XM Cyber Research Hub

Welcome to the XM Cyber Research Hub, where we offer you access to the leading minds in the field of cybersecurity. Our team is made up of a diverse group of experts from all around the world, including researchers, hackers, and seasoned cybersecurity professionals. By staying updated with the latest research from our team, you’ll gain valuable insights into the industry, be able to analyze the newest and most pressing threats, learn about preventative measures, and stay informed on the latest breakthroughs in attacks and hacking. Whether you’re a security professional, looking to improve your knowledge, or a company seeking to harden your defenses, XM Cyber is your source for staying ahead of the game in cybersecurity.

Prevent cyber attacks in Azure before they happen

Prevent cyber attacks in Azure before they happen

Misconfigurations within Azure environments are more common than you think. It’s important to learn and understand how attackers can exploit these misconfigurations and, more…
Watch Webinar
Decrypting VMware Workstation Passwords

Decrypting VMware Workstation Passwords for Fun

At XM Cyber, we have been hard at work on the techniques that attackers use against your VMware environments.
Read More
Open Source Pentesting Tool for Azure

XMGoat – An Open Source Pentesting Tool for Azure

We created XMGoat as an open source tool with the purpose of teaching penetration testers, red teamers, security consultants, and cloud experts how to abuse different misconfigurations within the Azure environment. In this way, you learn about common Azure security issues.
Read More
New Privilege Escalation Techniques

New Privilege Escalation Techniques are Compromising your Google Cloud Platform

In this research, you’ll discover some of the common attack techniques used in Google Cloud Platform (GCP) to better understand how an attacker exploits this environment to gain permissions and steal information.
Read More
Extracting Encrypted Credentials from Common Tools

Extracting Encrypted Credentials from Common Tools

In this blog post, we will show how an attacker can extract non cleartext credentials in order to authenticate to databases and servers.
Read More
XM Cyber Advisory

XM Cyber Advisory – Spring4Shell, Zero Day

On March 30 2022, A new zero day critical vulnerability was leaked in another open source software library. The vulnerability affects Spring Framework which is running over Java Development Kit 9.0 (JDK9.0) and above. Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. While Spring4shell needs to be addressed as soon as possible, it is important to highlight that as it is a common library that is used by many different java software components, it can be a major breach point allowing attackers to build a lateral move pivoting to business-critical assets in the organization. As this develops, XM Cyber Research will share insights and guidance on the impact of this new zero day.
Read More
Go beyond Log4Shell

Go beyond Log4Shell and see the entire attack path

We understand the facts: The most common open-source library (Java) has already been identified with 3 CVEs and counting, with over 3 million attacks already confirmed in the wild. The industry anticipates the largest ransom wave to hit organizations across the world. The attacker is already inside! What’s Next?
Read More
Log4Shell, CVE-2021-44228

XM Cyber Advisory – Log4Shell, CVE-2021-44228

On December 9th 2021, the Log4Shell vulnerability, CVE-2021-44228 (CVSS score 10), was discovered. This remote code execution (RCE) vulnerability was being exploited in the wild. Log4j is a logging library, and the vulnerability affects all products and applications that use log4j. That’s a lot of products.
Read More
Buyers Guide: Risk Exposure Reduction and Vulnerability Prioritization
eBooks & Whitepapers

2023 is almost here and security teams are focused on locking-in the funds needed to keep their orgs secured in the coming year. But…

Understanding ‘Lone Wolf’ Attacks Dissecting and Modeling 2022’s Most Powerful Cyber Attacks
Webinars

The second half of 2022 saw a dramatic increase in ‘lone wolf’ attacks and can be coined one of the most common enterprise attack…

2022 Attack Path Management Impact Report
eBooks & Whitepapers

The XM Cyber 2022 Attack Path Management Impact Report is the industry’s first annual report that reveals the likelihood and impact of a breach,…

Increasing Cyber-risk is Driving the Need for Exposure Management
eBooks & Whitepapers

Cyber-risk leads directly to cyber-attacks. Rather than monitor and measure cyber-risk through siloed/fragmented data or layering on more disconnected defenses, organizations should build their…

A CISO’s Guide to Reporting Cyber Risk to the Board
eBooks & Whitepapers

In the eBook you’ll learn the four key challenges CISOs face when reporting to the board:

XM Cyber for Active Directory
Solution Briefs

Discover Active Directory exposures within a single consolidated attack path to increase your cyber resiliency

The Necessity of Attack Path Management for the Hybrid Cloud
eBooks & Whitepapers

Published in collaboration with the UK Chapter of the Cloud Security Alliance, this whitepaper explores the necessity of attack path management for today’s hybrid…

Prevent cyber attacks in Azure before they happen
Webinars

Misconfigurations within Azure environments are more common than you think. It’s important to learn and understand how attackers can exploit these misconfigurations and, more…

Case Study: Hamburg Port Authority
Case Studies

When one of Europe’s largest seaports needed help securing its vast IT infrastructure “Because it offers continuous,  automated protection, security issues  that would normally…

XMGoat – An Open Source Pentesting Tool for Azure
Blog

  Overview We created XMGoat as an open source tool with the purpose of teaching penetration testers, red teamers, security consultants, and cloud experts…

Cloud Security Masterclass Part 1: Lifting the Fog: Understanding how to Secure the Hybrid Cloud
Webinars

With heavy pressures to accelerate digital transformation due to the COVID-19 pandemic, adopting and securing cloud environments is more urgent than ever. A question…

Cloud Security Masterclass Part 2: Reaching for the Cloud: Inside the Mind of an Attacker
Webinars

With 90% of enterprises leveraging multi-clouds by 2022, it is an absolute field day for hackers around the world. The inherent security gaps created…

‘Total Economic Impact’ Study Concludes That XM Cyber Delivered 394% Return On Investment
News

Attack Path Management Significantly Reduces Risk of Fines and Remediation Expenditures, Reduces Pen Testing and Labor Costs

Cloud Security Masterclass Part 3: Best Practices to Improve Your Cloud Security Posture
Webinars

Chances are, you are using the cloud or right on your way. It is critical to have a continuous understanding of how you can…

How Is Your Enterprise IT Hygiene?
Artiom Levinton | Blog

We’re hearing a lot these days about the need for strong and consistent enterprise IT hygiene in cybersecurity. Good. What is that, anyway? An…