Armadin, an offensive security startup launched by Mandiant founder Kevin Mandia, reported on November 2 that 88% of the critical and high-severity weaknesses found in its live attack tests on enterprise environments this year would not have been identified through vendor advisories or other outside sources.
The report is based on AI-driven attacks against clients' live systems. The clients span nearly a dozen industries. Armadin did not disclose how many organizations or findings the data covers.
According to the report, defects in software the clients wrote themselves made up 67% of the critical findings and 78% of the high findings that advisories could not cover. Vendor products deployed in ways no advisory describes accounted for 24% and 22%, respectively. The remaining 9% of critical findings, and under 1% of high ones, were zero-days that Armadin found itself. One zero-day was in an identity governance platform whose vendor took almost four months to issue an advisory.
Nearly 70% of critical and high findings sat on the unauthenticated attack surface. Of the documented attack chains, 82% began without credentials. Armadin said that in more than 70% of client environments, it reached a critical outcome in three steps or fewer without valid credentials.
Just under half of the chains