AI makes old weaknesses cheaper and easier to exploit. But some of the biggest recent breaches didn’t need AI at all.
When attackers raided Snowflake customer accounts in 2024, Mandiant found the affected accounts lacked multi-factor authentication and didn’t restrict where logins came from, and many used credentials unchanged for years. No zero-day. No super agent. Just settings nobody checked.
“What is old is new again from an adversarial standpoint,” Reach Security CEO and co-founder Garrett Hamilton said at a recent media roundtable.
What has changed, he said, is the economics. Automation makes old techniques relentless and cheap enough for less-skilled attackers to use.
Hamilton has a stake in that argument. His company, Reach Security, sells a platform that gives enterprises a continuously updated view of their security controls. It shows which vulnerabilities and attack paths remain exploitable and which are already blocked by defenses the company owns.
The company sits in a fast-growing corner of exposure management. Gartner has pushed this category since 2022 under the banner of continuous threat exposure management.
Many security tools ask which vulnerabilities exist. This newer class asks a narrower question: do the defenses a company already owns actually stop them? Often they don’t. Gartner has called misconfigured security controls a persistent factor in breaches. It blames weak defaults, settings that drift over time, and teams that tune tools down to quiet false alarms.
Reaching for Security Configuration Excellence
Reach focuses on flaws that can’t be patched quickly. Instead of waiting for a fix, it looks for security tools the company already owns that could block the attack path in the meantime, such as a firewall rule or an identity policy. Reach calls its engine “deterministic AI.”
In plain terms, its answers come from the actual settings on those tools, not a model’s best guess.
“How do we catch the change that someone made to multi-factor authentication for testing?” Hamilton said, describing the problems Reach set out to solve.
The market behind that idea is growing fast. Grand View Research values exposure management at $4.7 billion this year and expects it to more than double by 2030. Gartner predicts that prevention-first security will take half of IT security spending by 2030, up from under 5% in 2024.
Reach Raises $50M to Flip the Ratio
Budgets haven’t caught up. In a survey Reach commissioned, organizations said they spend 72% of their security budgets on detecting and responding to attacks and 28% on keeping their defenses properly configured. They checked configurations about 6.5 times a month and took more than eight days to fix problems they found.
Investors are betting that ratio flips. Earlier this month, Reach announced more than $50 million in Series B funding led by Top Tier Capital Partners. Ballistic Ventures, In-Q-Tel, Microsoft’s venture fund M12 and existing investors also took part. The company says its customer base doubled in the past year and names Autodesk, Insurity, MPS and Ensemble Health Partners among its customers.
CISOs Don’t Want Another Dashboard
Garth Timoll, general partner and CEO at Top Tier Capital Partners, said the firm had tracked Reach since it was more concept than product. The common theme from CISOs, he said, was fatigue.
“The last thing a CISO really wants is to buy yet another tool, and then figure out how to optimize yet another tool,” Timoll said.
Barmak Meftah, co-founder and general partner at Ballistic Ventures, framed it as an old imbalance made worse. Attackers pick when and where to strike, and defenders “have to be ready all the time,” he said.
The window to respond is shrinking fast. Mandiant has tracked the average time to exploit a vulnerability falling from 63 days in 2018–2019 to five days in 2023.
“So the question becomes what can we do to really close that propagation delay and the propagation gap?” Meftah said.
Reach’s answer is to push its findings into the tools security teams already use. Its new Reach Everywhere service lets companies reorder a backlog or tighten a setting without opening another dashboard.
Hamilton said most of the industry has spent recent years improving how it ranks vulnerabilities, runs red-team exercises and analyzes malware. “That’s all great,” he said. Reach set out to make the defenses companies already own do more of the work.
That work can’t be done by hand anymore, he argued. Defensive teams are stretched across dozens of tools, and manual reviews and siloed operations can’t keep pace. He said the demand is coming hardest from Fortune 500 companies.
“Because they more than anybody know what technology sprawl looks like, know that they have many ways in and need to solve that for themselves,” he said.
