Snapshot 130361
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Your trust, secured by Armis. The Armis Trust Center offers resources that highlight our unwavering commitment to safeguarding customer data. Here, you will find detailed information about Armis' trust practices, covering aspects such as security, privacy, compliance, and general infrastructure documentation. Security is a core element of our product strategy, and we build our platform following industry best practices to ensure high availability, scalability, and robust security for cloud-based applications. Our security program is rigorously monitored and assessed to ensure it consistently meets or exceeds regulatory standards and customer expectations. Compliance C5 CSA STAR Level 1 Cyber Essentials ENS FedRAMP Moderate ISO/IEC 27001 ISO/IEC 27001 SoA ISO/IEC 27017:2015 ISO/IEC 27018:2019 SOC 2 TISAX TX-RAMP Level 2 VPAT DoD IL5 ISO/IEC 42001:2023 Armis is trusted by DocuSign Colgate-Palmolive Uplight Mondelēz International Fortive Corporation Allegro MicroSystems Takeda Kalahari Resorts United Airlines Documents REPORTSPentest Remediation Report REPORTSPentest Report COMPLIANCEC5 COMPLIANCECSA STAR Level 1 COMPLIANCECyber Essentials COMPLIANCEENS COMPLIANCEISO/IEC 27001 COMPLIANCEISO/IEC 27001 SoA COMPLIANCEISO/IEC 27017:2015 COMPLIANCEISO/IEC 27018:2019 COMPLIANCEISO/IEC 42001:2023 COMPLIANCESOC 2 Risk Profile Third Party DependenceYes HostingMajor Cloud Provider Product Security Integrations Role-Based Access Control SSO Support Reports Pentest Remediation Report Pentest Report Self-Assessments CAIQ HECVAT 403 HECVAT Lite View more Data Security Access Monitoring Data Backups Data Erasure View more App Security Application Penetration Testing Code Analysis Software Bill of Materials (SBOM) View more Legal Subprocessors Privacy Policy Data Processing Addendum View more Data Privacy Cookies Data Privacy Officer Employee Privacy Training Access Control Least Privilege Password Security Remote Access View more Infrastructure Amazon Web Services Separate Production Environment Endpoint Security Anti-Malware Disk Encryption Endpoint Detection & Response View more Network Security Bot Detection Data Loss Prevention Web Application Firewall View more Corporate Security Asset Management Practices Employee Training HR Security View more Incident Response Security Operations Center (SOC) AI Armis Platform AI Disclosure - FAQ Armis Centrix AI Assistant: Data Privacy & Security Statement BC/DR Business Continuity Plan (BCP) Policies Acceptable Use Policy Access Control Policy Asset Management Policy View more Trust Center Updates Security Advisory Vulnerabilities Armis Advisory Regarding Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices 🔔 Dear Valued Customer, Armis has reviewed a recent Cybersecurity & Infrastructure Agency (CISA) Emergency Directive affecting Cisco Adaptive Secure Appliances (ASA) and verified that Armis is not impacted by these vulnerabilities. Background On September 25, 2025, CISA issued an Emergency Directive in response to active, widespread exploitation of Cisco Adaptive Security Appliances (ASA). Advanced threat actors are leveraging vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to achieve unauthenticated remote code execution on affected ASA devices. Impact on Armis Armis is not impacted and does not have any of the affected appliances deployed with our operating environments. Customer Action No action is required from customers regarding this matter. We continuously monitor security advisories from our vendors to ensure the integrity and security of our products. For any further questions, please contact Armis Support. Sincerely, The Armis Team Security Advisory Vulnerabilities Armis Advisory Regarding Supermicro BMC Firmware Vulnerabilities (CVE-2025-7937, CVE-2025-6198) 🔔 Dear Valued Customer, In line with our commitment to transparency, Armis has reviewed two recently disclosed Supermicro BMC firmware vulnerabilities (CVE-2025-7937 and CVE-2025-6198) and verified that Armis appliances are not impacted. Background On September 24, 2025, Supermicro announced two medium-severity vulnerabilities, CVE-2025-7937 and CVE-2025-6198, affecting the Baseboard Management Controller (BMC) firmware on a specific list of their motherboard models. The vulnerabilities are related to an Improper Verification of Cryptographic Signature, which could potentially allow a specially crafted firmware image to bypass security checks and update the system firmware. Impact on Armis Appliances After a thorough review of the Supermicro security