Intruder Report Reveals 1 in 4 Companies Leave MySQL Databases Exposed

<span style="display: inline-block; background: #EAF3FB; border: 1px solid #1B6CA8; color: #1B6CA8; font-family: 'Georgia', serif; font-size: 11px; font-weight: bold; letter-spacing: 2px; text-transform: uppercase; padding: 5px 16px; border-radius: 20px;">Attack Surface Management · Threat Intelligence</span>

<span style="display: inline-block; background: #FEF5E7; border: 1px solid #E8A020; color: #B87A10; font-family: 'Georgia', serif; font-size: 11px; font-weight: bold; letter-spacing: 2px; text-transform: uppercase; padding: 5px 16px; border-radius: 20px;">2026 Research Report</span>

</div>

1 in 4 Organisations Expose MySQL Databases to the Internet — Intruder's 2026 Attack Surface Management Index Reveals a Remediation Crisis

</h1>

<span style="color: #1B6CA8; font-weight: bold;">iTech360Hub</span>

<span style="background: #FEF5E7; border: 1px solid #E8A020; color: #B87A10; padding: 3px 12px; border-radius: 20px; font-size: 11px; letter-spacing: 1px; text-transform: uppercase;">3,000 Organisations Analysed</span>

</div>

</div>

Security teams have spent years focused on the vulnerability management problem — patching known CVEs before adversaries can exploit them. That focus has been largely justified. But new research suggests that organisations are systematically overlooking a more fundamental risk: the services, databases, and administrative panels that should never have been internet-facing in the first place. <a href="https://www.intruder.io" style="color: #1B6CA8; text-decoration: underline;">Intruder</a>, a leader in exposure management, has released the <a href="https://www.intruder.io/blog/attack-surface-exposures" style="color: #1B6CA8; text-decoration: underline;"><strong style="color: #0F3D6B;">2026 Attack Surface Management Index</strong></a> — based on anonymised data from 3,000 customers collected over the twelve months ending March 2026 — with findings that should serve as an urgent wake-up call for security leaders at organisations of every size.

</p>

Over a quarter of organisations — <strong style="color: #0F3D6B;">26%</strong> — have MySQL databases exposed to the public internet. One in six expose Postgres databases. More than one in seven expose sensitive API documentation. Nearly half expose risky ports and services. And the organisations that face the greatest exposure are not necessarily the ones closing gaps fastest: midmarket firms averaging 5,000–10,000 employees take <strong style="color: #0F3D6B;">56 days</strong> to remediate exposures — nearly four times slower than their smaller counterparts — while the emergence of autonomous AI models has compressed the time between vulnerability discovery and exploitation to a single day. The arithmetic of that gap is alarming.

</p>

<div style="font-family: 'Georgia', serif; font-size: 13px; color: #555; line-height: 1.5;">Of organisations expose MySQL databases to the internet — a known target for database ransomware and data extortion, requiring no CVE to exploit via brute force or credential stuffing</div>

</div>

<div style="font-family: 'Georgia', serif; font-size: 13px; color: #555; line-height: 1.5;">Average remediation time for midmarket organisations (5,000–10,000 employees) — nearly 4× slower than small enterprises, creating a dangerous window as AI-driven exploitation accelerates</div>

</div>

<div style="font-family: 'Georgia', serif; font-size: 13px; color: #555; line-height: 1.5;">Time-to-exploit for newly discovered vulnerabilities in AI-era threat landscape — making 56-day remediation windows an indefensible gap between exposure and compromise</div>

</div>

"The emergence of autonomous AI models like Mythos has fundamentally shifted the cybersecurity landscape. The security industry is seeing a major compression in the time between vulnerability discovery and exploitation. In this high-speed era, leaving a MySQL database or private API documentation exposed to the internet is an open invitation for automated, high-speed extortion. Many of the exposures we examined don't even need a CVE to be exploited. An exposed database or admin panel can be compromised through brute force or credential stuffing alone."

</p>

<cite style="font-family: 'Georgia', serif; font-style: normal; font-size: 13px; color: #1B6CA8; font-weight: bold; text-transform: uppercase; letter-spacing: 1px;">— Chris Wallis, CEO & Founder, <a href="https://www.intruder.io" style="color: #1B6CA8; text-decoration: underline;">Intruder</a></cite>

</blockquote>

The Top Ten Exposures — What Organisations Are Leaving Open on the Internet

</h2>

The <a href="https://www.intruder.io/blog/attack-surface-exposures" style="color: #1B6CA8; text-decoration: underline;">2026 ASM Index</a> categorises exposures across HTTP panels, ports and services, databases, files and information. Exposed databases dominate the top rankings — and what makes them particularly dangerous is that many do not require a known vulnerability to exploit. A MySQL database accessible from the public internet can be compromised through brute-force credential attacks or credential stuffing using previously breached passwords, with no CVE required. The 2020 PLEASE_READ_ME ransomware campaign compromised over 250,000 MySQL databases this way alone.

