Exposure management company Nucleus Security Inc. today unveiled Nucleus Helix, an artificial intelligence engine that now sits at the center of its platform.

Three new capabilities run on the engine. An expansion of Nucleus Insights, the company’s vulnerability intelligence service, is available now. Two more arrive in September. Nucleus Discover is a detection tool. The Nucleus Helix AI Agent puts a natural-language interface over the platform.

Helix draws on the Nucleus Data Core, the normalized store of asset, vulnerability and ownership data the platform already keeps. The company assigns the engine three jobs. One is building and maintaining a customer’s exposure management program. Reasoning agents handle the second, closing gaps where exposure has gone undetected. The third is tracking the threat landscape as it shifts.

Nucleus Discover aims at the window between a vulnerability becoming public and a scanner learning to spot it. Detection there is passive. Nucleus said the feature surfaces exposure in technology that scanners do not cover and in newly disclosed flaws that have no signature written yet. The company calls that early warning.

The Nucleus Helix AI Agent is a natural-language front end to the platform. Practitioners, chief information security officers and developers can query findings, trace who owns an affected asset or spin up a workflow by typing the request. Doing the same by hand means working through configuration screens.

Insights, which collects and analyzes vulnerability and exploit intelligence, picks up a data-collection agent aimed at reporting on in-the-wild attacks. New datasets cover Patch Tuesday, end-of-life operating systems and the U.S. Cybersecurity and Infrastructure Security Agency’s Stakeholder-Specific Vulnerability Categorization decision framework. Nucleus said the additions cut investigation effort and sharpen remediation guidance.

The SSVC dataset lands against a federal deadline, Binding Operational Directive 26-04 which took effect on June 10. Fixed patch windows went away with it. A flaw already sitting in CISA’s Known Exploited Vulnerabilities catalog now pushes an asset up the scale fast. Internet exposure does the same. The worst combinations carry a three-day remediation deadline. The CERT Coordination Center at Carnegie Mellon University has since published an SSVC decision tree built for agencies implementing the directive.

Nucleus holds FedRAMP Moderate authorization. Federal civilian agencies can buy the platform on that basis. Nucleus said it also supports the Defense Department and contractors in the defense industrial base operating under CMMC 2.0

Nucleus is a venture capital-backed startup that last raised $20 million in a Series C round in February. The company has raised approximately $86.1 million to date.

Michelle Abraham, research vice president in International Data Corp.’s Security and Trust Group, said Nucleus is taking a “pragmatic approach,” using AI to shape and improve processes while keeping deterministic execution for anything that touches production. Teams want the speed without losing predictability in what actually gets changed, she added.

Image: Nucleus Security