Amsterdam's Hadrian raised $40 million, bringing its total funding to $65 million, to sell exposure monitoring and AI-run penetration tests as one platform. For the security team asked to buy it, the case comes down to sorting real flaws from scanner noise, and almost every number behind that case comes from Hadrian.
Perspective Coverage
8 publishers
- Builder
- Builder 26%
- Operator
- Operator 32%
- Investor
- Investor 42%
Reality
- Evidence40
- Adoption35
- Hype gap+40
- Incentives75
- Confidence65
Korean financial firms must shut outside access to the staff and broker pages hackers used
South Korea's Financial Services Commission will block outside access to staff and loan-broker web pages by default after leaks at six firms. Every page a firm keeps reachable now has to be justified as indispensable to services or work.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher How Gunra actors got into a network through a default SSL VPN admin password
Gunra actors entered a victim's network through an SSL VPN admin account still on default credentials, according to a 10 August 2026 advisory. The path used no software flaw, so it tests credential changes, lockout and account reviews on edge devices.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Detectify finds most exploitable flaws on customer perimeters have been open more than 90 days
Detectify found 86% to 97% of open critical and high flaws on 1,293 customers' internet-facing systems had been exposed for more than 90 days. Its scanner confirmed each with a working attack request, so these are known, reachable flaws left to age.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence55
buildOne report1 publisher ZoomEye's fingerprint for Cisco's exploited FMC bypass returned zero hosts
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
- Evidence45
- Adoption55
- Hype gap+10
- Incentives70
- Confidence50
buildOne report1 publisher GitLab's commits API returns arbitrary files to an unauthenticated caller at CVSS 10.0
The fix for CVE-2026-85706 shipped on 10 September in 19.3.2, 19.2.6 and 19.1.8, and CISA listed the flaw as exploited the next day. A ZoomEye fingerprint count of 1,262,273 hosts does not report versions; it shows where to look.
Reality
- Evidence62
- Adoption38
- Hype gap+15
- Incentives78
- Confidence55
buildOne report1 publisher CISA warns of rising attacks on internet-exposed water sector PLCs
The 30 July advisory asks water utilities to validate what is reachable from outside. A query of ZoomEye's Modbus fingerprint on 15 September matched 47,028 assets on the public internet.
Reality
- Evidence58
- Adoption45
- Hype gap+12
- Incentives72
- Confidence62
Exploitation overtakes stolen credentials as the leading route in, per Verizon's 2026 DBIR
Verizon now puts vulnerability exploitation at 31% of initial access, up from 20%. Arctic Wolf's telemetry says about 17% of assets never appear in legacy vulnerability management at all, which sets a hard ceiling on any patch program.
Reality
- Evidence28
- Adoption18
- Hype gap+34
- Incentives88
- Confidence66
CISA's water-sector answer is an inventory: 100-plus exposed systems, most of them PLCs
July's intrusions into US water utilities did not need an exploit. They needed a PLC on a cellular modem with nothing in front of it, and CISA's August 21 guidance is an inventory job.
Reality
- Evidence62
- Adoption34
- Hype gap+14
- Incentives38
- Confidence55