Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI is everywhere in vulnerability management right now. Technology vendors in all areas are adding new features and making bold claims about revolutionary capabilities. But here's the reality, especially for vulnerability and exposure management: more AI doesn't automatically mean less risk. The gap between AI's promise and its practical impact in enterprise vulnerability management is wider than most organizations realize.

Gartner released its 2025 Magic Quadrant for Exposure Assessment Platforms in November 2025. The new categorization detailed in the report is something we view as a natural progression in response to the way enterprise risk has evolved over the years. It’s a move away from viewing vulnerabilities in a vacuum and looking at a more complete picture of the risk today’s enterprises face.

During a recent video interview, we spent time unpacking a deceptively simple question: what actually makes a vulnerability critical? Severity scores, exploitability, and asset importance all factor into the answer. But one layer of context consistently changes the urgency of a finding more than most teams expect: internet exposure. The difference between a vulnerability that exists and one that matters often comes down to whether an attacker can reach it.

CISA recently published BOD 26-02, the latest Binding Operational Directive shaping how federal agencies manage cyber risk. While attention often gravitates toward highly visible directives like KEV, this one matters for a different reason: it raises the standard for how lifecycle risk must be tracked and sustained over time. BOD 26-02 is described as guidance on unsupported edge devices, which is accurate but incomplete.

Today, we announced our Series C funding. I want to start by saying thank you to Delta-v Capital and Arthur Ventures for their partnership and conviction in what we’re building. We’re grateful for their support and for the trust they’ve placed in our team. They didn’t invest because Nucleus tells a good story.

When vulnerability remediation succeeds at enterprise scale, it’s very rarely because the vulnerability management team is finding more vulnerabilities. It’s because the program was built around the idea of turning messy findings into steady, measurable risk reduction. That’s not an easy task. It’s easier to make it a numbers game, pointing to vulnerability volumes and how many findings were addressed, rather than accurately depicting how much real risk was eliminated.

Most large organizations rely on multiple vulnerability and exposure scanning tools out of necessity. Infrastructure scanners, cloud security platforms, application security testing tools, container scanners, and attack surface management solutions all play a role. Each one is designed to answer a specific question. But when it comes to understanding the risk of the vulnerabilities and exposures they detect, each tool has its own approach to quantifying it.

For years, the cybersecurity industry has told itself that vulnerability management has been improving. This story is centered around “more”: more scanners, more data, more dashboards. Despite this abundance, by 2025 the gap between activity and outcomes became impossible to ignore. Security teams were doing more work than ever but struggled to show that risk was actually going down.

Cybersecurity in 2026 will be driven by economics. Not hype. Not novelty. Economics. Attackers follow financial incentives and scale their operations faster than most enterprises can defend. CISOs must shift from reporting technical metrics to explaining business impact, guide safe AI adoption as Shadow AI grows, and design programs that emphasize resilience over perfection.

When Kenna launched more than a decade ago, it reshaped an industry that had grown numb to vulnerability overload. Back then, vulnerability management meant looking at mountains of CSV files, scanner reports, and a never-ending backlog of unprioritized issues. Kenna introduced the idea that risk instead of raw counts should determine what gets fixed first. For many security teams, it was the first time they realized they didn’t have a vulnerability problem.