Some 88% of the critical and high-severity weaknesses Armadin found in live attack testing this year would not have been visible through vendor advisories or other outside sources, the offensive security startup reported on November 2. The tests — described by Armadin as AI-driven attacks against client systems — paint a picture of severe exposures that largely sit inside organizations' own code, configurations and repositories rather than in known, vendor-patched products.
88% of severe findings missed by vendor advisories
Armadin’s report puts a single number at the center of its findings: 88% of the critical and high-severity weaknesses discovered during its live tests would not have been identified through vendor advisories or other outside inputs. The company, launched by Mandiant founder Kevin Mandia, said the data comes from engagements across nearly a dozen industries but did not disclose how many organizations or individual findings those engagements covered.
That gap reflects the limits of relying solely on external advisories: Armadin found most of the most serious bugs where vendors’ published guidance simply does not reach.
Self-written software and misconfigured vendor products drove the gap
Armadin broke down the sources of advisory-blind findings. Software the clients themselves had written accounted for the majority of missed severe flaws — 67% of critical findings and 78% of high findings that vendor advisories could not cover. A sizable minority came from vendor products deployed in ways advisories do not describe: 24% of critical and 22% of high findings were attributable to deployment patterns such as administrative consoles exposed to the internet.
The report also flagged a small share of direct zero-days: about 9% of critical findings and under 1% of high findings were vulnerabilities Armadin itself discovered, including one in an identity governance platform whose vendor took almost four months to issue an advisory.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleUnauthenticated attack chains — short, frequent and effective
Armadin found that a large share of documented attack chains began without credentials. Across the record, 82% of documented chains began unauthenticated, and of those, 56% progressed without any password or key ever being presented. Nearly 70% of critical and high findings sat on the unauthenticated attack surface overall. In more than 70% of client environments, the firm said it reached a critical outcome in three steps or fewer without valid credentials.
Those statistics underline a recurring pattern in Armadin’s exercises: short, unauthenticated paths can lead rapidly to high-severity outcomes.
Exposed service accounts, repositories and backups as launch points
Just under half of the unauthenticated chains relied on an exposed credential, and 71% of those credentials belonged to applications or service accounts rather than individual people. Nearly 90% of exposed credentials were reachable without extraction — often found in repositories, configuration files, backups, logs or cloud settings.
Armadin provided a concrete chain as an example: starting from an unprivileged domain account, testers used a flaw in backup software to read credentials held by that account; that access led to a hypervisor management server and, via a domain controller backup, to domain administrator hashes.
Remediations, recommendations and where responsibility sits
The work to fix these severe findings largely remains inside organizations’ control. By Armadin’s count, 93% of severe findings required no third party to act — the fixes were something the affected organization could implement itself.
- Fix types and frequencies: shipping application code accounted for 51% of fixes; changing a setting, permission or policy accounted for 43%; rotating an exposed credential was required in 32% of cases. Many cases required multiple corrective steps.
- Armadin’s recommendations emphasized internal controls: policies for provisioning, storing and rotating service account credentials, and checks of CI/CD pipelines and code repositories for exposed secrets.
That combination — a large share of fixes that are code or configuration changes, and advice focused on credential hygiene and pipeline checks — points to organizational practices as the primary lever for reducing these exposures.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: the report signals that remediation will often require changes to internal application code, settings and secret handling rather than waiting for vendor patches; Armadin’s breakdown shows where to prioritize inspections and rotations.
- Procurement and deployment teams: the finding that 22–24% of missed high/critical issues arise from deployment patterns underscores a need to audit how vendor products are exposed and to limit administrative consoles and services reachable from the internet.
- End users and business units: because many exposed credentials belong to service accounts and are findable in repositories, backups or logs, non-security teams that manage code, backups and cloud settings have a direct role in reducing risk.
Armadin’s data frames a clear internal responsibility: most severe flaws it found were not waiting on vendors. If organizations act on the report’s recommendations — hardening deployment practices, tightening pipeline and repository hygiene, and rotating service credentials — they can close a large fraction of the gaps Armadin identified without outside intervention. The open question the numbers leave is how quickly organizations will take those steps given that short, unauthenticated chains can reach critical outcomes in three moves or fewer.
