating every vulnerability as equally urgent and working through an endless queue?
Can you prove that your actions are reducing risk? Not just demonstrating activity, but showing measurable movement in the right direction.

A confident answer addresses all three. Most programs are strong on the first and weak on the second and third. That is where the board’s frustration tends to originate.

Why traditional programs are showing their age

Most vulnerability management programs were designed for a different operating tempo. They show you where in the environment known vulnerabilities exist, score them by severity, and work through remediation queues in priority order. That model assumes time for deliberate triage.

That program is no longer sufficient.

Today’s environments include not only a growing of known vulnerabilities, but also unknown and zero-day threats that, by definition, are invisible to traditional scanning. In this reality, a “clean” system, one with known vulnerabilities, cannot be assumed safe.

The problem is not a shortage of data. Security teams are already buried in findings. The real challenge is context: understanding how systems are connected, how access is actually granted, and how an attacker could move across the environment if any system were compromised.

This requires a fundamental shift in approach, away from prioritizing individual vulnerabilities, and toward evaluating exposure based on reachability, segmentation, and the paths that lead to critical assets. In effect, assuming compromise and focusing on what an attacker could do next.

Without this context, prioritization becomes inconsistent, reporting becomes hard to defend, and the gap between security activity and measurable risk reduction grows wider, even as the team works harder.

Preemptive Exposure Management: The shift that changes the answer

Preemptive exposure management is a different operating model. Instead of treating vulnerabilities as isolated items on a list, it looks at the conditions that make attacks possible, how exposures combine into attack paths, and which paths carry real business risk.

RedSeal is built around this model. The platform continuously models the entire hybrid environment — IT (on-premises, cloud, and remote workers), OT, and IoT — including assets, configurations, and network controls that other tools miss. That living model is the foundation for everything else.

From that foundation, RedSeal maps every viable attack path through your environment. Not a sampled view. Not a theoretical exercise. Every path, based on actual connectivity and current control gaps, evaluated continuously as the environment changes.

We are not managing vulnerabilities. We are reducing the exposures attackers can actually exploit. That distinction is the difference between staying busy and reducing risk.

How RedSeal turns this into a Board-Ready Program

RedSeal’s capabilities map directly to what preemptive exposure management requires:

A ground truth model of tour environment

RedSeal’s agentless hybrid environment modeling creates a continuously updated digital twin of every asset, connection, and control across your infrastructure. No agents. No active scanning. No disruption to operations. Just an accurate, always-current picture of what you have and how it connects, including assets and configurations that other tools routinely overlook.

Attack Paths that reflect reality, not assumptions

RedSeal’s attack path analysis overlays your environment model with how threats can actually traverse it. It detects misconfigurations and exposure paths across IT/OT boundaries, maps lateral movement opportunities, and identifies the specific controls that need to change to block each path. This is passive red teaming, without the breach.

Risk Radius™: Prioritization with business context

RedSeal’s Risk Radius™ scoring fuses exploitability with blast radius and business impact, surfacing the exposures that are both reachable and consequential. Teams stop chasing noise and start acting on what actually moves the risk dial. Fewer fixes. Greater risk reduction.

A Risk Score the business can track

RedSeal’s Digital Risk Score translates technical exposure into a consistent, measurable representation of risk posture. It answers the question boards keep asking: where do we stand, and is that number going in the right direction? Track it over time. Show it at every quarterly review. Let it anchor the conversation on outcomes rather than activities.

Board-Ready Reporting, without the manual work

RedSeal’s Report Studio generates structured, executive-ready reports that show exposure trends, remediation impact, and compliance posture. The ability to translate technical findings into a clear risk narrative is not a soft skill — it is a program requirement. Without it, even the most sophisticated security work looks reactive to the people who fund it.

When the Board asks how you are handling Mythos

When the board asks how you are handling Mythos, the answer should reflect a clear operational shift, not a defensive posture.

You have moved from reactive vulnerability management to preemptive exposure management. You have continuous visibility into how your environment can be attacked. You prioritize based on business impact, not CVSS scores. And you can demonstrate, with a consistent metric, that your program is reducing exploitable risk over time.

