WithSecure uses Luminen to explain exposures and security incidents

WithSecure connects exposure management and XDR through Elements and Luminen AI. Explore guided remediation, modular licensing and evidence boundaries.

01 / ProductElements connects exposure reduction with incident investigation

WithSecure provides business cybersecurity through the WithSecure Elements platform. Its main product areas include Exposure Management, or XM, and Extended Detection and Response, or XDR. Luminen is the AI layer used to explain findings and guide the people operating those products. The useful question is whether that explanation helps a team choose and complete the right security action with evidence it can understand.

Elements Exposure Management combines information about devices, identities, cloud resources, networks and external exposure to prioritise remediation. Elements Extended Detection and Response brings protection and investigation across endpoints, identities, collaboration and cloud environments. These are related but different workflows: one asks what to fix before an attacker benefits, while the other asks what happened and how to respond.

The company remains an active business security provider under the WithSecure name. Its Diana BidCo ownership announcement, dated 26 March 2026, says Diana BidCo gained title to all shares and the company was delisted that day. Current Elements documentation remains published under the WithSecure brand. Buyers should use current WithSecure product and contractual material rather than assuming older stock-market or corporate descriptions are still current.

02 / AudienceLean security teams need an explanation they can turn into work

A midsize organisation may have enough technical capability to fix a configuration but too little time to investigate every finding from first principles. WithSecure is worth evaluating when the recurring problem is deciding what matters, understanding why it matters and assigning a practical next step. An explanation earns its place when it helps a responsible person act correctly without losing the underlying evidence.

A service provider has an additional requirement: the recommendation must remain understandable across different customer environments and support roles. A customer’s internal IT team may approve a change while the provider carries it out. The product should support a handover that makes the affected asset, expected effect and remaining uncertainty clear to both sides.

Huntress is an adjacent comparison when human-led managed security operations are central to the requirement. SentinelOne offers another platform context for AI-assisted endpoint operations. Compare the degree of service support, evidence access and operational responsibility. A guided product interface and a contracted team of investigators solve related problems, but they are not equivalent purchases.

03 / WorkflowProposed workflow: turn an exposure into a verified improvement

Choose a small authorised environment and one known, low-risk configuration issue. Record the affected asset, its business purpose and the existing security setting before evaluating any recommendation. Include the person who owns the system and the person who may approve a change. This proposed workflow is not a completed WithSecure test or a claim about its discovery accuracy.

Inspect the finding in Elements and ask whether its asset identity, observed condition and time are correct. Review the surrounding relationships before accepting the priority. A vulnerability on an isolated test machine may deserve a different response from the same vulnerability on a service with valuable access. The reviewer should understand the connection that makes the finding consequential in this environment.

Use Luminen’s explanation to draft a short change request. It should state the observed condition, the proposed action, the reason for the action and what could be disrupted. Compare that account with the underlying finding and the system’s configuration. A useful explanation can simplify terminology, but it must not quietly turn a possible attack path into a claim that an intrusion has already occurred.

Before carrying out the fix, confirm which product supplies the action. The XM page describes one-click patching through Software Updater with an Endpoint Protection licence requirement. An exposure-management finding is not proof that the buyer has licensed or configured every remediation tool. Make that dependency visible in the trial so a later rollout does not stop at the recommendation stage.

Apply the approved change in the test environment and check the business function afterward. Then verify whether the finding is cleared or meaningfully reduced when the product reassesses the asset. Record when the new evidence arrived. A successful command and an updated exposure state are different pieces of evidence, and either may lag behind the other.

Complete the exercise with an incident-oriented example in XDR, using authorised historical or benign test data. Compare the generated explanation with the event sequence and produce a handover for another analyst. Measure unsupported conclusions, missing qualifiers, time to verify and the effort needed to complete the task. The goal is a dependable security procedure, not simply a readable summary.

04 / PricingLuminen is included in context, while the platform remains modular

The WithSecure Elements platform describes Luminen as included for relevant Elements users, and the XM page explicitly includes it with an XM licence. This is an entitlement within the security product, not a free standalone assistant. The underlying modules and any operating service still need to match the environment and the actions the organisation expects to take.

The WithSecure pricing describes annual, monthly and usage-based purchasing approaches through its partner model, alongside a 30-day trial without a credit card. It does not establish a single public currency price for every combination of modules and services. Request a regional proposal with the exact endpoint, identity, cloud and support scope instead of comparing an isolated promotional amount.

Price the workflow from discovery to completion. An exposure module can identify a problem while a different module provides the response control. A service provider may also charge for monitoring, interpretation or remediation work. Ask the proposal to separate product access and operational responsibility so the organisation knows which parts of the intended procedure are included.

05 / DistinctionsPrepared context makes Luminen a specific kind of assistant

The WithSecure Elements privacy policy, effective 24 September 2026, describes Luminen using prepared security context rather than allowing the user to define arbitrary prompts or letting the model freely query across Elements. That is a useful distinction from a general conversational investigation agent. Evaluate the quality of the supported explanation and guidance flows rather than expecting an unrestricted chat interface.

This narrower interaction can make evaluation more concrete. The team can compare the same class of finding before and after explanation, check the relationship between the source data and the summary, and identify whether the recommended action is suitable. It also means a buyer should ask for a demonstration of the exact supported workflow when a requirement involves open-ended hunting or a highly specialised question.

06 / QuestionsCheck the data path and product dependencies behind a broad platform view

The privacy policy describes use of large language models through Amazon Bedrock in Europe and says data is not used to train foundation models. It separately discusses anonymised information for other training and development purposes. Those are specific processing statements, not a blanket claim that no security data is processed or retained. Review the applicable agreement and settings for the actual deployment.

The XDR page identifies module dependencies for identity and cloud functions. In a trial, enumerate the data sources required for the intended incident view and confirm the relevant subscriptions. A platform diagram that connects endpoints, identity and cloud does not establish that all three are active in a particular customer tenant. Missing input can make an explanation appear simpler than the underlying situation.

Finally, ask how the product handles stale findings, unavailable assets and legitimate exceptions. A fix may be unsuitable during a business-critical period or may require coordination with an application vendor. The explanation should support that decision without implying that every recommended action can be performed immediately. Public research cannot establish the quality of an attack-path assessment for your environment or the time your operating partner will take to respond.

07 / DecisionChoose an understandable path from finding to action

WithSecure is a useful candidate for organisations that want exposure management and incident response in one product family, with AI guidance that helps their team interpret the work. Start with one finding, the correct licences and an agreed approval route. Expand when the team can verify the evidence, complete the action and explain the result to the next person.