Brinqa cuts exposure data processing time from hours to minutes with redesigned data engine and launches AI Exploitability Agent as vulnerability volume hits record highs. Brinqa announced a redesigned data engine that cuts exposure data processing time from hours to minutes, so security teams can re-prioritize across their entire environment as fast as new vulnerabilities and exploits emerge. Brinqa also introduced an AI Exploitability Agent that reasons over that data to identify which exposures attackers could actually chain together, along with enhancements to BrinqaIQ. The announcements address a steep change in both the volume of exposures and the velocity of threats. Microsoft alone has disclosed roughly 2,700 CVEs through the first three quarters of 2026, more than double its largest full year on record, and exploitation timelines continue to compress from weeks to days. Security teams are collecting more findings, from more sources, faster than most programs can reconcile them, and a prioritization decision made on yesterday's data may already be wrong. Brinqa is raising the bar for the industry by enhancing its own solutions to address pressing security challenges. "AI is changing the math on both sides: Vendors are finding and disclosing vulnerabilities faster than ever, and attackers are turning patches into working exploits faster than most teams can deploy them, so a security team's view of its risk has to change as quickly as the threat does," said Dan Pagel, CEO at Brinqa. "We rebuilt our data engine so customers can re-evaluate their entire environment in minutes, at enterprise scale, whenever something material changes, which is what continuous prioritization actually requires." "You can't bolt AI onto fragmented, duplicated data and expect decisions you can act on," said Brad Hibbert, Chief Strategy Officer at Brinqa. "High-fidelity exposure data is the prerequisite for AI reasoning that holds up. It is what lets our Exploitability Agent accurately assess what an attacker could do, recommend the right action and drive measurable risk reduction. That is why we rebuilt the foundation first, and why our AI sits on top of it rather than beside it." Together with Brinqa's acquisition of PlexTrac in the third quarter, these updates give security teams the full continuous threat exposure management (CTEM) loop in one place. They can understand where to focus, decide what to do next and verify whether the fix worked. Re-evaluating enterprise exposure in minutes Brinqa redesigned its data engine to unify, deduplicate and enrich incoming exposure data for its CyberRisk Graph in minutes rather than hours, even as customers add more data sources. When new findings arrive, whether from a scanner run, a cloud change or a major Patch Tuesday, teams can re-evaluate risk across their entire environment on demand instead of waiting for the next scheduled processing cycle. In one production customer deployment, the engine processed roughly 150 million source records and 700 million relationships, more than 4 TB of data, in 17 minutes and 15 seconds. That run covered the full pipeline: integration, unification, deduplication, enrichment and lifecycle processing. Because full processing now takes minutes, the platform has room to go deeper on every run, with richer enrichment and more complete mapping of the relationships between assets, exposures and controls. That relationship mapping shows teams which exposures an attacker could reach and which to fix first, and it is the foundation the AI Exploitability Agent reasons over. Assessing exploitability and validating remediation The AI Exploitability Agent goes beyond severity scores to show which exposures an attacker could chain together. It models attack paths, mapping how individual vulnerabilities and misconfigurations connect into the sequence an attacker would follow, from initial access through lateral movement and privilege escalation to impact. It then assesses those paths against the network and security controls in the customer's environment to determine which are likely exploitable, and identifies choke points, the fixes that close multiple attack paths at once, so teams fix more efficiently and reduce more risk. Drawing on public and private threat intelligence, including exploit availability and ransomware activity, the agent produces an intelligence-driven risk score and visualizes the underlying attack paths in Brinqa's CyberRisk Graph. Teams can prioritize what is most likely reachable and dangerous, not just what is rated high severity, and every score includes an auditable explanation of how it was calculated, so teams can defend their priorities to auditors and stakeholders. Newly acquired PlexTrac functionality gives teams a way to confirm assessments. Offensive security teams use PlexTrac to document penetration testing and red team findings and to coordinate retesting after remediation. Those findings and retest records show whether a prioritized exposure could be exploited and whether the fix held, so teams can report risk reduction they have verified rather than assumed. Extending Bring Your Own AI through BrinqaIQ Once teams know where to focus, they need practical ways to work with the information in front of them. New enhancements to BrinqaIQ aid that effort, extending Brinqa's Bring Your Own AI (BYOAI) approach. By leveraging AI capabilities within BrinqaIQ, teams reduce their own AI spend while still using AI functionality to query their exposure data. Teams can query their exposure data and get answers, without the need to build out their own AI agents. With the latest enhancements, users ask for data in plain language, research CVEs and manage platform automations through BrinqaIQ Assistant and BrinqaIQ MCP. From there, they can describe the data they need, generate a Brinqa Query Language (BQL) query, look up vulnerability context, or launch, resume, cancel and check the status of flows and automations. Teams can save time by leveraging BrinqaIQ to automate workflows and enable faster responses by getting answers in plain language. BrinqaIQ can be used within the Brinqa platform or connected to a compatible client through Model Context Protocol (MCP). David Marshall is the founder of VMblog.com, one of the industry's longest-running independent publications covering