RedSeal makes that answer possible. It provides the ground truth, the attack path context, the prioritization intelligence, and the reporting capability needed to run a program that operates at the speed Mythos demands.

The organizations that succeed will not be the ones that simply patch faster. They will be the ones that understand their exposure in context, act on what matters most, and prove it.

Why this cannot wait

Mythos has not introduced entirely new attack techniques. It has eliminated the delay that most security programs depend on. The margin for a slow, reactive process is gone.

The tools exist to operate differently. RedSeal integrates with more than 2,000 third-party security and infrastructure systems, bringing together data from across the environment into a single, continuously updated model. Trusted by hundreds of Fortune 1000 companies and more than 75 U.S. government agencies, including all five branches of the U.S. military, the platform is built for environments where the stakes of getting exposure management wrong are real.

Preemptive exposure management is not a project. It is how leading security programs are repositioning for a threat landscape where speed and context are the only advantages that matter.

Security leaders are being asked to do more than report activity—they are expected to prove risk reduction. If you’re preparing for that conversation, it’s time to rethink how you measure and manage exposure.

Learn how RedSeal helps you understand what is truly exposed and prove it over time. Contact RedSeal Today.

The Mythos Is Coming: Why Preemptive Exposure Management Is Your Best Defense Against AI-Powered Attacks.

2026-04-15/by Wayne Lloyd, Federal CTO, RedSeal

How RedSeal’s preemptive exposure management uses empirical attack path analysis and workflow automation to help you lock down your enterprise before the next AI threat emerges.

The Mythos moment: Why everyone is freaking out

On April 7, 2026, Anthropic announced Claude Mythos Preview, and the cybersecurity world collectively held its breath. Here’s why:

Mythos isn’t just another AI model. It’s a general-purpose frontier model that excels at cybersecurity tasks—specifically, vulnerability discovery and exploit development. During internal testing, Mythos identified thousands of zero-day vulnerabilities across every major operating system and web browser. It found bugs that survived decades of human review and millions of automated test runs. One vulnerability had been hiding in OpenBSD—an operating system renowned for its security—for 27 years.

But here’s what should really concern security leaders: Mythos can autonomously turn these vulnerabilities into working exploits. In Anthropic’s testing, engineers with no formal security training asked Mythos to find remote code execution vulnerabilities overnight and woke up to complete, working exploits. The model chains together multiple vulnerabilities, writes sophisticated JIT heap sprays, and develops privilege escalation attacks that would take expert penetration testers weeks to craft.

Anthropic is limiting access through Project Glasswing, sharing the model only with select partners for defensive security work. But the reality is clear: models with these capabilities will eventually become more widely available. The defensive advantage Anthropic hopes to create is temporary. Attackers will eventually gain access to similar capabilities—if they haven’t already.

The Federal Reserve Chairman has already met with bank CEOs to discuss the security implications. Your board of directors will have questions. And the question they’ll ask is simple: What are you doing to prepare?

The real question: What can attackers actually reach?

Here’s what’s often missed in the Mythos panic: The fact that Mythos can find thousands of vulnerabilities doesn’t mean all those vulnerabilities pose equal risk to your organization.

A vulnerability only matters if an attacker can reach it.

Consider two scenarios:

Scenario A: Mythos discovers a critical remote code execution vulnerability in a widely-used database server. The CVE gets assigned, exploits start circulating on dark web forums, and your vulnerability scanner flags three instances in your environment. Your team is scrambling.

Scenario B: You’ve already modeled your network. You know, with certainty, that those database servers sit behind properly configured firewalls with no inbound access from the internet or user networks. You know the only systems that can reach them are internal management servers with strict access controls. You know there is no attack path.

In Scenario B, you’re not scrambling. You’re confident. You’ve already done the preemptive work.

This is the difference between reactive security and preemptive exposure management. One waits for threats and responds. The other eliminates the paths those threats would exploit before they’re ever discovered.

