Armadin Research Finds 88% of Critical Flaws Missing From Vendor Advisories

A significant majority of critical and high-severity security weaknesses identified during live attack tests on enterprise environments fall outside the scope of official vendor advisories, according to new research from Armadin.

The offensive security startup, founded by Mandiant founder Kevin Mandia, conducted AI-driven attacks against clients across nearly a dozen industries. The findings suggest that relying solely on vendor-provided security updates may leave organisations exposed to a vast array of unaddressed risks.

Software Defects and Misconfigurations Drive Risk

The research found that software written in-house by clients accounted for 67% of critical findings and 78% of high-severity findings that were not covered by external advisories. Misconfigured vendor products—such as administrative consoles exposed to the public internet—were responsible for 24% of critical and 22% of high-severity exposures.

A small portion of the critical findings involved zero-day vulnerabilities discovered by Armadin, representing 9% of the total critical findings. In one instance, the firm identified a flaw in an identity governance platform, noting that the vendor took nearly four months to issue an advisory after the discovery.

Unauthenticated Attack Surfaces

A major theme in the report was the prevalence of unauthenticated access. Nearly 70% of critical and high findings were located on the unauthenticated attack surface. Of the documented attack chains, 82% began without the need for credentials, and 56% of those proceeded without a password or cryptographic key ever being presented.

In more than 70% of the tested client environments, Armadin was able to reach a critical outcome in three steps or fewer without any valid credentials. Nearly half of the chains that began without authentication relied on exposed credentials, 71% of which belonged to service or application accounts rather than human users.

The research noted that approximately 90% of these exposed credentials were reachable without complex extraction methods, often sitting in plain sight within code repositories, configuration files, backups, logs, or cloud settings.

Internal Remediation is Possible

The report highlighted that most of these severe findings could be addressed by the organisations themselves without third-party intervention. Armadin calculated that 93% of the severe findings required no action from a vendor to fix.

Remediation strategies typically involved shipping new application code (51% of cases), modifying settings, permissions, or policies (43%), and rotating exposed credentials (32%).