Armadin Research Finds 88% of Severe Enterprise Exposure Did Not Appear in External Data

First Opportunity Intelligence report, drawn from agentic attacks on live production systems, also finds 93% of severe findings were within the organization's own control to remediate

PALO ALTO, Calif., Nov. 2, 2026 /PRNewswire/ -- Armadin, an AI-native cybersecurity company building effective autonomous security, today released Opportunity Intelligence: Reducing Exposure to Adversaries, its first reported research on where global enterprises are exploitable. The findings come from agentic attacks Armadin ran against live production systems throughout 2026 at global enterprises in nearly a dozen industries.

Most threat intelligence records what adversaries did after the harm was done. This research takes a different approach. It records what an adversary could actually reach in a specific environment, proven by attacking it. Armadin calls this opportunity data, which informs opportunity intelligence. A threat needs an adversary with the capability and the intent to act, and the opportunity to do it. Opportunity is the only one of those three conditions an organization controls, and the findings show how much of it most organizations are not seeing. In the agentic age, understanding what opportunities the attackers have to exploit organizations is the key to getting ahead of the attacks.

The key findings follow:

• 96% of clients had at least one critical finding. Critical findings represent a direct and immediate threat to the organization and require emergency remediation.
• 88% of Armadin's critical and high findings would not be identified via existing intelligence sources. Most sat in software the client wrote, products deployed in ways no advisory described, or in not-yet-discovered zero-day vulnerabilities.
• 71% of credentials used in kill chains were non-human identities. The majority of these were stored in readable form, with organizations disclosing them unintentionally.
• Nearly 70% of severe findings could be reached by someone without an account, and the majority of the documented kill chains started from an unauthenticated position. More than half of those kill chains ended with Armadin holding sensitive data, administrative control, or a combination of both.
• 93% of severe findings could be mitigated without third-party action and 49% did not require modification to application code. This means nearly all identified exposure could be mitigated directly by the organizations, and time to remediate depends primarily on the organizations' capabilities.

Armadin recommends that organizations base remediation decisions on the measured exposure of their own environments rather than on what data has been published about others. It also recommends governing service account credentials with the same discipline applied to people, and moving configuration changes through a faster approval path than code releases. The research reveals that 43% of severe findings could be closed by changing a setting or policy.

"Opportunity intelligence tells you where actors could get in, before they do," said Kevin Mandia, Chief Executive Officer, Armadin. "For decades our industry learned to set its defenses by what already happened to someone else. Now we can get ahead of the attackers by eliminating their opportunity. The good news is our remediation guidelines found 93% of our severe findings were within the organization's own power to close."

"Attackers don't read your vulnerability feed. They look at what's actually in front of them," said Evan Peña, Chief Offensive Security Officer and Founder, Armadin. "That's what this research measures. We attacked live production environments the way an adversary would, and most of the paths we found started without a login and ran through credentials an application had left lying around. None of that shows up in a CVE database, but all of it shows up in an attack."

Armadin assesses with high confidence that the share of available exposure converted into intrusions will rise over the next 12 months as AI lowers the cost of finding attack paths. The same tools lower the cost for defenders to measure their own environments, which leaves the speed of remediation as the variable that separates one organization from another.

The full research, including guidance for defenders, is available at https://armadin.com/opportunity-intelligence-research

About Armadin
Armadin is an AI-native cybersecurity company delivering the definitive offensive security platform to identify and eliminate an organization's exploitable risks. As the threat of AI-driven attacks escalates, Armadin empowers enterprises to proactively secure their environments. Armadin's platform safely delivers the most comprehensive and powerful AI Hyperattacks to identify new and novel attack paths before adversaries can exploit them. Led by CEO Kevin Mandia, Armadin is a group of engineers, researchers, and hackers on a mission to create effective autonomous security.

For more information, visit www.armadin.com

Media Contacts
Armadin | Kristy Campbell | [email protected]

SOURCE Armadin