The problem with theoretical security

In cybersecurity, we’ve become comfortable with probability. We prioritize vulnerabilities based on CVSS scores that theoretically represent severity. We use threat intelligence that theoretically indicates what attackers might target. We implement controls that theoretically block attack vectors.

But attackers don’t work in theory. They work in reality.

When an adversary—whether human or AI—breaches your perimeter, they don’t care about your theoretical risk scores. They care about one thing: Is there a path from where I am to where I want to be?

This fundamental disconnect explains why organizations with sophisticated security programs still get breached. They’re securing theoretical attack surfaces while attackers exploit actual attack paths.

Consider this scenario: Your vulnerability scanner flags a critical CVE on a server. The CVSS score is 9.8. Your threat intelligence feed shows active exploitation in the wild. Your security team prioritizes this for immediate patching.

But here’s what the theoretical analysis missed: That server sits behind a properly configured firewall that blocks all external access. The vulnerable service isn’t exposed to any network segment where an attacker could reach it. No internal host has both the network access and the credentials to exploit it. In other words, there is no attack path.

Meanwhile, a medium-severity misconfiguration on a different system creates a direct path to your crown jewels. But because it doesn’t trigger your theoretical risk thresholds, it sits in the backlog—waiting for Mythos or a similar AI to discover and exploit it.

This is the danger of security based on belief rather than knowledge. And in a world where AI can systematically probe for weaknesses, the cost of that gap just got exponentially higher.

What is empirical attack path analysis?

Empirical attack path analysis is the discipline of determining—definitively—whether an attacker can reach a target asset based on actual network configurations, access controls, and asset relationships.

Unlike theoretical approaches that rely on:

Probabilistic scoring (CVSS, EPSS, risk scores)
Threat assumptions (what attackers might do)
Compliance checklists (what auditors want to see)

Empirical analysis relies on:

Network topology data from firewalls, routers, and switches
Access control rules from ACLs, security groups, and identity systems
Asset relationships showing how systems connect and communicate
Vulnerability context mapped to reachable attack surfaces

The output isn’t a risk score or a priority ranking. It’s a definitive answer: Yes, an attacker can reach this asset via this path or No, there is no viable attack path to this asset.

This distinction matters enormously in the AI era. When Mythos-level capabilities can discover thousands of vulnerabilities, you cannot possibly patch them all. But you can systematically eliminate the attack paths that would make those vulnerabilities exploitable. You can prioritize the exposures that create real risk. You can focus your limited resources where they matter most.

The RedSeal difference: From belief to knowledge

RedSeal was built on a fundamental principle: You cannot secure what you cannot see, and you cannot prioritize what you cannot verify.

This philosophy has never been more relevant. When AI models can find vulnerabilities faster than humans can patch them, your only sustainable advantage is knowing which exposures actually create risk in your specific environment.

1. Network Modeling from Real Data

RedSeal ingests configuration data from every layer of your network infrastructure—firewalls, routers, switches, load balancers, cloud security groups, and end point agents,. This isn’t scanning or guessing. It’s mathematical modeling of your actual security posture.

From this data, RedSeal constructs a complete model of your network topology, including:

Every reachable IP address and port
Every access control rule and exception
Every path between any two points in your network
Every zone, segment, and trust boundary

This model becomes the foundation for all analysis. When RedSeal identifies an attack path, it’s not predicting. It’s calculating based on the mathematical reality of your network.

2. Definitive Attack Path Analysis

Given a starting point (an attacker’s position) and an ending point (a critical asset), RedSeal calculates every viable path between them. Not theoretical paths. Not possible paths. Actual paths that exist in your network right now.

This analysis considers:

Network layer reachability (can packets flow?)
Access control enforcement (what rules allow or deny?)
Vulnerability exploitation (what weaknesses enable lateral movement?)
Identity and credential paths (what access can be obtained?)

The result is a complete picture of your exposure—not in terms of risk scores, but in terms of specific, exploitable attack paths that an adversary could follow to reach your most valuable assets. Whether that adversary is a human attacker or an AI model like Mythos, the paths are the same.

