Tanium expands Atlas with autonomous threat hunting and exposure management

Tanium has expanded its Atlas platform with security tools designed to investigate operational issues, identify exposed systems and carry out approved responses across enterprise devices. Unveiled at Black Hat USA 2026, these additions span AI agents, exposure management and security operations. Through this update, Tanium positions Atlas as a governed framework where organisations can establish strict boundaries for automated tools while keeping an auditable record of every action.

To support this model, the expansion introduces background agents that continuously monitor systems without requiring user prompts. The platform also adds specialised tools to trace how attackers could pivot from internet-facing assets into internal networks, alongside AI-assisted threat hunting capabilities across connected endpoints.

Atlas gains continuous monitoring and wider automation

Built on the Tanium Autonomous IT Platform, Tanium Atlas guides operators directly from initial problem identification to resolution within a single environment. A key addition is the Agentic Performance Analysis capability, which automatically investigates sluggish devices to pinpoint root causes and eliminate manual log comparisons. Working alongside this feature, background AI agents continuously identify issues and execute complete alert-to-resolution workflows within boundary rules set by the organisation.

Automation within the platform expands further through Tanium Automate, which now supports endpoint-level sequence execution so playbooks can run directly on individual devices. To link these local workflows with broader IT systems, a generalised API step connects automated sequences to external applications using REST and GraphQL interfaces. Tanium describes Automate as the governed execution layer that converts endpoint data and AI recommendations into coordinated actions across connected environments.

Additionally, a dedicated Tanium Atlas MCP Server exposes approved platform data and actions as tools inside compatible AI services, including Claude, Microsoft Security Copilot and Copilot Studio. Leveraging the Model Context Protocol, the server ensures external interactions remain subject to the access controls defined within Atlas.

Highlighting the need for these guardrails, Harman Kaur, chief technology officer at Tanium, cautioned that deploying AI agents without sufficient oversight exposes organisations to new risks. “At Black Hat USA 2026, vendors will be talking about AI agents and tools. What fewer will acknowledge is that ungoverned agents are themselves an emerging attack surface,” said Kaur. “Tanium is the platform that governs and manages them with Tanium Atlas, where every action is auditable, boundaries are enforced, and everything is grounded in what’s actually happening on the endpoint right now. What we are introducing at the conference extends that same principle across the full lifecycle from external exposure to detection to remediation.”

Exposure tools connect external assets to internal risks

Beyond managing internal endpoints, the platform update provides security teams with broader visibility into internet-exposed infrastructure. By combining real-time internet intelligence from Censys with internal device data collected by Tanium, the External Attack Surface Management capability continuously discovers internet-facing hosts, services, web properties and certificates, correlating them directly with internal endpoint records.

Building on this unified view, Attack Path Mapping illustrates the precise routes an attacker might take to move from an exposed asset to sensitive internal systems.

Rather than treating all vulnerabilities as equally urgent, this mapping helps security teams identify fixes that eliminate the highest concentration of attack vectors. Tanium noted that this structured approach allows operators to prioritise weaknesses based on how close they bring an attacker to critical enterprise assets.

AI guides threat hunting across connected devices

To help security analysts proactively hunt for malicious activity, Tanium is introducing Agent-Guided Threat Hunting. Analysts can describe a suspected threat in plain language, prompting Atlas to select the appropriate investigation tools, execute the search across all connected devices and map the results directly to the MITRE ATT&CK framework.

In parallel, an integration with Google Threat Intelligence is entering private preview, combining threat data from Mandiant, VirusTotal and Google with Tanium’s real-time visibility across more than 36 million global endpoints. By validating external threat intelligence against live environment data, security teams can quickly confirm whether a threat is active on their network. This validation gives investigations a high-confidence starting point while cutting down the time analysts spend chasing false positives, allowing operators to move seamlessly from threat intelligence analysis to live endpoint remediation within the Tanium platform.

“Effective security operations require both high-fidelity intelligence and the ability to act on it instantly,” said Miton Adhikari, head of Google Security OEM Partnerships at Google. “By incorporating Google Threat Intelligence into Tanium’s real-time visibility and control across endpoints, Tanium operators can validate signals against what’s actually running in their environment and rapidly move from intel to remediation, at scale.”