Kyndryl has built something called the Security Intelligence Platform, designed for Microsoft Azure environments and now a finalist at the Cybersecurity360 Awards. It pulls together security posture management, attack path analysis, AI security posture management, SIEM use case generation, compliance, guided remediation and reporting for both operational and executive audiences.
The stated reason for its existence is the interesting part. Organisations, the project explains, now hold more security data than ever and still cannot answer the most basic questions in the discipline. Which vulnerabilities actually represent risk. Which attack paths can genuinely be exploited. Which fix buys the largest reduction in exposure.
Read that again as a description of an industry rather than a sales argument.
The problem was sold one licence at a time
Every one of those unanswered questions is the finished product of twenty years of selling visibility. Vulnerability assessment, SIEM, cloud posture dashboards, audit reports, compliance consoles: each sold on the promise that seeing more would mean knowing more. Each generating thousands of technical findings a day, in its own format, with its own severity scale, none of them speaking to the others.
Nobody had to plan the fragmentation. The market installed it one licence at a time, and it is now offering the upper floor that will finally impose order on the mess it delivered. In any other sector this would be called rework at the customer’s expense. In cybersecurity it is called maturity.
That is not an argument against the platform. It is an argument for remembering how the conditions that make it necessary came about, because on current form the same vendors will be back in five years explaining that exposure management platforms have proliferated and that what organisations really need is a layer above them.
The graph is only as good as the inventory
Strip away the framing and the technical core is sound, which is precisely why it deserves a harder look.
Attack path analysis is the right idea. Rather than listing vulnerabilities as independent items, the platform reconstructs chains of compromise, relating assets, configurations, identities and application dependencies, so that the security team can see not just where a weakness sits but how it could be used and what would fall with it. Prioritising remediation on that basis, rather than on the theoretical severity score of an isolated finding, is how the work should have been done from the start.
It also carries a dependency nobody enjoys discussing. A path graph is a model of the environment, and a model of the environment is built from an inventory of the environment. Show me an organisation that knows with precision which identities can reach which systems, which service principals still hold permissions granted for a migration that ended years ago, and which subscription somebody opened on a corporate card without telling anyone, and I will show you a trustworthy graph. Absent that, you get an elegant map of an imaginary territory, and the elegance is the dangerous part, because a clean visualisation carries an authority that a messy spreadsheet of findings never had.
Simulating a world you have not measured
The same objection applies to the most original component. The What-If module allows a team to simulate the effect of an infrastructure change or a remediation before applying it, so that side effects can be assessed before they reach production. The project compares the approach to a digital twin applied to cyber risk: observe the consequences of a change, then implement it.
Genuinely useful, and bounded by the same constraint. A digital twin of an infrastructure nobody has accurately catalogued is somebody else’s twin. It will faithfully model the environment as documented, which is the environment the organisation believes it operates, not the one it operates.
The AI part is the honest part
Credit where it is due. The platform includes AI security posture management covering language models, AI agents, application guardrails and abuse scenarios, and it combines LLM-based analysis with deterministic controls intended to guarantee quality, consistency and verifiability of output.
This is the one design decision in the whole architecture that reads as a genuine constraint rather than a feature. Generative models enrich the contextual analysis; deterministic controls carry repeatability and auditability. The design stops short of letting a probabilistic system have the final word on whether an environment is safe, at a moment when a good part of the market is going the other way and calling it an agentic workflow.
The feature that will actually sell it
And then there is the part the buyers will reach for first.
The same underlying data becomes operational dashboards for specialists, reports for management, and documentation for audit, compliance and incident response. Risk stops being confined to technical functions and becomes something shared with the decision-making levels of the organisation, which matters increasingly in a regulatory context where DORA requires cyber risk to be governed at management level and not merely operationally.
All of that is true. It is also the most commercially attractive sentence in the entire proposition, and for a reason that has nothing to do with security.
A well constructed exposure report and an actual reduction in exposure look remarkably similar on the desk of the person signing them. One of them requires reliable asset inventory, identity hygiene, patch cycles that survive contact with production owners, and difficult conversations about systems nobody wants to touch. The other requires a dashboard that renders correctly. Both can close a governance item. Only one of them changes what an attacker would find.
Where this leaves the buyer
The diagnosis in the project is correct: the value of a cybersecurity platform no longer depends on how much information it collects but on whether that information becomes coherent, justifiable, verifiable decisions. Posture management, attack path analysis, AI security and remediation genuinely should stop being separate disciplines.
Just be clear about which problem is being purchased. A layer that correlates findings into exploitable paths, simulates the effect of a fix and produces the same truth for the engineer and the board earns its place. It still reads from an inventory somebody inside the organisation has to build and keep honest, and it has no opinion on whether anyone acts on what it shows.
Correlation is the part worth paying for. The day the platform is used mainly to produce documentation for governance, the fragmentation has not been solved. It has been given a nicer interface and a deadline.
Raffaele Di Marzio
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html