A striking new benchmark in corporate cybersecurity has revealed that approximately 88% of critical and high-severity weaknesses uncovered during live penetration testing in enterprise environments would completely bypass detection through conventional vendor advisories, threat intelligence feeds, or standard perimeter monitoring. This eye-opening data underscores a fundamental shift in how sophisticated adversaries interact with modern digital infrastructure, heavily relying on custom-built flaws, misconfigurations, and unsecured pathways rather than known, patchable software vulnerabilities.
The findings were published on November 2 in a comprehensive inaugural threat report released by Armadin, an offensive security startup launched by industry veteran and Mandiant founder Kevin Mandia. The data compiled within the report is derived from advanced, AI-driven simulated attacks executed directly against the live production systems of enterprise clients throughout the year. These client organizations represent a diverse cross-section of the global economy, spanning nearly a dozen distinct industrial sectors. Although Armadin chose to withhold the exact number of participating corporations and individual discoveries to protect client confidentiality, the breadth of the operational scope provides a sobering look at contemporary enterprise risk exposure.
The Evolution of Offensive Security and the Rise of AI-Driven Testing
To fully contextualize the findings of the Armadin report, it is necessary to examine the evolving methodology of modern red teaming and automated offensive security. Historically, enterprise vulnerability management has relied heavily on signature-based scanning, compliance checklists, and the prompt application of patches released via vendor advisories. While these traditional defenses remain vital for stopping commodity malware and known exploits, they operate on a reactive paradigm.
As enterprises accelerate their digital transformation journeys—migrating core workloads to multi-cloud environments, adopting complex microservices architectures, and integrating generative artificial intelligence into daily operations—the attack surface has expanded exponentially. Cybercriminals and sophisticated Advanced Persistent Threat (APT) groups have similarly evolved, increasingly leveraging artificial intelligence to map out corporate networks, discover zero-day vulnerabilities, and chain together minor misconfigurations into catastrophic breaches.
Recognizing this asymmetry, Kevin Mandia established Armadin to pioneer AI-driven offensive security operations. By deploying autonomous agents capable of thinking and moving laterally like sophisticated human adversaries, the startup aims to stress-test enterprise defenses under real-world conditions. The November 2 report represents one of the first major public disclosures of insights gathered from this next generation of automated adversarial simulation, offering security leaders an unvarnished view of how enterprise defenses truly hold up when subjected to intelligent, multi-vector assaults.
Anatomy of the Unseen Attack Surface: Beyond Advisories and Logins
A granular breakdown of the report reveals that the most severe security findings consistently resided outside the purview of traditional threat intelligence. Specifically, software defects originating from custom applications developed in-house by the clients themselves accounted for a staggering 67% of all critical findings and 78% of all high-severity findings that vendor advisories could not possibly cover. This highlights a pervasive blind spot in corporate software development life cycles (SDLC), where proprietary code often lacks the rigorous security vetting applied to commercial off-the-shelf software.
Compounding the problem are structural deployment errors. Vendor-supplied products—ranging from enterprise resource planning systems to database management tools—configured in ways never contemplated or described by the original manufacturers accounted for 24% of critical and 22% of high-severity findings. A prime example of this phenomenon includes administrative consoles mistakenly exposed directly to the public internet, bypassing internal firewalls and virtual private network (VPN) requirements.
Furthermore, Armadin’s automated systems uncovered a remainder of 9% of critical findings and a fraction of high-severity findings that qualified as genuine zero-day vulnerabilities. Among these was a critical flaw discovered independently within an enterprise identity governance platform. The severity of the discovery was underscored by the fact that the platform’s vendor required nearly four months to officially issue a security advisory and patch after being notified.
The Zero-Trust Illusion: Exploiting the Unauthenticated Perimeter
One of the most alarming takeaways from the Armadin report is the ease with which external attackers can penetrate corporate environments without ever possessing valid credentials. According to the data, nearly 70% of all critical and high-severity findings identified by the startup sat directly on the unauthenticated attack surface.
When analyzing the documented attack chains—the step-by-step paths hackers use to move from initial access to system compromise—Armadin discovered that 82% of these campaigns began completely without credentials. Even more concerning, 56% of those credential-less entry points proceeded further into the network without a password, cryptographic key, or multi-factor authentication prompt ever being presented or bypassed.
