An exposed service, an unpatched workstation and an account with excessive privileges can look like separate problems in a security queue. For an attacker, they can form a route into the same critical system. Bitdefender is bringing those connections into focus with GravityZone Exposure Management, a new offering announced October 27 that combines internal and external exposure discovery, attack-path analysis and adaptive hardening.
The launch targets security teams that need to decide which weaknesses to address first without creating another console to manage. Built around the GravityZone platform, it connects the work of finding vulnerabilities with understanding their consequences and reducing the opportunities attackers could exploit.
From a List of Weaknesses to a Route an Attacker Could Follow
Traditional vulnerability management often starts with a large inventory of findings. Severity scores help organize that inventory, but they do not, on their own, explain whether a weakness provides access to an important asset or combines with an identity problem elsewhere in the environment.
GravityZone Exposure Management brings together operating-system and third-party application vulnerabilities, insecure configurations and risky user behavior. Its external attack surface management capabilities extend that view to internet-facing assets, including exposed subdomains, misconfigured services and shadow IT.
The attack-path component adds relationships between those findings. It maps exposures, identities and critical assets so defenders can examine how an initial foothold might lead to a more consequential destination. The practical question becomes which remediation would interrupt that route, rather than simply which individual alert has the highest score.
Bitdefender’s technical explanation of Attack Path describes a graph assembled from existing GravityZone telemetry. Accounts and devices appear as connected nodes, with explanations of the techniques that could enable movement between them. A shortest-path view helps analysts isolate a direct route while retaining alternative branches for investigation.
These graphs represent potential exposure, rather than evidence that an attacker is currently moving through a network. That distinction matters: a useful path model guides preventive work, while incident detection and response still require their own evidence and workflows.
Behavioral Hardening Targets the Abuse of Legitimate Tools
Discovery alone does not remove risk. The new offering also incorporates PHASR, Bitdefender’s Proactive Hardening and Attack Surface Reduction technology, which learns patterns of legitimate activity and uses them to guide restrictions.
This addresses a difficult defensive problem: attackers frequently use tools that administrators also depend on. PowerShell, for example, can support essential maintenance or help an intruder execute commands. Blocking a tool everywhere may disrupt operations; leaving it unrestricted everywhere preserves opportunities for abuse.
PHASR uses behavioral baselines to identify where access to such tools is necessary and where it can be reduced. According to Bitdefender’s PHASR documentation, profiles are specific to user-device pairs. Administrators can review recommendations in Direct Control mode or use Autopilot to apply them automatically. Learning typically requires 30 to 60 days, although existing EDR history can shorten that period.
The operational choice is significant. A team can start by reviewing proposed restrictions and testing their effect on important workflows before moving toward more automation. Behavioral learning supports that decision, but application ownership and exception handling remain part of a successful rollout.
Why Lean Security Teams Struggle to Turn Visibility Into Action
Bitdefender frames the launch around the gap between identifying weaknesses and consistently fixing them. In a company survey of 1,200 cybersecurity practitioners cited in the announcement, 38% identified the overhead of maintaining hardening rules and exceptions as a challenge. Fear of operational disruption followed at 35.4%, while resource constraints were cited by 34.6%.
Those findings help explain the appeal of connecting discovery, prioritization and hardening in one workflow. A team may already know that an account is overprivileged or that a server needs attention. The harder task is deciding what to change first, who owns the change and whether a restriction will interfere with legitimate work.
Andrei Florescu, president and general manager of Bitdefender Business Solutions Group, said in the announcement that AI and automated scanning make it easier for adversaries to identify an unpatched server or an overprivileged user that could provide a foothold. Bitdefender’s proposed response is to combine a broader view of exposure with hardening that adapts as activity changes.
For buyers, the value will depend on whether that combination produces fewer exploitable routes and faster remediation. A growing dashboard of findings is useful only if teams can translate it into changes they can verify.
Deployment, Licensing and the Limits of the Bundle
The launch announcement specifies Windows availability for new and existing customers, with additional operating-system support planned. Bitdefender is offering the product as an add-on for GravityZone Business Security Enterprise and higher tiers, and as a standalone option that can sit alongside an existing endpoint-security solution.
Its Exposure Management deployment documentation lists PHASR, Risk Management and external attack surface management among the included capabilities, with Attack Path and Unified Identities identified as Early Access features. Organizations should distinguish access to the overall offering from the maturity and availability of each component.
The same documentation makes another useful distinction: AI Visibility and Control and Patch Management are separate add-ons. Finding a missing patch, recommending remediation and deploying that patch are related jobs, but buyers should confirm which actions their selected license actually supports.
A More Connected Approach to Preventive Security
GravityZone Exposure Management reflects a wider shift toward evaluating weaknesses in context. The security significance of a device depends partly on what it can reach; the significance of an account depends on what its privileges enable. Bringing those relationships together can make preventive work more targeted.
The strongest use case is a security team that already has more findings than it can comfortably process and needs a clearer order of operations. Attack-path analysis can help explain where to intervene, while behavioral hardening can narrow the tools and privileges available along those routes. The measure of success is whether those interventions reduce exposure while preserving the work the business needs to do.