80% of security exposures are fuelled by misconfigurations

Produced in collaboration with the Cyentia Institute, the report which provides an in-depth look at the cyber exposure landscape based on data gathered from over 40 million exposures that present high-impact risks to millions of critical business entities. This research found that identity and credential misconfigurations represent a staggering 80% of security exposures across organizations, with a third of these exposures putting critical assets at direct risk of breach - a gaping attack vector actively being exploited by adversaries.

The report found that most of the exposure is within a company's Active Directory which is critical for connecting users to network resources, but it's also a prime target for attackers who could gain elevated privileges and access. The top exposures stem from misconfigurations and credential attacks, which create blind spots that traditional security tools often miss, such as issues with managing members and resetting passwords. Compounding this issue, poor endpoint hygiene plagues the majority of environments with cached credentials or lack of EDR coverage on over 25% of devices, providing attackers ample initial entry points to gain footholds. These overlooked identity and endpoint weaknesses represent a hacker's paradise that organizations urgently need to address.

"This data underscores that exposure management needs to expand well beyond vulnerabilities to look at all paths adversaries can take - including misconfigurations, user behavior, and more," said Zur Ulianitzky, Vice President, Security Research at XM Cyber. “The XM Attack Graph Analysis™ revealed that a mere 2% of exposures reside on crucial 'choke points,' where adversaries can exploit vulnerabilities to access critical assets. This revelation underscores the importance of adopting comprehensive threat exposure management frameworks."

CVEs Represent Only 1% of Massive Exposure Landscape

While most organizations concentrate on managing traditional software vulnerabilities tracked by CVE identifiers, the reality is that these only scratch the surface. XM Cyber's analysis reveals organizations typically have around 15,000 exposures scattered across their environments that skilled attackers could potentially exploit. Shockingly, CVE-based vulnerabilities account for less than 1% of this massive exposure landscape. Even when looking just at exposures affecting their most critical assets, CVEs represent only a small percentage of the risk profile. This points to major blind spots in security programs focused narrowly on vulnerability patching alone.

Over Half of Critical Asset Exposures Reside in the Cloud

Cloud environments are not exempted from the risk of exposure. As organizations accelerate cloud adoption, they must be aware that major exposure risks exist in these environments as well. Over half (56%) of exposures affecting critical assets reside in cloud platforms according to XM Cyber's analysis. Moreover, attackers can seamlessly traverse from on-premises to cloud environments and back again, posing a significant risk to cloud-based assets. From there, they can easily compromise critical cloud assets with minimal effort and lateral movement hops.

Vertical Vulnerabilities: One Size Exposure Strategy Fails Across Industries

The report's industry analysis also revealed sectors like Energy and Manufacturing have a higher proportion of internet-exposed critical assets affected by exposures compared to Financial Services organizations, which have large digital footprints. On average, while Financial Services firms manage a much larger digital asset footprint of 5x more assets than the Energy sector, that latter group has a staggering 21x higher proportion of its most critical assets affected by exposures. This demonstrates a true need for industry-specific exposure management strategies.

"The insights collected from this report are a transformative force for organizations navigating the complex realm of cybersecurity, especially in industries with entities that have a lot of exposures like Healthcare and Energy", said Dr. Wade Baker from the Cyentia Institute. “The fact that the median number of exposures affecting Healthcare providers is 5X that of the Energy and Utilities sector points to the inherent challenges of minimizing risk in those environments."