JEDI-SEC | Security Research & Digital Defense

Tag: Product Features

  • Introducing Flashpoint Agentic AI for Threat Intelligence

    Table Of Contents
    Table of Contents
    What Is Flashpoint Agentic AI?
    Agentic Hub: AI Agents for Briefings, Alerts, and PIRs
    Investigating Threats with Agentic Hub
    Why Primary-Source Intelligence Matters for AI Agents
    How Threat Intelligence Teams Maintain Control of AI Agents
    Human-Led. AI-Scaled.
    Frequently Asked Questions

    More

    subscribe to our newsletter

    Today, Flashpoint is introducing Flashpoint Agentic AI, a new offering that brings purpose-built AI agents into the intelligence workflows practitioners use every day. Powered by Flashpoint’s primary-source intelligence, these agents help teams accelerate investigations and automate recurring tasks, from intelligence briefings and alert refinement to priority intelligence requirements (PIR) management.

    This offering includes Agentic Hub, a new environment within Flashpoint Ignite that brings together Chat and purpose-built agents, along with product-specific agents in Echosec.

    As adversaries increasingly leverage AI to accelerate their operations, threat intelligence teams face mounting pressure to identify emerging risks, investigate threats, and operationalize insights in support of their Priority Intelligence Requirements (PIRs). Yet repetitive, time-intensive workflows continue to consume team capacity, limiting the time available for deeper analysis and strategic decision-making.

    In fact, recent research commissioned by Flashpoint underscores the operational challenges facing threat intelligence teams amid the rise in the AI threat landscape. According to our 2026 Enterprise Threat Intelligence Report, 65% of respondents identified alert noise and false positives as challenges affecting program effectiveness, while 55% cited insufficient analyst bandwidth.

    “The AI threat landscape is accelerating faster than many threat intelligence teams can keep up. Flashpoint Agentic AI helps close that gap by taking on recurring work that unnecessarily consumes teams’ time, freeing them to focus on connecting the dots, understanding adversary behavior, and informing critical security decisions, all powered by Flashpoint’s primary-source intelligence.”

    Josh LefkowitzFounder and CEO, Flashpoint

    What Is Flashpoint Agentic AI?

    Flashpoint Agentic AI builds on the AI-assisted capabilities already available across Flashpoint products. While capabilities like natural-language search and summarization help threat intelligence teams complete individual tasks, agentic AI goes a step further, executing defined, multi-step workflows on their behalf.

    Organizations set the objectives and requirements, while purpose-built agents carry out the work using Flashpoint intelligence. From investigating threats through natural-language queries to generating scheduled briefings, refining alert results, and maintaining priority intelligence requirements (PIRs), these agents reduce manual effort and free teams to focus on higher-value analysis.

    Flashpoint Agentic AI will be available as a new offering, extending the AI-assisted capabilities already included with Flashpoint product licenses.

    Agentic Hub: AI Agents for Briefings, Alerts, and PIRs

    Agentic Hub lets teams investigate threats conversationally, and work with purpose-built intelligence agents directly in Flashpoint Ignite, to streamline recurring workflows and accelerate investigations. 

    Through natural-language queries, teams can explore intelligence, investigate threat actors, assess emerging activity, and follow leads across cyber, vulnerability, fraud, and identity intelligence. Results can include source-linked findings, charts, tables, and other outputs that provide context and support further analysis.

    Agentic Hub initially includes:

    • Chat: Turns a single natural-language question into a multi-step investigation, following leads across vulnerability, credential, fraud, and threat actor intelligence and returning source-linked findings.
    • Intelligence Briefing Agent: Generates scheduled intelligence briefings tailored to executives, analysts, and technical teams, drawing on the alert rules, PIRs, investigations, assets, and credential exposure data each team selects.
    • Alert Setup Agent: Converts plain-language monitoring requirements into configured alert rules, allowing threat intelligence teams to preview results before saving.
    • Alert Triage Agent: Reduces alert noise by pre-filtering low-context results, flagging alerts that do not match monitoring intent, and labeling and archiving remaining alerts, with visibility into actions taken.
    • PIR Agent: Transforms plain-language intelligence requirements into structured PIRs for threat intelligence teams to review and approve, while identifying emerging threats that existing requirements may not address.

