June 2026 - RedSeal

RedSeal Expands Secure Access to Exposure Intelligence with Attribute-Based Control and AI Guidance

/by

New capabilities enable organizations to extend exposure management insights beyond security teams while maintaining governance and accelerating decision-making 

MENLO PARK, CA – [June 24, 2026] – RedSeal, the leader in exposure management for hybrid enterprise environments, today announced new Attribute-Based Access Control (ABAC) and AI Guidance capabilities within the RedSeal One platform. 

These new capabilities enable organizations to securely extend exposure management insights beyond specialized security teams to IT, cloud, compliance, operations, and executive stakeholders while maintaining the governance and control required in complex enterprise and government environments. 

As attack surfaces continue to expand and security teams face increasing resource constraints, organizations need a way to make critical exposure intelligence available to more decision-makers without compromising security. 

“Security teams are under increasing pressure managing complex environments, fewer specialists, and a growing number of threats,” said Joseph Ward, CEO of RedSeal. “Organizations need exposure intelligence to be accessible beyond a small group of experts while maintaining the governance and control enterprises require. These new capabilities make it easier for teams across the organization to understand risk, make informed decisions, and act faster.” 

Making exposure intelligence accessible across the enterprise 

Security operations increasingly rely on collaboration between security, IT, cloud, compliance, and business teams. Yet critical exposure intelligence often remains limited to a small group of administrators and security specialists. 

RedSeal’s new capabilities help organizations safely expand access to exposure intelligence while providing users with contextual guidance that improves understanding and accelerates action. 

Enterprise security and governance built in 

RedSeal’s new Attribute-Based Access Control (ABAC) capabilities provide precise control over what information users can access based on role, responsibility, mission, or need-to-know requirements. 

Organizations can securely share exposure intelligence with a broader audience while maintaining strict governance, compliance, and information access policies. 

This capability is particularly valuable for federal agencies and highly regulated organizations that require granular access controls and information compartmentalization. 

AI Guidance helps teams act with confidence 

RedSeal’s new AI Guidance capabilities provide contextual explanations and recommendations that help users better understand exposures, attack paths, remediation options, security controls, and segmentation strategies within their own environments. 

By combining AI-driven guidance with RedSeal’s digital twin and exposure intelligence, organizations can accelerate time-to-value, improve decision-making, and reduce dependence on scarce security expertise. 

Advancing the future of exposure management 

RedSeal believes exposure management should be accessible, actionable, and operational across the enterprise. 

By combining exposure intelligence, contextual guidance, and secure access controls, RedSeal is helping organizations move beyond isolated security analysis and build a shared understanding of cyber risk across teams responsible for protecting the business. 

ABAC and AI Guidance capabilities will be available as part of the RedSeal One platform beginning in June 2026. 

For more information, visit RedSeal.net 

About RedSeal
RedSeal is an AI-enabled exposure management platform that helps organizations reduce cyber risk across hybrid IT, cloud, OT, and remote environments. Using a continuously updated digital twin, RedSeal models assets, connections, attack paths, and security controls to uncover hidden exposures and validate real-world risk. By combining exploitability, business impact, and attack reachability through Risk Radius™, RedSeal helps security teams prioritize what matters most and accelerate remediation. Integrated with more than 2,000 third-party systems and devices, RedSeal transforms fragmented security data into actionable insight, enabling organizations to strengthen resilience, validate compliance, and proactively reduce exposure before threats become operational impact. 

Visit www.redseal.net to learn more.   

Active FortiBleed Campaign Underway: Can Attackers Reach Your Critical Assets?

/by

More than 73,000 FortiGate VPN devices have reportedly been linked to credentials exposed in the recently disclosed FortiBleed dataset. Security teams are understandably focused on the leaked credentials. They should be equally focused on what happens next.

A compromised VPN credential doesn’t create a breach on its own. A breach happens when an attacker uses that access to reach critical systems, move laterally across the environment, and compromise the assets that matter most.

Most organizations can tell you whether a credential was exposed. Far fewer can tell you what an attacker could reach after logging in. That’s the question that matters.

Public reporting indicates attackers collected and cracked VPN authentication data at scale, then used recovered credentials to gain access to victim environments and move laterally through networks.

Nothing about this attack sequence is new.

