Adobe's CVE arrived 120 days after our report, Citrix closed a report with no CVE, and NetScaler was exploited before its advisory. What your team can do while a disclosure window is open.
For thirteen days, PaperCut's emergency builds reported the same version number as the unpatched releases they were based on. Updated, remediated, and clean are three different states, and most vulnerability programs report them as one.
Adobe Genuine Service creates a named pipe writable by EVERYONE, served by a process running as SYSTEM. Adobe fixed it in July, published no advisory, and scored it a 4.0.
Enterprises are moving inference in-house for privacy and cost. The property that got it approved, that nothing leaves the host, is the property that hides it from AI security tooling built around the cloud.
Strip away the model and an AI agent is a process with an identity, a privilege level, and a set of things it can touch. Security teams already have a model for that.
CVE reachability claims are mostly inference. A former CISO grades three vulnerability tool categories, including his own, against one strict standard.
AI risk scoring for agentic AI: we evaluate AIVSS, MITRE ATLAS, and the OWASP Agentic Top 10, where each works, where it fails, and what to use now.
WinRAR is widely deployed and rarely updated, and its runtime behavior flagged it high-risk before its CVEs existed.
Punto Switcher's signed binary looks clean to file scanners. The flaw is an unquoted RunDll32.exe call it makes at launch that lets a local attacker run arbitrary code, caught by Spektion Research at runtime.
The mean time from CVE disclosure to exploitation hit negative seven days in 2025. CVEs are no longer leading indicators of risk, and runtime behavior is the signal that replaces them.
Mythos found thousands of critical vulnerabilities. Fewer than 1% have CVEs. If your entire security stack needs a CVE to see risk, you're structurally blind to what's already running on your endpoints.
Spektion Research discovered and disclosed a privilege escalation vulnerability in MobaXterm — caught at runtime, where static tools don't look.
AI tools like Claude are reshaping the attack surface in ways traditional vulnerability management can't track. Here's what security teams need to know.
Spektion wins two Global InfoSec Awards at RSAC 2026: Most Innovative Exposure Assessment Platform and Most Innovative Runtime Exposure Management
Continuous runtime exposure management has arrived. Joe Silva shares what Spektion built, why it matters, and why the window to act keeps shrinking.
AI agents are moving fast and security is scrambling to catch up. This post breaks down why static policies aren't enough, and gives security leaders a checklist to get ahead of the exposure.
Five supply chain campaigns. One has a CVE. The other four? Completely invisible to your vuln management program. And they're still your problem.
What failed in the update process, why CVEs didn’t tell the full story, and how runtime visibility helps security teams spot real exploit risk.
An analysis of how runtime evidence changes vulnerability prioritization.
PDF editors with zero CVEs can be just as dangerous as those with dozens. Our research shows why organizations need runtime behavioral monitoring, not just CVE tracking.
Learn what “runtime” means for vulnerability management and how runtime evidence separates exploitable vulnerabilities from theoretically present ones.
Why traditional vulnerability management creates the illusion of security while leaving teams drowning in noise, and why runtime context is the way out.
Get the summary of the Security Theater Podcast featuring two CISOs, Joe Silva & Kyle Bubp, discussing the limitations of current VM practices and the reasons to shift to real-time, behavioral context for true risk reduction.
Unquoted paths (CWE-428) remain a hidden threat in today’s software. See how runtime visibility exposes what legacy vulnerability tools overlook.
Vulnerability management finds the known flaws on your assets and ranks them for fixing. Exposure management decides what an attacker could exploit in your environment, with or without a CVE, and drives the work to close it. They run as layers: exposure management is the program frame, and vulnerability management is the input it runs on.
Learn how runtime monitoring helps banks and credit unions meet evolving third-party risk requirements from the Fed, NYDFS, DORA, and NCUA.
AI copilots and internally built applications are creating untracked software inside enterprises. Learn how Spektion exposes hidden risks at runtime.
Discover how a 250-day AI PDF editor vulnerability exposed the risks of public directories, and why runtime visibility is key to closing blind spots.
New features enable faster workflows for security teams, audit-ready reports for leadership, and enhanced visibility to explore and act on risk.
A practical guide to evaluating third-party software risk before purchase, after deployment, and continuously at runtime.
Vulnerability management is the broader process of identifying, prioritizing, and remediating security vulnerabilities across your environment. Patch management is one remediation method within it: applying vendor updates to fix known software flaws. Vulnerability management decides what to fix and why. Patch management is one way you do the fixing.
Strengthen CTEM programs with runtime insights into software risk to reduce blind spots and exposure.
Learn how continuous runtime monitoring simplifies DORA Chapter V compliance for banks, insurers, and other FSIs.
Runtime visibility into software behavior is fundamentally changing how security teams identify and respond to threats, moving beyond signatures to true behavioral analysis.
Discover where other vulnerability management approaches fall short and why runtime visibility is the key to staying ahead.
AI-coded software brings common exploitation risks into your org. Learn how runtime protection can help.
New feature, Unused Software, helps security teams reduce risk, cut costs, and shrink their attack surface.
Attackers increasingly prefer to leverage legitimate software already present in target environments rather than introducing malicious executables.
At Spektion, our continuous monitoring of software behavior across thousands of products in enterprise environments has revealed a concerning pattern: remotely accessible Named Pipes are far more prevalent than most security teams realize.
Breaking the Cycle of Ineffective Vulnerability Management with its Purpose-Built Solution Harnessing Runtime Insights
On the heels of releasing the macOS sensor earlier this week, its as good a time as ever to dig into some mac specific risks. Having spent the majority of my career attacking Windows its fun to peak under the macOS hood.
One of the more common risks I still see in commercial software is applications that dynamically allocate memory in external processes—for instance, by creating memory pages with both writable and executable permissions.
