Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories

Armadin, the offensive security startup founded by Mandiant’s Kevin Mandia, has published data from live attack tests showing that 88% of critical and high-severity weaknesses would not have been caught by vendor advisories or other outside sources. The report, based on AI-driven attacks against client systems, spans nearly a dozen industries, though Armadin did not disclose numbers of organisations or findings.

Most severe findings stemmed from defects in software written by the clients themselves (67% of critical and 78% of high findings) and from vendor products deployed in ways not described in advisories (24% critical, 22% high). Zero-days accounted for 9% of critical and under 1% of high findings, including one in an identity governance platform for which the vendor issued an advisory only after almost four months.

A substantial portion of issues lay on unauthenticated surfaces, with nearly 70% of critical and high findings on such surfaces. Documented attack chains began with no credentials in 82% of cases, and more than half proceeded without presenting a password or key. In Armadin’s engagements, 70% of environments reached a critical outcome in three steps or fewer without valid credentials.

Exposed credentials frequently resided in applications or service accounts rather than human users, and about 90% were reachable without extraction from repositories, configuration files, backups, logs or cloud settings. Fixes tended to require shipping updated code in 51% of cases, changing a setting or policy in 43%, and rotating an exposed credential in 32%, with many cases needing multiple steps.