Cyberattackers Shift Focus to Edge-Device Vendor Ecosystems, SentinelOne and Tenable Find — SentinelOne, Inc.

Event summary

SentinelOne and Tenable's joint research reveals attackers increasingly target edge-device vendor ecosystems rather than individual vulnerabilities.
79% of attack surfaces converge on the same vendor ecosystems, with only 21% overlap at the individual vulnerability level.
Twelve vulnerabilities in the dataset show 'multi-nexus' attribution, exploited by both state-sponsored and ransomware operators.
Citrix customers have the slowest remediation times, with a median of 461 days for exposed vulnerabilities.
The research highlights a 24-day gap in remediation complexity for high-priority vulnerabilities, widening the attack window.

The big picture

The research underscores a strategic shift in cybersecurity, where attackers are systematically targeting specific vendor ecosystems. This trend highlights the need for exposure management and runtime detection to work in tandem, as traditional patch cycles struggle to keep up with the speed of AI-driven exploits. The findings suggest a broader industry move towards prioritizing attack surface minimization and endpoint protection.

What we're watching

Attack Surface Prioritization: How defenders will adapt to focus on persistently targeted vendor ecosystems rather than individual CVEs.
AI-Driven Exploits: The pace at which frontier AI models will compress vulnerability discovery and exploitation timelines.
Remediation Gaps: Whether organizations can close the 24-day gap in remediation complexity for high-priority vulnerabilities.