Summary
- Armadin’s client testing data found that 88% of critical and high-severity findings were not covered by vendor advisories.
- The gap indicates that patch and advisory management programs alone are insufficient as a primary vulnerability management strategy.
- Security teams that treat vendor bulletins as the ceiling of their risk awareness are likely carrying significant unexamined exposure.
- Active testing — penetration testing and continuous assessment — appears necessary to surface the risks that advisory channels leave undiscovered.
- The finding has direct implications for how CISOs justify and scope offensive security investment.
The advisory gap is larger than most programs assume
Vulnerability management programs at most organisations are built, at least in part, around vendor advisories. Patch Tuesday rhythms, CVE tracking, and vendor security bulletins form the backbone of how many teams prioritise remediation effort. New data from security testing firm Armadin puts that approach under serious scrutiny.
Armadin’s testing results across its client base found that 88% of critical and high-severity findings fell outside what vendor advisories had flagged. That is not a marginal gap. It means the overwhelming majority of the most serious weaknesses identified during professional security assessments would have been invisible to teams relying on vendor guidance alone.
What the data does and does not tell us
It is worth being precise about what Armadin’s figures represent. These are findings from active penetration tests and security assessments conducted on real client environments — not a theoretical analysis of CVE databases. The 88% figure describes the proportion of critical and high findings that were not surfaced by vendor advisories, meaning they were identified through hands-on testing rather than reactive patching cycles.
The source material does not detail the industry breakdown of the client base, the testing methodologies used, or the timeframe over which the data was collected. Those variables matter when interpreting the precise scale of the finding. What the data does establish, however, is a consistent and substantial pattern across the testing engagements reviewed.
Why vendor advisories have structural limits
Vendor advisories are, by design, narrowly scoped. They address known flaws in specific products at the time of disclosure. They are not designed to account for the way multiple components interact in a particular environment, for misconfigurations that arise during deployment, for legacy integrations that introduce exposure, or for business logic weaknesses that emerge from how a system is actually used rather than how it was intended to operate.
A vulnerability that does not carry a CVE identifier, or that exists at the intersection of two otherwise-patched products, or that only becomes exploitable given a specific network topology, is unlikely to appear in any vendor bulletin. From a purely advisory-driven posture, it is effectively invisible. The Armadin data suggests these invisibles account for the bulk of the serious risk in tested environments.
The investment case for active testing
For CISOs managing security budgets under pressure, these figures carry a practical message about where defensive value actually sits. A mature patch management program is necessary but not sufficient. The data points toward active security testing — whether through regular penetration tests, red team exercises, or continuous automated assessment — as the mechanism for finding what advisory-driven programs cannot.
That is not a novel argument, but it is one that often struggles against the perceived tangibility of patching known CVEs. Executives and boards understand the logic of fixing what vendors have declared broken. The harder conversation is explaining why significant budget should go toward finding problems that no advisory has yet named. Armadin’s data provides a concrete reference point for that conversation.
Implications for risk reporting and assurance
There is also a governance dimension here. If critical and high findings are predominantly discovered outside vendor advisory channels, then any risk report built primarily on advisory coverage metrics is painting an incomplete picture of organisational exposure. Boards and audit committees receiving assurance based on patching rates against known CVEs may be receiving a measurement of one relatively small slice of actual risk.
CISOs should consider how their current reporting frameworks would need to change if 88% of serious risk is effectively off the advisory radar. The answer likely involves elevating findings from active testing programs to the same level of executive visibility currently given to patch compliance metrics.
Why it matters
CISOs who anchor their vulnerability management strategy to vendor advisories and CVE-based patching programs may be achieving high compliance scores against a metric that captures only a fraction of actual critical exposure. Armadin’s testing data is a direct challenge to the assumption that advisory coverage equates to risk coverage. The business case for penetration testing and continuous assessment becomes considerably stronger when framed this way — not as a compliance exercise, but as the primary mechanism for surfacing the serious weaknesses that no vendor bulletin will ever name.
What to do now
- Review your vulnerability management program to assess what proportion of your prioritisation logic depends on vendor advisories and CVE feeds alone.
- Ensure regular penetration testing and security assessment results are formally tracked and reported at the same level of organisational visibility as patch compliance metrics.
- Where active testing programs are infrequent or narrowly scoped, use Armadin’s findings to build the internal case for expanding their frequency and coverage.
- Revisit risk reporting frameworks presented to boards and audit committees to ensure they reflect findings from active testing, not only advisory-derived metrics.
- Consider how your environment’s specific configurations, integrations, and deployment patterns may create exposure that no vendor advisory is positioned to capture.
