Summary
- Forescout Vedere Labs validated 99 vulnerabilities across 10 TCP/IP stacks, including 66 previously unknown flaws.
- The research reduced an estimated nine-month manual analysis process to approximately 90 hours.
- Shared embedded software and long equipment lifecycles complicate remediation across industrial and critical infrastructure environments.
Forescout researchers used commercially available artificial intelligence to identify 66 previously unknown vulnerabilities in networking components widely used across industrial and connected equipment.
Research published on 12 November by Forescout Vedere Labs describes the use of commercially available AI models to analyse 10 TCP/IP software stacks commonly found in industrial, medical, networking and other connected devices.
The researchers validated 99 vulnerabilities, including 66 previously unknown flaws. Approximately 52% of the new vulnerabilities were classified as high or critical severity, and 54 were reported to software developers and maintainers.
Forescout estimates that the work, which previously would have required approximately nine months of manual research, was completed in 90 hours. That period comprised roughly 10 hours of independent AI-assisted analysis and 80 hours of subsequent validation.
Automation changes the economics of vulnerability research
The project examined whether generally available AI tools could support vulnerability discovery across both open-source software and proprietary binaries, which present different challenges because the underlying source code may not be available for inspection.
Researchers developed a specialised analysis harness that combined AI models with supporting research workflows. Seven of the TCP/IP stacks had been examined in earlier Vedere Labs investigations, while three were new targets.
The approach rediscovered 33 previously known vulnerabilities and identified 66 new findings. The researchers report that the system rediscovered approximately 40% of the vulnerabilities identified through previous research, demonstrating both its capabilities and its limitations.
Its performance should not be interpreted as evidence that AI has eliminated the need for specialist vulnerability researchers. Human validation remained a substantial component of the process, accounting for most of the reported 90-hour research period.
Forescout reported approximately $935 in automated static-analysis expenditure across the 10 software stacks. The figure covers the automated analysis rather than the full cost of the research programme, which included around 80 hours of validation. The company’s separate average cost-per-finding calculation cannot be reconciled directly with the 99 validated vulnerabilities from the figures supplied, so that comparison has been omitted.
The researchers also found that binary analysis was approximately six times more expensive and required roughly twice as long as source-code analysis. Proprietary software therefore remains a more demanding target, although the results suggest that AI-assisted techniques can extend beyond software for which full source code is available.
Shared components create widespread dependencies
TCP/IP stacks provide the networking functions used by connected devices to communicate over digital networks. They are embedded in operating systems, industrial controllers, medical technology, network appliances and many other products.
A weakness in one such component can therefore affect equipment sold by multiple manufacturers. The resulting exposure may not be immediately apparent from a device’s commercial name because the vulnerable software can sit several layers below the applications visible to the operator.
Forescout’s earlier work identified vulnerabilities in networking components used across large numbers of downstream products. Its latest findings suggest that previously examined software may still contain weaknesses capable of being discovered through new analysis techniques.
The remediation process is considerably slower than vulnerability discovery. A software maintainer may need to produce a correction, an equipment manufacturer must incorporate it into supported firmware, and the operator must then assess whether the updated device can be installed without compromising operational requirements.
Industrial and medical environments often include equipment that remains in service for many years. Some systems cannot be readily interrupted, while others are no longer supported by their original manufacturers. A newly discovered flaw may consequently have no straightforward route to a vendor-provided correction.
Exposure management becomes more important
Determining operational exposure requires knowing where vulnerable components are deployed and how they interact with surrounding systems. The existence of a software vulnerability does not establish that every device incorporating the component is remotely exploitable, because network accessibility, configuration and compensating controls influence actual exposure.
Manufacturers also face increasing pressure to maintain accurate software inventories and define support periods that reflect the operational lifetimes of their products. The European Cyber Resilience Act introduces requirements concerning cybersecurity across the lifecycle of products with digital elements, strengthening the regulatory context for vulnerability handling and software transparency.
Forescout’s research does not report widespread exploitation of the newly identified flaws. It demonstrates that commercially available AI can reduce the resources required to discover weaknesses in components that may have remained largely unchanged for years.
Daniel dos Santos, Forescout’s vice-president of research, said the approach compressed the research effort without removing the need for expert validation. The organisation has initiated responsible disclosure for the relevant findings, with some vendor remediation work still ongoing.
The difference between the pace of discovery and the pace of device replacement or repair is likely to become increasingly important as AI-assisted research develops. The technical weaknesses may be newly discovered, but the infrastructure depending on the affected software can remain operational for decades.
