Most Enterprise Flaws Escape Vendor Advisories
An AI-driven attack report finds 88% of critical and high weaknesses would have been missed, a finding from one firm's commercial testing rather than an independent study.
Updated on Nov. 2, 2026 in Cybersecurity
Armadin, an offensive security startup founded by Mandiant founder Kevin Mandia, published a report on November 2, 2026, finding that 88% of critical and high-severity weaknesses found in live enterprise attack tests would not have been identified through vendor advisories. The findings come from AI-driven attacks against clients' live systems, a status that is published results from a commercial report rather than a peer-reviewed study.
Why it matters
The findings suggest that vendor advisories capture only a small share of the exposures attackers can actually use, shifting attention toward how organizations configure and build their own software. As AI-driven attack tooling moves into live enterprise environments, the gap between advisory coverage and real exposure becomes a central question for defenders.
The report's headline figure is 88% of critical and high findings falling outside vendor advisories, a share that is itself a comparison against the advisory baseline. Armadin did not disclose the sample size, so the percentages cannot be weighed against a total count of findings or organizations.
The players
Armadin
An offensive security startup that runs AI-driven attacks against client environments to find exploitable weaknesses.
Kevin Mandia
Founder of Mandiant and the founder of Armadin, known for his prior work in incident response and threat intelligence.
The details
Armadin ran AI-driven attacks against its clients' live systems, meaning the tests targeted production environments rather than lab replicas. In one engagement, the team began from an unprivileged domain account, a standard user-level login with no administrative rights, and exploited a flaw in backup software to read stored credentials. That chain shows how a low-privilege foothold can be escalated by chaining a defect in one piece of software with credentials stored elsewhere.
Timeline
Live attack tests on enterprise environments were conducted in 2026.
Armadin published the report on November 2, 2026.
The Tech Race
Armadin's findings compete with the traditional model in which vendor advisories drive remediation, a model Mandiant helped shape through its threat intelligence work. The report positions AI-driven offensive testing against advisory-based vulnerability management as the emerging contest for how enterprises find their weakest points.
Security teams that rely mainly on vendor advisories may need to widen their testing to cover misconfigurations and their own code, since the report attributes most uncovered critical findings to those sources. Armadin did not disclose pricing or availability for its testing services, so the practical access path for other organizations is not yet known.
The takeaway
Watch whether Armadin publishes the sample size and methodology behind its 88% figure, since the headline number cannot be weighed without them. Enterprise security leaders can also track whether other offensive-testing firms release comparable advisory-gap data.
Further reading
For background on how attackers exploit gaps outside patch cycles, browse the Cybersecurity section.
