SentinelOne and Tenable Find Cyber Attackers Routinely Target Edge-Device Vendor Ecosystems Rather Than Individual Vulnerabilities

New joint research from SentinelOne and Tenable finds that exposure data and runtime detection converge on the same vendor surfaces even as the specific vulnerabilities change

MOUNTAIN VIEW, Calif. & COLUMBIA, Md.--(BUSINESS WIRE)--SentinelOne® (NYSE: S), the AI security leader, and Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today released joint research that suggests a growing disconnect between vulnerability discovery, disclosure and actual exploitation. The research draws on Tenable's exposure data across thousands of organizations and remediation telemetry with SentinelOne's endpoint and post-exploitation detection data. Together, both views produce a prioritized picture of where risk is concentrating, with lessons ripe for the Frontier AI era. The most critical takeaway: Both nation state and criminal threat actors are focusing on vendors and susceptible points in the attack surface more than specific CVEs.

Current attacker timelines are already moving faster than standard patch cycles can address. New frontier AI models compress vulnerability discovery from months to hours, significantly expanding potential risks while speeding the time for attackers to move from disclosure to exploit code in about a week. Today, the median organization takes five months to remediate known vulnerabilities.¹ Closing that window takes more than speed, it takes knowing which product lines are more likely to carry the next wave of exploitation.

The research finds that exposure data and runtime detection converge on the same edge-device vendor surfaces 79% of the time, while they share only 21% overlap at the individual vulnerability level. Both state-sponsored actors and ransomware operators draw from the same small set of high-severity, actively exploited vulnerabilities. The surfaces are consistent and the actors are not. That distinction matters for how defenders prioritize; a pattern Tenable has termed the “Persistently Targeted Vendor.” This is the idea that a small set of vendor product lines, not individual CVEs, is the durable unit of risk over time.

Other key findings from the research include:

• Twelve vulnerabilities in the dataset carry confirmed "multi-nexus" attribution — state-sponsored and ransomware operators independently exploiting the very same flaw across five distinct threat categories, including China, Russia, DPRK, Iran-nexus and criminal (financially motivated) actors.
• More than half (54%) of organizations running F5 products carry at least one exposed, actively exploited vulnerability, while Citrix customers post the slowest remediation of any vendor studied, at a median of 461 days — a concrete illustration of how specific product lines stay exposed long after a patch exists.
• Remediation complexity on high-priority vulnerabilities introduces a statistically significant 24-day gap, widening the window attackers have to operationalize an exploit — underscoring why patching speed alone isn't enough without attack surface minimization and endpoint protection working in tandem.

“Speed alone is not enough. By the time a vulnerability hits a remediation queue, adversaries are already iterating the exploit,” said Steve Stone, Chief Customer Officer at SentinelOne. “Static signatures run on human timelines, the threat does not. Runtime behavioral detection has to match that cadence, flagging exploitation patterns as they emerge rather than after the fact.”

For security teams, the research reinforces the need to look beyond individual vulnerabilities and understand which technology surfaces attackers repeatedly target. Tenable’s exposure data shows where organizations are most exposed and where risk is concentrated, while SentinelOne’s runtime threat and DFIR data shows where and how attackers are operating in the wild. The convergence of these two independent perspectives gives defenders stronger evidence for prioritizing remediation, strengthening detection and reducing risk across persistently targeted technology surfaces.

“Attackers systematically target specific vendor ecosystems that could provide access. They aren’t obsessing over single vulnerabilities, and neither should defenders,” said Vlad Korsunsky, Chief Technology Officer, Tenable. “Our joint research confirms that attackers, big and small, target the same attack surfaces the majority of the time. This research underscores exposure management principles: seeing, prioritizing and fixing exposures that create real business risk. As attackers weaponize AI to breach defenses faster, organizations that embrace exposure management will win.”

The research is the latest collaboration in an expanding partnership between best-in-class AI-native CTEM and AI runtime detection and response companies, building on Tenable and SentinelOne's existing work together, including SentinelOne's participation as a founding member of Tenable's CyberAgents Exchange announced at Black Hat USA 2026. It's the latest step in a partnership that continues to deepen as both companies invest further in AI security. The full research is available at sentinelone.com and tenable.com.

¹Tenable’s Key Takeaways from the Verizon DBIR (2026), May 19, 2026

About SentinelOne

SentinelOne (NYSE: S) is the leader in AI security, setting the standard for using AI and automation to give defenders a decisive operating advantage. Built for those who secure our world, its platform delivers unified coverage across endpoints, identity, cloud, and AI. Powered by Autonomous Security Intelligence, SentinelOne stops attacks at machine speed, reducing risk and delivering clarity and control to stay one step ahead. Headquartered in Mountain View, California with teams worldwide, SentinelOne protects nearly one-fifth of the Fortune 500 and hundreds of Global 2000 enterprises. From Main Street to Wall Street, the world's most critical organizations trust SentinelOne with their security.

About Tenable

Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for over 40,000 customers around the globe. Learn more at tenable.com.

This press release and the underlying research were jointly prepared and issued by SentinelOne, Inc. and Tenable Holdings, Inc. Each company is responsible for the data and findings it contributed. References to Tenable and its products, and to SentinelOne and its products, are made with the permission of the respective company.

Third-Party Disclaimer

Other than as expressly stated herein with respect to SentinelOne and Tenable, all third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third party.

Forward-Looking Statements

The following applies to statements made by SentinelOne in this press release. This press release includes forward-looking statements, including, but not limited to, statements concerning the expected timing of product and feature availability, the benefits and capabilities of our current and future products and services, competition and our competitive position, our strategic plans, partnerships and objectives, and general market trends. Forward-looking statements are subject to risks and uncertainties, including factors beyond our control, that could cause actual performance or results to differ materially from those expressed in or suggested by the forward-looking statements. These and other risk factors are described in the "Risk Factors" section of our most recent Annual Report on Form 10-K, subsequently quarterly reports filed on Form 10-Q, and other filings made with the U.S. Securities and Exchange Commission (SEC), which are available free of charge on our website at http://investors.SentinelOne.com and on the SEC's website at www.sec.gov.

You are cautioned not to place undue reliance on these forward-looking statements. Any future products, functionality and services may be abandoned or delayed, and as such, you should make decisions to purchase products and services based on features that are currently available.

Any forward-looking statements made in this document are based on our beliefs and assumptions that we believe to be reasonable as of the date hereof. You should not rely upon forward-looking statements as predictions of future events. Except to the extent required by law, we undertake no obligation to update these forward-looking statements to reflect new information or future events.