Research: Enterprise Attack Surface Trends

Scope and method

This is a secondary analysis. Cybrilliant did not run internet scans or collect incident data for it. We compared four published sources that use different populations and methods, and looked for findings that point the same way. Where they differ, the text says so.

Here, “attack surface” means everything an attacker can reach, authenticate to or influence from outside your control. That covers internet-facing assets, edge and remote-access devices, cloud tenants, supplier connections, identities, and human channels such as the help desk. Scanning for exposed IP addresses is one input to that picture, not the picture itself.

1. Exploitation has overtaken credentials as the main way in

Verizon reports vulnerability exploitation as the most common initial access vector, at 31% of breaches. Credential abuse, the previous leader, fell to 13%. Mandiant reports exploits as the leading vector at 32% where a vector could be identified, for the sixth straight edition.

The two sources sample different things. Verizon aggregates breaches reported by contributors. Mandiant sees cases where an organization called in responders. Their biases differ, which is why agreement between them carries weight.

2. The patching window has inverted for some flaws

Mandiant estimates mean time to exploit at minus seven days. A negative number means exploitation evidence appears before a patch is available. The earliest comparison Mandiant gives is 63 days, and the previous edition put it at minus one. Mandiant cites flaws in widely deployed enterprise platforms, including an SAP NetWeaver component, Oracle E-Business Suite and SharePoint, exploited before or around the time fixes shipped.

Remediation is slowing at the same time. Verizon found that 26% of vulnerabilities in CISA’s KEV catalog were fully remediated, down from 38% in the prior edition. The median time to full resolution rose to 43 days from 32. The median organization had 50% more critical vulnerabilities to deal with.

Our reading: a patch SLA counted in days assumes the defender moves first. For a growing class of internet-facing software, the attacker moves first. The decision shifts from “patch quickly” to “reduce what is reachable, mitigate first, and verify that nothing got in before the fix.”

3. Edge devices combine high exposure with low visibility

In Verizon’s previous edition, edge devices and VPNs made up 22% of vulnerability exploitation, up from 3% in the edition before. About 54% of those vulnerabilities were fully remediated. Mandiant describes edge and core network devices as primary targets for sustained campaigns, partly because they often lack endpoint detection and response visibility.

VulnCheck’s analysis of 181 exploited edge device vulnerabilities adds two details. Only 23.7% appeared in CISA’s KEV catalog. And 42.5% affected end-of-life or likely end-of-life devices. Consumer networking equipment accounted for 56% of the exploited vulnerabilities in that set. VulnCheck is a vendor and the published summary does not describe how the set was assembled, so treat these figures as indicative.

Our reading: two practical points follow. A KEV-only feed would have missed about three in four exploited edge flaws in that dataset, so KEV works as a floor, not a map. And the inventory must include end-of-life and branch or home networking gear that connects to corporate resources. These are often the least-owned assets in the estate.

4. The surface now includes systems you cannot scan

Verizon reports third-party involvement in 48% of breaches, a 60% increase on the prior dataset. Remediation by those third parties was slow. Only 23% fully fixed missing or improperly secured cloud MFA. Half of those findings closed within about four weeks (n=7,513). For weak passwords and permission misconfigurations, the median time to close half of the findings was well beyond two quarters.

Our reading: external attack surface tools see your DNS records, IP ranges, certificates and exposed services. They do not see a supplier’s tenant-level MFA policy, an integration token or a partner portal. Supplier access paths belong in the definition of your own surface, tracked with the same discipline.

5. Once access exists, it moves quickly

Mandiant found the hand-off model, where one group obtains access and another runs follow-on operations, in 9% of investigations, up from 4% at the earliest comparison point. The median time from initial access to hand-off was over eight hours then. In the latest edition it is 22 seconds. Voice phishing was the second most common initial vector at 11%.

Median dwell time rose to 14 days from 11. Intrusions detected internally took about nine days. Those reported by an outside party took a median of 25 days, up from 11. Just over half of organizations found the activity themselves.

Our reading: for an exposed asset, the metric that matters is the gap between exposure and mitigation. After exploitation, the window before access passes to someone else can be measured in seconds.

What leaders should change

Limitations

• The sources describe populations of incidents. They do not give the likelihood that any one organization will be hit.

• Verizon’s figures depend on contributor data and on regional disclosure rules. Mandiant’s vector percentages apply only where a vector was identified, and its sample consists of organizations that needed incident response.

• Mean time to exploit is an estimate, not a measurement.

• The VulnCheck figures come from a vendor summary without full method detail.

• Trend comparisons are between consecutive editions of each report. Figures from different sources are not directly comparable.

Next step

Four questions test where you stand:

• Can you list every internet-facing asset and name its owner?

• Which of those are edge or remote-access devices, and which of them do not send logs anywhere?

• How many are end of life?

• Which supplier connections give a path to your data, and what evidence do you hold about the supplier’s MFA and permissions?

Sources

1. Verizon. Data Breach Investigations Report, latest edition and executive summary. Initial access vectors, KEV remediation, third-party involvement and remediation. verizon.com/business/resources/reports/dbir verizon.com

2. Verizon. Data Breach Investigations Report, previous edition, as reported by SecurityWeek. Edge device and VPN exploitation share and remediation rate. securityweek.com

3. Mandiant (Google Threat Intelligence Group). M-Trends, latest edition, as reported by Help Net Security. Initial infection vectors, time to exploit, hand-offs, dwell time. helpnetsecurity.com

4. VulnCheck. Exploring Network Edge Devices (State of Exploitation summary). KEV coverage and end-of-life share for 181 exploited edge device vulnerabilities. wwv.vulncheck.com

5. CISA. Known Exploited Vulnerabilities Catalog. cisa.gov