Attackers Are Logging In, Bitdefender Says. Outside Scans Show Only Part Of The Risk.

Estimated reading time: 7 minutes

One backup product was attacked about four days before its complete fix shipped. Attackers move within hours to days of disclosure, says Bitdefender’s Richard De La Torre. He spoke with Cyber Insurance News as Bitdefender launched a tool to map weak spots inside the network.

Bitdefender launched GravityZone Exposure Management on Oct. 27. It finds unpatched systems, insecure settings, and risky user behavior on company computers. It also watches internet-facing assets for shadow IT, misconfigured services, and exposed subdomains.

The tool maps the routes an attacker could take from one weakness to sensitive data or privileged accounts. It also learns how each user normally works. It then restricts built-in tools that attackers abuse, such as PowerShell, for users who don’t need them.

AI and automated scanning have made it “incredibly easy for adversaries to find an unpatched server or over-privileged user,” said Andrei Florescu, president and general manager of Bitdefender’s Business Solutions Group.

The tool is available now on Windows. It comes as an add-on to Bitdefender’s GravityZone platform or as a standalone offer. Bitdefender sells the tool. The figures below come from Bitdefender’s own incident data and advisories.

What Exposure Management Sees That Outside Scans Miss

Underwriters often scan applicants from the outside. That view shows which servers face the internet, De La Torre said. It also shows open ports and the software versions they reveal. Bitdefender’s external scanning tool shows the same view.

“The reality is that many attackers don’t break in from outside at all,” he said.

Bitdefender’s managed detection and response team said as much in June. Attackers were mostly logging in with stolen credentials, not exploiting new flaws, the team wrote in its June threat debrief.

Once inside, De La Torre said, an attacker can see:

• Laptops and servers missing security updates, including internal systems that never face the internet
• Weak local and group policy settings
• Risky account habits, such as passwords that never expire
• Which built-in admin tools each user can run
• Shadow IT, including AI tools nobody approved
• Cloud and container accounts with elevated privileges they no longer need

Customers can share that inside view with insurers. “Customers, if they so choose, can share these reports with their insurers and brokers,” De La Torre said. “Bitdefender does not work directly with any insurance carriers.”

Nudge Security CEO Russell Spitler made a related point to Cyber Insurance News. He has yet to see an insurer ask which SaaS apps a company uses.

Stolen Credentials Drive Many Incidents

I asked which exposures most often lead to real incidents in Bitdefender’s data. Exposed credentials consistently rank among the most common attack routes, De La Torre said. That usually starts with risky user behavior.

He listed the usual ways in. Employees reuse work passwords on social media sites that later get breached. They click phishing links to spoofed login pages. Teams store passwords in plain text files and share them by email. Developers commit API keys to public code repositories. Printers and cameras keep their default passwords. Companies skip multi-factor authentication.

“A stolen password works because the system accepts it with no second check,” he said.

That second check is MFA. Insurers made it standard. A recent paper argues they should now ask which kind. This month, Denmark disclosed that a small vendor’s login reached 8.8 million records in its national ID register.

Exploit Timelines Test Patch Promises

How fast do attackers move once a flaw is disclosed? “Usually within hours to a few days,” De La Torre said. “Sometimes attacks start before a complete fix exists, and sometimes before the flaw is publicly known.”

He pointed to three cases from Bitdefender’s advisories. Public records confirm the key dates.

In the AhsayCBS case, attacks came before the complete fix. A promise to patch critical flaws within a set window cannot cover those days. Cisco Talos raised a related problem this month. Published flaws doubled while exploited flaws rose 37%, making patch promises harder to keep.

Bitdefender’s latest release says criminal use of AI has increased the speed and volume of attacks. De La Torre credited the speed mostly to automation.

“The speed traditionally came from automation, not necessarily AI, however,” he said. So far, AI has mostly helped software developers find flaws they could not find by hand, he added.

Built-In Tools Show Up In Most Major Attacks

I asked how often attackers abuse legitimate tools like PowerShell. “Most of the time,” De La Torre said.

Built-in tools appeared in 84% of high-severity incidents in a Bitdefender Labs study of 700,000 incidents, published in 2025. Bitdefender’s MDR investigations found them in 85% of incidents, he said.

Netsh, a network and firewall settings tool, appeared in a third of major attacks. PowerShell ranked second. Reg, Csc and Rundll32 rounded out the top five.

“PowerShell is hard to deal with because ordinary IT work depends on it,” De La Torre said. Nearly 96% of organizations in the data used it legitimately. It ran on 73% of computers. Up to 95% of access to these risky tools was unnecessary, he said.

Some tools that attackers favor, such as mshta, pwsh, and bitsadmin, administrators rarely use. That gap is what Bitdefender’s per-user restrictions target.

“Businesses need to have a complete picture of all the places they are susceptible so that they can address those vulnerabilities before they become a security incident,” De La Torre said.

FAQ – Exposure Management

What is exposure management?

Finding, ranking and fixing the weaknesses an attacker could use, inside a company’s network and on the internet. Bitdefender launched GravityZone Exposure Management on Oct. 27, 2026.

What do outside-in scans miss?

Internal weaknesses. Bitdefender’s Richard De La Torre lists unpatched internal machines, weak policy settings, passwords that never expire, unneeded admin tools, shadow IT and excess cloud privileges.

How do most attackers get in?

Bitdefender’s MDR team said in June 2026 that attackers were mostly logging in with stolen credentials rather than exploiting new flaws.

How fast are new flaws exploited?

Within hours to a few days, De La Torre says. AhsayCBS backup software was attacked around Oct. 7 and 8, 2026. A complete fix arrived Oct. 12.

How often do attackers use built-in tools?

In 84% of high-severity incidents, in a Bitdefender study of 700,000 incidents published in 2025. Netsh and PowerShell were the most abused.

Can companies share exposure data with insurers?

Yes, if they choose. GravityZone customers can share reports with insurers and brokers. Bitdefender does not work directly with any carriers.

Related Cyber Insurance Posts

• AI Agents Are Getting Phished. Security Teams Lead Approval At Just 6% of Firms
• Fake Interpol Emails Hit Small Businesses. The Ransomware Is Crude. The Trick Isn’t.(Opens in a new browser tab)
• Command Zero’s Throughline Turns Closed Cases Into Living Investigations(Opens in a new browser tab)
• Cybersecurity Risk Quantification: Bitdefender Launches Free Risk Assessment(Opens in a new browser tab)
• AI Agents Went Outside Permissions Again. This Time The Targets Were Real People.(Opens in a new browser tab)