---
title: "ArmorCode Announces Purpose-Built Models for Smarter Exposure Management"
url: "https://www.armorcode.com/blog/armorcode-forge-purpose-built-llms-for-exposure-management"
markdown_url: "https://www.armorcode.com/blog/armorcode-forge-purpose-built-llms-for-exposure-management.md"
llm_canonical: "https://www.armorcode.com/blog/armorcode-forge-purpose-built-llms-for-exposure-management.md"
canonical_for_llm: true
entity_type: "Article"
primary_entity: "ArmorCode Announces Purpose-Built Models for Smarter Exposure Management"
citation_value: "Published on ArmorCode; canonical URL https://www.armorcode.com/blog/armorcode-forge-purpose-built-llms-for-exposure-management."
last_updated: "2026-10-28T21:42:39-07:00"
---
ArmorCode Announces Purpose-Built Models for Smarter Exposure Management
*Built on NVIDIA Nemotron for AI that is faster, more precise, and cheaper to run*
ArmorCode today introduced ArmorCode Forge, a family of purpose-built models for exposure management decisions, built on open base models including NVIDIA Nemotron. Each model handles one of the questions security teams ask about every finding, giving Anya Agents targeted intelligence for the decisions they make every day.
> ***The goal: more precise decisions, in a fraction of a second, at a fraction of the cost of general-purpose models.***
A scanner flags a vulnerability as Critical. Before your team can act, someone has to figure out whether it affects your environment, whether the evidence holds up, who owns the fix, and what to do next. Multiply that work across millions of findings, and you can see why security teams can no longer keep up with the backlog.
AI should make those decisions easier. But asking a general-purpose model to reason through every finding introduces another problem: every answer takes time, and every answer has a cost. At enterprise scale, both create challenges.
Why exposure management needs its own models
Frontier AI has turned cybersecurity on its head. Its ability to find flaws, connect vulnerabilities, and help develop exploits puts enormous pressure on the teams responsible for fixing them. Finding more problems is valuable. Working through the decisions that follow is the part that is time consuming and where security teams need the most help.
General-purpose models have an infinite range, at least it feels that way. They can explain a vulnerability, write code, and help plan a vacation in the same conversation. That level of knowledge about everything, and anything can be useful in many cases. But for security specific use-cases it means a security agent has to supply instructions, examples, and background each time it asks the model to make a specialized decision.
We’ve invested in making Anya effective with frontier models, including memory, caching, planning, and access to the right context. We will keep using those models where they add value. But the same questions come up again and again in exposure management. Asking a large model to work through each one from scratch adds unnecessary delay and expense.
Armorcode Forge takes a more focused approach. Each model is trained for a specific exposure decision and receives the relevant context from the ArmorCode Context Risk Graph. Routine decisions stay with Forge. Harder cases go to a larger model or a person.
Precision and speed without the runaway AI bill
A purpose built model has numerous advantages. It already knows the decision it is being asked to make. It needs fewer instructions, uses fewer tokens, and can answer in a fraction of a second.
The Context Risk Graph makes that approach even more efficient. Before an Anya Agent calls Forge, findings are already deduplicated, correlated, and connected to assets, owners, and business context. The agent can use that context immediately, with fewer tool calls to assemble it.
The biggest benefit becomes clear as you begin to scale. A few seconds on one finding may seem trivial. Repeat that work across millions of findings, with long prompts and repeated context gathering, and it becomes a serious operational cost. Forge reserves larger models for the cases that need them, so teams can put more AI to work without treating every decision as an expensive reasoning exercise.
Precision matters just as much. Each model focuses on a specific task and explains its answer. We’re evaluating performance and will share benchmark results as we finalize them.
Your team stays in control
Security teams need to know why a model reached a conclusion before they trust it to influence their work. Every Forge decision includes a confidence level and the reasoning behind it. When the model cannot reach a confident conclusion, the case can escalate to a larger model or a person.
Early versions add tags and comments for review rather than changing a finding’s status or severity. Your team can inspect the results, challenge recommendations, and decide when to automate through runbooks. Forge supplies the intelligence. Anya and your workflows carry out the actions you authorize.
The context behind every decision
A model needs more than a vulnerability description to make a useful exposure decision. It needs to understand the affected asset, its owner, its business importance, and the evidence surrounding the finding.
The ArmorCode Context Risk Graph processes 400+ billion findings a year across 400+ security tool integrations. It connects findings with asset, ownership, code, threat intelligence, and business context. That is the operational foundation Forge uses to make decisions. It is separate from the data used to train the models.
That breadth matters. ArmorCode doesn’t sell a scanner, so we can bring together evidence from tools across your environment without favoring our own detection product. Your team gets a more complete view of the risk and can keep using the tools it trusts.
How Forge works with Anya and the Context Risk Graph
Anya Agents work alongside practitioners to triage, validate, remediate, and verify. Forge sits in Anya’s Model Hub alongside frontier models. Anya uses Forge for targeted exposure decisions and calls on larger models where their broader capabilities help.
The Context Risk Graph supplies the context throughout. Practitioners experience Forge through the agents they already use, with clearer decisions and less time spent assembling the evidence themselves.
Figure 1 – Forge works inside the Context Risk Graph, giving Anya Agents more precise, faster, and cheaper exposure decisions.
Why we chose NVIDIA Nemotron
Forge is built on NVIDIA Nemotron, a family of open models designed for agentic AI and for further training on specific jobs. That fits Forge, where each model is trained to make one exposure decision well. Open models are also easier to inspect and explain, which matters when a model’s output informs security decisions. Because the foundation is open, we can train on our side without sending data to an outside model provider, and run efficiently at the volume agents demand. It also means no one else can raise the price, retire, or take back the intelligence inside Anya.
