In this research, we analyzed real victims’ potential total impact from threat actors, by identifying hosts that have been targeted by real attacks in the wild and then analyzing their external-facing vulnerabilities.
This approach allowed us to determine the blast radius, or total potential impact, of these real-world attacks. Our findings show that many organizations are able to identify and remediate vulnerabilities, but not before they are targeted by a threat actor.