Unmasking the Hidden Server: Out-of-Band Infrastructure Exposed

Baseboard Management Controllers (BMCs) represent a formidable, shadow attack surface embedded within conventional rack-mounted servers. Engineered with independent processors, isolated firmware, and dedicated network interfaces, these out-of-band (OOB) devices wield profound administrative control over their host machines. While the security community has scrutinized BMCs since at least 2013, the discourse intensified in August 2026 when HD Moore publicly spotlighted runZero’s deep-dive investigations into OOB infrastructure. Today initiates our structured rollout of vulnerability disclosures, following responsible coordination with affected hardware vendors and technology providers.

This initiative originated from a hybrid methodology: leveraging off-the-shelf AI tools and advanced prompting to surface hundreds of potential candidates. Refining this list to roughly 40 verified vulnerabilities, however, demanded exhaustive, traditional security research. This meant navigating the unglamorous realities of hardware hacking—extensive trial and error, reverse-engineering firmware virtualization, and enduring agonizingly slow physical reboots to validate exploits.

We extend our sincere gratitude to Gadi Evron, Dan Farmer, Fabien Perigaud, Sn0rkY, Solar Designer, and the dedicated teams at NetRise, Dragos Threat Intelligence, and runZero. Their invaluable guidance, testing, and peer review underscore that cybersecurity research is fundamentally a collaborative endeavor.

September 15, 2026 Update: Critical OpenBMC Vulnerabilities

Our inaugural disclosure targets the IPMI implementation within OpenBMC’s phosphor-net-ipmid component. These vulnerabilities were validated against both the OpenBMC reference architecture and downstream products deploying equivalent code bases, notably the NVIDIA BlueField-3 DPU BMC and the H3C HDM3.

It is crucial to highlight the pervasive white-labeling of OpenBMC. Without a robust Software Bill of Materials (SBOM), organizations remain dangerously unaware that OpenBMC is powering the “server inside their server,” regardless of the OEM branding stamped on the exterior chassis.

Vulnerability Mechanics & Exploit Chaining

CVE Identifier	Vulnerability Type	Mechanism & Impact
CVE-2026-16141	Authentication Bypass	Located in the RMCP+ session setup pathway. An attacker with network line-of-sight to IPMI can exploit a default key alongside a stale challenge state to establish an authenticated session without possessing the account password. This grants initial foothold access to the BMC’s IPMI interface.
CVE-2026-16140	Privilege Escalation	An authenticated, low-privilege IPMI user can maliciously relabel an active session, mapping it to an enabled administrator account. This bypasses the need for the administrator’s password entirely.

When weaponized in sequence, these two vulnerabilities can transform basic network access to an exposed IPMI service into total administrative dominance over the BMC. However, a successful exploit chain requires a “perfect storm” of prerequisites:

• The target must execute the vulnerable phosphor-net-ipmid code.
• The IPMI service must be network-reachable.
• An enabled account name must be known or guessable by the attacker.
• For CVE-2026-16141, the stale challenge value must be predictable on that specific build (a factor heavily influenced by heap layout, allocator reuse, and precise session creation timing).
• For the privilege escalation (CVE-2026-16140), an administrator account must already be enabled on the device.

If these complex variables align, a threat actor gains the capacity to rewrite management configurations, manipulate core hardware functions, and infiltrate OOB console and storage mechanisms.

The Imperative of Deep Asset Discovery

Quantifying your exposure to these flaws is rarely straightforward. Standard server inventories typically record top-level vendor and model data, entirely missing the granular, embedded components driving the hardware. This highlights the critical necessity of comprehensive asset discovery.

A fundamental runZero query—such as (protocol:ipmi OR type:=BMC)—delivers immediate visibility into how many BMCs are actively listening for IPMI traffic across your environments. Following our Rapid Response release in August, running a broader IPMI diagnostic query is highly recommended. For teams with dedicated testing environments, runZero’s open-source oobscan toolchain is available to safely probe for these specific vulnerabilities.

Once assets are inventoried, runZero’s network topology and attack path mapping (introduced in version 4.9) become vital. These tools visualize the routing pathways to vulnerable devices, verifying whether your intended network segmentation holds up against reality. Fundamentally, IPMI interfaces should never be accessible from standard user subnets, production application segments, and certainly not the public internet.

Strategic Roadmap: The Month Ahead

This OpenBMC disclosure represents the first wave in a planned series of five technical releases. Over the ensuing weeks, culminating at the end of October, we will publish comprehensive technical details concerning vulnerabilities across several other vendor ecosystems (all of whom have been engaged via coordinated disclosure).

