Actu
XM Cyber Report Finds 80% of Security Exposures are Fueled by Misconfigurations
May 2024 by XM Cyber
XM Cyber released the findings of its third annual research report, Navigating the Paths of Risk: The State of Exposure Management. Produced in collaboration with the Cyentia Institute, the report which provides an in-depth look at the cyber exposure landscape based on data gathered from over 40 million exposures that present high-impact risks to millions of critical business entities. This research found that identity and credential misconfigurations represent a staggering 80% of security exposures across organizations, with a third of these exposures putting critical assets at direct risk of breach - a gaping attack vector actively being exploited by adversaries.
© Sebastian Kaulitzk
The report found that most of the exposure is within a company’s Active Directory which is critical for connecting users to network resources, but it’s also a prime target for attackers who could gain elevated privileges and access. The top exposures stem from misconfigurations and credential attacks, which create blind spots that traditional security tools often miss, such as issues with managing members and resetting passwords. Compounding this issue, poor endpoint hygiene plagues the majority of environments with cached credentials or lack of EDR coverage on over 25% of devices, providing attackers ample initial entry points to gain footholds. These overlooked identity and endpoint weaknesses represent a hacker’s paradise that organizations urgently need to address.
"This data underscores that exposure management needs to expand well beyond vulnerabilities to look at all paths adversaries can take - including misconfigurations, user behavior, and more," said Zur Ulianitzky, Vice President, Security Research at XM Cyber. “The XM Attack Graph Analysis™ revealed that a mere 2% of exposures reside on crucial ’choke points,’ where adversaries can exploit vulnerabilities to access critical assets. This revelation underscores the importance of adopting comprehensive threat exposure management frameworks."
CVEs Represent Only 1% of Massive Exposure Landscape
While most organizations concentrate on managing traditional software vulnerabilities tracked by CVE identifiers, the reality is that these only scratch the surface. XM Cyber’s analysis reveals organizations typically have around 15,000 exposures scattered across their environments that skilled attackers could potentially exploit. Shockingly, CVE-based vulnerabilities account for less than 1% of this massive exposure landscape. Even when looking just at exposures affecting their most critical assets, CVEs represent only a small percentage of the risk profile. This points to major blind spots in security programs focused narrowly on vulnerability patching alone.
Over Half of Critical Asset Exposures Reside in the Cloud
Cloud environments are not exempted from the risk of exposure. As organizations accelerate cloud adoption, they must be aware that major exposure risks exist in these environments as well. Over half (56%) of exposures affecting critical assets reside in cloud platforms according to XM Cyber’s analysis. Moreover, attackers can seamlessly traverse from on-premises to cloud environments and back again, posing a significant risk to cloud-based assets. From there, they can easily compromise critical cloud assets with minimal effort and lateral movement hops.
Vertical Vulnerabilities: One Size Exposure Strategy Fails Across Industries
The report’s industry analysis also revealed sectors like Energy and Manufacturing have a higher proportion of internet-exposed critical assets affected by exposures compared to Financial Services organizations, which have large digital footprints. On average, while Financial Services firms manage a much larger digital asset footprint of 5x more assets than the Energy sector, that latter group has a staggering 21x higher proportion of its most critical assets affected by exposures. This demonstrates a true need for industry-specific exposure management strategies.
"The insights collected from this report are a transformative force for organizations navigating the complex realm of cybersecurity, especially in industries with entities that have a lot of exposures like Healthcare and Energy", said Dr. Wade Baker from the Cyentia Institute. “The fact that the median number of exposures affecting Healthcare providers is 5X that of the Energy and Utilities sector points to the inherent challenges of minimizing risk in those environments."
The State of Exposure Management report’s findings are based on data from the XM Cyber Continuous Exposure Management Platform and analyzed independently by the Cyentia Institute.
