Seemplicity Exposure Management & Response

I have been using Seemplicity for the last two plus years across various different use cases and have been working closely with the company almost from day one, supporting client engagements and different use cases across various different geographies.

There are three main use cases for Seemplicity. The first use case is around signal to noise ratio. Seemplicity has an amazing capability to perform aggregation, deduplication, and consolidation of various different telemetry sources to help organizations limit the signal-to-noise ratio and get a better understanding from a visibility perspective in terms of what they are dealing with, and how they should prioritize elements. The second use case is around prioritization. Even once you have optimized the number, it is still very difficult for various different enterprises to understand the priority when you overlay the business context, when you take information from threat intelligence, exploitability, business criticality metrics, and other business-related context. This helps organizations and enterprises understand top-X priority, what they need to deal with first and why. The third use case, which is lately seeing growing focus around remediation with Mythos and others, is that Seemplicity has a great ability to integrate with systems such as Jira and ServiceNow, ingest ticket information, identify the right grouping in Jira, translate this into user stories so that they can be inserted into the next sprint and as such streamline remediation activities. The focus is shifting from purely operational related noise level into more advanced use cases, specifically in light of the recent focus around Mythos and the growing emphasis on remediation and streamlining remediation activities.

The biggest impact we have seen is around the first use case with the signal-to-noise ratio. What we are seeing in many client environments is exponentially growing incoming volume of telemetry from a growing number of sources. Gartner is saying close to thirty different telemetry sources in an environment from engines that are scanning code, applications, pipelines, configuration data, cloud telemetry, outputs from vulnerability scanning, threat intelligence, and much more. There is a lot of duplication and a lot of noise. Where we have been able to show immediate impact is through using this platform as an aggregator and as a business layer to really help organizations have better visibility, better context, limit the volumes, and have a better understanding of what they are dealing with.

It was really humbling to see how Seemplicity platform evolves. Initially, the key value and features were around the engine, the ability to correlate, aggregate, normalize, and deduplicate, as well as features around finding the developers, the ability to integrate with Confluence and Jira, identify where the different teams are, capture the information, the Jira stories, help them translate this into Jira points, and help them understand available velocity so that they can actually insert requests around security elements into the next sprint. This is where the traditional values for the platform reside. Recently, they have added some AI-related elements. The ability to use plain English to search for information, to look for certain patterns of behaviors, and to identify gaps and outliers is an amazing new feature with the platform and this is a recent addition.

Seemplicity has put tremendous effort into improving the overall user experience and UI. The recent versions of their platform provide quite a positive experience. There is always a need for new widgets and new metrics. The ability to allow every organization to build their own dashboard, metrics, trending, and reporting to their liking would be a great value add. Also, for every organization, given they are different, they need the ability to slice and dice information in a different way. This is some food for thought in terms of adding more metrics and adding more flexibility. The capability out of the box today is decent, but over time, if we can allow users and organizations to build their own view and how they want to report on things, that would be a great value add.

Governance and security have certainly been thought through in the product. If I look at where the market is going around governance and auditability, there is certainly room to think about integrating with other tools. For example, a central repository to track AI-related activities. At the moment, this is built into the platform. In terms of a roadmap item, thinking about governance, auditability, and integrating with other tools for a central repository would certainly be something to consider.

I have been using Seemplicity for the last two plus years across various different use cases and have been working closely with the company almost from day one, supporting client engagements and different use cases across various different geographies.

I have no complaints. The overall experience and interactions with customer support and the product organization, both of which I have spoken to over the years, was quite positive. Seemplicity is quite accommodating, specifically if there is an issue with the platform, but also with requests for additional features and roadmap items. The business was overall quite accommodating, obviously in line with market demand and other requests from other clients.

From our experience, the system was quite effective both in terms of availability and scalability. In terms of the operating region, data residency, and the ability to scale over time to accommodate growth in volume, additional operating regions, and additional zones, the system is quite scalable and was able to easily adapt to changes and growth within the business.

I want to mention that over the last few years, we had an open communication channel with Seemplicity team. We had the ability to provide feedback and request for new features, and the team overall was quite accommodating. Most of the things we have been asking for have already been implemented, and the team has been quite aligned with market demand and where the market is going, so all very positive.