FortiBleed Attack Pattern

Compromised VPN Credentials → Initial Access → Lateral Movement → Active Directory Compromise → Critical Asset Exposure

Security teams have spent years strengthening perimeter defenses, deploying MFA, and improving identity controls. Yet many still struggle to answer a simple question:

If an attacker successfully authenticates today, where can they go next?

Once valid credentials are in play, the firewall is no longer the primary security boundary. Internal connectivity becomes the story.

  • Can an attacker reach Active Directory?
  • Can they access sensitive databases?
  • Can they move into cloud environments?
  • Can they pivot into operational technology networks?
  • Can they reach systems that support critical business operations?

Answers to those questions determine whether an incident remains contained or turns into a headline.

If your credentials were exposed, what would you do first?

Organizations that rely on Fortinet infrastructure should assume attackers will continue targeting VPN credentials, remote access systems, and exposed management interfaces.

How quickly could your team answer these questions?

  • Which FortiGate devices are internet accessible?
  • Which management interfaces are exposed?
  • What systems become reachable after successful authentication?
  • How far could lateral movement extend?
  • Which critical assets sit within reach of those attack paths?

Many organizations cannot answer those questions without days of manual investigation. Security teams already have vulnerability scanners, asset inventories, identity tools, cloud security platforms, and countless dashboards. What they often lack is a clear understanding of how those pieces connect inside the real environment.

Knowing a device is exposed is useful. Understanding the business impact if that device is compromised drives action.

Why attack path visibility matters

A FortiGate device exposed to the internet may represent little risk, or it may provide a pathway to critical business systems. Without attack path visibility, security teams are forced to guess.

Effective exposure management requires understanding:

  • Whether a device is reachable from the internet
  • What an attacker can access after authentication
  • How lateral movement could occur across the environment
  • Which critical assets are exposed
  • Whether segmentation controls actually restrict attacker movement

Attackers don’t think in terms of individual vulnerabilities, credentials, or devices. They think in terms of paths. Defenders need to do the same.

How RedSeal helps

RedSeal enables organizations to understand the real-world impact of a compromise before an attacker exploits it. With RedSeal, security teams can:

  • Discover FortiGate devices across hybrid environments
  • Identify internet-accessible management interfaces
  • Model attack paths originating from VPN entry points
  • Visualize potential lateral movement to Active Directory and other high-value targets
  • Measure exposure using Risk Radius to understand business impact
  • Validate segmentation controls and compensating security measures

Instead of reviewing isolated alerts, teams gain a clear view of how an attacker could move through the environment and where remediation will reduce the most risk.

Immediate actions to take

Organizations concerned about potential exposure should:

  • Determine whether exposed credentials associated with their organization have been identified
  • Rotate VPN and administrative credentials
  • Review internet accessibility of management interfaces
  • Validate multi-factor authentication enforcement
  • Assess attack paths originating from remote access infrastructure
  • Review segmentation controls protecting critical systems
  • Prioritize remediation based on business impact, not device count

One breach lesson worth remembering

FortiBleed won’t be the last credential exposure event this year. Next time it may involve a VPN credential, cloud identity, SaaS application, contractor account, or third-party platform.

Organizations that understand how an attacker could move through their environment can respond faster, prioritize more effectively, and reduce the likelihood that a compromised credential becomes a major breach.

Contact RedSeal today and learn how you can clearly see how an attacker can get in, and what they can reach once they do.

CISA Just Described Your Monday Morning Problem — And We Already Built the Answer

/by

Yesterday, CISA Acting Director Nick Andersen stood up at a Washington, D.C. event and said something that should stop every vulnerability management team in their tracks:

“We’re really asking people to take more of a focus on risk associated with each vulnerability. Is it with an asset that is internet-exposed? Does it align to a KEV entry? Is it automatable in its exploitation? Really, we need to be able to highlight that some patches just aren’t as important as others.”

A binding operational directive for federal agencies is dropping today that formalizes exactly this thinking — a fundamental shift away from blanket, score-based patching toward targeted, context-driven risk prioritization.

Here’s what caught my attention: Andersen just described the exact problem we built our CISA KEV workflow to solve. Not in theory. In production. In customer environments today.

Let me show you what that looks like.

The problem CISA is finally naming

Picture Monday morning. Your vulnerability scanner just ran. You have 100 vulnerabilities — all CVSS score of 10. The worst possible rating. They’re all tied for first place.

Your team has a process for this. Some methodology to rack and stack and prioritize. Fair enough.

