The most useful number in the Armadin report is not the 88 percent figure that leads the coverage. It is the 93 percent that follows it: the share of severe findings that, by Armadin's count, needed no third party to act. If that holds, the fix sits almost entirely inside each organization's own walls, and the industry's habit of waiting for vendor advisories is aimed at the wrong target.
Consider where the critical and high-severity weaknesses actually came from. Defects in software the clients wrote themselves made up 67 percent of the critical findings and 78 percent of the high findings that advisories could not cover. Vendor products deployed in unsafe ways, such as administrative consoles exposed to the internet, accounted for 24 percent and 22 percent. Zero-days discovered by Armadin itself were a small slice, 9 percent of critical findings and under 1 percent of high ones. Most of what turned out to be dangerous was not a bug anyone was publicly tracking.
The credential findings deserve special attention. Armadin reported that just under half of the attack chains starting without authentication relied on an exposed credential, and 71 percent of those belonged to applications or service accounts rather than people. Nearly 90 percent were reachable without extraction, often in repositories, configuration files, backups, logs or cloud settings. Service accounts are easy to forget because nobody logs into them. Armadin's own example, an unprivileged domain account leading through backup software to domain administrator hashes, shows how one forgotten secret can unlock an entire directory.
Security leaders should take three concrete steps. They should inventory service account credentials and set rules for provisioning, storage and rotation. They should scan code repositories and pipelines for exposed secrets as a routine control rather than an audit exercise. And they should treat internet-facing administrative consoles as a configuration problem to be checked every quarter. None of these depends on a vendor releasing a patch.
The report has limits that readers should keep in view. Armadin did not disclose how many organizations or findings the data covers, and it is a startup reporting on its own engagements, so the percentages cannot be independently checked from the report alone. Even so, the direction of the evidence is consistent with what most practitioners already suspect. The lesson is not that advisories are worthless. It is that organizations have been measuring their exposure by the wrong yardstick.