Some 88% of the critical and high-severity weaknesses found in live attack tests on enterprise environments this year would not have been identified through vendor advisories or other outside sources, new data has suggested.

The figure comes from a report published on November 2 by Armadin, the offensive security startup launched by Mandiant founder Kevin Mandia, based on AI-driven attacks against its clients' live systems.

The clients span nearly a dozen industries, but Armadin did not disclose how many organizations or findings the data covers.

Read more on exposure management: AI Threats and Alert Fatigue Challenge Cybersecurity Teams

Most Severe Findings Sat Beyond Advisories and Logins

Defects in software the clients had written themselves made up 67% of the critical findings and 78% of the high findings that advisories could not cover. Vendor products deployed in ways no advisory describes, such as administrative consoles exposed to the internet, accounted for 24% and 22%.

The remaining 9% of critical findings, and under 1% of high ones, were zero-days Armadin found itself, including one in an identity governance platform whose vendor took almost four months to issue an advisory.

Nearly 70% of critical and high findings sat on the unauthenticated attack surface. Of the documented attack chains, 82% began without credentials, and 56% of those went on without a password or key ever being presented.

In more than 70% of client environments, Armadin said it reached a critical outcome in three steps or fewer without valid credentials.

Exposed Service Accounts Created Further Attack Paths

Just under half of the chains that started without authentication relied on an exposed credential, 71% of which belonged to applications or service accounts rather than people. Nearly 90% were reachable without extraction, often in repositories, configuration files, backups, logs or cloud settings.

In one engagement, Armadin started from an unprivileged domain account and used a flaw in backup software to read the credentials it held. That led to a hypervisor management server and, via a domain controller backup, to domain administrator hashes.

Fixing the severe findings meant shipping application code in 51% of cases, changing a setting, permission or policy in 43% and rotating an exposed credential in 32%, with many needing more than one step.

Armadin's recommendations included policies for provisioning, storing and rotating service account credentials, and checks of pipelines and code repositories for exposed secrets.

By its count, 93% of severe findings needed no third party to act, leaving the fix in each organization's own hands.