This was not a one-for-one replacement. We had scanning engines and various different sources of telemetry. We were either in-house built, using Excel sheets, or native modules for VM scanners that offer some aggregation. However, we did not have anything to the extent of a single aggregator that takes feed from everything, gives us visibility and context across the board, and integrates with the back end. I see this as the next evolution in exposure management, and this tier of business logic in between is served well by Seemplicity.

The simple answer is yes. In my view, this is one of the areas, and in my experience, it is important to look for friction and pain. Seemplicity is certainly associated with a few areas where there is obvious friction and obvious pain, and as such, it was fairly easy to demonstrate value for money. Some of the recent focus areas such as remediation is obviously a slow move that requires a lot of education and multiple touch points. However, we certainly had multiple opportunities to demonstrate value for money and a good return on investment.

Our overall experience was quite positive. Seemplicity had the ability to be competitive. I have dealt with them in several other opportunities as well. They know the market and they know the competitors. Seemplicity has a compelling offering in terms of the platforms and the module, and from a commercial perspective, we have not had cases where we lost on price. The value for money is seen by most clients and as a client as well, I think we got a fair price for what we pay for.

We did evaluate other options. On one hand there were solutions such as ServiceNow with the specific modules applicable here, and on the other hand there were enhancements of VM engines such as Rapid7, Tenable, and Qualys. They all offer some level of aggregation and reporting that can help. We explored developing certain capabilities in-house through various automation tools, from using things such as Ansible to various different coding we have implemented before. The conclusion was it is not scalable, it is not reputable, and it is too costly. We lost skills over the years, and investing in one platform that covers so much ground was the right decision for us.

As I mentioned earlier, organizations are going through the journey. The low-hanging fruit is around operational issues where we have seen over the years high levels of friction. With the focus and urgency around Mythos, I can specify a few recent engagements where the focus was around remediation. The ability to integrate with different teams and build workflows with specific gates for approval to really have full control while streamlining, reducing, and better aligning with SLAs, and reducing response time to patch critical systems, has been instrumental. We had a few recent engagements where organizations were able to better meet their SLAs, better communicate to their leadership and executive level about the overall risk and exposure levels, and overall have a better understanding of what they are dealing with.

If I need to identify some of the areas that are big selling points, they would be visibility, having more accurate numbers, removing all the overhead in terms of duplication, and really understanding what you are dealing with. Being able to see the patterns or associate this with specific platforms and specific applications, then streamline conversations with the right business peers and owners is valuable. Now with the ability to use plain English, this is in support of a specific outbreak or specific element you are looking for, which now can be done within a few seconds to get the straight answer. Specifically with Mythos, to try and understand what is potentially exploitable and what are the true levels of exposure associated with key services you take to the market are amazing features on the platform.

Seemplicity is doing amazing work. Specifically with simple tasks, they are getting better at more complex, multi-dimensional tasks. This is in line with the recent enhancements we see with other LLMs. This is why I was saying earlier, it would be nice to see over time things such as bring your own LLM. That would allow access for an external module that can access the data and apply the different queries. Seemplicity is doing a decent job. However, as the market is getting more accommodated to this type of interface using smart bots with plain English, requirements are going to grow as well in terms of complex, multi-dimensional searches. This is a very positive add-on and it is worthwhile keeping an eye on this because this is going to evolve over the next coming months or years.

Organizations should think about the true cost of ownership and what it would take to implement and operate this type of platform. There are great opportunities and benefits around Seemplicity platform.

My main use case for Seemplicity is aggregating vulnerability data and tool rationalization.

For aggregating vulnerability data, I connected all of our different data sources, deduplicated them, deduplicated the findings, and assigned them. For the data sources I used, Wiz, Qualys, Imperva, and Active Directory, I connected all of them together and ensured that I did not have duplicate findings going to individual users. I sent those findings via Jira and ServiceNow, two different platforms, based on where the users were located.