This post will serve as a living document, updated with links to our official advisories as subsequent disclosures go live. Our overarching mission is to eliminate informational asymmetry. The cybersecurity ecosystem remains fragile if deep attack surface knowledge is restricted to a minority of actors. We are committed to educating defenders, implementors, and researchers about the severe risks posed by untracked management interfaces. OOB devices like KVM emulators and BMCs are ubiquitous, frequently bleed outside of isolated management networks, and represent a critical blind spot that demands daily operational vigilance.

Securing Your Network: Critical MikroTik RouterOS Vulnerabilities

System Overview & Threat Impact

MikroTik RouterOS is a Linux-based operating system that drives MikroTik RouterBOARD hardware, providing essential firewall, routing, and bandwidth management functionalities for SMBs and Internet Service Providers.

Recent disclosures reveal severe unauthenticated remote access flaws within the OS. A successful exploit allows a remote, unauthenticated attacker to instantly acquire full administrative privileges, leading to a complete system takeover.

Vulnerability Breakdown

MikroTik has identified three distinct vulnerabilities affecting the RouterOS SSH and bandwidth-test services:

CVE Identifier	Severity (CVSS)	Affected Service	Vulnerability Details
CVE-2026-67276	9.2 (Critical)	SSH Service	Flawed cryptographic signature verification. An attacker who knows an authorized username and RSA modulus can completely bypass authentication protocols.
CVE-2026-86060	9.2 (Critical)	SSH Service	Failure to neutralize argument delimiters in commands. Threat actors can use a specially crafted username to seize full administrative control.
CVE-2026-67277	8.8 (High)	Bandwidth-Test	Memory disclosure and Denial of Service (DoS). Unauthenticated attackers can extract kernel memory data or intentionally crash the service.

 

Affected Versions and Remediation Paths

To eliminate these security blind spots, administrators must immediately update their RouterOS deployments to the patched versions listed below.

Vulnerable Release Ranges	Required Secure Upgrade
Versions 7.24 through 7.24.1	Upgrade to 7.24.2 or later
Versions 7.0.0 through 7.23.3	Upgrade to 7.23.4 or later
Versions 6.0.0 through 6.49.20	Upgrade to 6.49.21 or later

 

Locating Exposed Assets with runZero

For organizations using runZero, identifying potentially compromised assets on your network is straightforward. Navigate to your Asset Inventory and execute the following search query to isolate vulnerable MikroTik hardware:

The Strategic Imperative of Securing Critical Infrastructure 

The protection of U.S. critical infrastructure is no longer a peripheral concern—it is an urgent operational necessity. A recent Executive Order declaring a national emergency over the bulk-power system serves as a stark reminder of this reality. Cyber adversaries are increasingly moving beyond data theft, deliberately targeting systems that govern the physical world.

Threat actors are shifting their focus to the lifelines of modern society: power grids, municipal water supplies, and medical facilities. While Artificial Intelligence dominates current tech conversations, AI algorithms are entirely useless if data centers cannot be cooled or if basic civic utilities fail. Securing these physical foundations must take precedence.

The Convergence of Threats: Why Attacks Are Surging

The rapid escalation of cyber attacks against industrial environments is a calculated trend driven by four converging factors:

• Global Geopolitical Friction: Nation-states and aligned hacking groups are pre-positioning themselves for future conflicts or actively seeking to disrupt the daily lives of rival populations.
• The Weaponization of AI: Threat actors no longer need deep engineering expertise in niche protocols like Modbus or BACnet. Today, attackers can simply utilize AI agents to autonomously scan targets and identify critical exposures, drastically lowering the barrier to entry.
• Resource Depletion: Operational Technology (OT) teams consistently operate with inadequate funding and severe staffing shortages.
• IT and OT Amalgamation: The accidental or forced blending of Information Technology (IT) and OT networks has inadvertently expanded the attack surface.

This creates a highly perilous environment. Under-resourced infrastructure defenders are now pitted against highly motivated adversaries armed with AI capabilities. Because disconnecting OT from IT is practically impossible in most modern environments, adversaries exploit this convergence, using interconnected IT systems as a bridge to pivot directly into sensitive OT networks.

The Hidden Realities of IT/OT Integration

Recent internal telemetry from a runZero survey of local area networks (LANs) illustrates the severity of this issue. OT assets were discovered within the addressable network space of every single industry evaluated. More alarmingly, nearly every sector had a fraction of its OT equipment exposed directly to the public internet, providing attackers with immediate, reachable targets.