But here’s the math: if it takes an hour to properly evaluate each vulnerability — and that’s a reasonable estimate — you’ll know which one to start with in about two and a half weeks.

That’s before you factor in CISA’s Known Exploited Vulnerabilities database.

The KEV catalog is CISA’s list of CVEs being actively exploited in the wild right now. Not theoretical. Not scored by committee. Actively weaponized by adversaries targeting organizations like yours.

But the KEV database doesn’t update on any regular cadence. It might update three times this week. It might not update at all. That means your team has to either subscribe to email alerts, maintain a custom polling script, or check it manually every day. And even when you have the KEV list, you still have to cross-reference it against every vulnerability in your environment — manually.

Two and a half weeks of triage, plus a daily manual intelligence operation layered on top of it.

This is the problem Andersen is directing federal agencies to solve. And it isn’t just a federal problem.

What the new CISA directive actually requires

The binding operational directive formalizes a three-factor risk lens for vulnerability prioritization:

  1. Internet exposure— Is the vulnerable asset reachable from outside your network?
  2. KEV alignment— Does this vulnerability appear in the CISA Known Exploited Vulnerabilities catalog?
  3. Exploitability— Can this vulnerability be automated in its exploitation?

The directive moves federal agencies away from “a patch is released, apply this patch as quickly as you can” toward a model where context determines urgency. Not every CVSS-10 is equally dangerous. The one that matters is the one that’s internet-exposed, KEV-listed, and sitting unpatched in your environment right now.

That’s a precise, three-part question. The answer should be immediate — not the result of two weeks of analyst effort.

We already built this

At RedSeal, we’ve been operationalizing exactly this logic for our customers.

Here’s what it looks like in practice.

A RedSeal workflow — no code required, schedulable at any interval — automatically pulls the current CISA KEV list, compares it against every vulnerability in your RedSeal environment model, and builds a dynamic scope inside the RedSeal UI called CISA. It runs in under 20 seconds. It runs as often as you tell it to. It requires zero analyst hours.

When a security team opens RedSeal on Monday morning, that scope is already there. Already current. Already filtered to the vulnerabilities in their environment that CISA has flagged as actively exploited.

In one recent demonstration environment, that scope contained 50 assets carrying known exploited vulnerabilities. That’s still a week of work to evaluate — until you apply the internet exposure filter

Filter to assets exposed to the outside world: the list goes from 50 to 1.

One asset. One action. That’s your Monday morning priority list.

And RedSeal doesn’t stop there. For that single exposed asset, RedSeal shows you:

  • The blast radius — in this case, one untrusted network connection providing a path to 92 critical internal assets
  • The exact network path from the untrusted external network to the vulnerable asset — traced hop by hop, like a visual traceroute through your actual security controls
  • The specific firewall with the specific rule allowing that access — highlighted automatically
  • The exact line in the configuration file your network team needs to change to close the exposure

In the example above: line 347 on a Palo Alto firewall. Change that rule. Exposure mitigated. You didn’t need to wait for a patch. You closed the door.

That’s not just KEV alignment — that’s all three factors in Andersen’s framework addressed simultaneously. Internet exposure: confirmed. KEV alignment: confirmed. Actionable remediation: here’s the firewall, here’s the rule, here is the line.

Why this matters beyond federal agencies

Andersen was explicit that this directive targets federal civilian executive branch agencies — but he was equally clear that the underlying logic applies broadly. CISA strongly urges all organizations to prioritize KEV remediation as part of their vulnerability management practice.

That guidance lands differently when you consider what’s driving it: AI-enhanced threats are shortening the timeline from vulnerability disclosure to weaponized exploit. The window your team has to act is narrowing. The cost of prioritizing the wrong vulnerability — spending two weeks evaluating 100 CVSS-10s while the one internet-exposed KEV sits unpatched — is rising.

The organizations that will respond fastest to this directive, and to the threat environment driving it, are the ones that have already automated the intelligence layer. Not just the scanning. Not just the scoring. The continuous, real-time correlation of what’s in your environment, what CISA says is being exploited, and what’s actually reachable from the outside world.

That’s what RedSeal does. Not as a future roadmap item. Today.

63% of organizations lack the network visibility to answer Andersen’s question

There’s a data point that contextualizes why this directive is necessary: 63% of companies say they lack the network visibility necessary to achieve a strong security posture.

