Criminal IP Unveils AITEM as the Next Evolution of Attack Surface Management
Criminal IP by AI SPERA has introduced AITEM (AI-Powered Threat Exposure Management), a new platform designed to advance traditional Attack Surface Management (ASM) by moving beyond simple asset discovery to enable real-time investigation, prioritization, and response. The announcement was made ahead of the company's participation in GovWare 2026 in Singapore, where AI SPERA CEO Byungtak Kang will present a case study on AI-driven attack surface management.
According to Kang, traditional ASM tools have fulfilled their role in helping organizations discover internet-facing assets such as servers, domains, IP addresses, and admin panels before attackers do. However, he emphasized that discovery alone is no longer sufficient in today’s threat landscape.
"Seeing a threat and responding to it are completely different challenges," said Byungtak Kang, CEO of AI SPERA. "Building a safer cyber world requires a shift from visibility to action. Organizations today have more visibility than ever, but many still struggle to effectively prioritize and act on the risks it reveals."
Kang explained that by applying AI to filter noise, enrich context, and guide investigations, security teams can focus on the exposures that matter most and respond in real time, turning insight into meaningful action.
Why the Shift from Visibility to Action Is Critical
The gap between detection and action has widened due to the lowering barrier for attackers, driven by automated scanning, publicly available proof-of-concept exploit code, and AI-assisted vulnerability discovery. These developments allow threat actors to identify and target exposed assets faster than ever.
As a result, the defender’s challenge is no longer just achieving visibility — it is now about the speed of response. Organizations need tools that not only show what is exposed but also help them understand the context, prioritize risks, and initiate action swiftly.
AITEM: Expanding ASM into Threat Exposure Management
AITEM expands the scope of traditional ASM by moving beyond external asset inventory to include exposure across external assets, open-source intelligence (OSINT), dark web data, internal infrastructure, Shadow AI, leaked data, and emerging vulnerabilities. This broader approach is framed as threat exposure management.
Rather than stopping at discovery and applying generic risk scores, AITEM is designed to connect fragmented findings with the context security teams need to investigate, prioritize, and respond effectively.
AI-Powered Across the Exposure Lifecycle
AITEM applies artificial intelligence across four stages of exposure management:
- Detect: Connects emerging threats and vulnerabilities to the actual products, services, and assets within an organization’s environment.
- Investigate: Enables security teams to investigate assets, exposures, vulnerabilities, and security findings using natural language, while aggregating relevant context in a single interface.
- Prioritize: Evaluates exposure using organization-defined risk criteria combined with real-world exploitability and attacker activity, reducing reliance on generic vendor risk scores.
- Automate: Converts prioritized findings into alerts, tickets, and workflow actions that can be routed to the appropriate teams, accelerating the path from detection to response.
Threat Intelligence at the Core of AITEM
AITEM is built on Criminal IP’s threat intelligence, which adds real-world context to exposure management beyond vulnerability data alone. This includes information on open ports, exposed services, vulnerabilities, connected infrastructure, abuse history, scanner activity, threat attribution, and malicious infrastructure.
By integrating these data points, AITEM helps security teams understand not only what is exposed but also what is happening around that exposure and why it matters — enabling a shift from passive monitoring to active threat hunting.
From Visibility to Threat Hunting at GovWare 2026
At GovWare 2026, Byungtak Kang will deliver a presentation titled "From Visibility to Threat Hunting: A Case Study of AI-Driven Attack Surface Management." The session will draw from real-world examples to demonstrate how threat intelligence and attack surface visibility can support faster investigation and more effective security operations.
It will also examine the evolving shift from merely discovering exposure to understanding and acting on it — a transition Kang believes is essential for modern defense.
Reflecting a Broader Industry Shift
The direction Criminal IP is taking with AITEM aligns with a wider trend in the global security industry. At RSAC 2026, agentic AI, AI SOC, and Shadow AI emerged as major themes, with leading vendors increasingly moving away from siloed tools toward integrated, AI-driven security operations.
"The competition in ASM is no longer about who finds the most assets," said Kang. "It will be about who can operate faster, respond more effectively, and mobilize the organization. AI should handle the repetitive analytical work. Humans should focus on judgment, accountability, and prioritization."
About Criminal IP by AI SPERA
Criminal IP is a cyber threat intelligence solution operated by AI SPERA that delivers decision-ready threat intelligence and attack surface visibility to security teams worldwide. By continuously scanning the global internet, it aggregates and contextualizes threat signals across IPs, domains, URLs, and attack infrastructure, covering malicious indicators, known vulnerabilities, exposed assets, and attacker behavior.
The company’s mission is to provide organizations with real visibility into their cyber landscape and accelerate threat detection and response by supplying the intelligence needed to outsmart attackers. More information is available at www.criminalip.io.
This content was sponsored and written by Criminal IP.
Source: BleepingComputer