Furthermore, relying solely on traditional perimeter defenses like VPNs, reverse proxies, or firewalls is a failing strategy. Over the past three years—including the current landscape of 2026—the CISA Known Exploited Vulnerabilities (KEV) catalog has consistently recorded roughly 40 exploited vulnerabilities annually that specifically target edge security technologies. As exploit development accelerates, perimeter defenses alone cannot guarantee network integrity.

Actionable Strategies to Fortify OT Environments

Defending these complex networks requires profound visibility and proactive hardening. runZero provides essential capabilities to help IT and OT defenders secure their infrastructure:

• Locating Internet-Facing PLCs: Federal agencies like the FBI and EPA strongly advise removing Programmable Logic Controllers (PLCs) from the public internet. However, you cannot remove what you cannot see. runZero scans both internal and external attack surfaces to pinpoint every active PLC, map its connections, and determine its exact distance from the internet.
• Detecting Default Credentials: Unchanged default passwords are an open door for attackers. runZero automatically identifies these weak entry points, preventing adversaries from bypassing security via trivial credentials.
• Mapping Attack Paths: Static network diagrams are insufficient. Organizations must understand exactly how a threat actor could navigate their infrastructure. runZero maps lateral movement possibilities, revealing how an attacker could pivot from a breach point to high-value OT targets.
• Identifying End-of-Life (EOL) Edge Devices: Because edge security hardware is a primary initial access vector, identifying and upgrading outdated, EOL equipment is a fundamental security requirement. runZero natively flags these aging devices for remediation.

Securing the Foundation of Society

runZero currently secures some of the world’s most complex and sensitive environments, spanning telecommunications, government services, healthcare, municipal utilities, biotech, and aerospace and defense. Our platform delivers absolute asset visibility, exposes hidden risks, maps critical attack paths, and validates network segmentation integrity.

Navigating the Vulnerability Management Alphabet Soup: The NVD’s Call for AI Feedback

Decoding the Acronyms: CVE vs. NVD

To truly grasp the significance of this RFI, it is essential to untangle the acronyms that define coordinated vulnerability disclosure (CVD). While often used interchangeably, these programs serve distinct purposes:

• CVE (Common Vulnerabilities and Exposures): Managed primarily via cve.org, the CVE program serves as the global dictionary for identifying and cataloging technical vulnerabilities. Although funded by the U.S. Department of Homeland Security (DHS) through CISA and operated by the MITRE Corporation, it is fundamentally an international, volunteer-led initiative. Through hundreds of CVE Numbering Authorities (CNAs)—ranging from vendors to researchers—vulnerabilities are assigned their unique identifiers (e.g., CVE-2026-1234). Today, an unassigned software vulnerability is an extreme rarity.
• NVD (National Vulnerability Database): Operating strictly as a federal program under NIST, the NVD functions as the contextual engine for CVEs. It enriches raw vulnerability identifiers with critical metadata, including Common Vulnerability Scoring System (CVSS) severity metrics, Common Weakness Enumeration (CWE) classifications, and Common Platform Enumeration (CPE) strings. Notably, the NVD maintains the authoritative CPE database—a notoriously complex undertaking in software identification.

In short: The CVE program provides the name and baseline description, while the NVD provides the vital operational context (severity and weakness type).

The Bottleneck: When Human Curation Fails

Unfortunately, the NVD has struggled to maintain consistent enrichment over the past two years. Beginning in 2024, the sheer volume of vulnerability disclosures simply overwhelmed the database’s human-curated processes. Exacerbated by funding constraints, this operational bottleneck has severely impacted the U.S. federal government and private sector organizations that heavily rely on downstream NVD data to prioritize patching.

Industry data—such as insights shared during recent VulnCheck webcasts—suggests that the NVD’s manual processing capacity is effectively capped at roughly 30,000 vulnerabilities annually. Meanwhile, AI tooling is simultaneously accelerating the rate at which attackers and researchers discover new flaws. Because the disclosure pipeline will only continue to surge, the NVD must urgently transition to “machine-speed” processing to survive.

AI: The Catalyst and the Cure

Integrating Large Language Models (LLMs) to automate vulnerability summarization, categorization, and scoring presents both immense promise and significant hurdles. High-quality AI tooling is expensive—a stark challenge for a program with limited funding—and its outputs are prone to hallucinations, making them difficult to trust implicitly. Through the current RFI, the NVD is directly asking non-federal industry experts how it should best allocate its limited energy and resources to safely modernize these critical operations.