Four models for the decisions every finding needs
Consider a vulnerability in a software component. A scanner can tell you the component is present. Your team still needs to understand what that finding means in your environment and how to address it. The first four Forge models each handle a distinct part of that work.
Forge Assess: How severe is it, really?
A scanner’s Critical rating is a starting point. Forge Assess uses asset, exposure, and business context to suggest a severity that reflects your environment. A finding on an isolated test system may deserve a different response from the same finding on an exposed production application. Forge explains its recommendation and preserves the scanner’s original score.
Forge Verify: Is it a false positive?
Few things frustrate security teams more than spending hours on a finding that doesn’t apply. Forge Verify evaluates component applicability, runtime conditions, and scanner signals to flag false positives. When the evidence is insufficient, it returns an undetermined result rather than forcing an answer.
Forge Decide: Is it confirmed?
Knowing that a vulnerability exists doesn’t prove that a particular finding is real. Forge Decide evaluates the evidence to confirm true positives. That gives teams a clearer basis for action and a reason they can share with the person responsible for the fix.
Forge Resolve: How do we fix it?
Developers need guidance they can use in their own code and environment. Forge Resolve builds on Anya’s existing remediation guidance, now using an ArmorCode model to recommend a fix, offer a mitigation when the fix has to wait, and explain how to validate the result. The guidance accounts for the code, ownership, and controls already in place.
Together, these models help teams spend less time questioning findings and more time resolving the risks that matter most.
How we build and train Forge
Forge models start from NVIDIA Nemotron and are adapted for specific exposure management tasks. We train and run them ourselves, which gives us more control over how they behave.
Forge models are trained on publicly available vulnerability intelligence, including CVE history and exploitation data, and on ArmorCode’s own data. Customer data is used for training only when a customer opts in through the ArmorCode Forge design partner program.
Design partners can help shape future models and contribute training data through that program. Using ArmorCode does not automatically mean your data is used to train Forge.
About ArmorCode
ArmorCode is the Agentic AI Platform for Unified Exposure Management. Anya Agents triage, prioritize, and remediate the risks that matter most. ArmorCode Forge provides purpose-built models for exposure decisions, and the Context Risk Graph correlates findings with asset, ownership, business, and threat context across 400+ integrations. Learn more at [armorcode.com](https://www.armorcode.com/).
Frequently Asked Questions
Q: What is ArmorCode Forge?
A: ArmorCode Forge is a family of purpose-built large language models for exposure management decisions. It gives Anya Agents targeted intelligence to assess severity, identify false positives, confirm true positives, and recommend fixes. Each model uses context from the ArmorCode Context Risk Graph to help security teams decide what needs attention and how to act.
Q: What do the four Forge models do?
A: Forge Assess recommends severity based on asset, exposure, and business context while preserving the original scanner score.
Forge Verify identifies potential false positives by evaluating component applicability, runtime conditions, and scanner signals.
Forge Decide evaluates the available evidence to confirm true positives.
Forge Resolve recommends fixes, offers mitigations when a fix must wait, and explains how to validate the result.
Q: How are Forge Verify and Forge Decide different?
A: They answer different questions about a finding. Forge Verify asks whether the finding is a false positive. Forge Decide asks whether the evidence confirms a true positive. Both can return an undetermined result when the available evidence does not support a confident conclusion.
Q: Why use purpose-built models for exposure management?
A: Security teams make the same types of decisions across large volumes of findings. A model trained for a specific decision needs fewer repeated instructions and examples. Forge is designed to reduce the time, token use, and cost of that work so teams can apply AI across more of their backlog.
Q: Does Forge replace general-purpose AI models?
A: Forge works alongside frontier models in Anya’s Model Hub. It handles targeted exposure decisions, while larger models provide broader reasoning where needed. This approach lets Anya use specialized intelligence for recurring tasks and draw on more extensive capabilities for harder cases.
Q: How does Forge use the Context Risk Graph?
A: The Context Risk Graph connects findings with assets, owners, code, threat intelligence, and business context. Forge uses relevant context at runtime to evaluate a finding in your environment. For example, the same vulnerability may call for a different response on an exposed production application than on an isolated test system.
Q: How do Forge, Anya Agents, and the Context Risk Graph work together?
A: Forge supplies the decision intelligence. Anya Agents use that intelligence within workflows for triage, validation, and remediation. The Context Risk Graph supplies the context that informs their work.
Q: Does Forge automatically change or close findings?
A: Early versions add recommendations through tags and comments for review rather than changing a finding’s status or severity. Your team can inspect the results and decide when to automate through runbooks and workflows. Forge provides the recommendation. Anya and your authorized workflows carry out the action.
Q: Can security teams review Forge’s decisions?
A: Every Forge decision includes a confidence level and the reasoning behind it. When the evidence is insufficient, a decision check can return an undetermined result, and the case can escalate to a larger model or a person. Your team can review the recommendation and decide what happens next.
Q: What data is used to train Forge?
A: Forge models are trained on publicly available vulnerability intelligence, including CVE history and exploitation data, and on ArmorCode’s own data. Customer data is used for training only when a customer explicitly opts in through the Forge design partner program. Using ArmorCode does not automatically enroll your data in model training.
Q: Is the context Forge uses the same as its training data?
A: Training data teaches a model how to perform its task. Runtime context supplies the information needed for a particular decision, such as an asset’s business importance or a finding’s supporting evidence. Forge’s use of your environment’s context to make a recommendation is separate from contributing customer data for model training.
Q: What technology is Forge built on?
A: Forge builds on open base models, including NVIDIA Nemotron, that ArmorCode adapts for specific exposure management tasks. This approach gives ArmorCode control over task-specific training and model operation while allowing Anya to continue using frontier models where they add value.