If you don’t know what’s internet-exposed in your environment, you cannot answer the first question in Andersen’s framework. If you’re not continuously monitoring the KEV catalog and cross-referencing it against your vulnerability data, you cannot answer the second. And if you don’t have a network model that shows you the actual path from the external network to the vulnerable asset, you can’t act on the answer even when you have it.

Visibility isn’t a nice-to-have in this new framework. It’s the prerequisite for everything else.

What to do right now

Whether you’re a federal agency subject to the new directive or a critical infrastructure operator taking Andersen’s guidance seriously, here are three immediate steps:

Step 1 — Know what’s internet-exposed. Build or verify a continuously updated model of your hybrid environment that can answer, at any moment, which assets are reachable from outside your network. Not a six-month-old Visio diagram. A living, current model.

Step 2 — Automate your KEV correlation. Stop manually checking the CISA KEV catalog. Build a workflow that pulls the catalog automatically, cross-references it against your vulnerability data, and surfaces matches without analyst intervention. If you’re a RedSeal customer, this workflow is available to you today.

Step 3 — Know your path to remediation before the call comes. For any KEV-listed vulnerability on an internet-exposed asset, you should be able to answer: what is the specific network path enabling that exposure, and what is the specific control change that closes it? That answer should take minutes, not days.

The bottom line

CISA’s Acting Director just codified in a binding directive what the most operationally mature security teams have known for years: CVSS scores don’t tell you what matters. Internet exposure plus active exploitation plus network context tells you what matters.

RedSeal was built to answer exactly that question — continuously, automatically, and with the specific evidence your network team needs to act.

When the directive drops today, your team shouldn’t be scrambling to figure out how to comply. They should already be there.

To see the CISA KEV workflow and the internet exposure filter in action, contact your RedSeal representative or visit www.redseal.net.

 

Master the Fire First: What José Andrés Taught Security Leaders About Thriving in Chaos

/by

One of the most thought-provoking sessions I attended, so far, at the Gartner® Security & Risk Management Summit this week wasn’t led by a security practitioner, analyst, or technology vendor.

It was led by José Andrés.

The renowned chef, humanitarian, and founder of World Central Kitchen spent the session sharing stories from restaurant kitchens, disaster response efforts, and some of the most challenging environments in the world. While the subject matter had little to do with cybersecurity on the surface, many of the leadership lessons felt surprisingly relevant to the challenges security leaders face every day.

Throughout the discussion, one theme surfaced again and again: success is rarely determined by how well you execute the plan. It’s determined by how well you adapt when the plan no longer applies.

In a world where AI is accelerating change, threats are evolving faster than ever, and organizations are being asked to do more with limited resources, that message resonated deeply.

Master the Fire First

One of Andrés’ earliest lessons came from his father while learning to cook over an open flame.

Everyone wanted to stir the pot. Everyone wanted to control the ingredients. But none of that mattered until you learned to control the fire.

“Master the fire first.”

It’s a simple lesson, but one that immediately made me think about cybersecurity.

Security teams spend a tremendous amount of time chasing emerging threats, new vulnerabilities, evolving compliance requirements, and now the rapidly expanding impact of AI. Yet many organizations still struggle to fully understand the environment those risks exist within.

Before you can effectively prioritize risk, validate exposure, or respond with confidence, you need a clear understanding of the underlying environment.

You need to master the fire.

In cybersecurity, that means understanding the assets, pathways, dependencies, and controls that make up your hybrid environment. Without that foundation, every decision becomes more difficult and every response becomes more reactive.

Stop Waiting for the Perfect Plan

Andrés returned repeatedly to a simple truth: no matter how much planning you do, eventually something will happen that wasn’t in the plan.

Security leaders know this better than anyone.

Every organization has playbooks, runbooks, policies, and incident response plans. They’re essential. But the next major attack, business disruption, AI-driven threat, or operational crisis will almost certainly introduce variables nobody anticipated.

One observation from the session stood out to me. We spend a lot of time teaching people how to follow the plan. We spend far less time teaching them how to adapt when the plan breaks down.

The teams that perform best aren’t always the ones with the most detailed playbooks. They’re the ones that can quickly assess new conditions, make informed decisions, and adjust course when necessary.

Adaptability isn’t a backup plan. Increasingly, it’s becoming a core capability.

Use the Ingredients You Already Have

One of the most practical lessons from the keynote centered around resourcefulness.

