Most security tools are very good at producing lists. Lists of assets, lists of ports, lists of CVEs. The problem is that a list is not a risk assessment — and a team drowning in thousands of "possible" findings still has to work out, one by one, which of them an attacker could actually reach and exploit. That triage is where the hours go.
The challenge: a list is not a risk assessment
A finding on a dashboard answers "does this software have a known weakness?" It does not answer the question your team actually needs answered: "is this exposure reachable from the internet right now, and can it be used against us?"
Those are very different questions. A vulnerability on a service that nothing can reach is noise. The same vulnerability on a live, internet-facing listener is an incident waiting to happen. When every finding looks the same on the screen, teams spend their scarcest resource — analyst time — proving or dismissing issues by hand, and the genuinely dangerous ones wait in the same queue as the harmless ones.
And the clock is faster than it used to be. Attackers increasingly automate discovery and exploitation with AI, compressing the time between "exposed" and "exploited". A static list that a human works through by hand was never going to keep pace with that.
A vulnerability on a service that nothing can reach is noise. The same vulnerability on a live, internet-facing listener is an incident waiting to happen.
What's new: reachability first, then proof
TONK, our external attack surface management (EASM) platform, now focuses your attack surface on what is genuinely reachable, and lets you prove the exposures that matter — without the manual legwork.
Your dashboard leads with the exposures an attacker can actually reach from the outside, rather than treating every finding as equal. The result is a headline view that reflects real-world risk: the issues on live, externally reachable services rise to the top, and the inside-only noise steps back.
From there, you can confirm a finding rather than guess at it. With a single, approved action, TONK verifies whether an exposure genuinely behaves the way it was flagged — turning a "possible" into a "confirmed", or clearing a false positive outright, with the evidence recorded against the finding. For the exposures that warrant deeper certainty, our Assurance workflow establishes real-world impact under controlled, authorised conditions. Every step is gated and human-approved.
And because analyst time is the real constraint, TONK now includes an AI assistant that reasons over your own exposure data. Ask it a plain-language question — which high-severity issues are new this month, what's changed on your perimeter — and it answers from your findings and asset data, with references back to the records behind every statement. It helps you decide; it never acts without your approval.
Fighting AI with AI
If attackers get to use AI, so should you. TONK can carry a full assessment through its stages on its own — discovering, checking and validating your exposure, then handing each stage forward to the next — so the routine work that used to consume an analyst's week runs at machine speed instead.
The difference that matters is control. This is not automation left to run unattended: every consequential step waits for a human to approve it before it proceeds. You get the pace of an automated adversary with a person's hand firmly on the controls — nothing runs against your environment that you didn't authorise, and you can see exactly what each stage did and why.
Key capabilities
- Reachability-first view — your dashboard leads with exposures that are genuinely internet-reachable, so the headline numbers match real risk.
- One-click verification — confirm whether a finding is real, or clear a false positive, with a single approved action, and keep the evidence.
- Assurance validation — establish real-world impact for your most important exposures under controlled, authorised conditions.
- AI-assisted analysis — ask plain-language questions about your own exposure and get grounded, cited answers that help you prioritise.
- Human-gated automation — let TONK progress a full assessment through its stages at machine speed, approving each consequential step yourself.
Who benefits
Security teams measured on outcomes rather than ticket counts — and organisations aligning to the ASD Essential Eight, the ACSC Information Security Manual (ISM), APRA CPS 234 or SOCI obligations — benefit most, because validated exposure data turns a long list of findings into a short list of decisions.
How it works
Exposure validation is built into the workflow you already use:
- Open your dashboard and review the exposures that are actually reachable, front and centre.
- Select a finding and run an approved verification to confirm it or clear it.
- Escalate the exposures that matter into Assurance for controlled validation.
- Ask the AI assistant for a plain-language summary to brief your team or your board.
Everything stays under your control — nothing runs without an explicit, human approval.
Getting started
These capabilities are available now to TONK clients. Log in to your dashboard to see the reachability-first view, or schedule a demo to see exposure validation in action.