Exposure Management Market
CROSS-SOURCE THEMES
Consensus by Category
PHP2Shell and the Patch-Gap Problem: External Visibility as the Binding Constraint
The PHP2Shell pair (CVE-2026-109618 / CVE-2026-109619, CVSS 9.8 in most accounts) is the dominant event in this window, and sources agree the failure is operational rather than technical. [5] reports PHP's October 20 emergency release, [10] and [64] describe millions of web services exposed, and [38] says Amazon saw hackers probing the flaw four days before the fix. [33] quotes researchers saying 'the panic hasn't turned into patching', and [60] confirms CISA added both CVEs to its Known Exploited Vulnerabilities catalog. [9] adds that exploitation hit a European government entity and showed signs of agentic-AI post-exploitation. Vendor content converges on one diagnosis: you cannot patch what you cannot see. [6] argues internal scanners miss forgotten external assets, [87] pitches IONIX's response and [35] cites Censys finding 4,691 exposed hosts in the UAE. A small number of numbers conflict: [87] gives CVSS 9.2 while [5], [6] and [10] describe 9.8, and [5] is titled around different exposure counts for the same vulnerability. For Aunoo's readers this is useful evidence that EASM and exposure counts differ by scanner and method, so a buyer should ask how a vendor's number was produced.
17 ARTICLESSafety/Security
Aunoo can publish a measured read of how each tracked vendor handled PHP2Shell: who shipped detection, who shipped asset context, and who only shipped a blog post. The scanner-count discrepancy in [5] is a ready-made editorial test for European buyers (how many exposed hosts, by whose method, over what window). The independent coverage in [33] and [60] is stronger evidence than vendor posts such as [6] and [87], and Aunoo should weight them accordingly and say so. Where a vendor claims it 'helped customers respond', Aunoo should ask for time-to-detect and time-to-remediate rather than repeat the claim.
Optimistic Outliers
Pessimistic Outliers
-
2026Federal remediation deadlines under the CISA KEV listing pass for PHP2ShellFirst public indication of whether mandated patching actually closes the exposure
-
2027Follow-up scan data on remaining unpatched PHP hostsTests the 'panic hasn't turned into patching' claim in [33]
-
CRITICALPublish a vendor-response comparison for PHP2Shell covering detection availability, asset context and published timelines, with sources for each claim
Coverage is at its peak now; evidence of who responded how is perishable and buyers are forming shortlists
-
HIGHRun an explainer on why scanners report different exposure counts for the same vulnerability and what to ask vendors
[5] gives a concrete worked case; it addresses the 'one scanner with a dashboard' concern directly
-
MEDIUMCreate a recurring 'time from disclosure to exploitation' tracker drawing on public sources such as [38] and [60]
A durable, vendor-neutral data series differentiates the publication
Supporting articles (6)
-
CRITICALThe PHP2Shell Blind Spot: Why You Cannot Patch What Your Internal Scanners Cannot See
Frames PHP2Shell as an external-visibility failure rather than a patching one; vendor-authored.
-
NEUTRALCensys takes census of the Internet like no one else
Details the October 20 emergency release and shows different scanners count different exposure for the same CVEs.
-
CRITICAL“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response
Independent researcher view that awareness has not translated into remediation.
-
CRITICALCISA Confirms PHP2Shell Exploitation, Orders Federal Agencies to Patch
Confirms active exploitation via the KEV catalog.
-
CRITICALPHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Documents a European government victim and agentic-AI post-exploitation.
-
NEUTRALphp2shell (CVE-2026-109618 & CVE-2026-109619) and how IONIX is helping you respond
Example of vendors using the event as a sales moment; cites CVSS 9.2, differing from other sources.
Edge Device Exploitation Wave: FortiBleed, NetScaler and Network Appliance Exposure
Sources consistently show perimeter appliances as the main compromise route this window. [49] and [51] report FortiBleed compromising over 86,000 FortiGate devices across 194 countries, and [32] (Hudson Rock) adds 40,573 cleartext-secret records across 975 previously unlisted domains. [36] and [37] describe a campaign against Fortinet and Palo Alto devices that took more than 70,000 credentials. Citrix NetScaler has three actively exploited zero-days in under a week ([78]), with a further critical flaw (CVSS 9.5) in builds that fixed earlier ones ([73]), watchTowr post-exploitation analysis ([76]), and an Ivanti Connect Secure KEV listing ([55]). [46] reports a maximum-severity SonicWall SMA 1000 SSRF under attack, and [68] covers a BeyondTrust upload flaw. Note a data-quality issue: [20] (CyCognito) carries a NetScaler title but its summary describes IBM DataPower authentication, so it should not be treated as clean evidence. The consensus is that these appliance classes are now the highest-yield target; the disagreement is whether the response is better patching, better external discovery, or retiring the products.
