Checkmate on 94% of critical assets in just four moves

Issue 2 2022 News

XM Cyber, a hybrid cloud security company, announced findings from its first annual Impact Report. Attack Path Management Impact Report: 2021 Year in Review incorporates insights from nearly two million endpoints, files, folders and cloud resources throughout 2021. The XM research team analysed the methods, attack paths and impacts of attack techniques that imperil critical assets across on-premises, multi-cloud and hybrid environments and developed tips for thwarting them.

Today’s security tools enable organisations to detect all kinds of misconfigurations, vulnerabilities and other security gaps. However, they fail to show how these seemingly unrelated issues form hidden attack paths that hackers can use to pivot through a hybrid cloud environment and compromise critical assets.

XM’s Impact Report takes the attackers’ perspective to show how, once they get a foothold in the network, they can easily move towards critical business assets. The report was enabled by the company’s namesake attack path management platform, which allows users to see all of the ways that hackers can leverage attack paths across cloud and on-premises environments, aiding mitigation and prevention efforts.

Key insights include:

• 94% of critical assets can be compromised within four steps of the initial breach point.

• On average, 75% of an organisation’s critical assets can be compromised in their current security state.

• 73% of the top attack techniques involve mismanaged or stolen credentials.

• 95% of organisational users have long-term access keys attached to them that can be exposed.

• 78% of businesses are open to compromise every time a new Remote Code Execution (RCE) technique is found.

• The main attack vectors in the cloud are misconfigurations and overly permissive access.

• By knowing where to disrupt attack paths, organisations can reduce 80% of issues that would otherwise have taken up security resources.

An attack path is a chain of attack vectors (vulnerabilities, misconfigurations, user privileges, human errors, etc.) that a hacker can use to move laterally through the network. Hybrid cloud computing architecture is especially vulnerable as attackers can exploit security gaps to obtain a foothold in the network and then move laterally between on-premises and cloud applications. XM Cyber’s report outlines the security gaps and hygiene issues that exist in multiple attack paths across on-premises and cloud environments, demonstrating the importance of risk visibility across the entire network.

“Modern organisations are investing in more and more platforms, apps and other tech tools to accelerate their business, but they too often fail to realise that the interconnection between all these technologies poses a significant risk,” said Zur Ulianitzky, head of research, XM Cyber. “When siloed teams are responsible for different components of security within the network, nobody sees the full picture. One team may ignore a seemingly small risk, not realising that in the big picture it’s a stepping stone in a hidden attack path to a critical asset. To keep pace with today’s technology and business demands, attack path remediation must be prioritised.”

Highlights of the report include:

• Methodology and synopsis of the attack path.

• The top attack techniques used to compromise critical assets in 2021.

• New attack techniques used in 2021.

• Cross-platform attack insights.

• Key findings across on-prem and cloud.

To download the XM Cyber Research Impact Report, visit or use the short link:*xm1

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Spend on cloud to accelerate across Africa in 2023
More than two-thirds of companies using cloud computing across major African markets plan to increase their spending on cloud services in 2023.

ChatGPT’s impacts will be social, not technical
ChatGPT is truly a remarkable achievement, an artificial intelligence (AI) that you can have a conversation with and ask to do everything from writing essays to coding computer programs.

Artificial intelligence in Africa: levelling the narrative
While AI can benefit multiple industries, in Africa the key sectors that stand to gain are financial services (specifically fintech) and agriculture.

Improving data security for a hybrid society
Researchers from Tokyo University of Science develop a method that can perform computations with encrypted data faster and at a lower cost than conventional methods, while also improving security.

Cybersecurity in 2023: The latest trends and developments
In 2023, experts predict that several trends will shape the cybersecurity landscape, including the growing use of artificial intelligence (AI), the increasing focus on the Internet of Things (IoT), and the rise of quantum computing.

SAN market set for growth
Technews Publishing News IT infrastructure
Storage-area network (SAN) market to hit US$ 26,86 billion in revenue by the end of 2029 due to factors like widespread adoption of Hybrid SAN-NAS solutions.

Enterprise threats in 2023
News Cyber Security
Large businesses and government structures should prepare for cybercriminals using media to blackmail organisations, reporting alleged data leaks, and purchasing initial access to previously compromised companies on the darknet.

Trends in the proptech industry for 2023
By mixing real estate with technology to optimise industries, create new ones, and generate efficiencies or capabilities that improve revenue generation, something as fundamental as the concept of parking has been turned on its head.

31 percent of all IoT SIMs managed with third-party IoT CMPs
News Integrated Solutions
Berg Insight recently released new findings about the market for IoT connectivity management platforms (CMPs), a standard component in the value proposition from mobile operators and IoT MVNOs around the world.

Off-highway vehicle telematics systems
The installed base of off-highway vehicle telematics systems to reach 12.2 million units worldwide by 2026, says Berg Insight.