disclosure, we have confirmed that Armis does not use any of the affected motherboard models listed in the vendor's advisory. Therefore, Armis products are not susceptible to these vulnerabilities. Customer Action No action is required from customers regarding this matter. Armis appliances are secure and not at risk from these specific vulnerabilities. We continuously monitor security advisories from our vendors to ensure the integrity and security of our products. For any further questions, please contact Armis Support. Sincerely, The Armis Team Security Advisory Incidents Security Advisory: Armis Unaffected by "Shai-Hulud" npm Supply Chain Attack 🔔 Dear Customer, Armis is actively tracking an ongoing software supply chain attack named "Shai-Hulud," involving malicious packages published to the npm registry on September 15, 2025. Our security team has conducted a thorough investigation, and we can confirm that the Armis Centrix platform is not affected by this campaign. Our review has verified that we do not utilize any of the hundreds of malicious package versions identified in this attack. Background on the "Shai-Hulud" Campaign The "Shai-Hulud" campaign delivers data-stealing malware through a post-install script embedded in compromised npm packages. The attack specifically targets the software development lifecycle (SDLC) and developer workstations. Execution: Once a developer installs a malicious package, the script activates and harvests sensitive data, including environment variables, cloud keys, and other secrets. Data Exfiltration: This data is then exfiltrated to public GitHub repositories named "Shai-Hulud" created by the attacker. GitHub Token Abuse: If the malware finds developer GitHub tokens, it abuses them in order to create public repositories with the stolen secrets, push malicious GitHub Actions workflows to other repositories, and migrate private organizational repositories to public ones under the attacker's control. Propagation: The attack is a self-propagating worm. If it finds additional npm tokens in a victim's environment, it will automatically publish malicious versions of any packages it can access, spreading the compromise further. Security researchers assess that this activity is likely a downstream result of a separate campaign that occurred in late August 2025, where initial GitHub token theft enabled this broader attack. Our Commitment to Security The security of our platform and the trust of our customers are our highest priorities. The Armis team's robust supply chain security practices and continuous monitoring were effective in preventing any impact from this threat. While the Armis platform is not impacted, we strongly recommend that your development and security teams assess their own environments for exposure. If you have any questions or concerns, please do not hesitate to contact Armis support. Sincerely, The Armis Team Reference: Key Facts of the "Shai-Hulud" Campaign Initial Compromise: Malicious versions of multiple npm packages were first published on September 15, 2025. Attack Vector: The malware is delivered via a post-install script in the compromised packages. Data Harvested: The script uses secret scanning tools to find and collect sensitive developer assets, environment variables, and cloud keys. Exfiltration Method: Stolen data is exfiltrated to public GitHub repositories named "Shai-Hulud." Propagation Mechanism: The malware is a self-propagating worm that uses stolen npm tokens to publish new malicious packages. GitHub Abuse: Stolen GitHub tokens are used to expose secrets, spread malicious workflows, and migrate private repositories to public ones with the label "Shai-Hulud Migration." Security Advisory Incidents 🔔Security Advisory: Armis Unaffected by Malicious npm Packages Dear Valued Customer, Armis is aware of a recent software supply chain attack involving malicious versions of highly popular npm packages, which were published starting on September 8, 2025.¹ Following a thorough investigation, we have confirmed that the Armis platform and all Armis products are not affected by this incident. Our security team has verified that none of the compromised package versions were incorporated into our software. Background on the npm Package Compromise On September 8, 2025, malicious versions of 18 popular npm packages, including debug and chalk, were published.² On September 9, additional packages such as @duckdb/duckdb-wasm were also reported as compromised.³ The malware is designed to execute in a user's web browser when a website or application serves the compromised code.