3. Built-in Workflow Automation

Discovery without action is just observation. RedSeal recognized early that exposure management requires operational processes to close gaps, not just identify them.

In a world where AI can find vulnerabilities at unprecedented speed, this operational capability becomes critical. You need to move from identification to remediation quickly and at scale.

RedSeal’s workflow automation capabilities include:

Automated ticketing integration with ITSM platforms
Remediation tracking from identification to closure
Change validation confirming fixes were effective
Compliance reporting mapping exposures to frameworks

This isn’t automation added as an afterthought. It’s workflow capability designed into the platform from the beginning, ensuring that every exposure identified can be tracked through to resolution.

Building a Mythos-ready security program

For security leaders looking to prepare for the AI-accelerated threat landscape, the transformation requires three strategic shifts:

1. From Scanning to Modeling

Stop relying solely on scanning tools that probe from outside. Start modeling your network from the inside using configuration data. This reveals the complete picture—including assets and paths that scanners miss.

Why this matters for Mythos: When AI can find vulnerabilities anywhere, you need to know your entire attack surface—not just what scanners can see. Network modeling gives you visibility into segmented networks, air-gapped systems, and the complex paths that connect them.

RedSeal advantage: Multi-vendor configuration ingestion supports firewalls, routers, switches, and cloud infrastructure from all major vendors. The platform maintains a living model of your network that updates as configurations change.

2. From Scores to Paths

Stop making remediation decisions based on severity scores. Start making them based on attack paths. A vulnerability’s true risk isn’t captured by its CVSS score—it’s determined by whether an attacker can reach it and what they can access from there.

Why this matters for Mythos: AI will flood your vulnerability management pipeline with findings. The Mythos evaluation found thousands of critical vulnerabilities. You cannot patch them all. But you can systematically eliminate the attack paths that make them exploitable.

RedSeal advantage: Path analysis engine calculates every viable route through your network, considering access controls, vulnerabilities, and identity relationships. The platform shows you not just what’s vulnerable, but what’s reachable.

3. From Reporting to Workflows

Stop treating exposure management as a reporting exercise. Start treating it as an operational process with defined workflows, accountability, and validation.

Why this matters for Mythos: The pace of vulnerability discovery is accelerating. What worked when your team faced dozens of critical findings per month won’t work when AI models can surface hundreds or thousands. You need automation that moves faster than manual processes allow.

RedSeal advantage: Built-in workflow automation integrates with your existing ITSM tools, automatically creating tickets for exposures and tracking them through to closure. Customizable workflows support your organization’s change management processes.

The preemptive exposure management advantage

Here’s the strategic reality that should shape your thinking:

Mythos and similar AI models are weapons. Like any weapon, they’re more effective against unprepared targets. An attacker using Mythos against an organization that understands its attack paths and has closed the critical ones will waste time probing dead ends. The same attacker against an organization operating on theoretical risk will find and exploit real paths to critical assets.

Preemptive exposure management is your defensive advantage. By understanding and eliminating attack paths before threats emerge, you change the equation. You’re not trying to outpace AI at finding vulnerabilities—you’re making the vulnerabilities it finds irrelevant to your specific environment.

The time to act is now. Anthropic is deliberately limiting Mythos access to give defenders a head start. This window won’t last forever. The organizations that use this time to build empirical understanding of their attack surfaces will be positioned to weather the AI threat landscape. Those that wait will be playing catch-up when the next Mythos-class model becomes available to adversaries.

The bottom line: What you know vs. what you believe

Every security decision your organization makes is based on one of two foundations:

Belief-based decisions rely on theoretical models, probability scores, and assumptions about attacker behavior. They feel sophisticated because they use data and algorithms. But they’re still fundamentally guessing.

Knowledge-based decisions rely on verified facts about your environment. They know—with certainty—whether an attack path exists. They don’t prioritize based on what might happen; they remediate based on what can happen.