    Flashpoint Agentic AI also includes the Echosec Reporting Agent, which transforms saved searches into scheduled reports containing assessments, cited findings, and recommended actions. Each report is preserved, allowing organizations to review how a monitored situation develops over time.

    Because these agents operate directly within Flashpoint products, teams can take advantage of agentic AI without building separate infrastructure or managing additional integrations. Agentic Hub is also designed to support additional agents and future customization capabilities as the offering evolves.

    Investigating Threats with Agentic Hub

    Threat investigations rarely follow a predictable path. What begins as a single question can quickly evolve into a complex investigation spanning multiple intelligence domains.

    Consider a newly disclosed vulnerability. An organization may need to determine whether exploit code is circulating, identify threat actors discussing or testing it, and assess whether exploitation has been observed. As new intelligence emerges, the investigation may uncover connections to illicit communities, compromised credentials, or broader threat campaigns, each introducing new questions and potential leads.

    Within Agentic Hub, threat intelligence teams can pursue these leads using conversational text or natural language queries, ask follow-up questions, and test hypotheses across Flashpoint’s intelligence collection. Rather than manually searching and assembling information from separate datasets, they can explore related activity within a single investigative environment, with findings linked to the underlying intelligence for further review.

    This approach helps teams move more efficiently from an initial question to a more comprehensive understanding of the threat, while maintaining control over the direction of the investigation and the conclusions they draw.

    Why Primary-Source Intelligence Matters for AI Agents

    AI agents are only as effective as the intelligence behind them. While many AI agents are designed for security operations center (SOC) workflows, relying on publicly available threat feeds or intelligence from individual datasets, Flashpoint Agentic AI is purpose-built for intelligence teams and powered by Flashpoint’s proprietary, primary-source collection.

    This distinction matters because public vulnerability databases, published threat reports, and open-source indicators, while valuable, do not capture the full threat landscape. Discussions of emerging exploits, stolen credentials, and criminal services within illicit communities can provide early indicators of threats before they are widely documented.

    Flashpoint Agentic AI draws on intelligence spanning cyber threats, vulnerabilities, fraud, and identity-related risks. For vulnerability intelligence specifically, Flashpoint’s proprietary research provides visibility beyond commonly used public resources such as the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities (KEV) catalog. This includes tens of thousands of vulnerabilities cataloged ahead of NVD, a known-exploited vulnerability dataset several times larger than CISA KEV, and ransomware likelihood scoring across vulnerability records.

    For a threat intelligence team investigating a vulnerability, this depth of intelligence can help uncover related exploit discussions, threat actor activity, and exposed credentials that may influence remediation priorities or warrant further investigation. Equally important is the ability to trace findings back to their sources. Agent-generated findings link back to the underlying intelligence, enabling teams to examine original evidence, validate assessments, and make informed decisions. 

    Together, purpose-built agents, proprietary intelligence, and source traceability help intelligence teams move beyond surface-level threat information to develop a more comprehensive understanding of the risks facing their organizations.

    How Threat Intelligence Teams Maintain Control of AI Agents

    Flashpoint Agentic AI is designed to automate intelligence workflows without removing human judgment from the process. Threat intelligence leaders remain in control of the objectives guiding agent activity, the intelligence they review, and the decisions that follow.

    Teams can define intelligence requirements, examine source-linked findings, and evaluate results against their organization’s unique threat environment and priorities. For example, the PIR Agent translates plain-language requirements into structured PIRs for team review and approval, rather than activating them automatically.

    Organizations can also retain control over when and where agentic capabilities are deployed, allowing them to align AI adoption with their security and privacy requirements.

    Human-Led. AI-Scaled.

    The future of threat intelligence isn’t about asking teams to do more with less. It’s about giving them the tools to focus their expertise where it matters most.

    By combining purpose-built AI agents with Flashpoint’s primary-source intelligence, Flashpoint Agentic AI helps teams reduce manual effort, accelerate investigations, and turn intelligence into action, without sacrificing the human judgment that effective threat intelligence demands.

