The emergence of such tools has created a sense of crisis across the industry, with vulnerabilities rapidly increasing. "Everyone knows how to do code security now. If you want to find it, you can find it," Zanger said. He predicts that over the next year or two, there will be an "explosion" in vulnerability disclosures from all vendors. "If you use generated AI to scan code, you can find any number of vulnerabilities. However, there will come a time when it will not be possible to respond to all of them. The traditional response of patching all vulnerabilities will no longer be viable in the future," Zanger says.
When discussing this shift, Zanger repeatedly cites Gartner's concept of CTEM (Continuous Threat Exposure Management). Responding to threats involves five stages: scoping (identifying the target area), discovery (discovering assets and vulnerabilities), prioritization, verification, and mobilization (executing the response), and Zanger particularly emphasizes the importance of ``prioritization.''
"The important thing is not to eliminate all vulnerabilities found, but to respond to those that have a high risk of being actually exploited," Zanger explains. If you know that an attacker is coming from a specific country or a specific IP address, you can stop that route. Some of these can be prevented with "WAF" (Web Application Firewall), which monitors and blocks communication to web applications, and "IPS" (Intrusion Prevention System), which detects and prevents unauthorized communication patterns on the network. The idea that "we have to patch" is just one option.
What is exposure management?
In response to this shift, Check Point has invested in Exposure Management. It continuously identifies assets and vulnerabilities that could be exposed to attackers, and supports everything from prioritizing them to implementing countermeasures.
According to Check Point's Yochai Corem, who leads exposure management efforts as general manager, the platform is comprised of three elements: 1. Threat intelligence (understanding attacker trends), 2. Prioritization (assessment of impact on business and configuration deficiencies), and 3. Remediation (actual implementation of countermeasures), and the platform covers all five stages of CTEM.
The engine that plays a central role in this Exposure Management is "Agentic Exposure Validation" (AEV), which was announced in June 2026. An AI agent that reasons from an attacker's perspective correlates asset information and threat intelligence and determines based on evidence whether a vulnerability can actually be exploited. AEV mainly covers scoping, discovery, and prioritization of the five stages of CTEM. "What's unique about our platform (Exposure Management) is that we can cover everything from there, including verification and repair," said Colem. It is said that it can automatically link to actual actions such as patch application, dynamic patching, and rotation of authentication information.
Zanger breaks down the technology supporting AEVs into four elements. These are a basic model that makes human-like inferences, a knowledge graph that stores related information, a set of tools that the model operates on, and a "harness" that ties them all together (a control mechanism that gives tools and instructions to the AI agent to make it move). "The harness part in particular is our 'secret sauce,'" Zanger said. ``By instructing the model which attack methods to prioritize and imitate, and running an agent that constantly monitors security in parallel, we maintain a balance between the attacker side and the security management side,'' he explained.
Check Point's AEV is a system in which five agents work together. There are five components: an ``intelligence orchestrator'' that grasps the overall situation and organizes the context, a ``clustering agent'' that groups discovered assets, an ``asset agent'' that learns vulnerabilities for individual assets, creates attack code, and even reverse engineers patches, a ``safety agent'' that verifies that there will be no actual damage such as service outage or data destruction in the event of an attack, and a ``validator agent'' that determines false positives and over-positives.
"If you use AI as an attacking agent, you may over-identify something as a risk when it's not, which is why you need a validator agent," Colem explains.
Check Point's differentiation is an approach from an external perspective
Colem also provided an example of how the three elements that make up Exposure Management - threat intelligence, prioritization, and remediation - work in practice.
First, here's an example of threat intelligence. At a major European energy company, a phishing site and spoof advertising campaign was observed that masqueraded as the company's brand. The attackers used Meta ads to target investors in France and Italy over the age of 30, directing them to fake investment deals that promised returns of "more than 1,000 euros per month." Due to its sophisticated and geographically focused techniques, it was not detected by typical threat intelligence companies with detection sensors located in the United States and the United Kingdom. Check Point detected this campaign and took down the advertising and phishing site within hours. According to the company, the takedown rate for phishing sites is over 99%, and the average response time is 12 hours.
