Exposure Management: The New Cyber Risk Strategy | Mark Thurmond, Tenable | RSAC 2025 Keynote

Mark Thurmond, co-CEO of Tenable, presents exposure management as a complete strategic mindset shift in cybersecurity—not merely a product, platform, or compliance checkbox. He dedicates the keynote to Amit Yoran, Tenable's former leader who championed these ideas and was originally scheduled to deliver this talk.

**The Problem**: Organizations face exponential growth in attack surfaces (cyber assets up 133% year-over-year) while managing 2,000+ assets per employee. Most enterprises deploy 83 security tools from 29 different vendors, requiring 6-8 specialized teams (SecOps, threat intel, cloud security, GRC, AppSec) working in silos. This fragmentation creates dangerous blind spots: 32% of critical vulnerabilities remain unpatched for 180+ days, yet 97% of cyber-attacks exploit known, unremedialized vulnerabilities. Reported vulnerabilities grow at 65% annually since 2016; 20% increase in exploited CVEs in the past year alone. Traditional dashboards and Excel-based workflows leave security teams drowning in data but starving for clarity and actionable insight.

**AI-Driven Threat Landscape**: Password attacks surged from 579 per second (2021) to 7,000+ per second (2024). Gartner reports 4 out of 5 senior risk executives identify AI-driven attacks as top business risk in 2024. Global cybercrime damages projected at $10.5 trillion in 2025, rising to $15.6 trillion by 2029. AI doesn't invent new vulnerabilities—it scales existing attack vectors (misconfigurations, unpatched systems, exposed credentials) at unprecedented speed and dramatically reduces attacker costs.

**Three Dimensions of Required Evolution**:

1. **Fragmented to Unified**: Replace siloed tool ecosystems with AI-powered unified visibility spanning cloud, OT, identity, code, and other attack surfaces. AI maps infrastructure faster than human teams; unified visibility is now baseline for survival.

2. **Static to Contextual & Predictive**: Move beyond severity scores and static reports. AI learns patterns, adapts in real-time, and connects data sources analysts would take weeks to uncover manually. It identifies toxic combinations (e.g., misconfigured cloud storage + overly permissioned identity) and uses threat intelligence to predict which exposures are most likely exploited. Predictive models simulate adversary movements, estimate time-to-compromise, and forecast attack paths. Organizations fully deploying security AI and automation reduced breach lifecycle from average of 322 days to 214 days—a 34% efficiency gain.

3. **Manual to Autonomous & Agentic**: A three-stage progression—first, automation with humans fully in the loop to eliminate friction in sharing prioritized guidance to right teams; second, autonomous workflows where AI orchestrates action, assigns duties, tracks ownership, and manages dependencies; third, agentic AI that proactively makes decisions, orchestrates responses, and executes remediation plans based on risk, context, and business priority. Agentic remediation answers four critical questions: What needs fixing? Who should fix it? What's the response process? When do humans get involved? It translates technical data into business language for leadership, enabling board-level understanding of impact and progress.

**Key Insight**: Security can't be the outlier slowing business innovation. Doubling cybersecurity budgets annually is unrealistic. AI-enabled exposure management must scale intelligently, moving organizations from a system-of-record (dashboards, PDFs, ticket queues) to a system-of-action that learns and improves autonomously.

**Call to Action**: Industry-wide integration across systems, openness between vendors, and collaboration between private and public sectors are essential. The threat landscape evolves at machine speed; defenses must evolve with the same velocity. Move forward with grit, ready to adapt, innovate, and collaborate.