Forward Verified Exposure Management

Brandon Heller and Renata Budko of Forward previewed a new approach to exposure management built on the company’s network digital twin. The session examined how AI-driven vulnerability discovery is outpacing remediation, why existing exposure assessment tools leave gaps, and how a complete, verified, and preemptive model of on-premises and cloud connectivity can reveal which exposures are actually reachable. Heller, a Forward co-founder, led the presentation at Security Field Day 16 and set the stage for a live demo from Budko.

Heller opened with data showing disclosed vulnerabilities rising roughly tenfold in a few months as frontier AI models got better at finding software flaws. He cited the Verizon Data Breach Investigations Report, where vulnerabilities became the leading breach vector for the first time, rising from 20% to 31%, while remediation rates fell from 38% to 26% and time to remediate grew to 43 days. He distinguished a vulnerability from an exposure, which requires an ingress point, a transit path, an accessible flaw, and something worth protecting. After surveying scanners, agents, attack surface management, CNAPP, attack simulation, network security posture management, and aggregation platforms, he argued none of them sees the full environment. Forward’s twin collects configuration and state from cloud constructs, routers, switches, firewalls, load balancers, and SD-WAN, then reasons about all possible traffic across networks of up to 100,000 devices.

Heller framed the approach around three keywords: complete, verified, and preemptive. Completeness catches multi-hop and hybrid paths other tools miss, verification eliminates false positives and supplies the context teams need to act, such as tracing a public IP through NAT and load balancers to the internal servers behind it, and prevention comes from Forward Predict, which became generally available in September and tests changes before deployment. He stressed that exposure assessment must be deterministic, producing the same answer every time rather than a probabilistic guess. Budko added that confidentiality-sensitive customers run the platform on premises, while others use the SaaS version on AWS. The features shown will ship in Forward 26.11 later this month, with more inputs, outputs, and customization arriving in Q1 and beyond.