Eclypsium Tackles Hardware's Blind Spot with a 'Patch Tuesday' for Devices

PORTLAND, Ore. – July 22, 2026 – For decades, IT security teams have operated with a familiar rhythm: on the second Tuesday of each month, Microsoft releases a batch of software security patches, and a global effort to test and deploy them begins. This predictable cadence, known as 'Patch Tuesday,' brought a semblance of order to the chaos of software vulnerability management. Now, a Portland-based infrastructure assurance company is aiming to do the same for the far more fragmented and often-ignored world of hardware.

Eclypsium today launched InfraTrust, a free global knowledge base for hardware infrastructure risks, alongside InfraTrust Pulse, a monthly digest designed to act as a 'Patch Tuesday' for the foundational layer of enterprise technology. The initiative seeks to consolidate security advisories from a sprawling list of chip manufacturers, server OEMs, and network device makers into a single, centralized intelligence hub. The goal is to illuminate a critical blind spot for organizations: the firmware and hardware that underpins their entire digital operation.

The Hidden Dangers in Our Digital Foundation

The timing is critical. While software vulnerabilities grab headlines, adversaries are increasingly shifting their focus downward in the technology stack. Hardware and firmware-level attacks have become a preferred tool for sophisticated threat actors, from nation-states to ransomware gangs, for a simple reason: they are incredibly effective.

These attacks operate below the operating system, making them invisible to most traditional security tools like endpoint detection and response (EDR) platforms. Once compromised, a device’s firmware can provide an attacker with persistent, stealthy access that survives reboots and even complete reimaging of the system. This makes them a nightmare for defenders.

"Since 2024, the percentage of edge devices and VPNs as a target of vulnerability exploitation grew almost eight-fold," said Yuriy Bulygin, CEO and co-founder of Eclypsium. "These hardware-level attacks are now commonplace, but difficult to track though individual vendor websites and notifications." The firm's research points to a concerted effort by Russian and Chinese state-sponsored groups to exploit routers, firewalls, and other network edge devices, turning critical infrastructure into a primary battleground.

For security teams, the problem has been one of visibility. An anonymous CISO at a Fortune 500 financial firm described the current process as untenable. "We have teams that spend countless hours hunting through dozens of disparate vendor sites, trying to correlate CVEs with specific firmware versions on our equipment. It's a manual, error-prone process, and we're always afraid of what we might be missing." This fragmentation means that even when patches are available, they often go unapplied because teams are simply unaware of the risk.

A 'Patch Tuesday' for a Fractured Ecosystem?

InfraTrust’s comparison to Patch Tuesday is both its greatest strength and its most significant challenge. Microsoft’s model succeeded because it controlled a relatively homogenous software ecosystem and provided a unified update mechanism. The hardware world is the polar opposite: a complex, diverse web of independent manufacturers, each with its own disclosure processes, update cycles, and proprietary technologies.

Furthermore, patching hardware is inherently riskier than updating software. A failed firmware update can 'brick' an expensive server or network switch, requiring physical intervention. This operational risk, combined with the lack of a universal patching tool akin to Windows Update, means that even with perfect intelligence, the deployment of hardware fixes will remain a major hurdle for enterprises.

Despite these challenges, the launch of InfraTrust Pulse represents a tangible step forward. The inaugural July 2026 digest, published today, demonstrates the scale of the problem. It tracked 61 infrastructure advisories from 14 different vendors, flagging 26 vulnerabilities as remotely exploitable and unauthenticated. Products from major vendors like Dell, Fortinet, Juniper, and NVIDIA were identified as priority patching targets due to their exposure and exploitability. By curating this information and prioritizing it based on real-world risk rather than just CVSS scores, the initiative provides the actionable intelligence security leaders crave.

"The goal may not be to create a single 'push-button' update day for all hardware, which is likely impossible," noted one independent industry analyst. "The real value is in creating a standardized rhythm for intelligence gathering. It forces a monthly conversation about hardware risk at a strategic level, which is something most organizations lack today."

The Strategy Behind Free Intelligence

In an industry where threat intelligence is often a high-priced subscription service, Eclypsium’s decision to offer InfraTrust as a free public resource is a calculated strategic move. By giving away the intelligence, the company is betting it can create a market for its core commercial product: an infrastructure assurance platform that helps organizations act on that very intelligence.

This approach effectively serves as a powerful market education and lead-generation tool. InfraTrust highlights the 'what' and the 'why'—what devices are vulnerable and why it's critical to patch them. The firm's paid platform then provides the 'how'—helping customers discover their full hardware inventory, verify device integrity, detect active exploits, and harden configurations against attack. It's a classic top-of-funnel strategy: solve a universal pain point for free to build trust and demonstrate expertise, thereby driving demand for the comprehensive solution.

This move positions the Portland-based company not just as a product vendor, but as a central authority in the hardware security space. By curating and disseminating this critical data, it reinforces its brand and provides a compelling differentiator in a crowded cybersecurity market. The process of gathering and analyzing this intelligence also feeds back into its own platform, creating a virtuous cycle that strengthens its commercial offerings.

From Intelligence to Action: The Road Ahead

The launch of InfraTrust is not a silver bullet for the complex problem of hardware security. It solves the critical intelligence and visibility challenge, but the equally difficult operational challenge of safely testing and deploying firmware patches across a diverse fleet of devices remains squarely in the hands of enterprise IT and security teams. However, by providing a clear, predictable, and expert-curated source of truth, Eclypsium has laid a new foundation for how organizations can begin to manage this fundamental layer of risk.

For security professionals who have long struggled to get a handle on the opaque world of hardware vulnerabilities, this new, centralized resource provides a powerful starting point. It transforms the daunting task of scouring dozens of websites into a manageable monthly review, enabling teams to prioritize their efforts and make data-driven decisions about where to focus their limited resources. While the journey to securing the entire technology stack is a long one, having a reliable map is a crucial first step.