    Human-led. AI-scaled.

    Ready to see Flashpoint Agentic AI in action?

    • Already a Flashpoint customer? Contact your customer success manager to explore how Agentic AI can help you get even more value from Flashpoint.
    • New to Flashpoint? Request a demo to discover how Agentic AI can accelerate investigations and streamline your team’s threat intelligence workflows.

    Frequently Asked Questions

    What is Flashpoint Agentic AI?

    Flashpoint Agentic AI is a new offering that brings purpose-built AI agents directly into Flashpoint’s threat intelligence products. Powered by Flashpoint’s primary-source intelligence, it helps threat intelligence teams investigate threats and automate recurring intelligence workflows, including briefings, alert refinement, priority intelligence requirements (PIR) management, and reporting.

    What is Agentic Hub?

    Agentic Hub is an environment within Flashpoint Ignite that combines natural-language investigation with purpose-built AI agents. It allows threat intelligence teams to investigate across Flashpoint intelligence and delegate recurring intelligence workflows.

    Which AI agents are included?

    Agentic Hub includes the Intelligence Briefing Agent, Alert Setup Agent, Alert Triage Agent, and PIR Agent.

    What intelligence powers Flashpoint’s AI agents?

    Flashpoint Agentic AI is powered by Flashpoint’s proprietary intelligence collection, including primary-source intelligence across cyber threats, vulnerabilities, fraud, and identity-related risks. Unlike AI tools that rely primarily on public threat feeds, Flashpoint’s agents leverage proprietary intelligence and provide source-linked findings that threat intelligence teams can review and validate.

    How do threat intelligence teams maintain oversight of agent activity?

    Flashpoint Agentic AI is designed to keep threat intelligence teams in control of intelligence workflows and decisions. Practitioners establish requirements, retain visibility into agent outputs, and review the evidence supporting findings. Certain workflows, including PIR creation, require approval before activation.

    Is Flashpoint Agentic AI available to existing customers?

    Flashpoint Agentic AI will be available as a new offering in early 2027, extending the AI-assisted capabilities already included with Flashpoint product licenses.

    Is customer data used to train AI models?

    No. Customer data, prompts, and AI-generated outputs from Agentic Hub are not used to train, fine-tune, or improve any AI model.

    See Flashpoint in Action

    Get a Demo

    Contact Sales

    Source: Flashpoint · 2026-11-10

  • The Missing Layer in Vulnerability Prioritization: Full Visibility Into Your Attack Surface

    Table Of Contents
    Table of Contents
    How EASM Extends Vulnerability Prioritization to Your Full Environment
    Why This Matters More in Regulated Industries
    Discovery and Prioritization, Built Into One Platform
    Frequently Asked Questions

    More

    subscribe to our newsletter

    Security teams have more vulnerability data at their disposal than ever. But even the best intelligence has limited value if teams can’t determine where those vulnerabilities exist within their own environment.

    For many organizations, that visibility remains a challenge. Asset inventories, scanners, and ticketing systems provide valuable information, but connecting those insights with real-world exploit activity isn’t always straightforward. And as environments evolve, undocumented assets, forgotten infrastructure, and newly exposed systems can introduce risks that traditional inventories may miss.

    Flashpoint External Attack Surface Management (EASM) helps close that gap by connecting continuous discovery of internet-facing assets with Flashpoint’s threat-informed Vulnerability Intelligence. With coverage of more than 480,000 vulnerabilities, including over 105,000 not found in NVD or CVE, Flashpoint provides context on active exploitation, exploit maturity, and ransomware risk through its patented Ransomware Risk model. Together, these capabilities help teams identify which exposures warrant the most immediate attention.

    What is EASM? External Attack Surface Management (EASM) is the continuous discovery and monitoring of an organization’s internet-facing assets, including domains, subdomains, IPs, and infrastructure that isn’t formally tracked. It gives security teams visibility into what’s exposed to the internet, whether or not that infrastructure was deliberately set up or documented.