RedSeal was designed for knowledge-based security. Our platform transforms the question from “What do we think our exposure is?” to “What do we know our exposure is?”

In a world where attackers—AI or human—exploit reality, not theory, this distinction isn’t academic. It’s the difference between preventing a breach and explaining one. It’s the difference between scrambling when Mythos finds a new CVE and confidently knowing you’re not exposed.

The Mythos is coming. The only question is whether you’ll be ready.

Take the next step

Ready to build a Mythos-ready security program? Here’s how to get started:

Assess your current approach. Are you prioritizing based on scores or paths? Do you know your actual attack surface or just what your scanners can see?
Model your network. RedSeal can ingest configurations from your existing infrastructure and build a complete topology model within days, not months.
Identify your critical assets. Map your crown jewels—systems and data that would cause the most damage if compromised.
Calculate your attack paths. Let RedSeal identify every viable route from potential entry points to your critical assets.
Automate your remediation. Use RedSeal’s workflow integration to close exposures and validate that fixes are effective.

Learn more

In an era of AI-powered threats, RedSeal provides the empirical foundation for preemptive security. Learn more at redseal.net.

CISA AA26-097A: Iranian actors are targeting your OT Systems. Is your critical infrastructure exposed?

2026-04-08/by Jane Paolucci, CMO

CISA Advisory AA26-097A is direct: Iranian-affiliated threat actors are actively targeting internet-facing programmable logic controllers (PLCs) across U.S. critical infrastructure, water, energy, and government sectors included.

The advisory describes adversaries using legitimate remote engineering tools and valid credentials to access and manipulate OT systems. That changes the fundamental security question.

It is no longer: “Are we vulnerable?”

It is: “Can an attacker reach our critical systems, and what can they do once they get there?”

What CISA’s Guidance Requires

CISA’s advisory identifies clear, actionable priorities. Organizations operating critical infrastructure must act on each:

Eliminate unnecessary internet exposure. PLCs and OT systems should not be directly or indirectly internet-accessible. CISA specifically calls for removing inbound port exposure and ensuring all remote access is mediated through a secure gateway.

Control and monitor all remote access. Where remote access is required, implement network proxies, firewalls, or VPNs in front of PLCs, and to enforce MFA for any access from external networks. Access should be logged, monitored, and reviewed for unusual or unexpected activity.

Enforce and verify network segmentation. Configure firewalls to block unnecessary protocols by network segment, disable unused services, and implement device control lists to restrict which workstations can communicate with OT components.

Understand attack path, not just assets. Continuously monitor network traffic for unusual logins, unexpected protocols, and ICS management commands that alter operating modes or modify programs. When adversaries use legitimate tools, behavioral context becomes the detection signal.

Plan for operational impact. OT incidents affect operations, especially uptime and safety, not just systems. Incident response must be built for that reality.

RedSeal for IT, OT, and IoT Security

RedSeal is built for exactly this problem: understanding how a hybrid IT/OT/IoT environment is connected, what is reachable, and where exposure creates real operational risk.

Unified hybrid visibility. RedSeal continuously models the full environment, IT, OT, IoT, and cloud, so organizations know how everything is connected.

Attack path analysis across IT/OT boundaries. RedSeal identifies the paths an attacker could take from external entry points into OT systems, including multi-hop paths that cross network zones.

Segmentation validation. RedSeal verifies whether controls are actually enforced, not assumed, and identifies gaps that create unintended access.

Risk-based prioritization. RedSeal focuses remediation on exposures that create the highest operational and business risk, not simply the highest vulnerability count.

Pre-deployment simulation. RedSeal enables teams to model the impact of network changes before implementation, reducing risk during remediation.

Orchestrated remediation, from discovery to verified fix. RedSeal Workflow connects exposure intelligence to the tools teams already use, automating ticket creation, ownership assignment, and fix validation through a low/no-code builder driven by Agentic AI, purpose-built for exposure management.