In Andrés’ world, if there isn’t enough food, you add more rice. You work with the ingredients you have. You don’t stop moving because conditions aren’t perfect.

That mindset felt particularly relevant for cybersecurity teams.

Most organizations aren’t struggling because they lack security tools. They’re struggling to get maximum value from the tools, data, and expertise they already possess.

Security leaders face the same challenges every year: budget pressure, staffing constraints, competing priorities, and a growing list of responsibilities. Success often comes less from acquiring another platform and more from making better use of existing investments.

That may not be as exciting as deploying a new technology, but it’s often where the biggest gains are found.

The most resilient organizations learn how to create advantage from what they already have.

Make Adversity Work in Your Favor

One of my favorite moments came when Andrés described burning onions while cooking.

His response?

“Let’s call it burnt onion soup.”

The audience laughed, but the lesson landed.

Unexpected events happen. Mistakes happen. Conditions change.

The best leaders don’t spend valuable time wishing circumstances were different. They accept reality, adjust, and move forward.

Cybersecurity leaders face this challenge constantly.

A critical vulnerability emerges without warning. An acquisition introduces new risk. A cloud deployment changes architecture overnight. AI creates both new opportunities and new concerns at the same time.

The organizations that navigate these moments most effectively aren’t necessarily the ones that avoid adversity. They’re the ones that respond quickly and turn disruption into momentum.

The Worst Decision Is the One You Don’t Make

Perhaps the most powerful lesson of the morning came from Andrés’ experience responding to humanitarian disasters.

When disaster strikes, there is never perfect information. There is never complete certainty. There is never enough time.

Yet decisions still have to be made.

As Andrés put it:

“The worst decision is the one you don’t make.”

That lesson resonates deeply in cybersecurity.

Too often organizations become trapped waiting for more information, more validation, more approvals, or more certainty. Meanwhile, threats continue evolving and attackers continue moving.

AI is only accelerating this reality.

Security leaders are increasingly being asked to make decisions in hours rather than weeks. Perfect information is becoming a luxury. The ability to act decisively is becoming a competitive advantage.

The organizations that succeed won’t be the ones that know everything. They’ll be the ones that know enough to move forward with confidence.

Finding Clarity in the Middle of Chaos

World Central Kitchen has delivered millions of meals in some of the most challenging environments on earth. According to Andrés, success often comes from seeing possibilities where others see obstacles.

In Gaza, they partnered with existing restaurants. In stadiums, they used kitchens that were already there. Instead of starting from scratch, they looked at what was available and found ways to build on it.

The same mindset applies to cybersecurity.

The strongest security teams are not the ones drowning in the most data. They’re the ones that can quickly identify what matters. They understand which exposures create real business risk, which vulnerabilities are actually reachable, and where to focus limited time and resources.

In a world overflowing with alerts, dashboards, and findings, clarity becomes a competitive advantage.

The Next Security Challenge Is Already Taking Shape

Toward the end of the discussion, Andrés shifted to a topic few expected: food security.

He argued that food, water, and supply chains are national security issues that deserve far more attention. His point wasn’t really about agriculture. It was about recognizing tomorrow’s challenges before they become today’s crisis.

That message feels especially relevant in cybersecurity.

The next major disruption may not look anything like the last one. Just as food systems, energy infrastructure, and supply chains have become security concerns, AI is rapidly reshaping how organizations think about cyber risk, resilience, and operational readiness.

The leaders who will be best positioned for what’s next are the ones asking difficult questions today, before everyone else starts asking them tomorrow.

What emerging risk deserves more attention now?

A Lesson Worth Taking Home

As I left the session, I found myself thinking less about food and disaster relief and more about the challenges security leaders face every day.

The pace of change is accelerating. AI is reshaping both attack and defense. Teams are being asked to make decisions faster, often with incomplete information and limited resources. In many ways, cybersecurity has become an exercise in operating through uncertainty.

That’s why Andrés’ message resonated so strongly.

The goal isn’t to predict every challenge. The goal is to build organizations that can respond when the unexpected happens.

Master the fire first. Understand the environment. Trust your people. Act decisively.

Then adapt to whatever comes next.

Get the latest news, invites to events, and threat alerts

CONTACT US
Distinguished Vendor badge 2025

NEW Gartner® Report, Emerging Tech: The Future of Exposure Management is Preemptive.Download Report.
Footer
Connect on LinkedIn