In order to provide you with the best experience possible we might sometimes track information about you. Sometimes this may involve writing a cookie. We use this information for things like experience enrichment, analytics and targeting advertising. We recommend allowing these functions to get the most out of your experience.
OK
RedSeal Expands Secure Access to Exposure Intelligence with Attribute-Based Control and AI Guidance
/by Jane Paolucci, CMONew capabilities enable organizations to extend exposure management insights beyond security teams while maintaining governance and accelerating decision-making
MENLO PARK, CA – [June 24, 2026] – RedSeal, the leader in exposure management for hybrid enterprise environments, today announced new Attribute-Based Access Control (ABAC) and AI Guidance capabilities within the RedSeal One platform.
These new capabilities enable organizations to securely extend exposure management insights beyond specialized security teams to IT, cloud, compliance, operations, and executive stakeholders while maintaining the governance and control required in complex enterprise and government environments.
As attack surfaces continue to expand and security teams face increasing resource constraints, organizations need a way to make critical exposure intelligence available to more decision-makers without compromising security.
“Security teams are under increasing pressure managing complex environments, fewer specialists, and a growing number of threats,” said Joseph Ward, CEO of RedSeal. “Organizations need exposure intelligence to be accessible beyond a small group of experts while maintaining the governance and control enterprises require. These new capabilities make it easier for teams across the organization to understand risk, make informed decisions, and act faster.”
Making exposure intelligence accessible across the enterprise
Security operations increasingly rely on collaboration between security, IT, cloud, compliance, and business teams. Yet critical exposure intelligence often remains limited to a small group of administrators and security specialists.
RedSeal’s new capabilities help organizations safely expand access to exposure intelligence while providing users with contextual guidance that improves understanding and accelerates action.
Enterprise security and governance built in
RedSeal’s new Attribute-Based Access Control (ABAC) capabilities provide precise control over what information users can access based on role, responsibility, mission, or need-to-know requirements.
Organizations can securely share exposure intelligence with a broader audience while maintaining strict governance, compliance, and information access policies.
This capability is particularly valuable for federal agencies and highly regulated organizations that require granular access controls and information compartmentalization.
AI Guidance helps teams act with confidence
RedSeal’s new AI Guidance capabilities provide contextual explanations and recommendations that help users better understand exposures, attack paths, remediation options, security controls, and segmentation strategies within their own environments.
By combining AI-driven guidance with RedSeal’s digital twin and exposure intelligence, organizations can accelerate time-to-value, improve decision-making, and reduce dependence on scarce security expertise.
Advancing the future of exposure management
RedSeal believes exposure management should be accessible, actionable, and operational across the enterprise.
By combining exposure intelligence, contextual guidance, and secure access controls, RedSeal is helping organizations move beyond isolated security analysis and build a shared understanding of cyber risk across teams responsible for protecting the business.
ABAC and AI Guidance capabilities will be available as part of the RedSeal One platform beginning in June 2026.
For more information, visit RedSeal.net
About RedSeal
RedSeal is an AI-enabled exposure management platform that helps organizations reduce cyber risk across hybrid IT, cloud, OT, and remote environments. Using a continuously updated digital twin, RedSeal models assets, connections, attack paths, and security controls to uncover hidden exposures and validate real-world risk. By combining exploitability, business impact, and attack reachability through Risk Radius™, RedSeal helps security teams prioritize what matters most and accelerate remediation. Integrated with more than 2,000 third-party systems and devices, RedSeal transforms fragmented security data into actionable insight, enabling organizations to strengthen resilience, validate compliance, and proactively reduce exposure before threats become operational impact.
Visit www.redseal.net to learn more.
Patching Isn’t Enough: CISA’s FIRESTARTER Advisory and What It Means for Your Network
/by Wayne Lloyd, Federal CTO, RedSealCISA doesn’t issue Emergency Directives lightly. When ED 25-03 landed last week — mandating immediate action for federal agencies and urging all U.S. organizations to respond — it came with a warning that should stop every security leader cold:
Patching your Cisco ASA/FTD devices will not remove this threat.
FIRESTARTER is a persistent backdoor specifically engineered to survive firmware updates and device reboots. The nation-state APT behind it — UAT4356/Storm-1849, the same group responsible for the 2024 ArcaneDoor campaign — designed it to stay resident on your perimeter firewalls long after you think you’ve remediated. Once installed, it gives attackers persistent remote access and control of the most critical chokepoints in your network.
This is not a patch-and-move-on situation.
What Makes FIRESTARTER Different
Most vulnerabilities follow a predictable response arc: identify, patch, verify, close. FIRESTARTER breaks that arc at the last step.
Initial access was gained by chaining two zero-days — CVE-2025-20333 (a buffer overflow enabling remote code execution) and CVE-2025-20362 (a missing authorization flaw) — to fully take over vulnerable Cisco ASA and FTD devices. But the real danger isn’t the initial exploit. It’s what happens next.
Once FIRESTARTER is installed, it persists. Organizations that apply Cisco’s patches without first confirming the backdoor has been removed may believe they are clean while the attacker retains full access. Silently. Indefinitely.
And the target isn’t a workstation or a server. It’s your perimeter firewall — the device that controls everything entering and leaving your network.
The Pattern Every Security Leader Should Recognize
This is not the first time UAT4356 has done this. ArcaneDoor in 2024 targeted the same device category using different Cisco zero-days. Two years later, the same actor, the same target, a more sophisticated persistence mechanism.