The Bigger Picture: Redundancy vs. Consolidation

This RFI also opens the door to a more existential debate: Should the NVD continue its enrichment program at all?

Following the NVD’s visible operational degradation in February 2024, CISA stepped in by launching the “Vulnrichment” program in January 2025. While Vulnrichment effectively processes most CVE metadata, CISA quickly discovered that generating accurate CPEs is exceptionally difficult—a specialized task that the NVD is uniquely equipped to handle.

Having two separate federal entities (CISA within DHS, and NIST within the Department of Commerce) performing overlapping enrichment tasks might appear to be bureaucratic duplication. However, in enterprise systems design, redundancy is often a virtue. This dual-agency approach may serve as a highly effective hedge against future funding crises or operational single points of failure.

---

The Hidden Dangers of Internet-Connected Cameras: From Public Streets to Military Supply Chains

A disturbing reality has recently come to light, underscoring how common technology can be weaponized in modern warfare. According to a joint cybersecurity advisory from the Netherlands General Intelligence and Security Service (AIVD) and the Defence Intelligence and Security Service (MIVD), Russian state-sponsored hackers are actively compromising internet-connected IP cameras. Their objective? To conduct systemic digital espionage against Ukraine, NATO, and various EU member states. The practice of hacking surveillance equipment for international espionage is not entirely new, but the latest intelligence reveals that Russia is specifically leveraging these feeds to monitor NATO troop deployments and supply logistics. While we expect adversarial nations to continuously develop novel combat tactics, the ease with which IP cameras are repeatedly exploited remains a glaring security failure.

The Threat Within Civilian Infrastructure

What makes this situation particularly unsettling is the ownership of the compromised devices. Hackers are not breaking into highly classified military cameras; they are infiltrating civilian infrastructure. The data sources fueling these intelligence operations are ordinary security cameras mounted on storefronts, residential homes, and city street corners. For organizations, this highlights a massive blind spot. Many businesses lack comprehensive visibility into their own surveillance networks and the security protocols—or lack thereof—governing them. An unsecured IP camera acts as a double-edged sword: it offers adversaries a literal window into sensitive logistical operations and serves as a highly effective beachhead for launching broader network intrusions.

Understanding the Scope of the Vulnerability

The sheer volume of at-risk devices is daunting. Security firm Censys recently identified roughly 87,000 internet-facing cameras across the EU (including over 4,000 in Ukraine) that are running services tied to known, exploitable vulnerabilities. While the presence of a CVE (Common Vulnerabilities and Exposures) does not guarantee a device is actively being hacked, sophisticated exploits are rarely necessary. Cybercriminals frequently bypass complex hacking methods by simply logging in using default, factory-set credentials, which offer quiet, hard-to-detect network access. Another critical issue omitted from the European advisory involves the hardware supply chain. Certain major IP camera manufacturers have been outright banned by the U.S. government due to espionage concerns and ties to the Chinese state. However, private businesses and citizens across the U.S. and allied nations continue to purchase and deploy these exact brands in massive numbers. When you combine this risky hardware with universally vulnerable protocols like UPnP (Universal Plug and Play), it becomes clear that western nations are currently a goldmine for cyber threat actors.

Closing the Vulnerability Gap: Defense Strategies and runZero

While the exploitation of IP cameras is unlikely to cease, the Dutch intelligence advisory provides actionable, straightforward guidelines to secure these devices. To protect your network, you should:

• Audit Internet Exposure: Identify which cameras are accessible from the internet, whether directly or via firewalls, proxies, or vendor clouds.
• Lock Down Access: Disable public internet streaming, UPnP, and port forwarding. Route all camera access securely through a VPN.
• Enhance Authentication: Immediately change all default passwords and enforce Multi-Factor Authentication (MFA) wherever supported.
• Adjust Physical Placement: If possible, aim cameras away from highly sensitive areas like loading docks, logistical hubs, and supply routes.
• Maintain Software: Purchase hardware with long-term support and apply firmware patches religiously.

Conquering the Cyber Desert: A Recap of runZero’s Epic Week at Hacker Summer Camp 2026

Spanning August 3rd to the 9th, we made our mark across BSides Las Vegas, Black Hat USA, and DEF CON 34. The momentum at our booths was unprecedented, fueled by massive company milestones: three major product unveilings and our announced strategic alliance with Dragos and NetRise (empowered by a formidable $4 billion investment from Accenture). Add in interactive RPG quests, the debut of fresh open-source tools, and physical Yetis roaming the exhibit halls, and you have a week that will echo in runZero history. Here is a retrospective look at our week navigating the digital and physical desert.

