Forward Digital Twin in Action Demo

Renata Budko and Brandon Heller of Forward demonstrated Forward Threat Exposure, a preview application that uses the company’s network digital twin to prioritize vulnerable servers by actual reachability. The session showed exposure analysis from multiple entry points, hop-by-hop attack paths, AI-recommended mitigations, and transitive exposure detection, then made the case for moving exposure management from testing to verification. Budko, Forward’s director of product management for security and cloud, led the demo at Security Field Day 16 before Heller closed the session.

Budko configured an analysis against a network snapshot, adding exposure points beyond the internet, including partner networks, guest Wi-Fi, and WAN links, each weighted by risk. The platform works inside out from selected critical servers and scores each one by combining exposure, vulnerability data from Tenable, and asset criticality. Each result shows the full path through firewalls, and Forward’s AI agent recommended mitigations at the identified choke point, such as verifying NAT rules and changing a specific firewall policy. Transitive analysis surfaced neglected vulnerable hosts sharing a VLAN with critical assets. In a comparison, an attack surface management tool flagged an IP that Tenable couldn’t find because it was a virtual IP, which Forward traced to the server behind it. Budko noted the platform imports server vulnerability data from partners but detects network device vulnerabilities itself, and handles identity-based firewall rules and SASE but not OS-level identity.

Heller argued that security teams need verification, proof of zero unwanted paths, rather than testing a few sample paths, citing the Pentium division bug and the Ariane 5 failure as the events that pushed hardware and software toward formal verification. He said AI-equipped attackers that chain exploits at model speed make transitive paths critical and 43-day remediation windows untenable. He recounted a bank breach in which removing a decommissioned server’s route left a default route that created a network wormhole, letting attackers reach a transaction ledger. Pairing Threat Exposure with Forward Predict, he said, creates a guardrail that checks every network change for new exposures before deployment, with the application arriving next month.