Forescout Research –
Vedere Labs
“Vedere” is the Italian word meaning “to see,” which epitomizes the mission of Forescout Vedere Labs, the cybersecurity research arm of Forescout. Our team of global experts focuses on increasing visibility of cybersecurity threats and vulnerabilities for all connected asset types and providing mitigation steps organizations can use to protect themselves.
Our research is fed into the Forescout Platform and shared with the cybersecurity community, including CISA and other cybersecurity agencies, CERTs, ISACs, open-source projects, device manufacturers, universities and other researchers.
What We Do
Vulnerability Research
- Focus on vulnerabilities against managed and unmanaged devices (IT/IoT/IoMT/OT)
- 200+ vulnerabilities discovered in last 5 years
- 100+ known exploited vulnerabilities on unmanaged devices
Threat Reports
- Manual and automatic analysis of malware samples collected via customer telemetry and other sources
Threat Intelligence & Detection
- Daily context-rich, machine-consumable threat feeds
- Detection rules to keep our Threat Detection & Response solution on top of emerging threats
- Live dashboards
How We Do It
Forescout Vedere Labs studies what attackers are working towards by observing actual attacks in our sandboxes, on the Darknet and in our Adversary Engagement Environment. We analyze significant attacks and generate vulnerability and threat intelligence that is consumed by the Forescout Platform. We also create corresponding detection rules that are added to Forescout Threat Detection & Response to help ensure customers can protect their IT, OT, IoT and IoMT environments.
Firsthand Observations in Our Research Laboratory
Located in Eindhoven, Netherlands, our research laboratory is where we observe firsthand the vulnerabilities being exploited and attacks in progress. The information we collect is analyzed to generate threat intelligence, calculate multifactor risk scores and create detection rules.
How Vedere Labs Uses Artificial Intelligence
VL threat intelligence is integrated on generative AI products, such as Microsoft Copilot for Security, allowing security analysts to query OT and IoT-specific threat intelligence directly from Forescout Research.
We also have integrated generative AI within our TDR solution, which summarizes proprietary intelligence that can be gathered about IP addresses and other indicators of compromises observed during an incident.
VL KEV: Our Proprietary List of Vulnerabilities
Our KEV list is compiled from real attacks we observe within our OT and IoT-specific honeypots, customer data and third-party intelligence. The list is complementary to industry-standard sources, such as CISA KEV. It is updated in tandem with other threat intelligence for Forescout eyeInspect and REM solutions. This type of intelligence allows users to prioritize vulnerability management actions based on what is currently being exploited by threat actors.
Partnerships and Threat Intelligence Sharing Groups
Vedere Labs is a proud member and contributor to threat intelligence sharing groups, including CERTs, cyber threat alliances and ISACs — where new intelligence and best practices are shared. Member organizations include industry, academia and governments where we share machine-readable intelligence and human-readable reports.
European Energy ISAC
Forescout is a founding member and actively participates in the threat intelligence task force.
ETHOS
Forescout is a founding member and part of the board of directors in this industry partnership dedicated to OT-centric, open-source sharing of anonymous early-warning threat information.
OT-ISAC
Forescout is a partner that shares reports, answers questions about emerging threats and presents at conferences and threat briefing meetings.
CISA JCDC and AIS
Forescout shares indicators of compromise and reports distributed to other members of the JCDC and IAS initiatives.
ACSC CTIS
Forescout shares indicators of compromise and reports distributed to other members of the CTIS initiative.
Data. Lots of Data.
The threat intelligence data we analyze comes from millions of connected devices that we monitor that give us billions of data points about device configuration and network behavior. It also comes from attacks we observe and dissect and other sources that we monitor.
Devices
- 19 million monitored devices
- 39 billion unique data points
- 1,500 global sites
- 6,500+ unique vendors
- 2,300+ unique OS versions
Threats
- 750+ threat actors
- 100+ ransomware group leak sites
- 20+ C2 types monitored on the Internet
- Third-party intel
Forescout Research - Vedere Labs Featured In...
Researchers uncover software flaws leaving medical devices vulnerable to hackers
Researchers say they have found more than a dozen vulnerabilities in software used in medical devices and machinery used in other industries that, if exploited by a hacker, could cause critical equipment such as patient monitors to crash…
Read More
Critical Bugs Expose Hundreds of Thousands of Medical Devices and ATMs
“You can imagine the type of impact an attacker could have when they can either exfiltrate data from medical equipment or other sensitive devices, potentially tamper with lab results, make critical devices unavailable, or take them over entirely…”
Read More
Government cyber workers increasingly concerned hackers will strike during shutdown
The government’s cybersecurity professionals are increasingly concerned that hackers will take advantage of the partial shutdown to tamper with sensitive government data or steal citizens’ information — and that the bare-bones staff won’t be able to fend them off…
Learn More
OT:ICEFALL FINALE
Forescout Vedere Labs is wrapping up its yearlong project looking at design vulnerabilities in operational technology with a closing report today that blames many of the issues they’ve encountered on vendors of the technology not implementing designs that would build security into the systems…
Read More
Dray:Break
In 2024, routers are a primary target for cybercriminals and state-sponsored attackers – and are the riskiest device category on networks. We investigated one hardware vendor, DrayTek, with a history of security flaws to help it address its issues and prevent new attacks — especially when ransomware and denial of service attacks are so high today.