BSides Las Vegas: Decoding Ciphers and Examining Network Chasms

The week’s festivities commenced at BSides Las Vegas. We challenged attendees to flex their cryptographic muscles with a Caesar Cipher puzzle, rewarding successful codebreakers with premium merchandise. Naturally, our mascot, Zeti the Yeti, was on site for photo ops, helping attendees snap the best selfies of the conference. A major highlight was a presentation by our CEO and Founder, HD Moore. In his session, “Mind the Gap: Bridges, Backplanes, and BloodHound,” he explored catastrophic network segmentation breakdowns, equipping defenders with methodologies to audit these vulnerabilities at an enterprise scale. The following day featured Tod Beardsley on a distinguished panel of public and private sector experts titled “I am CVE, AMA!” The group tackled difficult audience questions and debated how artificial intelligence will shape the future of the CVE ecosystem. It was an exceptionally insightful and hard-hitting discussion.

Black Hat USA: Tabletop Triumphs and BMC Breakthroughs

As Tuesday rolled around, the Yetis descended upon the Mandalay Bay Bayside Foyer for Black Hat USA. The lines were packed with security professionals eager for live platform demonstrations, another crack at our cipher puzzles, and more face time with Zeti. A massive draw was our interactive tabletop RPG experience: Prism of Truth: Zeti’s Odyssey — The Quest to Restore the Shattered Network. Participants merged fantasy role-playing with real-world cybersecurity problem-solving, competing fiercely on our leaderboard for top completion times and exclusive rewards.

• The Grand Prize: The ultimate reward, dubbed the “One Hacker Bundle to Rule Them All,” was claimed by the user CAPTAIN_ORCHESTRATOR. Encased in a tactical SLNT Faraday Dry Bag, the grand prize included top-tier hardware: a Wi-Fi Pineapple, Key Croc, Hacker Pager, and a TBeam.
• Runners-Up: Players SAGENECROMANCER and 9889_ORCHESTRATOR_OPAL didn’t leave empty-handed, securing SLNT Phone and Laptop Sleeves to keep their digital footprints secure in style.

However, the pinnacle of Black Hat was HD Moore’s highly acclaimed briefing: “Lights Out: BMCs Are Still Broken and Now We Have the Receipts.” Highlighted in the conference’s official press release, the session exposed critical vulnerabilities in Baseboard Management Controllers (BMCs). Coinciding with the talk, HD released OOBscan, an open-source tool built to audit devices exposing IPMI interfaces (which is available now in our public repository).

DEF CON 34: Deep Dives and Soldering Irons

The marathon week concluded at the Las Vegas Convention Center for DEF CON 34. We immersed ourselves in the raw, authentic hacker culture, distributing gear and engaging in deep discussions regarding the total attack surface—spanning IT, OT, IoT, mobile, and cloud environments. We even managed to get some hands-on soldering experience while exploring the various villages. Bringing our 2026 speaking circuit to a close, HD Moore delivered “Lights Out: Out-of-Band, Out of Mind, Out of Control.” This presentation expanded on his Black Hat briefing, plunging into the granular, technical details of his BMC vulnerability discoveries.

runZero Discovers Critical BMC Vulnerabilities

Understanding the Threat Landscape

Baseboard Management Controllers are specialized microcontrollers deeply embedded within enterprise servers. Because they operate on dedicated firmware and utilize separate network interfaces, they function completely independently of the host’s primary operating system. In fact, a BMC remains active and accessible over the network even when the main server is powered down.

A vast majority of these devices depend on the Intelligent Platform Management Interface (IPMI) protocol. Back in 2013, researcher Dan Farmer exposed catastrophic architectural weaknesses in IPMI, including Cipher Zero authentication bypasses and the leaking of RAKP password hashes. While the cybersecurity community has identified various vendor-specific bugs since then, the foundational implementations of the core IPMI protocol have rarely been subjected to modern, rigorous re-examination.

