What happened
Armadin published a report on 2 November drawing on AI driven attacks run against its clients' live systems. The firm, an offensive security startup founded by Mandiant founder Kevin Mandia, said 88% of the critical and high severity weaknesses it found this year would not have been identified through vendor advisories or other outside sources. Clients span nearly a dozen industries. Armadin did not disclose how many organisations or findings the data covers.
The breakdown matters more than the headline. Defects in software clients had written themselves accounted for 67% of the critical findings and 78% of the high findings that advisories could not cover. Vendor products deployed in ways no advisory describes, such as administrative consoles exposed to the internet, accounted for 24% and 22%. The remaining 9% of critical findings and under 1% of high findings were zero-days Armadin found itself, including one in an identity governance platform whose vendor took almost four months to publish an advisory.
Nearly 70% of critical and high findings sat on the unauthenticated attack surface. Of the documented attack chains, 82% began without credentials, and 56% of those continued without a password or key ever being presented. In more than 70% of client environments, Armadin reached a critical outcome in three steps or fewer without valid credentials.
Just under half of the chains that started without authentication leaned on an exposed credential, and 71% of those belonged to applications or service accounts rather than people. Nearly 90% were reachable without any extraction, sitting in repositories, configuration files, backups, logs or cloud settings.
Fixing the severe findings meant shipping application code in 51% of cases, changing a setting, permission or policy in 43%, and rotating an exposed credential in 32%, with many requiring more than one step. By Armadin's count, 93% of the severe findings needed no third party to act.
Why this is a GRC story
Advisory driven vulnerability management is a partial control. If most severe exposure lives in your own code and in how you deployed someone else's product, then a programme measured by patch compliance against published vulnerability feeds is measuring the part of the estate that is easiest to see. The register should carry configuration and architecture findings with the same weight as patches.
Service accounts are the quiet identity problem. Credentials that belong to applications tend to be created once, granted broadly and never rotated. They also sit where nobody scans: build pipelines, configuration files, backups, logs. Ownership is usually unclear, which is why they survive access reviews.
Unauthenticated surface is an architecture decision. An admin console on the internet is a choice made for convenience, and it turns a vendor product into an internet facing system running the vendor's default controls.
Vendor delay is the risk you cannot schedule away. A four month gap between finding and advisory is outside your control, so the mitigation has to be compensating controls and monitoring around the affected platform while you wait.
What to watch
Watch whether Armadin publishes sector level data, because a sharper picture of which industries rely most on exposed administrative consoles would move this from anecdote to benchmark. Watch the identity governance advisory when it lands.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.