80% of security exposures are fuelled by misconfigurations

XM Cyber has released the findings of its third annual research report, Navigating the Paths of Risk: The State of Exposure Management.

  • Friday, 10th May 2024 Posted 10 months ago in by Phil Alsop

Produced in collaboration with the Cyentia Institute, the report which provides an in-depth look at the cyber exposure landscape based on data gathered from over 40 million exposures that present high-impact risks to millions of critical business entities. This research found that identity and credential misconfigurations represent a staggering 80% of security exposures across organizations, with a third of these exposures putting critical assets at direct risk of breach - a gaping attack vector actively being exploited by adversaries.

The report found that most of the exposure is within a company's Active Directory which is critical for connecting users to network resources, but it's also a prime target for attackers who could gain elevated privileges and access. The top exposures stem from misconfigurations and credential attacks, which create blind spots that traditional security tools often miss, such as issues with managing members and resetting passwords. Compounding this issue, poor endpoint hygiene plagues the majority of environments with cached credentials or lack of EDR coverage on over 25% of devices, providing attackers ample initial entry points to gain footholds. These overlooked identity and endpoint weaknesses represent a hacker's paradise that organizations urgently need to address.

"This data underscores that exposure management needs to expand well beyond vulnerabilities to look at all paths adversaries can take - including misconfigurations, user behavior, and more," said Zur Ulianitzky, Vice President, Security Research at XM Cyber. “The XM Attack Graph Analysis™ revealed that a mere 2% of exposures reside on crucial 'choke points,' where adversaries can exploit vulnerabilities to access critical assets. This revelation underscores the importance of adopting comprehensive threat exposure management frameworks."

CVEs Represent Only 1% of Massive Exposure Landscape

While most organizations concentrate on managing traditional software vulnerabilities tracked by CVE identifiers, the reality is that these only scratch the surface. XM Cyber's analysis reveals organizations typically have around 15,000 exposures scattered across their environments that skilled attackers could potentially exploit. Shockingly, CVE-based vulnerabilities account for less than 1% of this massive exposure landscape. Even when looking just at exposures affecting their most critical assets, CVEs represent only a small percentage of the risk profile. This points to major blind spots in security programs focused narrowly on vulnerability patching alone.

Over Half of Critical Asset Exposures Reside in the Cloud

Cloud environments are not exempted from the risk of exposure. As organizations accelerate cloud adoption, they must be aware that major exposure risks exist in these environments as well. Over half (56%) of exposures affecting critical assets reside in cloud platforms according to XM Cyber's analysis. Moreover, attackers can seamlessly traverse from on-premises to cloud environments and back again, posing a significant risk to cloud-based assets. From there, they can easily compromise critical cloud assets with minimal effort and lateral movement hops.

Vertical Vulnerabilities: One Size Exposure Strategy Fails Across Industries

The report's industry analysis also revealed sectors like Energy and Manufacturing have a higher proportion of internet-exposed critical assets affected by exposures compared to Financial Services organizations, which have large digital footprints. On average, while Financial Services firms manage a much larger digital asset footprint of 5x more assets than the Energy sector, that latter group has a staggering 21x higher proportion of its most critical assets affected by exposures. This demonstrates a true need for industry-specific exposure management strategies.

"The insights collected from this report are a transformative force for organizations navigating the complex realm of cybersecurity, especially in industries with entities that have a lot of exposures like Healthcare and Energy", said Dr. Wade Baker from the Cyentia Institute. “The fact that the median number of exposures affecting Healthcare providers is 5X that of the Energy and Utilities sector points to the inherent challenges of minimizing risk in those environments."

Failure to prioritise testing and integrate generative AI tools raises concerns as agentic AI adds pressure.

CIOs 'overspend' on cloud

Posted 5 days ago by Phil Alsop
43% of CIOs say their CEOs and/or board of directors have concerns about their company’s cloud spend.
Research revealed at Coterie Connect event highlights shifting team structures, evolving skills priorities, and urgent training needed for partner...
Endava has launched its latest research report “AI and the Digital Shift: Reinventing the Business Landscape”.

3,000% surge in enterprise use of AI/ML tools

Posted 1 week ago by Phil Alsop
Zscaler has released the ThreatLabz 2025 AI Security Report, based on insights from more than 536 billion AI transactions processed between February...
Over one in four (28%) British small business owners have used AI tools to help run their business.

Tech fragmentation cited as biggest cyber challenge

Posted 1 week ago by Phil Alsop
New Palo Alto Networks data shows 82% of UK organisations confident in their use of AI, despite AI being identified as biggest cyber risk for 2025.
MIT researchers crafted a new approach that could allow anyone to run operations on encrypted data without decrypting it first.