    How EASM Extends Vulnerability Prioritization to Your Full Environment

    EASM continuously discovers internet-facing assets associated with an organization, including domains, subdomains, IP addresses, and infrastructure that may not appear in existing inventories. This could include a subsidiary’s infrastructure following an acquisition, a forgotten staging environment, or a cloud instance that remains active long after a project ends.

    With Flashpoint EASM, discovered assets enter a triage queue organized by relevance, helping teams focus on assets that warrant further investigation. Once ownership is confirmed, Flashpoint maps those assets against its Vulnerability Intelligence to identify vulnerabilities associated with the software versions running on them.

    Findings are prioritized using Flashpoint KEV, EPSS, and Ransomware Risk scores. Asset-level details also show the products and versions responsible for identified exposures, along with potentially high-risk open ports such as RDP and SSH. This gives teams the context they need to assess risk and determine where remediation should begin.

    Example Scenario

    Consider a development team that deploys a staging server running an outdated web framework. The project ends, but the server remains online and is never added to the organization’s asset inventory.

    Flashpoint EASM discovers the server and shows how it connects to the organization’s infrastructure. Once the team confirms ownership, Flashpoint Vulnerability Intelligence identifies an actively exploited CVE affecting the framework version.

    The team can now investigate an exposure that might otherwise have gone unnoticed and prioritize remediation based on evidence of active exploitation.

    Why This Matters More in Regulated Industries

    For organizations in heavily regulated industries such as financial services and healthcare, incomplete asset visibility can introduce additional compliance and security risks. Requirements under frameworks and regulations such as GLBA and HIPAA make maintaining appropriate safeguards especially important. An unknown, internet-facing asset with an exploitable vulnerability can create exposure regardless of whether it appears in the organization’s CMDB.

    Mergers and acquisitions can complicate this further. Acquired organizations bring infrastructure that security teams may have limited visibility into, including assets that have not yet been incorporated into existing monitoring processes.

    Continuous external asset discovery helps teams identify and assess that infrastructure earlier, reducing reliance on periodic audits or manual inventory updates to uncover potential exposures.

    Discovery and Prioritization, Built Into One Platform

    When attack surface discovery and vulnerability intelligence operate in separate systems, security teams may need to manually correlate asset inventories with vulnerability findings. That process becomes increasingly difficult as infrastructure changes and new vulnerabilities emerge.

    Flashpoint brings these capabilities together in one platform, an approach we call attack surface intelligence. Newly discovered assets can be evaluated against Flashpoint’s Vulnerability Intelligence, giving teams access to threat-informed prioritization within the same workflow.

    For teams already using Flashpoint Vulnerability Intelligence, EASM can be added as a module within the existing Ignite platform, with no separate console to manage. Contact your account team to learn more about adding EASM to your deployment. New to Flashpoint? Schedule a demo to explore how Vulnerability Intelligence and EASM work together to help your team identify and prioritize external exposures.

    Frequently Asked Questions

    How is EASM different from a vulnerability scanner? 

    Traditional vulnerability scanners scan assets you already know about and tell them to check, typically from inside the network perimeter. EASM continuously discovers internet-facing assets from the outside, including unknown infrastructure like forgotten test environments and acquired systems, then enriches them with vulnerability intelligence beyond public sources like NVD and CVE. The two are complementary: scanners provide depth on known internal assets, while EASM extends that visibility to what’s exposed externally.

    Can EASM help identify compound risk on a single asset? 

    Yes. The Vulnerable Assets view surfaces how many vulnerabilities are tied to a given asset, so teams can quickly spot assets carrying disproportionate risk and prioritize accordingly, rather than treating every finding as an isolated issue.

    If we’re already running Flashpoint Vulnerability Intelligence, do we need a new implementation to add EASM? 

    No. EASM is a module inside the platform you’re already using. It appears inside the same Ignite workflows your team relies on today, with no separate console or parallel rollout required.

    How is EASM priced?

    EASM is priced based on company size rather than asset count or seats, so costs are predictable and don’t scale up just because the attack surface grows.

    See Flashpoint in Action

    Get a Demo

    Contact Sales

    Source: Flashpoint · 2026-10-21