CISA AA26-097A confirms that critical infrastructure is under active, targeted threat. The organizations best positioned to respond are those that already know:

What is exposed
What is reachable
What the consequences are

RedSeal delivers a continuous visibility and understanding across the full hybrid environment, providing you the understanding you need to pre-emptively defend against active threats.

For more information on how RedSeal supports critical infrastructure security, contact us today.

AI at RSA: cutting through the noise

2026-04-02/by Jane Paolucci, CMO

You couldn’t miss it. Every billboard on the way into San Francisco. Every booth on the show floor. Every keynote, panel, and happy hour conversation. AI was everywhere at RSA this year, supporting the theme “Many Voices. One Community,” in spades.

What was also everywhere, if you were listening carefully: skepticism.

Buyers are curious about AI. They are not, for the most part, ready to hand it the keys. After spending time on the floor and in conversations with analysts and practitioners, the tension between the promise of AI and the reality of deploying it responsibly was the most honest and useful theme of the entire conference.

The signal underneath all the noise

Strip away the marketing (which was once again big!), and a clear picture emerges of where AI is actually delivering value in cybersecurity today. The highest-trust use cases are pattern recognition, noise reduction, enrichment, and summarization. These are the areas where AI can meaningfully accelerate what skilled teams are already doing, without replacing the judgment behind it.

The lower-trust use cases such as autonomous remediation and automated patching, remain a bridge too far for most organizations. Not because the technology isn’t advancing, rather because the data foundations and guardrails required to deploy it responsibly aren’t yet in place at most enterprises.

Speaking with our analyst partners, it is clear that this is a realistic assessment of where the market actually is.

Explainability is the real opportunity

One of the most important distinctions that came through our conversations at RSA: the greatest near-term value from AI isn’t autonomous action, it’s explainability and translation.

Security teams need AI that can communicate the why behind an exposure. That can explain the impact of a change request to a network engineer in language that makes sense to a network engineer and then also frame the same issue for a C-suite executive in terms of business risk. That translation layer is where AI earns its credibility, and it’s where most vendors are still falling short.

At RedSeal, this is exactly the capability we’ve been building toward. Our AI-powered explainability work is designed to meet teams where they already work, in their own channel and in natural language so that exposure context becomes part of the workflow, not a separate reporting exercise.

Trust is the real barrier to AI adoption

Here’s what the vendor community needs to hear more clearly: buyers don’t distrust AI explanations. They distrust authority inversion.

Trust breaks down when recommendations feel constructed after the fact, or when the rationale behind a decision feels persona-driven rather than evidence-driven. The implication is significant, AI credibility is built on the strength of the underlying exposure data. Get the data right first, then layer in AI as a controlled accelerator.

The sequencing that kept surfacing in analyst conversations was consistent: build and maintain foundational exposure datasets, integrate exposure context into SOC workflows, and introduce agentic AI only after data integrity and guardrails are established. A disciplined approach that will drive your pre-emptive exposure management practices.

Differentiate on outcomes, not AI claims

With 70 to 80-plus vendors making nearly identical AI claims on the show floor, the path to standing out isn’t a better AI story. It’s demonstrable outcomes including shorter exposure windows, faster resolution, and clearer priorities. The trust that gets built between security and network teams when tickets carry rationale and bridge the language gap are those that drive efficiency.

Worth naming directly: investor pressure to AI-wash messaging is real, and buyers are increasingly aware of it. Failed POVs from well-funded vendors are already making the rounds. Skepticism is growing, and it will only reward organizations that lead with substance.

What this means for security leaders

RSA this year was a useful forcing function. AI in cybersecurity is not a future consideration but a present-tense decision that requires a strategy, and fast. That strategy starts with data integrity, not AI features, and requires building the translation layer between technical exposure and business risk while resisting the pressure to chase autonomous capabilities before the foundational work is done.

RedSeal has spent years building the visibility, analysis, and validation that makes that foundation possible. AI makes it faster, clearer, and more actionable for every team that needs to act on it, from network engineers to the board.

Contact us today to learn more about our architecture-driven foundation powered by AI and Agentic capabilities, and how RedSeal can help you to move from insight to action with confidence.