Criminal IP by AI SPERA, a threat intelligence platform providing decision-ready intelligence and attack surface visibility, will showcase its latest capabilities at GovWare 2026 in Singapore. The company is introducing AITEM (AI-Powered Threat Exposure Management), positioning it as the next phase in how attack surface management tools should evolve.
From Visibility to Action: Why ASM Must Evolve
Conventional attack surface management has focused on helping organizations locate internet-facing infrastructure—servers, domains, IP addresses, administrative interfaces—before adversaries find them. Yet asset discovery by itself has become insufficient for modern security operations.
Seeing a threat and responding to it are completely different challenges. Building a safer cyber world requires a shift from visibility to action.
Byungtak Kang, CEO of AI SPERA
Many organizations now have unprecedented visibility into their exposures but lack the ability to effectively triage and act on what they discover. When AI is applied to reduce false positives, supply missing context, and direct investigations, security teams can concentrate on the most significant exposures and take action immediately, converting visibility into concrete results.
The space between identifying a threat and responding to it has grown more urgent as artificial intelligence lowers the cost of launching attacks. Attackers can now leverage automated reconnaissance, publicly available exploit code, and AI-driven vulnerability identification to locate and exploit exposed systems faster than defenders can react. The real challenge for defenders is no longer simply seeing threats—it is the speed at which they can respond.
AITEM: The Next Evolution of Attack Surface Management
AITEM goes beyond what traditional attack surface management delivers by broadening its scope past external asset cataloging. Leveraging Criminal IP's intelligence capabilities, the platform consolidates exposure data from external assets, open-source intelligence, dark web sources, internal infrastructure, Shadow AI, compromised data, and newly discovered vulnerabilities into a unified threat exposure framework.
Rather than concluding at asset discovery and assigning generic risk scores, AITEM is engineered to link scattered findings with the intelligence security teams require to examine, rank, and take action.
AI-Powered Across the Exposure Lifecycle
AITEM deploys artificial intelligence across four phases of exposure management:
- Detect - Match newly identified threats and vulnerabilities to the actual products, services, and systems running in an organization's infrastructure.
- Investigate - Enable security personnel to examine assets, exposures, vulnerabilities, and findings using conversational language while consolidating pertinent information in a single interface.
- Prioritize - Assess exposure by applying organization-specific risk parameters alongside genuine exploitability and documented attacker activity, rather than depending solely on standardized vendor scoring.
- Automate - Convert ranked findings into notifications, tickets, and automated actions that route to the right teams, helping move critical exposures from discovery to resolution.
Threat Intelligence at the Core
AITEM rests on Criminal IP's threat intelligence foundation, supplying practical context to exposure management that extends past vulnerability databases alone.
Open ports, running services, known vulnerabilities, connected systems, historical abuse records, scanning activity, threat attribution data, and malicious infrastructure can be unified to give security teams a complete picture—not just what is exposed, but what activity surrounds that exposure and its significance.
AITEM embodies Criminal IP's perspective on how attack surface management should develop: stretching beyond external asset inventories and linking exposure discovery with investigation, threat intelligence, prioritization, and response capabilities.
From Visibility to Threat Hunting at GovWare 2026
At GovWare 2026, Byungtak Kang will present "From Visibility to Threat Hunting: A Case Study of AI-Driven Attack Surface Management" during the conference agenda.
The presentation will draw on practical scenarios to demonstrate how threat intelligence and attack surface visibility can accelerate investigation and strengthen security operations, while analyzing the transition from simply finding exposures to comprehending and addressing them.
The Broader Industry Shift
Criminal IP's direction with AITEM aligns with a wider transformation happening throughout the security industry. Agentic AI, AI-driven security operations centers, and Shadow AI became prominent discussion points at RSAC 2026, as major security vendors moved away from disconnected point solutions toward unified, AI-enabled security operations.
The competition in ASM is no longer about who finds the most assets. It will be about who can operate faster, respond more effectively, and mobilize the organization. AI should handle the repetitive analytical work. Humans should focus on judgment, accountability, and prioritization.
Byungtak Kang
About Criminal IP by AI SPERA
Criminal IP is a threat intelligence solution managed by AI SPERA that delivers actionable intelligence and attack surface management capabilities to security teams globally.
The platform continuously monitors the internet, gathering and organizing threat signals across IP addresses, domains, URLs, and attack infrastructure, encompassing malicious indicators, documented vulnerabilities, exposed systems, and attacker patterns.
Criminal IP's objective is to equip organizations with genuine insight into their cyber environment and enhance threat detection and response velocity by supplying the intelligence required to stay ahead of attackers.