For tool rationalization, I had several different tools that were duplicative. Wiz and CrowdStrike were finding the same thing, so I was able to cut some licenses from Wiz. GitHub Advanced Security was doing the same thing as Snyk scans as well as several other tools. I was able to cut about $150,000 in licensing spend. I was able to evaluate all of our different tools and remove licenses that were not being used or were duplicative elsewhere. I was able to cut about 2x what I actually spent for the product.

Seemplicity's best features include deduplication and aggregation, tool rationalization, and the AI chatbot.

Regarding the AI chat feature for deduplication and aggregation, the time to market was extremely long for some of the other tools I evaluated. I had to manually map different tools and different vulnerabilities that I thought were important, where Seemplicity used AI to do that. As for the AI chatbot, Seemplicity does a fairly decent job at providing substantive dashboards to give me different metrics. When I want a deeper dive than what the dashboards can do, the chatbot is there to let me take an extremely deep dive. It lets me join different data sources, where I could not do that necessarily with some of the other tools.

Seemplicity has helped me draw down my known vulnerability count by about 45%.

Seemplicity can be improved by adding additional graphs and charts that make it easier to do trending over time. I had to do some of that manually via manual reports, but Seemplicity already has a feature request for this.

Seemplicity has done a pretty good job of keeping up with integrations. One gap that I identified and that Seemplicity is trying to fill now is having a complete end-to-end mapping. Seemplicity currently looks at the external attack surface using tools like Censys, and then looks at the internal side, examining what is in AWS and other clouds using CSPM. However, there is not anything that currently ties a property on the outside to a system on the inside, especially when you have additional security layers like web application firewalls that actually mitigate the risk.

I have been using Seemplicity for two years.

Seemplicity is stable.

Seemplicity's scalability is good because they changed out their data source type during the middle of my evaluation. I never hit any sort of wall. They went from a Postgres database to a ClickHouse database and that gave me the capability to build a lot more charts on the fly.

Seemplicity's customer support has been excellent. I had a TAM, so it was never an issue for me. I have never had to actually open a ticket myself, neither has anyone on my team. I called my account manager and they handled it for me. I would rate the customer support a 15 on a scale of 1 to 10.

I did not have a solution in place before, but I was manually aggregating things in a spreadsheet.

My experience with pricing, setup cost, and licensing was that I first purchased for one year, as I always do, just to make sure that the tool has value, and then I purchased for three years after that. The pricing did not increase dramatically from year to year because I maintained a similar number of data sources and similar integrations.

I use AWS as my cloud provider. I did not purchase Seemplicity through the AWS Marketplace.

I have seen a return on investment because the time to actually do the assignment of a task is much less. The number of employees that would have had to look at a particular set of errors from different tools or vulnerabilities has decreased dramatically. I had seven different tools that sometimes produced the same message. Because one employee can do a lot more vulnerabilities, it is a lot better from a timing perspective on how many people I would need to do the work. I was also able to pay for the tool twice over by using it for tool rationalization. I was able to cut the amount of licensing from other tools to make up for what the cost of Seemplicity was times two.

My company has just the relationship with Seemplicity. I actually went through a VAR to purchase Seemplicity.

Before choosing Seemplicity, I evaluated other options including ArmorCode, Vulcan, and three other tools. The names of the three other tools are escaping me.

The advice I would give to others looking into using Seemplicity is to make sure you correlate all your data sources that you are going to want to bring in up front. Make sure you have security review and API tokens ahead of time. Getting some of that data causes a little bit of churn, especially teams or systems managed by different teams, such as ticketing systems that were managed by different teams. Whether you are evaluating Seemplicity or other solutions, you are going to need access to that to be able to do a full end-to-end test. I would rate this product a 9 out of 10.

I have been working in my field for approximately 25 years. At my job, I am in charge of designing, scaling, and the governance aspect of AI and machine learning products. My primary focus is ensuring that the products we ship do not have any vulnerabilities. I work on the product security side.

Understanding the products that are going to be shipped and identifying which ones have the biggest impact to the business is really important to us. For example, if a certain team can only handle so many vulnerabilities within one sprint cycle, we are able to track that within Seemplicity and ensure that what they are focusing on is exactly what they should be focusing on. Seemplicity has remediation guidance built in.

