Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In our recent webinar featuring Enterprise Strategy Group Principal Analyst, Tyler Shields, we discussed the widening gap between vulnerabilities organizations know about and what they can realistically fix. Most teams are swamped. Too much data, too many tools, and not enough people. Naturally, automation and AI come up as potential solutions. One comment from Tyler has stuck with me since watching and subsequently reviewing the webinar recording.

Let’s get this out of the way: the term vulnerability management has always been misleading. It evokes the idea that we’re wrangling a tidy list of software flaws, checking boxes, patching holes, and keeping things humming. But anyone who’s worked in the trenches or tried to explain this chaos to an executive board knows the truth. What we call “vulnerability management” isn’t a single discipline, or even a well-contained function.

Today, we’re excited to announce a preview of the Model Context Protocol (MCP) Server for Nucleus. This marks an important step towards AI-native workflows for vulnerability and exposure management. Model Context Protocol (MCP) is an emerging industry standard enabling seamless integration between enterprise applications and AI models. Backed by leading organizations like OpenAI, Microsoft, and Google, MCP servers are quickly becoming the foundation for AI-enablement across the enterprise.

In our first article exploring vulnerability management vs. exposure management, we explored the growing recognition that exposure management is not just a rebranding of vulnerability management. Rather, it’s a strategic evolution. Where traditional vulnerability management often focuses narrowly on CVEs and technical severity, exposure management demands a broader, more integrated understanding of risk across assets, environments, and attack vectors.

Vulnerability management has hit a wall. Exposure management is how forward-looking teams break through it. According to Gartner, by 2026, organizations that adopt a continuous exposure management approach to guide security investments will be three times less likely to experience a breach. a more advanced and iterative approach to vulnerability management. Despite growing interest, confusion remains around what exposure management is and how it differs from vulnerability management.

I hear a lot these days about SBOMs and how they are going to be the key to supply chain security accountability, to even include a Presidential Executive Order mandating SBOMs in the procurement process for federal agencies. There are multiple areas of research going on in this area, such as this Academic SBOM Repository. But before we get too far down the road, let’s get one thing straight: SBOM isn’t going to save us. It’s a transparency tool, not a solution.

For years, vulnerability scanners have been the cornerstone of enterprise security programs. But as organizations scaled, and as infrastructure, applications, and attack surfaces diversified, the single-scanner model broke down. Security teams now face a fragmented reality. Data pours in from dozens of sources: endpoint detection tools, cloud security platforms, application security testing, and more. Each of these systems generates findings with its own schema, priorities, and assumptions. The result?