We spent decades building best-of-breed security stacks. Unfortunately, attackers got pretty good at finding the gaps between them.
For years, I’ve been writing and speaking about offensive security, enterprise security architecture, and the importance of continuously validating whether our security controls actually work.
One of my recurring arguments is that we’ve built layers of security around our enterprise information architecture without always addressing how those layers work together.
Operating systems, infrastructure, identity, cloud services, business applications, and governance platforms each have their own security models, controls, and operational responsibilities.
Individually, many of these technologies work remarkably well. Collectively? That’s where things get interesting.
Attackers don’t respect the boundaries between our security products. They exploit the architectural seams, disconnected workflows, and assumptions that one control is covering what another has missed.
We’ve seen this movie before.
The industry moves toward best-of-breed solutions, complexity grows, and eventually consolidation and integration become the next big priorities. ServiceNow’s expansion into risk management and platforms like PlexTrac connecting security findings with remediation workflows are examples of this evolution.
Now Tenable has announced OPEN for AI, bringing exposure intelligence together with other security platforms through MCP and APIs.
I see this as an encouraging step toward a more integrated and mature enterprise security architecture.
But here’s where my offensive security instincts kick in.
Connecting security tools doesn’t automatically mean the resulting architecture is secure.
And giving AI agents access across those tools introduces another layer of authority and trust boundaries that must be tested.
Otherwise, we risk replacing disconnected dashboards with beautifully integrated dashboards that are still confidently wrong. At least the new ones might have better graphics.
At Ridge Security, this direction aligns with something I believe strongly: organizations should be able to build on their existing security investments while continuously testing and validating their defenses from an attacker’s perspective.
We need more than vulnerability counts, severity scores, and assumptions about what our controls should prevent.
We need to demonstrate what is actually exploitable, prioritize what matters, remediate the weaknesses, and independently verify that the fixes work.
A strong defense requires continuous offensive validation.
The future isn’t necessarily about owning fewer security products. It’s about making the security architecture operate as a coordinated system and proving that it works.
Because attackers aren’t particularly interested in how impressive our architecture diagrams look.
They’re looking for the gaps.