My team is on the receiving end of things with Seemplicity at times, and what I love is that it integrates directly with Jira. There are AI capabilities that ensure the Jira tickets or the remediation requests that show up are actually the things that the team needs to be doing. The steps are very clear, the guidance is very clear, and the audit trail is very clear. The information that gets passed to the ticket is all very clear and straightforward, and the team understands exactly what they need to do.

Seemplicity has really helped the relationship that we have with the security operations team and the broader vulnerability management team because it helps us and them speak the same language and get on the same page when it comes to what we are focusing on.

Before we really struggled with meeting SLAs that were in place because we did not have the information we needed and there was too much back and forth. Now we nearly have a perfect SLA meeting time.

I would appreciate the ability to interact with Seema outside of Seemplicity. Seema is the chat assistant, and it would be great if my team could interact with her from Slack.

Because my team is happy, which makes me happy. Given that transparency and data usage are a specialty area of mine, I really appreciate the transparency and the thorough documentation Seemplicity has around the way they are using our data in models. That has been really great and it has definitely been adequate for our team.

I actually just started using Seemplicity at my current job about four or five months ago when I started.

We have not had any issues, so I would say it is pretty good.

A lot of it has to do with the audit trail, so every action is logged within Seemplicity, making sure we understand what happens with the particular vulnerabilities and findings that have been identified. Everything is very thorough.

I have heard that customer support is good from my colleagues. I do not deal with it specifically. If we have any issues, usually the vulnerability management team reaches out. I have been on a couple of calls as an observer, and they have been fantastic.

The vulnerability team was using a solution called Nucleus and they switched because it could not handle the scale that they were beginning to get and also really struggled with code-to-cloud use cases.

We actually considered building it ourselves but very quickly determined that that was not an adequate solution for us.

I would recommend making sure you pull in all the stakeholders, including the recipients of the tickets, and give them a chance to see what will actually be coming to their team and ensure that it is adequate to get things done. I was not involved in the original negotiation, but I heard no complaints. I would rate this review a 10.

The main use case for Seemplicity is centralizing vulnerability and risk findings from multiple scanners and tools into a single queue instead of chasing spreadsheets across teams. I am also using it to drive remediation ownership, routing findings to the right infra, app, and dev teams instead of InfoSec manually triaging everything.

I have several additional angles I could add about my main use case for Seemplicity. One is about standardizing across a diverse group, as our X-Press Feeders Group has multiple subsidiaries that likely had inconsistent, siloed vulnerability processes before. Seemplicity gives us one standardized workflow across all of them instead of each entity managing remediation its own way. The next point is supporting a formal vulnerability management program; part of what I am doing is building out a more mature, structured VMT function this year, and Seemplicity is the backbone for that. It actually gives the actual workflow and accountability, not just a tool, but the operational layer for how vulnerability management gets done day to day. I am also using Seemplicity to feed the leadership reporting, primarily to pull remediation status into my quarterly reviews for our senior leadership.

Regarding Seemplicity's best features, a few things stand out for me. First, it pulls everything into one place: findings from the tech stack that we have and all our different tools. We use one for cloud, one for all our office systems, and some for our software engineering. Instead of my team jumping between five different dashboards, this tool is very helpful. Second, the way it handles ownership and routing is genuinely useful because it figures out who actually owns a finding and routes it there automatically, which used to be a huge manual headache for us, especially across a group with multiple entities. My favorite feature right now is Seema, their AI assistant; instead of digging through filters and dashboards to answer a simple question, I can just ask it directly, for example, "What's breaching SLA right now?" and get a quick summary I can bring straight to the leadership. This saves a lot of time for me, and it is one of those features that once you start using it, you do not want to go back to doing it manually.

The biggest impact Seemplicity has had on my organization is turning what used to be a fragmented, manual process into something structured and accountable. Before, we had vulnerability data scattered across multiple tools and multiple entities in our group, and a lot of time went into just chasing people down: Who owns this? Has it been fixed? Where does this stand? Seemplicity took that coordination overhead off our plate. Ownership gets mapped automatically, tickets get routed to the right team, and nothing falls through the cracks the way it used to. That has had a real ripple effect; my team spends less time on manual triage and more time on actual risk reduction. It also strengthened how we show up for compliance: Audit-ready reporting for things like ISO 27001 and SOC 2 used to mean pulling together data manually. Now, that visibility is just there when we need it. Seema has amplified all of that. She is my go-to person because I can just ask it questions directly instead of digging for answers. I can move faster and bring leadership clear, accurate updates without a lot of prep work. Overall, it has shifted us from being reactive and scattered to having a much more accountable, structured approach to vulnerability management across the whole group.