In more than 70% of the client environments evaluated, Armadin’s AI-driven agents successfully reached a critical operational outcome—such as domain dominance or access to sensitive data repositories—in three steps or fewer, all without utilizing a single valid user credential. This statistic directly challenges the foundational assumptions of many corporate zero-trust architectures, suggesting that perimeter defenses and internal segmentation frequently fail to account for deep-seated structural vulnerabilities.
The Hidden Danger of Exposed Service Accounts and Secrets
While many attack chains initiated without authentication, they frequently capitalized on internal footholds to escalate privileges. Just under half of the unauthenticated attack paths ultimately relied on an exposed credential to move laterally or vertically within the network.
Crucially, 71% of these harvested credentials did not belong to human users, but rather to automated applications, software integrations, or service accounts. Service accounts are notoriously difficult to monitor and manage, often possessing elevated privileges and static passwords that are rarely rotated. Armadin found that nearly 90% of these service account credentials were accessible without requiring complex extraction techniques; instead, they were sitting unprotected in code repositories, local configuration files, backup directories, system logs, or misconfigured cloud storage settings.
The report details a representative engagement illustrating this dangerous propagation vector. Armadin’s automated agents initiated the test from an unprivileged domain user account. By exploiting a subtle security flaw in the enterprise’s backup software, the system was able to read plain-text credentials stored within the backup configuration. This initial discovery provided the stepping stone required to compromise a hypervisor management server. From there, access to a domain controller backup yielded domain administrator hashes, effectively granting the simulated attacker total control over the entire corporate domain within a matter of hours.
Remediation Realities: The Burden Falls In-House
When examining what it takes to remediate these severe vulnerabilities, the Armadin data shifts the conversation from external vendor accountability to internal operational hygiene. Fixing the discovered weaknesses required a multifaceted approach across client organizations:
- Shipping updated application code was necessary in 51% of the cases to patch custom software flaws.
- Changing an administrative setting, security permission, or network policy accounted for 43% of the required fixes.
- Rotating an exposed credential or API key was mandatory in 32% of the engagements.
Many of these remediation efforts required a combination of steps, demonstrating that patching a modern enterprise network is rarely a matter of simply clicking an update button.
To combat these systemic weaknesses, Armadin issued a series of robust strategic recommendations. Chief among them is the implementation of strict governance policies governing the provisioning, storage, and automated rotation of service account credentials. Furthermore, the startup emphasized the critical need to integrate continuous security checks into CI/CD (Continuous Integration/Continuous Deployment) pipelines and code repositories to intercept exposed secrets before code is pushed to production environments.
According to Armadin’s internal metrics, an overwhelming 93% of the severe findings identified during the tests required no third-party vendor intervention to resolve. This leaves the ultimate responsibility for remediation firmly in the hands of the individual enterprise organizations, highlighting a gap not in technology availability, but in internal visibility and hygiene.
Industry Implications and Future Outlook
The release of Armadin’s threat report arrives at a critical juncture for the cybersecurity industry. As organizations grapple with alert fatigue and the sheer volume of CVEs (Common Vulnerabilities and Exposures) published daily by software vendors, security operations centers (SOCs) are increasingly overwhelmed.
Independent cybersecurity analysts and enterprise risk officers have begun responding to the Armadin findings with a mix of validation and urgency. While the security community has long understood that custom code and misconfigurations pose severe risks, quantifying the exact scope—specifically the 88% blind spot regarding vendor advisories—provides empirical justification for shifting budget and resources away from purely signature-based tools toward offensive security validation and posture management.
The broader implications for corporate governance are profound. Boards of directors and executive leadership teams can no longer rely solely on compliance frameworks and clean vendor patch reports as proof of robust security posture. As AI-driven attacks become democratized and accessible to malicious actors worldwide, enterprises must adopt proactive, continuous testing methodologies that mirror the dynamic, relentless nature of modern cyber threats.
Ultimately, Armadin’s findings serve as a stark reminder that the greatest cybersecurity risks facing modern enterprises are often those of their own making—embedded quietly within custom code, forgotten service accounts, and unmonitored cloud configurations waiting for an intelligent adversary to connect the dots.