16 ARTICLESSafety/Security
This is a market-shaping theme for readers evaluating exposure management: the dominant real-world breach path is appliances that scanners can see from outside but that internal tools often cannot manage. Aunoo can publish a perimeter-appliance lens on the vendor landscape, asking which tracked vendors detect these devices, enumerate their versions from outside, and link to exploitation status. Aunoo should also flag data quality in the coverage itself (for example the mismatched summary in [20]) and avoid treating vendor blog titles as evidence.
Optimistic Outliers
Pessimistic Outliers
-
2026Federal remediation deadlines for the Ivanti KEV entriesIndicates how quickly mandated fixes are achieved
-
2027Follow-up counts of compromised FortiGate devicesShows whether the 86,000 figure in [49] is falling or the campaign is extending
-
HIGHPublish a buyer's checklist for edge-device exposure: version fingerprinting from outside, KEV linkage, credential-leak correlation
Repeated campaigns across Fortinet, Citrix, Ivanti, SonicWall and Palo Alto make this the most concrete test of a vendor's usefulness
-
MEDIUMMaintain a dated log of appliance zero-days and mass compromises with their primary sources
A neutral timeline supports later analysis of whether exposure vendors changed outcomes
Supporting articles (6)
-
CRITICALFBI Warns FortiBleed Attacks Continue After 86,000+ Devices Compromised
Government warning that the campaign persists beyond patching.
-
CRITICALFortiBleed 2.0 Exposes 40,573 FortiGate Secrets Across 975 Previously Unlisted Domains
Hudson Rock data on scale of leaked secrets; shows exposure beyond known victim lists.
-
CRITICALHackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cross-vendor campaign hitting Fortinet and Palo Alto edge devices.
-
CRITICALCitrix discloses third actively exploited NetScaler zero-day in less than a week
Cadence of exploitation against one product line; assessment of vendor response.
-
CRITICALCISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
Regulatory confirmation of active exploitation of a further appliance class.
-
CRITICALMaximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Another maximum-severity appliance flaw under attack.
AI on Both Sides: Agentic Attackers, Agentic Defenders and the Measurement Gap
Sources agree AI is changing the speed and cost of attack, but the evidence for defensive AI is mostly vendor assertion. On the attacker side: [88] says one hacker used AI agents and about $5,000 to breach over 100 sites, [63] documents campaigns costing as little as $12 to gain domain control, [11] describes ransomware affiliates running an AI framework called Phantom, [62] cites VulnCheck data that AI helped double flaw discovery year on year, and [85] and [86] link AI-discovered bugs to real disruption. [45] shows Censys measuring internet-facing AI infrastructure up 63% in nine months to nearly 268,000 systems, and [12] found 35 AI-built sites among 1.3 million new domains leaking live secrets. On the defender side, launches cluster: Axonius AI Workforce ([15], [41], [67]), Censys AI Agents ([7]), ProjectDiscovery Neo Triage ([84]), Novee external surface testing ([27]), and Terra Security's podcast ([66]). The caution comes from [44], where Axonius argues AI is only as good as asset data, and [50], an ArmorCode survey of 200 security leaders showing over half expect continued difficulty simplifying software security programs. The consensus is that agentic claims are abundant and measured outcomes scarce, which is the gap Aunoo's readers should press on.
26 ARTICLESTechnical Advancement
This is the category where Aunoo's sceptical stance on automation and AI claims has the most to work with. Attacker-side evidence ([63], [88], [11]) is concrete and costed; defender-side evidence ([15], [7], [84], [27]) is launches. Aunoo can say so plainly, and set a standard: an agentic claim earns credit when it reports a measured outcome (time to remediate, false-positive rate, tickets closed) from a named customer or independent test. [44] gives vendors' own best argument (asset data quality) and should be treated as a precondition test rather than an endorsement.