Upcoming Presentations

We will be sharing an in-depth analysis of these findings at two upcoming conferences:

• Black Hat 2026: “Lights Out: BMCs Are Still Broken and Now We Have the Receipts”
• DEF CON 34: “Lights Out: Out-of-Band, Out of Mind, Out of Control”

Affected Implementations

The vulnerabilities impact a wide array of major BMC environments, including:

• OpenBMC
• Supermicro IPMI
• HPE iLO
• Dell iDRAC
• AMI MegaRAC
• Raritan
• H3C HDM
• Fujitsu

Potential Impact

If exploited, these security gaps empower attackers to bypass existing defenses, granting them the ability to access, manipulate, or completely disable the affected BMCs. Ultimately, this level of compromise provides a formidable stepping stone for establishing persistence and moving laterally throughout a managed enterprise network.

Mitigation and Workarounds

Organizations must remain vigilant by closely monitoring vendor security advisories and enforcing a strict, formal patching cadence across all BMC hardware. As embargoes lift and official CVEs drop, runZero will automatically identify and flag these specific vulnerabilities within our platform.

To secure unpatched systems immediately:

• Restrict management interface access strictly to trusted internal IP addresses or specific subnets.
• Sever the interface’s connection to the public Internet completely.
• If total isolation is impossible, ensure that all access is funneled through a secure VPN or an isolated, out-of-band management network.
• Ramp up logging and monitoring on any active management pathways.

Hunting for Vulnerable Assets in runZero

You can proactively identify potentially exposed systems in your environment. Simply navigate to your Asset Inventory and apply the following search query:

Announcing runZero 5.1: Private AI, Autonomous Discovery, and Advanced Integrations

1. Compliance-Friendly AI: Powerful Insights, Zero Data Leakage

We know you want to leverage AI to streamline your workflows, but sending sensitive metadata to third-party LLMs is a compliance nightmare. With version 5.1, you can bring your own AI directly into runZero safely and securely.

Whether you choose a Bring-Your-Own-Key (BYOK) setup or a completely self-hosted model, you can now use natural language to query your environment. Forget complex syntax—just ask questions like “Find all expired TLS certificates” or “Show me all endpoints missing EDR,” and let runZero do the translation. You can also use this feature to build custom reports and dashboards.

Navigating this new capability is seamless thanks to the Quick Command Menu (press Cmd-K or Ctrl-K anywhere in the app). Administrators can easily enable AI at the account level (cascading down) or configure it for specific organizations via the settings panel.

2. Autonomous Discovery: Put Attack Surface Mapping on Autopilot

Historically, scoping a scan required tedious manual entry of IP ranges, CIDRs, and domains—and if your network changed, your scope became outdated, leading to blind spots. Autonomous discovery changes the game entirely.

Once enabled for internal or external scans, runZero analyzes the results of your initial scan to automatically tune and expand the scope for the next one. It learns from routing tables, adjacent subnets, and related hostnames, continually widening its net until your entire attack surface is mapped. Say goodbye to manual scope management and hello to continuous, self-expanding intelligence.

3. Enhanced Integration Framework: Build Faster, Merge Smarter

Integrating disparate data sources is critical. Our upgraded Custom Integrations Framework allows you to leverage LLMs and AI coding agents to build custom pipelines faster than ever. We’ve refined our merge logic to ensure that overlapping data from multiple sources consolidates into a single, high-fidelity asset record—eliminating the headache of duplicates.

Additionally, we’ve expanded the data sources you can integrate natively, adding robust options for SSH, SMB, WinRM, WMI, and SQL.

4. Streamlined Remediation: Frictionless Handoffs

Finding a vulnerability is only half the battle; fixing it requires accountability. runZero 5.1 ensures that remediation doesn’t stall when passing the baton:

• No ITSM? No problem: You can now assign issue ownership directly via email. Team members can receive tasks and track status even if they don’t have a runZero account.
• For ITSM Users (e.g., Jira): We are ending the era of static, outdated CSV attachments. Tickets are now enriched with secure, direct links to interactive, real-time reports of affected assets inside runZero.

5. Deepened Dragos Integration: Bridging the IT/OT Divide

In converged environments, analysts waste precious time toggling between tools to connect OT context with IT data. runZero 5.1 brings critical Dragos intelligence natively into your dashboard.

Dragos “crown jewel” designations are now automatically flagged as Critical in runZero. Furthermore, you can view Purdue model levels and high-level asset communication paths directly in our interface. This allows you to easily filter for specific OT assets (like Purdue Level 2 controllers), analyze their attack paths in runZero, and pivot seamlessly to Dragos for granular details. (Note: Support for Purdue levels from tools like NetBox and Nozomi is coming soon!)

---

Ready to experience the future of exposure management? Our goal with 5.1 is to remove friction from your day-to-day operations. Log into your console to explore these new features, or start a free trial today. We’d love to hear your feedback!