Sort the four workflows by which direction the model's output runs. Three of them subtract. Keystone takes a stated security intent and has the model investigate attack paths and exposures and identify the appropriate remediation [5]. The Autonomous Workspace Platform correlates email, endpoint, mobile and browser telemetry and uses the model to issue verdicts, severity and remediation guidance in place of a raw alert queue [6]. The exposure pipeline exists to strip theoretical findings out of the real ones [4]. In all three, a wrong model answer removes work rather than creating it, and that is the error direction no SOC metric surfaces.
NexPloit runs the other way. It generates the attack material rather than filtering findings [7]. The by-product is a body of verified working exploit material sitting inside a vendor research pipeline that the customer never sees [13].
Then there is the counting. Four workflows are named, and exactly one carries a stage label: the exposure validation pilot [4]. The phase paragraph says some capabilities run in production today and others are in development with design partners [8], without mapping products to either. That leaves three of the four unplaced [9]. No dates, no model versions, no customer or deployment counts appear in the post [10], so scale here is a direction of travel rather than a measurable fact.
Design-partner status is a procurement state as much as an engineering one. The customers in that cohort are the ones whose live risk decisions the newest logic touches first [8].
What a security team is being asked to delegate is narrower than the announcement's framing. Logic that adds an alert is cheap to audit, because you see the alert. The logic on offer here concludes that an attack path is not exploitable, and therefore that a host does not need fixing [4]. That conclusion looks identical when it is right and when it is wrong, until somebody else finds the path. The number that governs the exposure is the rate at which the pipeline downgrades something an attacker can reach, and no such figure is published [10].