Optimistic Outliers
Pessimistic Outliers
-
2027First customer-attributed outcome data for agentic remediation productsMoves claims from marketing to evidence
-
2028The date by which the Gartner forecast in [1] would be testableAllows assessment of the 70% lower breach likelihood claim
-
HIGHPublish an 'agentic claims vs measured outcomes' scorecard for tracked vendors, starting with Axonius, Censys, ProjectDiscovery, Novee and Terra Security
Launch density is high now and buyers need a defensible filter; this is the publication's clearest differentiator
-
MEDIUMCommission or compile independent data on AI-infrastructure exposure beyond a single vendor's measurement (for example comparing [45] with other scanners)
The 63% growth figure comes from one scanner; [5] already shows scanners disagree
-
MEDIUMTrack Gartner-style forecasts such as the 70% lower breach likelihood in [1] against outcomes
Forecasts are being used in marketing; accountability over time builds credibility
Supporting articles (6)
-
CRITICALAI Tools Are Generating Massive Attacks for Little Cost
Documents two open-weight-model campaigns, one hitting 105 sites and one reaching domain control for $12.
-
CRITICALExposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Evidence of an operational agentic framework (Phantom) used by INC and The Gentlemen affiliates.
-
CRITICALCompanies are building with AI — and exposing new security risks
Censys data: AI infrastructure exposure up 63% in nine months to nearly 268,000 systems.
-
NEUTRALAI is only as good as your asset data
Argument from a vendor that defensive AI depends on complete asset inventories.
-
NEUTRALAutomation, AI agents or people? Sorting out who handles each security finding
ArmorCode survey of 200 security leaders showing struggle to simplify programmes.
-
POSITIVEAxonius launches AI Workforce virtual workers as AI Companion and MCP Server go live
Representative defensive-agent launch; claims delegated remediation follow-up.
Exposure Management Product Differentiation: Discovery, Validation and Buyer Guidance
Product coverage splits into discovery-led, validation-led and platform-led positions, with limited independent comparison. Discovery and EASM: Censys is the most active publisher ([4], [16], [22], [21], [19]), with pricing changes in [4], deeper web rendering in [16] and 22 new protocol scanners in [22]; Flashpoint ([13]), ThreatNG ([17], [25], [42]), Attaxion ([71]) and CyberMindr ([23], [83]) publish EASM positioning. Validation and testing: Novee launched External Surface Testing for forgotten assets ([27]), Bishop Fox positions continuous attack surface testing ([19] datasheet) and AI security scoping ([69], [77]), CyCognito argues for AI-powered testing of overlooked assets ([34]), ProjectDiscovery's Neo Triage confirms exploitability ([84]), and [4]'s AEV platform roundup together with [79]'s breach-and-attack-simulation guide (Cymulate, Pentera, AttackIQ, SCYTHE) frame the validation segment. [1] and [14] argue prioritisation needs asset context, threat intelligence and validation together. Platform consolidation signals are thin in this window: [59] shows Group-IB framing exposure management with adversary intelligence and incident response under 'preemptive security', and [23] and [83] frame M&A and PE portfolio exposure as a buying reason. Caveat: buyer guides such as [28], [79] and [81] are tabular and pricing-focused, and several items ([3], [26], [4]) are low-provenance promotional pieces on aggregator sites. No acquisition, funding round or European vendor exit appears in this window's coverage, so no consolidation claim is supported.
29 ARTICLESMarket Shift
The evidence base here is mostly vendor-authored. That is itself a finding Aunoo should state: in this window no tracked vendor appears in independent comparative testing, and the buyer guides ([28], [79], [81]) compare features and pricing rather than outcomes. Aunoo can add value by mapping vendors to the discovery, validation and platform positions above, flagging which claims have independent support, and noting what is absent: no European acquisition, funding event or sovereignty/NIS2 buying signal surfaces in this set, so Aunoo should not extrapolate on those topics from this coverage alone. For European coverage, the only direct marker is that a European government entity was a PHP2Shell victim ([9]) and that European operators shut down services ([64]); this supports the relevance of external exposure but not a statement about European vendors.
Optimistic Outliers
Pessimistic Outliers
-
2027Review of whether discovery-only vendors have added validation or been repositionedTests the 'one scanner with a dashboard' concern
-
2028Check of Gartner-style forecasts such as that in [1] against observed adoptionDetermines whether prioritisation-plus-validation became an operating norm
-
HIGHPublish a positioning map (discovery, validation, platform) for tracked vendors, with each placement tied to a cited product announcement
Launch activity from Censys, Novee, ProjectDiscovery, Axonius and Group-IB gives enough dated evidence to place vendors defensibly
-
MEDIUMReview buyer guides such as [28], [79] and [81] for method and independence, and publish a note on how to read them
Readers rely on these guides; their criteria and ownership flags vary and should be made explicit
-
MEDIUMSet up a watch for acquisitions and funding events among tracked European vendors, since none appear in this window
Consolidation is a core reader concern, and the absence of events in this window should be monitored rather than assumed
Supporting articles (7)
-
POSITIVEThe 4 Elements of Exposure Prioritization and How to Operationalize Them
Sets out the threat intelligence + asset context + validation model and cites a Gartner forecast.
