Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Let’s get this out of the way: the term vulnerability management has always been misleading. It evokes the idea that we’re wrangling a tidy list of software flaws, checking boxes, patching holes, and keeping things humming. But anyone who’s worked in the trenches or tried to explain this chaos to an executive board knows the truth. What we call “vulnerability management” isn’t a single discipline, or even a well-contained function.

Today, we’re excited to announce a preview of the Model Context Protocol (MCP) Server for Nucleus. This marks an important step towards AI-native workflows for vulnerability and exposure management. Model Context Protocol (MCP) is an emerging industry standard enabling seamless integration between enterprise applications and AI models. Backed by leading organizations like OpenAI, Microsoft, and Google, MCP servers are quickly becoming the foundation for AI-enablement across the enterprise.

In our first article exploring vulnerability management vs. exposure management, we explored the growing recognition that exposure management is not just a rebranding of vulnerability management. Rather, it’s a strategic evolution. Where traditional vulnerability management often focuses narrowly on CVEs and technical severity, exposure management demands a broader, more integrated understanding of risk across assets, environments, and attack vectors.

Vulnerability management has hit a wall. Exposure management is how forward-looking teams break through it. According to Gartner, by 2026, organizations that adopt a continuous exposure management approach to guide security investments will be three times less likely to experience a breach. a more advanced and iterative approach to vulnerability management. Despite growing interest, confusion remains around what exposure management is and how it differs from vulnerability management.

I hear a lot these days about SBOMs and how they are going to be the key to supply chain security accountability, to even include a Presidential Executive Order mandating SBOMs in the procurement process for federal agencies. There are multiple areas of research going on in this area, such as this Academic SBOM Repository. But before we get too far down the road, let’s get one thing straight: SBOM isn’t going to save us. It’s a transparency tool, not a solution.

For years, vulnerability scanners have been the cornerstone of enterprise security programs. But as organizations scaled, and as infrastructure, applications, and attack surfaces diversified, the single-scanner model broke down. Security teams now face a fragmented reality. Data pours in from dozens of sources: endpoint detection tools, cloud security platforms, application security testing, and more. Each of these systems generates findings with its own schema, priorities, and assumptions. The result?

The biggest cybersecurity bottleneck for today’s enterprises isn’t detection. It’s remediation. Organizations are flooded with vulnerability data, but that flood rarely translates into effective action. Instead, security teams spend their time wrangling data, chasing tickets, and firefighting the same risks week after week. The outcome? Wasted effort, missed SLAs, and real business risk.

Application security has evolved far beyond traditional vulnerability management (VM). Today, security teams face massive scale, increasing complexity, and a constant flow of vulnerability findings that often vanish in hybrid and cloud-native environments. We’ve moved from managing a single virtual machine to dealing with an unlimited number of containers and ECS tasks, many of which only exist for about 15 minutes.

Vulnerability management is no longer about simply cataloging risks. It’s about reducing them intelligently, at scale, and in alignment with how your business operates. At Nucleus, we believe in building a platform that doesn’t just surface issues, but solves them. With our latest release, we’re doubling down on that vision.

RSA Conference 2025 in San Francisco was a breath of fresh air, literally and figuratively. The city felt more vibrant and welcoming, and the conference buzzed with genuine excitement. Unlike previous years, which were dominated by hype and theoretical discussions, this year’s focus was on tangible (not yet game-changing!) AI applications in cybersecurity. AI extended throughout the conference, from the keynotes through the track sessions and into the exhibition hall.