Overwhelming Majority of Critical Security Weaknesses Invisible to Traditional Threat Intelligence, Report Finds

In a stark revelation that challenges the efficacy of modern vulnerability management, a new report has indicated that 88% of the critical and high-severity weaknesses identified during live offensive security tests this year would have remained undetected by standard vendor advisories or conventional threat intelligence sources. The findings, published on November 2 by Armadin—the offensive security startup founded by Mandiant visionary Kevin Mandia—underscore a growing disconnect between the intelligence organizations rely upon and the reality of the threats they face within their own perimeters.

The report, which draws upon data derived from AI-driven offensive security operations conducted against the live systems of clients across nearly a dozen industries, paints a sobering picture of the enterprise attack surface. While Armadin has not disclosed the precise number of organizations involved or the total count of individual findings, the breadth of the industries represented suggests that this is a systemic issue rather than a localized one. For cybersecurity leaders, the report serves as a wake-up call, suggesting that relying on external feeds and CVE (Common Vulnerabilities and Exposures) databases is no longer sufficient to secure modern, complex, and highly dynamic digital environments.

Most Severe Findings Sat Beyond Advisories and Logins

The core of the problem lies in the nature of the vulnerabilities themselves. According to the Armadin data, the vast majority of critical security gaps are not found in the widely publicized, vendor-disclosed software bugs that dominate headlines and security newsletters. Instead, they are rooted in the unique ways that organizations build, deploy, and configure their digital infrastructure.

Defects in bespoke, custom-written software accounted for 67% of the critical findings and 78% of the high-severity findings that vendor advisories could not cover. This highlights a persistent blind spot: as enterprises increasingly rely on proprietary applications to drive their business logic, they are simultaneously creating a bespoke attack surface that traditional, external-facing vulnerability scanners are fundamentally ill-equipped to audit.

Beyond custom code, the report points to the persistent danger of configuration errors. Vendor products, even when inherently secure, often become vulnerabilities when deployed in ways that deviate from standard security practices. The research found that 24% of critical and 22% of high-severity findings stemmed from deployments where administrative consoles or sensitive management interfaces were unnecessarily exposed to the public internet—a scenario rarely addressed in standard product advisories.

Perhaps most concerning is the role of zero-day vulnerabilities in this landscape. Armadin’s offensive security operations uncovered zero-day flaws that accounted for 9% of critical findings and under 1% of high-severity ones. One illustrative case involved a critical vulnerability in an identity governance platform that remained unpatched for nearly four months before the vendor finally issued an advisory. During that window, any organization relying solely on vendor notifications would have remained completely exposed to an active exploit path.

The data further clarifies how easily attackers can bypass traditional security perimeters. Nearly 70% of the identified critical and high-severity findings were located on the unauthenticated attack surface. This means that, in most cases, an attacker does not need to compromise a user account to gain an initial foothold. The report notes that 82% of documented attack chains began without the need for any credentials, and in 56% of those instances, the attacker was able to proceed through the entire kill chain without ever presenting a password or a security key.

The efficiency of these attackers is particularly alarming. In more than 70% of the client environments tested, Armadin researchers were able to achieve a critical outcome—such as gaining unauthorized access to sensitive data or systems—in three steps or fewer, all without the use of valid credentials. This effectively strips away the safety net that organizations often assume is provided by multi-factor authentication or robust identity management systems, demonstrating that the "front door" is often left wide open by misconfigurations or design flaws.

Exposed Service Accounts Created Further Attack Paths

A significant portion of the risk identified by Armadin is tied to the management of service accounts and machine-to-machine credentials. These accounts, which are essential for the automation of modern cloud and enterprise environments, are frequently neglected in standard security hygiene programs.

The report found that just under half of the attack chains that began without authentication eventually relied on an exposed credential to escalate their position or achieve their objective. Strikingly, 71% of these exposed credentials belonged to applications or service accounts rather than individual human users. Because these accounts are often treated as "background noise" by security teams, they are rarely subject to the same rigorous password rotation policies or monitoring as user accounts.

The accessibility of these credentials is, in itself, a major security failure. Nearly 90% of the exposed secrets were reachable without the need for advanced extraction techniques. They were frequently found in easily accessible locations, including code repositories, configuration files, backups, system logs, or insecurely managed cloud settings. This creates a scenario where an attacker, having gained a foothold in a development environment or a misconfigured server, can easily harvest the "keys to the kingdom" to move laterally across the network.

Armadin provided a clear example of how this path often unfolds. In one engagement, researchers began with an unprivileged domain account. By exploiting a flaw in backup software, they were able to read the credentials held within those backups. From there, the path was straightforward: the credentials provided access to a hypervisor management server, and by further leveraging a domain controller backup, the researchers were able to obtain domain administrator hashes. This sequence, which moves from a low-privilege starting point to full domain control, represents a catastrophic failure of defense-in-depth, yet it is a common pattern in the current threat landscape.

Remediating these findings requires more than just "patching." The Armadin data suggests that fixing the severe vulnerabilities identified in their tests is a multifaceted process. In 51% of cases, organizations were required to ship updated application code. In 43% of instances, the fix involved a fundamental change to a setting, permission, or security policy. In 32% of cases, the organization had to rotate exposed credentials. Many of these issues required a combination of all three approaches to be fully resolved.

For security leaders, the recommendations offered by Armadin are clear: focus on the fundamentals of secret management. This includes implementing robust, automated policies for the provisioning, storage, and rotation of service account credentials. It also requires a proactive approach to auditing pipelines and code repositories to ensure that secrets are not being leaked during the development process.

Crucially, the report emphasizes that the power to mitigate these risks lies almost entirely with the organizations themselves. By Armadin’s count, 93% of the severe findings required no third-party action, such as a vendor patch or a hardware replacement. The fix was, in every one of these cases, entirely within the control of the organization. This underscores a shift in the cybersecurity paradigm: while external threats are real, the most significant vulnerabilities are those created by internal processes, architecture choices, and administrative oversights.

As the digital landscape continues to evolve, the ability to identify and remediate these internal weaknesses—before they are exploited by an adversary—will likely become the primary differentiator between organizations that remain resilient and those that succumb to the increasing frequency of sophisticated cyberattacks. The Armadin findings serve as a stark reminder that in the absence of proactive, offensive-minded security testing, the most dangerous vulnerabilities are often the ones that are hiding in plain sight.