ASM vendor announcements in 2026, grouped by theme

What does this recap cover?

It groups the dated items on our news page by theme, from FIRST's February 2026 CVE forecast to watchTowr's 23 September announcement. Each item is summarized from the vendor's or organization's own release, and the sources are listed at the end. We found no dated 2026 announcements about Hadrian, Cortex Xpanse or Microsoft Defender EASM on the pages we checked, so they do not appear here.

Why did vendors focus on speed?

Because of volume. On 11 February 2026 FIRST forecast a median of about 59,427 CVEs for the year, with a 90% confidence interval of 30,012 to 117,673. On 15 June it raised the forecast to about 66,000. More CVEs means more version matches on internet-facing assets, and the useful question becomes how quickly a tool can say which matches are exploitable on your estate.

Who announced faster proof of exploitability?

• 19 March, Rapid7: runtime validation and data security posture management for Exposure Command, aimed at showing which cloud vulnerabilities are exploitable and which sensitive data they expose.
• 31 May, IONIX: Live Exposure Defense, which IONIX says correlates each newly published CVE with a customer's internet-facing assets, confirms exploitability through safe active testing and delivers a mitigation workflow within 12 hours.
• 16 June, CyCognito: Continuous AI Pentesting, which runs AI-driven offensive testing continuously across the external attack surface through its Target Graph architecture.
• 24 July, watchTowr: Project Red, an AI-based capability that reproduces emerging vulnerabilities to validate client exposure. watchTowr says it reproduced CVE-2026-63030 in 22 minutes.

The four approaches differ. Rapid7's announcement concerns cloud exposure inside Exposure Command; IONIX pairs validation with a mitigation workflow; CyCognito and watchTowr describe continuous, AI-driven offensive testing. All four are claims from the vendors' own releases.

What changed on the mitigation side?

• 31 July, IONIX: joined the Akamai Technology Partner Program, pairing its external discovery and exploitability validation with Akamai's edge web application protection.
• 17 August, IONIX: WAF Posture Management, described as continuous, evidence-based WAF validation that finds unprotected assets, checks enforcement status and detects configuration drift across WAF deployments.

Both address the same gap: a virtual patch only helps if the asset sits behind a WAF that is enforcing rules. Our note on virtual patching explains why that gap is common in large groups.

What did vendors announce about AI?

• 4 August, Tenable: extended exposure management coverage to Google Gemini alongside Claude, ChatGPT Enterprise and Copilot, and to Model Context Protocol deployments and AI-native developer tools.
• 8 September, Tenable: said it is integrating Anthropic's Claude Mythos 5 into the Tenable One Exposure Management Platform, starting with Tenable One Adversary View for finding attack paths and remediation options.

What did Censys announce?

• 8 July: added real-time DNS visibility to its Internet Map, bringing domains, DNS records, IPs, hosts, services and certificates into one view.
• 22 July: reported 400% year-over-year growth in customers above $1 million in annual recurring revenue, 115% growth in Censys Platform customers, and expansion into the Middle East and Japan.
• 22 September: announced a unified partner framework for distributors and resellers, early roadmap access and a Partner Summit, and said partner-sourced bookings grew 186% year over year in the first half of 2026.

The growth figures are Censys's own and we have not verified them.

Were there analyst mentions?

On 23 September watchTowr stated that it is named a Sample Vendor for Preemptive Exposure Management in Gartner's 2026 Emerging Tech Impact Radar: Preemptive Cybersecurity report. Preemptive Exposure Management is watchTowr's own name for its category. We report analyst recognition only where a vendor's page states it, and we do not score it.

Does any of this change our scores?

Not in this edition. Scores reflect vendor documentation reviewed in September 2026, and a capability announced in a press release is scored once it appears in product documentation. The next scheduled review is December 2026. See how we score.