For Seemplicity, I would say two things for improvement. First, reporting customization could go further because this industry is evolving; the CEO tries to get much information that they are looking for. The dashboards are solid for the most part, but every now and then, I want to slice the data a slightly different way for a specific leadership ask, and I have to work around that a little. That is number one. Number two, with the introduction of AI and agentic AI and more involvement in day-to-day tasks, it would be great if this platform starts remediating the vulnerabilities as well. Right now, it just displays what is vulnerable and where it is coming from, but they need to go one step next by fixing it as well, provided the tool gets approval from the owner, from me. If I am okay and if this tool goes ahead and fixes it, then nobody can stop Seemplicity.

I have been using Seemplicity in this current company for the last two years.

Seemplicity is stable.

I do not see any challenges with Seemplicity's scalability. The only aspect is you need to make sure that whatever you want to integrate or ingest is covered as part of the contract. The contract is based on the data sources that you connect; as long as that is covered, connecting ten data sources or twenty data sources, then you are good. Other than that, when it comes to the volume of data ingestion, I have never had any challenges with them, and they pretty much stick to what they promise.

The customer support for Seemplicity is fantastic.

We did not have a direct predecessor doing what Seemplicity does; we use Lansweeper for asset discovery and inventory, and we actually looked at Axonius at one point for broader asset visibility. Neither of these tools is built for remediation orchestrations. They will tell you what assets you have, and in Axonius's case, give you a consolidated view of your attack surface, but they do not solve the problem of taking findings and actually driving it into a resolution, assigning ownership, routing it to the right team, and tracking it against SLA. That gap is really why we brought in Seemplicity. Instead, Seemplicity sits downstream and does the orchestration piece neither tool was designed for.

On the integration side of Seemplicity, it has been seamless connecting it with our existing tools. We are not ripping out anything we already rely on; it just sits on top of these tools and pulls everything into one place. That vendor-agnostic approach matters a lot to us since we did not want to be locked into a scanner ecosystem, especially with a group as spread out as ours across multiple entities.

I have not put a formal dollar-for-dollar ROI calculation together, but directionally, Seemplicity has paid off. The clearest signal for me is time. Before Seemplicity, a meaningful chunk of my team's week went into manually chasing ownership, status updates, and pulling together reports across our different entities. That coordination overhead has dropped substantially. I could not give you an exact percentage, but it has freed my team to spend more of their time on actual remediation instead of admin work. On the compliance side, prep time for audits and leadership reporting has also gone down; what used to take real manual pulling together is largely already sitting in the dashboards now. Given what we are paying, I would want to see that translate into a harder number eventually, but qualitatively, the shift from reactive to structured and automated has been real.

Regarding Seemplicity's pricing, setup cost, and licensing, I will be upfront that I cannot get into specific figures because that is commercially sensitive on our end. But directionally, the value has matched the investment. Setup was straightforward enough that we did not need any heavy professional services to get going, which kept implementation costs reasonable. Licensing was clear and predictable; I appreciate there being no surprise costs creeping in after the fact, especially as someone who has to plan budgets. Given the time it has saved my team on manual coordination and reporting, I would say it has paid for itself in efficiency even if I cannot put an exact ROI number on that.

We did not evaluate any other options other than Axonius, but Axonius and Seemplicity serve two different purposes. Seemplicity is something I got very positive feedback on from a very good friend who is a CISO. He recommended it, and that is how I started exploring Seemplicity, and it proved to be a good tool.