Nation-state APTs are systematically targeting perimeter network infrastructure because these devices are high-value, under-monitored, and — when compromised — provide a persistent, trusted foothold for long-term espionage. FIRESTARTER won’t be the last campaign in this pattern.
The Questions You Need to Answer Right Now
If your organization runs Cisco ASA or FTD devices, five questions require immediate answers:
How quickly you can answer these questions determines how effectively you respond. For organizations without continuous network visibility, each of these questions could take days to answer. Days you don’t have.
How RedSeal Helps
RedSeal customers aren’t starting from scratch when an advisory like this lands. They already have a continuously updated digital twin of their entire hybrid network — every Cisco device, every version, every connection, every potential attack path.
With RedSeal, you can immediately identify every affected device, understand the blast radius of a potential compromise, validate that isolation measures are actually working, deploy custom checks based on CISA’s indicators of compromise, and verify — with evidence — that your remediation closed the door.
Not as a one-time audit. Continuously.
That’s the difference between reacting to FIRESTARTER and being prepared for whatever comes next.
Don’t Wait for the Next Directive
CISA issued this emergency directive because the threat is real and active right now. If you’re not sure how exposed you are — or you’re not confident your response is complete — let’s talk.
RedSeal can show you exactly what’s at risk in your environment and help you respond with confidence.
Schedule a conversation with our team
US Marshals Scramble to Shut Down Computer System
/by Jane Paolucci, CMOAudacy | May 1, 2023
Tune in to KCBS and hear Dr. Mike Lloyd, RedSeal’s CTO, share insights into double dip ransomware attacks, why segmentation matters, hardening your infrastructure and a quick perspective on the importance of Biden’s National Cyber Strategy.
Christine Carberry Named a 2022 Cyber Defender Award Winner
/by Jane Paolucci, CMOMeriTalk | May 10, 2022
Congratulations to Christine Carberry from RedSeal for winning a MeriTalk Cyber Defenders Award! This award recognizes leaders who are bringing unique approaches and driving cyber innovation across the Federal IT landscape. Join us in celebrating her at MeriTalk’s Cyber Central and Cyber Smoke events on May 19.
Simplifying and Securing Hybrid Clouds
/by Jane Paolucci, CMOGovLoop | October 26, 2021
President Joe Biden’s executive order (EO) on cybersecurity suggests the cloud will play a pivotal role in the federal government’s future; it urges agencies to maximize the technology’s flexibility and scalability rapidly and securely.
But what can happen if agencies embrace the cloud too rapidly? The answer is haphazard and insecure IT environments. These environments often occur when agencies combine on-premises and cloud-based IT in a hybrid model.
Finding the Right Approach to Cloud Security Posture Management (CSPM)
/by Jane Paolucci, CMODark Reading | October 29, 2021
New strategies are surfacing to respond to new problems. Dr. Mike Lloyd, RedSeal’s CTO, reviews one of the latest: CSPM.
Cloud security is maturing — it has to. We’ve had too many face-palm-worthy incidents of organizations hearing “hey, I found your data in a world readable S3 bucket” or finding a supposedly “test” server exposed that had production data in it. Happily, we are emerging out of the Wild West phase, and some order and maturity is emerging, and along with it, new lingo.
How to Mitigate Security Risks in the the Cloud
/by RedSealCloudTweaks | August 3, 2021
Enterprises continue to spend billions annually on security technology, yet cyber breaches continue to come fast and furious. So what exactly is going on here? Why are the odds stacked against the good guys?
It turns out there are some pretty good reasons why security remains so elusive. Many organizations simply don’t have the staffing resources to do battle with a heavily automated enemy.
Behind the Firewall: 5 security leaders share incident response plans
/by RedSealCybersecurity Dive | July 30, 2021
First, it’s good you have a plan to begin with. But have you tested it?
That is, have you gathered all your stakeholders, from the C-suite to the trenches, and run through your plan? And testing it once is not good enough. Your teams and networks are constantly changing, so your plan should evolve as well with time.
When an incident occurs, that is not the time to find out if your plan works. Testing turns up simple things, like having the ability to use outside communication mechanisms. If your system gets locked down by ransomware there is a good chance your address book in Outlook will be inaccessible.
Part of testing is also getting to know your network by modeling it and examining how it’s all connected. Having a continuously updated model of your network greatly speeds up your response time.
DOD’s Forecast Post-JEDI: Multi-Cloud with a Chance of Peril
/by RedSealNexGov | July 20, 2021
The Pentagon’s abandonment of the Joint Enterprise Defense Infrastructure, or JEDI, contract was an anticlimactic demise for the once visionary single-cloud network.
…the protracted legal battle pushed JEDI past viability. While the cloud titans fought for their slice of the pie, other actors within the federal government, most significantly the intelligence community, transitioned to a multi-cloud network. As a result, the decision to retire JEDI is best seen as an inevitable step toward DOD’s multi-vendor destiny.
Dr. Mike Lloyd Named a Gold Globee Chief Technology Officer of the Year
/by RedSealIT World Awards | June 15, 2021
RedSeal’s Chief Technology Officer Dr. Mike Lloyd was named a Gold Globee winner for Chief Technology Officer of the Year, Security Hybrid in the 16th Annual 2021 IT World Awards honoring achievements and recognitions in the information technology and cyber security industries worldwide.
More than 65 judges from around the world representing a wide spectrum of industry experts participated in the judging process. The IT World Awards are open to all Information Technology and Cyber Security organizations from all over the world and their end-users of products and services.