⁴ Its primary functions are to: Hook into browser functions to monitor for cryptocurrency transactions.⁵ Silently rewrite transaction details, such as wallet recipients, to redirect funds to an attacker-controlled address before the user signs the transaction.⁶ Use "look-alike" addresses to hide the malicious change from the user in the UI.⁷ The highest risk is for public-facing websites, dApps, and payment widgets that may have bundled these specific malicious versions and deployed them to users.⁸ The risk is considered lower for exclusively server-side applications where the malicious code would not be served to a browser.⁹ Our Commitment to Security The security of our platform and the trust of our customers are our highest priorities. The Armis Security team continuously monitors our software supply chain to protect against threats like this. While the Armis platform is not impacted, we recommend your development teams review their own applications to ensure they are not using the malicious versions of the affected packages. If you have any questions or concerns, please do not hesitate to contact Armis support. Sincerely, The Armis Security Team References ¹ Malicious releases of 18 popular npm packages were published on September 8, 2025. ² Malicious new versions of 18 popular npm packages, including debug@4.4.2 and chalk@5.6.1, were published to npm on September 8, 2025. ³ On September 9, 2025, JFrog reported that more packages were affected, including @duckdb/duckdb-wasm@1.29.2. ⁴ When bundled into frontend assets and deployed on a website, the malicious code runs in visitors' browsers. ⁵ The malware overrides global fetch and XMLHttpRequest, and wallet interfaces like window.ethereum and Solana signing calls. ⁶ The injected code runs in the browser and can silently redirect crypto transactions (recipients/approvals) to attacker-controlled addresses. ⁷ It uses "look-alike" address substitution so the UI can look normal while the signed payload is altered. ⁸ High risk applies to any site or app that bundled these specific versions and served them to browsers, including dApps and payment/donation widgets. ⁹ There is a lower risk for pure server-side use of these packages (Node-only), as the payload is browser-oriented. Security Incidents Update Incidents Security Notification: Salesloft Drift Incident 🔔 Dear Valued Customer, At Armis, the security of our data and our customers’ data is our highest priority. In the spirit of full transparency, we are writing to inform you of a security incident experienced by one of our third-party vendors, Salesloft, which affected their Drift application. What Happened On August 20, 2025, Salesloft began notifying its customers of a security issue within its Drift application. The issue was later confirmed to be a data breach intended to compromise the integration connections between Drift and Salesforce. As a user of this application, Armis was notified and immediately began monitoring the situation. Armis's Proactive Response and Containment Our security and business applications teams took immediate action. In an abundance of caution, on August 20, 2025, we proactively severed the integration between our internal Salesforce environment and the Salesloft Drift application. Our decision to disable the integration was validated when Salesforce took the industry-wide step of disabling all Salesloft integrations on its platform on August 29th. This action was taken well ahead of Salesloft’s decision to take the Drift service fully offline on September 2nd. This decision was validated when Salesforce took the industry-wide step of disabling all Salesloft integrations on August 29, 2025. This action was taken well ahead of Salesloft’s decision to take the Drift service fully offline on September 2, 2025. Impact on Armis and Customer Data Due to these swift and proactive containment measures, we have no evidence to suggest that any Armis data or customer information was compromised or affected by this incident. Our internal monitoring and third-party risk intelligence from our Panorays platform support this conclusion, indicating that the breach event did not impact our company. Our commitment to a robust vendor risk management program enabled us to react quickly to this external event, ensuring the continued security of our environment. We will continue to monitor the situation with Salesloft and will only consider re-establishing the integration when we are completely satisfied with their security posture. Thank you for your continued trust in Armis. Sincerely, The Armis Security Team