-
POSITIVENovee puts forgotten internet-facing assets through penetration testing
A new entrant's External Surface Testing launch bridging discovery and validation.
-
POSITIVEProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable
Exploitability confirmation as a distinct product capability.
-
NEUTRAL11 Breach & Attack Simulation Tools: The 2026 Buyer’s Verdict Guide
Buyer's guide naming Cymulate, Pentera, AttackIQ and SCYTHE; useful for who is being compared, thin on outcomes.
-
POSITIVEFrost Radar 2026: Enterprise Risk and Path to Preemptive Security
Group-IB's own account of analyst placement and its exposure-plus-intelligence positioning; vendor-authored.
-
POSITIVE5 attack chains that started with assets nobody thought to test
Vendor case-style argument for testing unmanaged external assets.
-
POSITIVEWeb Scanning in Censys ASM Just Got Deeper
Incremental discovery depth improvement (JavaScript-rendered content).
CROSS-CATEGORY QUOTES
Key Insights
PHP2Shell shows the same vulnerability can produce different exposure counts depending on the scanner: [5] makes this its central point, while [6] and [87] each tell the story from a single vendor's viewpoint.
Edge appliances dominate the real-world breach evidence: 86,000+ FortiGate devices in [49], 70,000+ credentials from Fortinet and Palo Alto devices in [37], three NetScaler zero-days in under a week in [78], and CISA listing Ivanti in [55].
Attacker-side AI claims are costed ($12 in [63], about $5,000 in [88]) while defender-side AI claims are launches ([15], [7], [84]); the one survey in the set ([50], 200 leaders) points to continued difficulty rather than solved problems.
Roughly half of the articles in this set are negative in sentiment (45 of 88), and most describe vulnerabilities and exploitation rather than market structure; coverage of acquisitions, funding and sovereignty is absent.
Gartner's forecast of 70% lower breach likelihood by 2028 for organisations combining exposure prioritisation, threat intelligence, asset context and validation appears in [1], a vendor-adjacent explainer, and is a forecast, not a measured result.
Data-quality issues recur: the CyCognito item [20] carries a NetScaler title but an IBM DataPower summary, [87] gives CVSS 9.2 where others say 9.8, and several items sit on low-provenance aggregator sites ([3], [26], [4]).
NUMBERED SOURCES
References
- Stop Guessing Your Attack Surface: The ROI of Third-Party External Penetration Testing
- The 4 Elements of Exposure Prioritization and How to Operationalize Them
- When AI Agents And Attackers Look Alike, What Should Defenders Test?
- Best Adversarial Exposure Validation (AEV) Platforms for Enterprise Security Teams
- Introducing Censys Starter Subscriptions
- Censys takes census of the Internet like no one else
- The PHP2Shell Blind Spot: Why You Cannot Patch What Your Internal Scanners Cannot See
- Censys AI Agents: Automate Investigations and Amplify Your Threat Intel
- Building Multi-Cloud Security Guardrails With Policy-as-Code, IAM, and Automated Remediation
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
- Global cyber alert rings as two critical PHP flaws leave millions of web services exposed to remote takeover
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
- The Keys Are in the Browser: Secret Exposure Across AI-Built Websites
- The Missing Layer in Vulnerability Prioritization: Full Visibility Into Your Attack Surface
- Joe Diamond, CEO, Axonius
- Axonius AI Workforce pairs asset intelligence with automated action
- Web Scanning in Censys ASM Just Got Deeper
- Mind the Gap: The Visibility Deficit Between Your SOC and the Cybercriminal
- 5 Key Takeaways From Censys’ State of the Internet Report
- Attack Surface Testing Datasheet
- Emerging Threat: (CVE-2026-107406) NetScaler ADC and Gateway Remote Code Execution via SAML
- The Ultimate Guide to Brand Protection with Censys
- New on the Map — September 2026: 22 Protocol and Endpoint Scanners
- Why PE Firms Can No Longer Manage Cyber Risk Deal by Deal
- Six Weeks After Google and JPMorgan Patched MCP Flaw, US Servers Stay Exposed
- Beyond the Domain: Mapping the Adversary's Shadow Infrastructure with External Attack Path Intelligence
- Novee puts forgotten internet-facing assets through penetration testing
- 11 Threat Hunting Services: The 2026 Buyer’s Verdict Guide
- 🗺️ Hidden API Endpoints in JavaScript Bundles: Find and Prove Them
- Critical Linux kernel flaw allows remote root attacks on MPTCP servers
- ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
- FortiBleed 2.0 Exposes 40,573 FortiGate Secrets Across 975 Previously Unlisted Domains
- “The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response
- 5 attack chains that started with assets nobody thought to test
- UAE Firms Race To Patch AI-Discovered PHP Flaw As Thousands Of Servers Face Risk
- Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials
- Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
- Amazon caught hackers probing a PHP flaw 4 days before the fix
- Internet-Wide Threat Has Security Teams Scrambling to Patch PHP
- A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss supermarket systems open to remote takeover
- Axonius Introduces AI Workforce, Providing Security Teams With Virtual Workers to Act on ...
