Threat actors are using highly-automated tools to find and exploit vulnerabilities, and Palo Alto Networks aims to help security teams catch up with the new Xpanse Active Attack Surface Management.

The service is designed to actively discover and remediate risky exposures for organizations' internet-faced assets, the security vendor claims.

“While the fundamental need for attack surface management hasn’t changed, the threat landscape today is much different. Organizations need an active defense system that operates faster than attackers can,” Matt Kraning, CTO of Cortex for Palo Alto Networks, said in a statement. “With Xpanse Active ASM, we give defenders the ability not only to see their exposures instantly but also to shut them down automatically with no human labor required.”

Xpanse Active Attack Surface Management offers an Active Discovery module that refreshes its internet-scale database several times a day and uses machine learning to report vulnerabilities to users.

It also includes an Active Learning module that processes the streamed discovery data to analyze and prioritize top risks and the Active Response that includes embedded automatic remediation capabilities to automatically shut down the exposures based on the findings and analysis from Active Discovery and Active Learning modules.

The response module also includes built-in playbooks that automatically mitigate critical risks such as exposed Remote Desktop Protocol (RDP) servers and insecure OpenSSH instances, Palo Alto Networks claims.

The Active Attack Surface Management is the latest addition to the vendor’s attack surface management (Xpanse) product family that is designed to manage internal and external digital attack surfaces across the internet for users. The platform is based on the vendor’s 2020 Expanse acquisition, which Palo Alto Networks later integrated into its artificial intelligence-based detection, prevention, and automation portfolio — Cortex.

The vendor last month announced a multi-year, nine-figure deal for Cortex Xpanse with the U.S. Department of Defense (DoD). DoD will tap the security giant’s Cortex products for internet operations management (IOM) capabilities.