SECURITYWEEK contributor Nadir Izrael argues that security teams should use agentic AI to automate the final stage of continuous threat exposure management (CTEM): mobilisation, where validated findings are turned into fixes. Discovery, prioritisation and validation are increasingly automated, but remediation often still depends on tickets moving between teams, change windows and manual approvals. This leaves the exposure-management process open and can allow vulnerabilities to remain unresolved.
The proposed approach, described as “agentic remediation”, is to let software apply known fixes to known assets rather than make independent judgements about unfamiliar risks. Organisations could use a “human in the loop” model for higher-risk findings, requiring approval before action, and a “human on the loop” model for lower-risk work, allowing agents to act within defined limits while people supervise through dashboards and alerts. Izrael recommends using existing exposure rankings to determine which model applies, rather than relying solely on CVSS severity.
The article says autonomous agents should be restricted to an approved set of actions, such as applying specific patches, changing defined configuration settings or isolating a network segment. Anything outside that scope should generate a ticket. Each action should have a rollback plan, approval routes should be standardised, and tabletop exercises should test failures such as an agent patching the wrong host at the wrong time. These controls, the article argues, could help organisations close CTEM’s operational loop and eventually support more autonomous, self-healing networks.