- Stop Blaming the Victim: Shifting the Burden Back to the Attacker
- Insider Threat Report: Dark Web Recruitment & Access Trends
- AI is only as good as your asset data
- Companies are building with AI — and exposing new security risks
- Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
- Stolen Passwords Expose 1,787 US Water Providers to Hackers
- Key Questions That Reveal Whether An SBOM Really Reduces Risk
- FBI Warns FortiBleed Attacks Continue After 86,000+ Devices Compromised
- Automation, AI agents or people? Sorting out who handles each security finding
- FortiBleed Hackers Breach 86,000 Firewalls, Lock Out Admins in 194 Countries
- Caught in 4K: The Gentlemen Files
- Citrix patches NetScaler SAML zero-day exploited in attacks
- Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
- CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
- Open source OSINT toolkit
- The Flashpoint Threat Intelligence Brief: Middle East
- Fake “View & Sign” and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect Clients
- Frost Radar 2026: Enterprise Risk and Path to Preemptive Security
- CISA Confirms PHP2Shell Exploitation, Orders Federal Agencies to Patch
- 12,976 Refrigeration Controls Found Exposed Online in 99 Countries
- AI-Discovered Bugs May Soon Trigger Fresh Disruptions, Cyber Experts Say
- AI Tools Are Generating Massive Attacks for Little Cost
- Why a PHP bug is a business risk, not just an IT problem: ‘Next step could be the mass compromise of…’
- How Higher Ed Institutions Are Managing Third-Party Risk
- Terra Security’s AI Native Cybersecurity podcast opens with Amazon’s CISO
- Axonius launches AI Workforce virtual workers as AI Companion and MCP Server go live
- Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)
- AI Security Scoping: Define What To Test In Your Deployment
- Frostbitten in France: A Danfoss StoreView Internet Exposure Report
- 11 Popular Vulnerability Scanning Tools in 2026
- Brazil Election Domains 2026
- NetScaler builds that fixed zero-days carry critical flaw, too
- Agentic AI In Cybersecurity: What Changes When The System Chooses The Next Step
- dddd — Batch asset collection and vulnerability scanning tool for red teams. Pulls targets from Hunter, Fofa, and Quake, performs fingerprinting, subdomain enumeration, and Nuclei v3 PoC checks.
- Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771
- Why the AI Attack Surface Extends Your Stack
- Citrix discloses third actively exploited NetScaler zero-day in less than a week
- 11 Breach & Attack Simulation Tools: The 2026 Buyer’s Verdict Guide
- Binance Hack: Inside the $6.3B Hot Wallet Theft
- 12 Threat Intelligence Platforms (TIP): The 2026 Buyer’s Verdict Guide
- The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign
- Security Risks That Come With an Acquired Company’s External Footprint
- ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable
- AI-driven software flaws could trigger more internet disruptions, experts warn
- Government websites go dark after AI-discovered flaw sparks security scramble
- php2shell (CVE-2026-109618 & CVE-2026-109619) and how IONIX is helping you respond
- How One Hacker Used AI Agents And A Few Thousand Dollars To Break Into Scores Of Sites
By the Cyberfuturists
made using AunooExposure Management Market · Consensus analysis · About · Privacy · Three horizons