A few pieces of advice I would give to others looking into using Seemplicity are as follows. First, go in with clear eyes on the investment; it is not cheap, and so it makes the most sense if you have real complexity to manage, as is the case with us: multiple teams, multiple entities, and findings scattered across several tools. If you are a small, single-team shop with a simple environment, the value proposition is a lot less obvious. Second, budget time up front to tune the prioritization and routing rules to match how your organization really works; do not expect it to be plug and play on day one. That initial setup iteration is worth doing properly rather than rushing. Finally, do not overlook Seema, their AI assistant; I use it constantly to pull answers instead of digging through dashboards myself, and if you are evaluating the platform, it is worth specifically testing that in a demo rather than just looking at the core orchestration feature. Overall, if you are dealing with fragmented vulnerability data across a complex, multi-entity environment, and the manual coordination overhead is a real pain point, it is worth the investment. If your environment is simpler, you may not need something this robust. I would rate this product a nine out of ten.

The main use case for Seemplicity is automating vulnerability tickets creation by using predefined asset scopes. I use Seemplicity's remediation queues to automatically feed vulnerability tickets into our remediation owners native Jira projects, ensuring that the entire process end to end is automated. The automation allows us to maintain control over ticket volume while ensuring nothing falls through the cracks.

The best features Seemplicity offers from our perspective include the ticketing queue automation, which allows us to create unique ticketing queues specific to each remediating team, and the various customizability around severity assignment, and rules that help us alter the priority or severity level as appropriate to our business.

Ticketing queue automation in Seemplicity has freed time and resources for my team because it reduces the time we spend on manually cutting tickets. Instead we can focus on tuning the automation, scopes and queues which scales with time.

More customizations around the scoping, filters, dashboarding/metrics would be great.

I have been working in my current field for about eight years.

Seemplicity is stable.

For our use, the scalability is good because it is very easy to setup new scopes and remediations queues.

Customer support for Seemplicity is quick to respond and provide feedback to any issues or feature requests that we have requested.

We previously had Daz, which was acquired by Wiz, and we switched because the vulnerability management capabilities inside of Wiz were not satisfactory at the time of purchase.

I do not have any specific metrics to share regarding return on investment, but Seemplicity has saved us time and overhead.

We found the pricing, setup costs, and licensing for Seemplicity to be extremely fair.

We evaluated a couple of other options before choosing Seemplicity, including Nucleus and Armis.

My advice to others looking into using Seemplicity is to make sure that you have your primary use cases documented and measure the success of the proof of concept against your requirements.

My main use case for Seemplicity is ticketing all of our security findings to the service teams for remediation and prioritization. I use Seemplicity for our security tools such as Wiz in the SaaS environment, Tenable for on-prem, GitHub, and Fossa for our code side. Instead of ticketing everything critical, I rated it based on CVSS and EPSS so that the teams are focused on what needs to be fixed based on criticality.

I really appreciate the AI agents that test reachability and exploitability, particularly with the host agent which can look at CrowdStrike and Wiz telemetry and also the code analysis to see if a function is actually reachable.

They are really useful for exception requests, which used to be a manual analysis, but now it takes that burden off the analyst to allow them to look at all aspects of the CVE, the asset, what it is hosted on, and how it could be exploited.

Seemplicity has allowed us to have all findings in one single pane of glass and the service teams use it to track metrics, file exception requests, and our overall ticketing Kanban process.

We have seen improvements in remediation rates. Initially, a lot of our metrics were in the red, but now all are in the green or yellow.

Seemplicity could be improved with some of the aggregation accessibility. Currently, it is a bit of a black box and can be a bit of a bottleneck. It would be nice if customers could perform the aggregation themselves on the spot to reduce that bottleneck.

I have been using Seemplicity for 1.5 years.

Seemplicity is stable.

Seemplicity's scalability is great.

Seemplicity's customer support is great.

I previously used an in-house model and switched because it was not sustainable or scalable.

I have saved a significant amount in ticket churn and developer analysis when having them remediate vulnerabilities, though I do not have an exact number.

My experience with pricing, setup cost, and licensing for Seemplicity was great. They gave us unlimited licensing for automation and we have a lot of tools at Omnicell, so it has been very easy to work with them on this front.

I evaluated other options before choosing Seemplicity, specifically Brinqa and Nuclei.

My advice to others looking into using Seemplicity is that if you do not have an existing RemOps platform or you are looking to improve, it is a great product. I would rate this product a 10.