AI SPERA says AITEM turns lists of exposed servers into ranked, routed fixes. Here is what attack surface management is, what the pitch promises and what is still unproven.
Criminal IP, a threat intelligence platform run by AI SPERA, is pitching AITEM (AI-Powered Threat Exposure Management) as the next step beyond attack surface management, the job of finding every internet-facing system a company has.
Classic tools produce an inventory with risk scores. The company says AITEM goes further in four stages: it matches new threats to what an organization actually runs, lets analysts investigate in plain language, ranks risks using real attacker activity, and sends the top issues to the right team as alerts or tickets. It also looks at leaked data, the dark web and unapproved AI tools.
The direction makes sense, but the claims are the vendor's own. Anyone interested should insist on a trial on their own systems.
Most companies already know which of their servers are exposed to the internet. Knowing which one to fix first, and getting the right person to fix it before an attacker finds it, is the hard part. That gap is what Criminal IP says its new AITEM product closes.
Why should anyone outside a security team care? Because forgotten servers, open admin pages and leaked logins are how many data breaches start, and the customer records exposed in those breaches are often yours. Tools that shorten the time a weak spot stays open matter even if you will never see them. But AITEM was introduced through a sponsored article written by the company, so it is worth separating the idea from the marketing.
Attack surface management, or ASM, is the job of finding everything an organization has that faces the internet: web servers, domains, IP addresses, login pages and admin panels. The “attack surface” is simply every door an outsider could try.
Classic ASM tools scan the internet the way an attacker would and hand back an inventory, often with a risk score for each item. That’s useful, but it leaves a busy team staring at a long list. Criminal IP’s own argument is that discovery on its own no longer cuts it, because AI is helping attackers move faster too. Automated scanning, publicly posted exploit code and AI-assisted hunting for bugs all shrink the time between a weak spot appearing and someone trying it.
AITEM stands for AI-Powered Threat Exposure Management. Criminal IP, a threat intelligence platform operated by AI SPERA, describes it as an expansion of ASM that looks beyond external assets. The company says it pulls together exposure data from several places: internal infrastructure, open-source intelligence, the dark web, leaked data, newly found vulnerabilities and “Shadow AI”, meaning AI tools staff use without the IT team’s approval.
The company splits the work into four stages:
Behind all four sits Criminal IP’s scanning data: open ports, exposed services, abuse history, scanner activity and known malicious infrastructure. The idea is to show not just what is exposed but what is happening around it.
AI SPERA’s CEO, Byungtak Kang, framed the pitch as a move “from visibility to action”. He argued the competition in ASM will no longer be about who finds the most assets but who responds fastest, with AI handling repetitive analysis and people keeping judgment and accountability.
That is a reasonable direction, and it matches where the wider security industry is heading. At RSAC 2026, agentic AI, AI-run security operations centers and Shadow AI were among the big themes, as vendors moved away from separate single-purpose tools toward joined-up, AI-driven operations.
What’s missing is evidence. The announcement offers no independent test results, no customer case numbers, no pricing and no detail on how its AI ranks one exposure above another. Every claim in it comes from the company itself. Buyers should treat AITEM the way they would any new security product: ask for a trial on their own systems and compare its rankings with what their team already knows.
AI SPERA used GovWare 2026 in Singapore to present AITEM. The event ran October 13 to 15 at the Sands Expo and Convention Centre, with organizers expecting more than 15,000 attendees from over 90 countries and regions. Kang gave a session on moving from visibility to threat hunting, built around a case study of AI-driven ASM.
The company then took the product to Security Days Fall 2026 in Tokyo, held October 21 to 23, with live demos. Those covered investigating suspicious IP addresses, domains and web links, finding exposed IT assets, spotting leaked information on the dark web, and checking risks tied to business partners and affiliated companies.
For most readers, the name AITEM will never come up. The wider shift it represents does matter. Exposure management tools of this kind aim to cut the time a misconfigured server or unpatched service sits open, which is often the difference between a near miss and a breach.
If you run IT for a small business, the lesson isn’t to buy anything yet. It’s to make sure you have the basics a tool like this automates: a current list of what you have online, a way to rank what matters most, and a clear owner for each fix. Partners and suppliers count too, since their exposed systems can become your problem.
AI-Powered Threat Exposure Management. It is Criminal IP’s product for linking the discovery of exposed systems with investigation, ranking and automated follow-up.
AI SPERA operates Criminal IP, a threat intelligence platform that continuously scans the internet for exposed assets, vulnerabilities and attacker infrastructure. Its CEO is Byungtak Kang.
Not publicly. The details come from the company’s own sponsored announcement and trade show demos. No independent reviews or pricing have been published.
You're reading the quick version.
Read next
Starlink Ukraine restrictions left drones losing connectivity
Ukrainian officials allege Starlink connectivity restrictions disrupted drone strikes and long-range missions, prompting questions about aid reliability.
A spy board was reported inside a Trezor Safe 5. Trezor says you can't reliably spot one yourself, so the real test is where your wallet came from.
A poisoned update slipped an SSH key and hidden startup scripts onto up to 5,000 computers. Removing the extension won't clean it up. Here's what will.
A hijacked engineer laptop opened the door to the biggest crypto theft yet. Here is how it unfolded, who is blamed and what customers should do.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
