Armadin Report Finds Most Critical Flaws Missed by Advisories
An offensive security firm founded by Mandiant's Kevin Mandia says AI-driven attacks on live enterprise systems surfaced weaknesses that vendor advisories did not cover.
Updated on Nov. 2, 2026 in Cybersecurity
Armadin, an offensive security startup launched by Mandiant founder Kevin Mandia, published a report on November 2, 2026, finding that 88% of critical and high-severity weaknesses uncovered in live enterprise attack tests would not have been identified through vendor advisories. The firm did not disclose how many organizations or findings the data covers.
Why it matters
The findings suggest that organizations relying mainly on vendor advisories may miss the majority of serious weaknesses in their own environments. Armadin's data points to flaws in clients' own software and unadvised product deployments as the main sources of exposure.
The report is a company-published analysis of AI-driven attacks on live enterprise systems, with 88% of critical and high findings absent from vendor advisories and 67% of critical uncovered findings traced to clients' own software defects. Armadin did not disclose the total number of organizations or findings behind these percentages.
The players
Armadin
An offensive security startup that conducts AI-driven attacks on client systems to identify weaknesses before adversaries do.
Kevin Mandia
The founder of Mandiant, a prominent cybersecurity firm, who launched Armadin as an offensive security startup.
The details
Armadin conducted AI-driven attacks against its clients' live systems across nearly a dozen industries. In one engagement, the firm started from an unprivileged domain account and used a flaw in backup software to read stored credentials. One zero-day in an identity governance platform took the vendor almost four months to issue an advisory.
Timeline
2026: Armadin conducted live attack tests on enterprise environments.
November 2, 2026: Armadin published the report.
Roadmap
Armadin's report extends the offensive-testing approach associated with Mandiant founder Kevin Mandia into AI-driven attacks on live enterprise systems. The findings point to a gap between vendor advisory coverage and the weaknesses that actually appear in client environments.
Security teams that depend mainly on vendor advisories may need to add live attack testing and internal code review to find the flaws most likely to be exploited. Organizations that store service account credentials in widely accessible places face a specific exposure the report highlights.
The takeaway
Vendor advisories alone may leave the majority of serious weaknesses unaddressed, so testing live environments and auditing internal software and credential storage can close gaps advisories miss.
Further reading
For related coverage of threats and defenses, explore the Cybersecurity section.
