Most Severe Security Flaws Never Appear in Vendor Advisories, New Testing Suggests

Armadin, the offensive security startup launched by Mandiant founder Kevin Mandia, published a report on November 2 based on AI-driven attacks against its clients' live systems. It found that 88% of the critical and high-severity weaknesses would not have been identified through vendor advisories or other outside sources. The clients span nearly a dozen industries, though Armadin did not disclose how many organisations or findings the data covers.

Most of the gaps were in software the clients had written themselves, which made up 67% of critical findings and 78% of high findings that advisories could not cover. Vendor products deployed in ways no advisory describes, such as administrative consoles exposed to the internet, accounted for most of the rest. Nearly 70% of critical and high findings sat on the unauthenticated attack surface, and in more than 70% of client environments Armadin reached a critical outcome in three steps or fewer without valid credentials.

Exposed credentials were a major theme. Just under half of the attack chains that started without authentication relied on one, and 71% of those belonged to applications or service accounts rather than people. They were often found in repositories, configuration files, backups, logs or cloud settings. Armadin recommended policies for provisioning, storing and rotating service account credentials, plus checks of pipelines and code repositories for exposed secrets.