Security Experts:

Connect with us

Hi, what are you looking for?


Data Protection

Tens of Cybersecurity Firms Found Exposing Their Assets: Study

Tens of cybersecurity companies expose a large number of assets to the internet, according to a study conducted recently by attack surface management firm Reposify.

Tens of cybersecurity companies expose a large number of assets to the internet, according to a study conducted recently by attack surface management firm Reposify.

It’s not uncommon for major companies to unwittingly expose databases and other assets, but a study conducted by Reposify over a two-week period in January showed that 35 multinational cybersecurity companies and their more than 350 subsidiaries hosted over 200,000 exposed assets. These assets included databases, remote access sites, and cloud services.

Reposify’s analysis showed that 86% of these companies have at least one exposed remote access service, 80% expose network assets, and 63% expose back office internal networks. Just over half of the cybersecurity firms have at least one exposed database.

Cybersecurity companies expose assets

In a vast majority of cases, companies exposed platforms such as Nginx, Apache, OpenSSH, IIS and Portmap, which are “highly sensitive, and the consequence of a breach is severe — particularly in the case of the cybersecurity industry.”

As for exposed remote access protocols, 90% of companies exposed OpenSSH, followed by RDP (47%), Telnet (33%), and SMB (30%).

The study showed that more than two-thirds of companies exposed PostgreSQL databases, and half exposed Oracledb databases.

Many cybersecurity firms and their subsidiaries also appear to expose storage and backup systems (FTP, S3), and development tools (Express, Jenkins, Tableau Server).

Nearly every cybersecurity company seems to host exposed assets on the AWS cloud platform (97%), followed by Azure (82%) and Google Cloud (76%).

[ You can learn more about attack surface management at

SecurityWeek’s Attack Surface Management Summit – available on demand ]

One concerning finding is that — except for storage and web assets — a majority of exposed services are in the organization’s “unofficial perimeter,” which means they are less likely to be monitored.

“Services under unknown perimeters are less likely to be known, and often represent shadow IT, unknown risks, or flag a possible backdoor malactors can use to access a company’s assets,” Reposify said in its report.

More than 40% of the vulnerabilities affecting exposed services have a “high” or “critical” severity rating.

“Just one of these statistics is concerning enough – but the combination points to a sincere need for the industry to better practice what it preaches,” Reposify said.

Related: Over 28,000 Vulnerabilities Disclosed in 2021: Report

Related: Telemetry Report Shows Patch Status of High-Profile Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Many developers and security people admit to having experienced a breach effected through compromised API credentials.


The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...