Forescout Research. In Your Inbox. Every Month
With 13 cyber attacks every second, it’s hard to keep up.
To help, Vedere Labs now has its own newsletter. Curated by our research leaders, you’ll receive the most crucial information you need to stay ahead of attackers.
It’s loaded with useful context, links and spotlights on threat actors, newly exploited vulnerabilities and other must-know asset intelligence. Once a month. Nice and easy.
Meet Our Leader
Daniel dos Santos
Daniel dos Santos is the Head of Research at Forescout Vedere Labs, where he leads a team of researchers that identifies new vulnerabilities and monitors active threats. He holds a PhD in computer science, has published over 35 peer-reviewed papers, has found or disclosed hundreds of CVEs — and is a frequent speaker at security conferences.
Explore Vedere Labs Blogs
-
Introducing Alison King, Forescout VP of Government Affairs
Forescout is excited to announce that Alison King has joined the company as Vice President of Government Affairs. Alison has been at the forefront of change initiatives that positioned organizations in the Department of the Navy, Congress, the Cyberspace Solarium Commission and the Cybersecurity Infrastructure Security Agency (CISA) to achieve key objectives. Her extensive experience […]
Read More -
BOD 23-01 April 3, 2023, Deadline for Federal Agencies: Are You Ready?
On October 3, 2022 the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 23-01 – Improving Asset Visibility and Vulnerability Detection on Federal Networks, a compulsory order intended to “make measurable progress toward enhancing visibility into agency assets and associated vulnerabilities.” BOD 23-01 mandates that Federal Civilian Executive Branch (FCEB) agencies complete a series […]
Read More -
Deep Lateral Movement in OT Networks: When Is a Perimeter Not a Perimeter?
Forescout’s Vedere Labs latest research report is the first systematic study into deep lateral movement: how advanced adversaries can move laterally among devices at the controller level – also known as Purdue level 1 or L1 – of OT networks. Deep lateral movement lets attackers gain deep access to industrial control systems and cross often […]
Read More -
Company Update from CEO Barry Mainz
As the new CEO of Forescout, I am honored and excited to join this team and partner with our board, our strong management team and employees as we take the company through its next phase of growth. Over the past several months I have been working with Wael, Greg and our Board to prepare and […]
Read More -
Royal Ransomware – Analysis of One of the Most Active Ransomware Groups in Late 2022 and Early 2023
In our new threat briefing report, Forescout’s Vedere Labs analyzes the Royal ransomware threat actor group and encryptor payload, presents threat hunt opportunities for network defenders and shares details of the group’s tactics, techniques, and procedures (TTPs). Who is Royal ransomware? The Royal ransomware threat actor group, initially tracked as DEV-0569, first emerged in early […]
Read More -
Visibility Helps Global Energy Company AES Assess Risk and Secure its OT Networks
With 70 international plants spanning 15 different countries, the AES Corporation is a next-generation energy company helping lead the way to a carbon-neutral future. Like many organizations, AES wanted to improve the security posture within their OT networks with technology spanning multiple vendors. Recently I sat down with Kyle Oetken, Director of Cyber Defense, and […]
Read More -
Log4j/Log4Shell One Year Later: Endemic Vulnerability Indeed
On December 9, 2021, Apache upended the cybersecurity industry by publishing a zero-day vulnerability (CVE-2021-44228) for its ubiquitous Log4j logging utility. Dubbed Log4Shell, the remote code execution flaw (CVSS score:10) allows an attacker to take control of a connected device and run malicious code, access sensitive data or alter its configuration. Because Logj4 is free […]
Read More -
SBOMs and the Hunt for Software Supply Chain Vulnerabilities
Too much of our software, including critical software, is shipped with significant vulnerabilities that our adversaries exploit. This is a longstanding, well-known problem, but for too long we have kicked the can down the road. We need to use the purchasing power of the Federal Government to drive the market to build security into all […]
Read More -
What Project Memoria Foretold about TCP/IP Security and Supply Chain Vulnerabilities
Project Memoria was the largest study about the security of TCP/IP stacks, conducted by Vedere Labs and partners in the cybersecurity industry. It started from a collaboration with JSOF to understand the impact of Ripple20 and led to the discovery of almost 100 vulnerabilities in 14 TCP/IP stacks, divided into five phases: AMNESIA:33, NUMBER:JACK, NAME:WRECK, […]
Read More