Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

Tens of Cybersecurity Firms Found Exposing Their Assets: Study

Tens of cybersecurity companies expose a large number of assets to the internet, according to a study conducted recently by attack surface management firm Reposify.

Tens of cybersecurity companies expose a large number of assets to the internet, according to a study conducted recently by attack surface management firm Reposify.

It’s not uncommon for major companies to unwittingly expose databases and other assets, but a study conducted by Reposify over a two-week period in January showed that 35 multinational cybersecurity companies and their more than 350 subsidiaries hosted over 200,000 exposed assets. These assets included databases, remote access sites, and cloud services.

Reposify’s analysis showed that 86% of these companies have at least one exposed remote access service, 80% expose network assets, and 63% expose back office internal networks. Just over half of the cybersecurity firms have at least one exposed database.

Cybersecurity companies expose assets

In a vast majority of cases, companies exposed platforms such as Nginx, Apache, OpenSSH, IIS and Portmap, which are “highly sensitive, and the consequence of a breach is severe — particularly in the case of the cybersecurity industry.”

As for exposed remote access protocols, 90% of companies exposed OpenSSH, followed by RDP (47%), Telnet (33%), and SMB (30%).

The study showed that more than two-thirds of companies exposed PostgreSQL databases, and half exposed Oracledb databases.

Many cybersecurity firms and their subsidiaries also appear to expose storage and backup systems (FTP, S3), and development tools (Express, Jenkins, Tableau Server).

Nearly every cybersecurity company seems to host exposed assets on the AWS cloud platform (97%), followed by Azure (82%) and Google Cloud (76%).

[ You can learn more about attack surface management at

SecurityWeek’s Attack Surface Management Summit – available on demand ]

One concerning finding is that — except for storage and web assets — a majority of exposed services are in the organization’s “unofficial perimeter,” which means they are less likely to be monitored.

“Services under unknown perimeters are less likely to be known, and often represent shadow IT, unknown risks, or flag a possible backdoor malactors can use to access a company’s assets,” Reposify said in its report.

More than 40% of the vulnerabilities affecting exposed services have a “high” or “critical” severity rating.

“Just one of these statistics is concerning enough – but the combination points to a sincere need for the industry to better practice what it preaches,” Reposify said.

Related: Over 28,000 Vulnerabilities Disclosed in 2021: Report

Related: Telemetry Report Shows Patch Status of High-Profile Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Many developers and security people admit to having experienced a breach effected through compromised API credentials.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Identity & Access

Strata Identity has raised $26 million in a Series B funding round led by Telstra Ventures, with additional investment from Forgepoint Capital, Innovating Capital,...

Cybercrime

A database containing over 235 million unique records of Twitter users is now available for free on the web, cybercrime intelligence firm Hudson Rock...

Application Security

Software maker Adobe on Tuesday released security patches for 29 documented vulnerabilities across multiple enterprise-facing products and warned that hackers could exploit these bugs...

Cybersecurity Funding

Los Gatos, Calif-based data protection and privacy firm Titaniam has raised $6 million seed funding from Refinery Ventures, with participation from Fusion Fund, Shasta...