Finding exposed assets is no longer the hard part of security. Acting on them fast enough is. Criminal IP, the threat intelligence platform from AI SPERA, has introduced AITEM (AI-Powered Threat Exposure Management), which it presents as the next step beyond traditional Attack Surface Management (ASM). It also arrives as agentic AI reshapes how security teams work.
Here is what AITEM claims to do, how its four stages work, and what to ask before relying on any tool like it.
Why Traditional ASM Is Not Enough
Attack Surface Management tools help organizations find internet-facing assets such as servers, domains, IP addresses, and admin panels before attackers do. Discovery alone leaves a gap, though. Many teams now see more than ever but struggle to prioritize and act on what they find.
The pressure is growing because AI lowers the barrier for attackers. Automated scanning, published proof-of-concept exploit code, and AI-assisted vulnerability discovery let threat actors find and target exposed assets faster. According to AI SPERA CEO Byungtak Kang, the challenge is no longer just visibility but speed of response.
What AITEM Covers
AITEM widens the scope beyond an external asset inventory. Backed by Criminal IP's threat intelligence, it brings these sources together:
- External assets and internal infrastructure
- Open-source intelligence (OSINT) and dark web data
- Shadow AI and leaked data
- Emerging vulnerabilities
The stated aim is to link fragmented findings with enough context to investigate, prioritize, and respond, instead of stopping at discovery and generic risk scores.
The Four-Stage Exposure Lifecycle
| Stage | What It Is Meant to Do |
|---|---|
| Detect | Match emerging threats and vulnerabilities to the products, services, and assets that actually exist in your environment |
| Investigate | Let analysts query assets, exposures, and findings in natural language, with relevant context in one place |
| Prioritize | Rank exposure using your own risk criteria plus real-world exploitability and attacker activity, not only generic vendor scores |
| Automate | Turn prioritized findings into alerts, tickets, and workflow actions routed to the right teams |
Threat Intelligence as the Foundation
Criminal IP says AITEM adds real-world context beyond vulnerability data. Open ports, exposed services, connected infrastructure, abuse history, scanner activity, threat attribution, and malicious infrastructure are combined to show not just what is exposed, but what is happening around it and why it matters.
GovWare 2026 Appearance
Criminal IP is taking part in GovWare 2026 in Singapore. Kang will present "From Visibility to Threat Hunting: A Case Study of AI-Driven Attack Surface Management," using real-world examples to show how threat intelligence and attack surface visibility can support faster investigation. The company ties AITEM to wider industry themes from RSAC 2026, including agentic AI, AI SOC, and Shadow AI.
Who Benefits and What to Ask a Vendor
Security operations teams, SOC analysts, and organizations with large or fast-changing internet footprints are the natural audience, especially those drowning in findings without a clear priority order. Before adopting any exposure management platform, ask:
- How is exploitability measured? Ask what data backs "real-world exploitability" and how fresh it is.
- Can you set your own risk criteria? Confirm prioritization reflects your business, not just a default score.
- What does automation touch? Check which ticketing and workflow systems it integrates with, and whether actions need human approval.
- How are AI answers verified? Natural-language investigation should show its evidence so analysts can check it.
- Where does your data go? Review how internal infrastructure data is handled and stored.
Why This Matters
The competitive question in attack surface management is shifting from who finds the most assets to who responds fastest. Kang argues AI should take over repetitive analysis while humans focus on judgment, accountability, and prioritization. That division of labor is sensible, but it only works if the AI's context is accurate. Shadow AI being tracked as an exposure category also reflects a real change: unsanctioned AI tools are now part of the attack surface. For related reading on AI tooling and costs, see our guide to reducing AI agent costs.
Official source: Criminal IP by AI SPERA.
Frequently Asked Questions (FAQ)
What is AITEM?
AITEM stands for AI-Powered Threat Exposure Management. It is Criminal IP's approach to extending attack surface management into investigation, prioritization, and response.
How is it different from traditional ASM?
Traditional ASM focuses on discovering external assets. AITEM adds internal infrastructure, OSINT, dark web data, Shadow AI, and leaked data, plus AI-assisted investigation and automated workflows.
What are the four stages of AITEM?
Detect, Investigate, Prioritize, and Automate.
What is Shadow AI?
It refers to AI tools and services used inside an organization without formal approval or oversight, which can create data exposure risks.
Where can I see AITEM in action?
Criminal IP is presenting at GovWare 2026 in Singapore, and the company invites interested teams to contact it through its website.
No comments:
Post a Comment