Additionally, a major airline was found to have a fake boarding pass issuing app imitating its own brand. Check Point began responding three minutes after receiving the alert, and within 24 hours determined through reverse engineering that there was no leakage of source code or internal fraud. They also discovered the source code for the app generation algorithm that had been published on GitHub, and even took steps to remove it from the mobile app store.
All of these are examples of the power of "threat intelligence" to understand the movements of attackers.
On the other hand, there are also cases where AEV itself has verified the exploitability of vulnerabilities and taken measures. AEV detected a vulnerability in a corporate application (CVSS score 9.6, known exploits). We automatically created and deployed defense rules to the target WAF (in this case, Cloudflare), and after confirming that there were no false positives, moved to block mode. It takes just one hour from detection.
There are also numbers that show not only the ability to respond to individual attacks, but also the results of the company as a whole. Exposure Management checks whether the security products a company already owns (firewalls, WAFs, endpoint products, etc.) are correctly configured and enabled to the point where they can actually block threats, and gradually corrects them from monitoring mode to blocking mode. The ``security hardening effect'' is an index that shows ``how much protection can be achieved with existing investments alone.''
One company integrated security products from multiple vendors, including Check Point, F5 (WAF), and Cisco. As a result, the hardening effect reached 95% and the average response time was reduced to just 1.7 hours. During this period, IPS blocked 13 million attacks, WAF blocked 10,000 attacks, and implemented over 200 remedial actions.
At another company, the hardening effect was 30% at the start of implementation, but it increased to 83.8% after one month. The average response time was 2.3 hours, and 2,000 corrective actions were taken.
Exposure management is attracting attention with AI agents, but vendors other than Check Point also have solutions.
According to Zanger, the company's strength lies in its approach from an "external (attacker's) perspective" centered on threat intelligence. This is supported by the acquisition of two companies: Cyberint (October 2024) and Veriti (agreed in May 2025). These efforts have strengthened both external threat intelligence and exposure management.
"Existing vulnerability management vendors (such as Qualys, Tenable, and Rapid7) take an approach that starts with internal scanning. We don't have an internal scanning mechanism and are in a position to provide them with an external view of the information," Zanger explained.
It's Linux, so security doesn't apply.
So while AI has brought about the need to change approaches to vulnerability management, Zanger is concerned about the industry-wide conversation. Currently, discussions about vulnerabilities tend to focus on areas such as operating systems, middleware, and browsers from major vendors such as Microsoft, Oracle, and SAP. However, he points out that open source frameworks and homegrown applications could have a big impact going forward.
"There are many examples of major vulnerabilities found in open source frameworks like Log4j and Struts in the past. The same goes for software packages for e-commerce sites. Many enterprise companies develop Java applications in-house, and SaaS vendors also use similar technologies. This is an area that everyone should be aware of, but we don't hear much discussion about it," Zanger said.
Zanger also touches on the reality that AI is improving the development capabilities of attackers. Check Point Research announced in late 2025 that a single developer had ported 80,000 lines of code to a well-known open source penetration tool for Windows in one week and modified it to work in a Linux environment. There is also a project to port the same tool to run on Amazon Web Services (AWS) as a benchmark, and there is a movement to reproduce functionality even in different OS environments. "In the past, there were assumptions such as ``It's safe because it's Linux,'' or ``It's safe because it's Apple or iOS.''However, with AI, those assumptions no longer hold true.''
"The attacker, who until now could only operate within the scope of his own knowledge, now has an 'other partner' in the form of AI," Zanger said, adding, "It's frightening."
In light of these changes, Zanger advises: First, reevaluate your business priorities. Pay close attention to announcements from vendors. Then, incorporate zero-day protection into endpoints and increase the priority of updates. "These preparations are definitely going to be needed over the next two to three years," Zanger said.