modern data center technologies. What began as a focus on virtualization and cloud computing has expanded to cover the full spectrum of enterprise IT, including AI, security, and DevOps, making VMblog a trusted destination for vendor news, technology analysis, and industry commentary.Beyond publishing, David has spent his career at the intersection of technology and business, inventing, marketing, and launching a number of successful software companies and products, and building a reputation as a skilled marketing executive in the enterprise IT space.David is also a published author, having written two well-regarded books on virtualization and served as technical editor for two "For Dummies" titles covering virtualization and cloud computing. He co-founded CloudCow.com, a publication focused on cloud computing, and has been named a VMware vExpert every year since 2009, one of the longest continuous honoree streaks in the program's history.Connect with David on LinkedIn: https://www.linkedin.com/in/davidmarshall/

Brinqa acquires PlexTrac to expand Unified Exposure Management platform. August 19, 2026 Brinqa has acquired PlexTrac, adding offensive security validation, penetration testing workflows and remediation verification to its enterprise exposure management platform. Financial terms of the transaction were not disclosed. The combination expands Brinqa's ability to manage the cybersecurity exposure lifecycle from identifying and prioritizing vulnerabilities through remediation and post-remediation testing. The company said the acquisition creates the largest standalone vendor in Unified Exposure Management, with more than 3,000 customers across 57 countries, including more than 25% of the Fortune 500. PlexTrac specializes in offensive security validation, workflow management and reporting. Its technology gives Brinqa a way to verify whether identified vulnerabilities are exploitable before remediation and then retest those vulnerabilities after remediation to determine whether corrective measures were effective. That capability addresses an important part of Continuous Threat Exposure Management, or CTEM. While vulnerability and ticketing systems can indicate that remediation work has been completed, Brinqa is seeking to provide security teams with validation that the underlying exposure has actually been eliminated. "We've spent over a decade building the platform enterprise security teams trust to prioritize what to fix first," said Dan Pagel, CEO of Brinqa. "PlexTrac brings real offensive security depth, from practitioners who have spent years proving exactly how attackers get in." The acquisition builds on a period of growth for Brinqa. The company reported a 164% year-over-year increase in new bookings in 2025 and a 32% increase in average selling price for new customers. In 2026, new-logo bookings have more than doubled from the prior-year period, according to the company. Brinqa has also been investing in artificial intelligence capabilities, including MCP interfaces, an AI Attribution Agent and an AI Deduplication Agent. The company's platform consolidates and normalizes security information from multiple sources, adds business and threat intelligence and uses that data to prioritize remediation based on risk. PlexTrac adds another source of validated information to that data infrastructure. Confirmed exploits and remediation results generated through PlexTrac can flow into Brinqa's data layer and Cyber Risk Graph, providing additional context for the company's AI tools and for outside AI models connected through Brinqa's Bring Your Own AI program. For enterprise customers, the strategic value lies in connecting vulnerability prioritization with offensive security testing and verification rather than managing those functions through separate workflows. Brinqa can identify exposures based on their relevance to the business, direct testing resources toward higher-priority risks and incorporate retesting results into the same risk-management environment. "Exposure management only matters if teams can prove the fix worked, and that's the gap Brinqa now closes," said Thomas Krane, managing director at Insight Partners and a member of Brinqa's board. He said validated data is becoming increasingly important as security organizations incorporate AI into their operations. The combination also gives PlexTrac customers access to Brinqa's broader exposure management infrastructure. Penetration testing teams will be able to connect their workflows with Brinqa's prioritization engine, allowing security, IT and offensive security teams to work from a common set of prioritized exposures. PlexTrac's products will continue to be offered as standalone solutions, preserving existing customer workflows while giving customers the option to adopt additional Brinqa capabilities over time. PlexTrac founder and Chief Customer Brand Officer Dan DeCloss will join Brinqa's executive leadership team and board of directors. He will lead the combined company's offensive security practice. "PlexTrac was built by offensive security practitioners, for offensive security practitioners, and that's not changing," DeCloss said. He added that the combination provides a larger platform for applying offensive security expertise as more cybersecurity processes become automated. The acquisition expands Brinqa's position in a cybersecurity market increasingly focused on reducing the volume of vulnerabilities that security teams must investigate and connecting technical exposures to business risk. Rather than treating vulnerability discovery, remediation and penetration testing as separate processes, the combined platform is designed to establish a continuous workflow from discovery through validated remediation. Brinqa serves large enterprises including Nestlé, PhonePe, Cambia Health Solutions, Guidewire and SAP. PlexTrac is used by Fortune 500 companies and security providers including Expedia, Royal Caribbean, Mandiant and Deloitte. Covington & Burling represented Brinqa in the transaction. With PlexTrac incorporated into its platform, Brinqa is positioning the combined business around an integrated exposure management model that pairs risk prioritization and AI-supported analysis with offensive security testing and evidence that remediation measures have been effective.