The Missing Piece
Vulnerability management teams have more visibility than ever and less time to act on what they see. They know exactly what to fix. What they don’t have is a way to fix it faster: triage, remediation, and validation still run at human speed.
The gap blew open during April 2026, when a new generation of frontier models, led by Mythos and GPT-5.5-Cyber, broke the attacker-defender equation.
Attacker effort has collapsed to nearly zero: exploits arrive faster. Meanwhile, defenders’ mean time to remediate hasn’t moved, and the number of actively exploited vulnerabilities in their environments is higher than ever. Pairing generic risk models with agentic remediation, as many solutions now do, only automates the waste: time and resources go to false positives right when teams can least afford it.
One thing didn’t change: Reachability. AI models move fast, but network infrastructure doesn’t.
The Reachability Core
Over the last year and a half, we built Astelia on two foundations. The first: a data layer and model that maps the network topology for enterprise infrastructures, at scale. The second: an agentic exposure layer that analyzes exploit prerequisites and complexity in an era when frontier models work to the attacker’s advantage.
Together, these foundations make Astelia the only exposure management platform that specializes in reachability: top-down network analysis that traces the full attack path, down to the individual port running on each asset. That analysis is as accurate as ever, and our customers still rely on it to focus on the small fraction of vulnerabilities that are actually reachable in their environment. What's changed over the past few months is the work that comes after prioritization, which keeps growing as vulnerabilities and active exploits climb in both volume and speed.
Closing the Gap
That’s the gap we set out to close. Relieving our customers’ operational overload requires two new capabilities.
The first is the new Astelia agents, for multi-step agentic workflows that carry a vulnerability from triage through remediation to validation, customized to each organization’s enterprise processes. The second is Astelia MCP, built for organizations that already run their own AI assistants and need to ground them in real reachability and exploitability analysis.
In this blog, we’ll mostly focus on the Astelia agents. Astelia MCP, which exposes every Astelia data point, deserves a post of its own.
Building Agents for Enterprise
Getting agents to run inside an enterprise takes more than wiring a model to a set of tools. A workflow that touches production infrastructure has to be planned, scoped, audited, and tested like any other enterprise system. That principle shaped every layer of what we built:
- From plain English to a running workflow: Write your workflow spec in natural language, and the planner agent translates it into a step-by-step workflow, suggesting the MCP tools, skills, and permissions needed to make it operational.
- Full context of your environment: More than 100 MCP integrations connect Astelia to your enterprise tech stack, so workflows act on your real ticketing, patching, firewall, and asset data rather than a partial picture.
- Agents execute, humans decide: Every workflow runs on infrastructure built for full human control and auditing, both during execution and after it. Fine-grained tool scopes and human-in-the-loop checkpoints are our north star for every agentic capability we design.
- Continuous testing and validation: A wide testing infrastructure continuously validates every workflow to catch failures, including silent ones: workflows that still complete successfully but whose results have drifted.
- Agents that fit your processes: From day one, our agent infrastructure was designed for customization. Create new agents from scratch, or take any template from the marketplace and adjust it to fit your enterprise’s processes.
- Agents and skills marketplace: Browse ready-made agents and skills built on the same infrastructure. Deploy them as-is, or use them as the starting point for your own tailored workflows.
See the Astelia agents in action below:
From Advisory to Remediation
Take a process every vulnerability team knows by heart. A critical advisory drops for an edge appliance on a Thursday night, and the same questions start again: are we running it, is it reachable, is it actually exploitable in our topology, and who owns the fix?
In Astelia, that entire process is one workflow. You describe it to the Planner agent in plain language: “When a new critical advisory is published, find every affected asset, check whether it’s reachable, open a ticket for the asset owner, and propose an interim network mitigation until the patch lands.” The Planner translates that into a step-by-step workflow and suggests what it needs to run: the advisory feed, Astelia’s reachability analysis, your ticketing and firewall management connectors, and the exact permissions each step requires. Nothing more.
The workflow then runs as a routine, triggered by every new advisory rather than by someone remembering to check. When it finds a reachable instance, it doesn’t act alone. The drafted ticket and the proposed firewall rule wait in the approval queue for a human click, every step lands in the execution log, and every decision in the audit log.
Remediation doesn’t stop at “a ticket was opened.” Where a patch exists, the workflow drives it through your patch management solution. Where it doesn’t, or can’t be applied yet, Astelia proposes network mitigations, firewall and IPS rules placed at the right choke point, derived from the same topology map.
That’s the blueprint. Here’s what it looks like when a real enterprise team runs on it.
Agents in Production
The blueprint above isn't just a concept. Below is the same pattern running end to end in a real enterprise environment. A team that used to walk every finding through triage, a change request, a patch job, and a follow-up scan by hand now runs one workflow across the entire path, with a single approval click as their only manual step.
What’s Next
This infrastructure is just the starting point. We’re expanding our MCP integrations, adding code steps inside agent flows for durable, deterministic execution, with retry policies and observability to keep workflow success rates climbing, and building out agent orchestration and triggering, customized dashboards, and an enterprise knowledge base.
Schedule a demo to learn more about how these new capabilities can protect your vulnerability program.
