XM Cyber Research Finds That Hackers Can Claim ‘Checkmate’ on 94% of Critical Assets in Just Four Moves 

First Annual Impact Report Reveals Hackers’ Journeys and How To Mitigate; 
Demonstrates XM’s Ability to See All Ways that Critical Business Assets Can Be Compromised

Herzliya, Israel, March 31, 2022 — XM Cyber, the multi-award-winning hybrid cloud security company, today announced findings from its first annual Impact Report. Attack Path Management Impact Report: 2021 Year in Review incorporates insights from nearly two million endpoints, files, folders, and cloud resources throughout 2021. The XM research team analyzed the methods, attack paths and impacts of attack techniques that imperil critical assets across on-prem, multi-cloud and hybrid environments, and developed tips for thwarting them. 

Today’s security tools enable organizations to detect all kinds of misconfigurations, vulnerabilities and other security gaps. However, they fail to show how these seemingly unrelated issues form hidden attack paths that hackers can use to pivot through a hybrid cloud environment and compromise critical assets. 

XM’s Impact Report takes the attackers’ perspective to show how, once they get a foothold in the network, they can easily move towards critical business assets. The report was enabled by the company’s namesake attack path management platform, which allows users to see all of the ways that hackers can leverage attack paths across cloud and on-prem environments, aiding mitigation and prevention efforts.

Key insights include:

• 94% of critical assets can be compromised within four steps of the initial breach point 
• On average, 75% of an organization’s critical assets can be compromised in their current security state
• 73% of the top attack techniques involve mismanaged or stolen credentials
• 95% of organizational users have long-term access keys attached to them that can be exposed
• 78% of businesses are open to compromise every time a new Remote Code Execution (RCE) technique is found
• The main attack vectors in the cloud are misconfigurations and overly permissive access
• By knowing where to disrupt attack paths, organizations can reduce 80% of issues that would otherwise have taken up security resources

An attack path is a chain of attack vectors (vulnerabilities, misconfigurations, user privileges, human errors, etc.) that a hacker can use to move laterally through the network. Hybrid cloud computing architecture is especially vulnerable, as attackers can exploit security gaps to obtain a foothold in the network and then move laterally between on-premises and cloud applications. XM Cyber’s report outlines the security gaps and hygiene issues that exist in multiple attack paths across on-prem and cloud environments,  demonstrating the importance of risk visibility across the entire network. 

“Modern organizations are investing in more and more platforms, apps and other tech tools to accelerate their business, but they too often fail to realize that the interconnection between all these technologies poses a significant risk,” said Zur Ulianitzky, Head of Research, XM Cyber. “When siloed teams are responsible for different components of security within the network, nobody sees the full picture. One team may ignore a seemingly small risk, not realizing that in the big picture, it’s a stepping stone in a hidden attack path to a critical asset. To keep pace with today’s technology and business demands, attack path remediation must be prioritized.” 

Highlights of the report include:

• Methodology and Synopsis of the Attack Path
• The Top Attack Techniques Used to Compromise Critical Assets in 2021
• New Attack Techniques Used in 2021
• Cross-platform Attack Insights
• Key Findings Across On-Prem and Cloud

To download the XM Cyber Research Impact Report, visit: https://info.xmcyber.com/2022-attack-path-management-impact-report.

###

About XM Cyber

XM Cyber is a leading hybrid cloud security company that’s changing the way innovative organizations approach cyber risk. Its attack path management platform continuously uncovers hidden attack paths to businesses’ critical assets across cloud and on-prem environments, enabling security teams to cut them off at key junctures and eradicate risk with a fraction of the effort. Many of the world’s largest, most complex organizations choose XM Cyber to help eradicate risk. Founded by top executives from the Israeli cyber intelligence community, XM Cyber has offices in North America, Europe, and Israel.