</p>

<h3 style="font-family: 'Georgia', serif; font-size: 18px; color: #1B6CA8; margin: 0 0 10px 0;">Databases — MySQL (26%) and Postgres (16%): Ransomware's Favourite Targets</h3>

<p style="font-family: 'Georgia', serif; font-size: 17px; line-height: 1.8; color: #2C2C2C; margin: 0;">Exposed databases take the top two spots in the Index. More than a quarter of organisations expose MySQL — a known target for database ransomware and data extortion campaigns — and one in six expose Postgres. Internet-facing databases have been a consistent target for opportunistic attackers for years, and the emergence of AI-driven autonomous exploitation has made the risk of leaving them exposed categorically more severe. When a new vulnerability drops, anything exposed to the internet is immediately at risk — and at AI-driven exploitation speed, the window to patch before active attacks begin has collapsed to hours or less.</p>

</div>

<h3 style="font-family: 'Georgia', serif; font-size: 18px; color: #B87A10; margin: 0 0 10px 0;">API Documentation — 1 in 7 Organisations Expose Sensitive Endpoint Intelligence</h3>

<p style="font-family: 'Georgia', serif; font-size: 17px; line-height: 1.8; color: #2C2C2C; margin: 0;">More than one in seven organisations expose API documentation publicly — a finding that ranks ahead of Remote Desktop in the Index's severity assessment. Exposed API documentation is not simply an information disclosure issue — it provides adversaries with a detailed map of endpoints, authentication parameters, data structures, and integration patterns that dramatically lowers the effort required to identify exploitable weaknesses. For adversaries using AI to automate vulnerability discovery, a publicly accessible API specification is the equivalent of a detailed blueprint of the building before the attack.</p>

</div>

<h3 style="font-family: 'Georgia', serif; font-size: 18px; color: #1B6CA8; margin: 0 0 10px 0;">Remote Desktop and Risky Ports — 49% of Organisations Expose High-Risk Services</h3>

<p style="font-family: 'Georgia', serif; font-size: 17px; line-height: 1.8; color: #2C2C2C; margin: 0;">Nearly half of all organisations in the dataset expose risky ports and services — with Remote Desktop Protocol (RDP) as the most commonly exposed service, ranked as the poster child of services that should never face the public internet. RDP was the entry vector for some of the most damaging ransomware campaigns in recent years, and its continued exposure across 49% of organisations reflects a persistent failure to enforce basic network hygiene. Legacy services including SNMP (9%), UPnP (8%), NTP, and RPC complete the top ten — all services designed for internal networks that were never intended to be internet-facing.</p>

</div>

<h3 style="font-family: 'Georgia', serif; font-size: 18px; color: #B87A10; margin: 0 0 10px 0;">Admin Panels — WordPress Admin (15%) and phpMyAdmin (8%) Left Internet-Facing</h3>

<p style="font-family: 'Georgia', serif; font-size: 17px; line-height: 1.8; color: #2C2C2C; margin: 0;">Administrative interfaces that provide direct control over websites and databases — WordPress Admin (15% of organisations) and phpMyAdmin (8%) — are among the most consequential exposures because they provide attackers with privileged access pathways that bypass the normal application security stack. A brute-forced admin panel credential does not trigger a CVE alert and may not be caught by vulnerability scanners that focus on known software vulnerabilities. These exposures represent exactly the category of risk the Index highlights: not a vulnerability in code, but a fundamental question of whether a service should be publicly reachable at all.</p>

</div>

The Midmarket Bottleneck — Scale Without Security Maturity

</h2>

One of the most commercially significant findings in the Index is the inverse relationship between organisation size and remediation speed in the midmarket range. Small enterprises — those with 51 to 250 employees — remediate exposures in an average of 14 to 18 days. As organisations scale into the 5,000–10,000 employee range, that average rises to 56 days — nearly four times slower. The Index identifies this as the <strong style="color: #0F3D6B;">midmarket bottleneck</strong>: organisations with 251 to 5,000 employees are managing enterprise-level attack surface complexity without the headcount, budget, or tooling maturity that large enterprises have built to manage it.

</p>

The scale of this challenge is illustrated by the asset data: organisations with 1,000–5,000 employees manage an average of 748 external assets — more than five times as many as organisations in the 251–1,000 range, and nearly 35 times more than small enterprises. Each additional asset is a potential exposure point, and each additional exposure point is a potential entry vector for an adversary who, in the AI era, can enumerate and probe those surfaces at machine speed. The combination of large attack surfaces, slow remediation cycles, and AI-compressed exploitation timelines creates a structural risk profile that the midmarket is currently failing to address.

</p>

<div style="font-family: 'Georgia', serif; font-size: 15px; font-weight: bold; color: #0F3D6B; margin-bottom: 8px;">Banking</div>

<p style="font-family: 'Georgia', serif; font-size: 14px; line-height: 1.65; color: #555; margin: 0;">The fastest-remediating sector — banks close exposures in an average of 11 days, reflecting the regulatory pressure and security investment that financial services organisations maintain as baseline requirements.</p>

</div>

<div style="font-family: 'Georgia', serif; font-size: 15px; font-weight: bold; color: #0F3D6B; margin-bottom: 8px;">Retail</div>

<p style="font-family: 'Georgia', serif; font-size: 14px; line-height: 1.65; color: #555; margin: 0;">Retail organisations remediate in an average of ten days — the fastest alongside banking — likely driven by high-volume customer data exposure risk and the acute commercial consequence of breaches.</p>

</div>

<div style="font-family: 'Georgia', serif; font-size: 15px; font-weight: bold; color: #0F3D6B; margin-bottom: 8px;">Insurance & Pharma</div>

<p style="font-family: 'Georgia', serif; font-size: 14px; line-height: 1.65; color: #555; margin: 0;">Insurance and pharmaceutical firms average over 40 days to remediate — a striking contrast with banking that suggests their regulatory regimes are creating compliance overhead without the operational security velocity that healthcare and financial data sensitivity demands.</p>

</div>

The AI Acceleration Factor — Why Exposure Reduction Must Come Before Patching

</h2>

The Index's data takes on a different character when placed against the AI threat acceleration context that Chris Wallis highlights. Autonomous AI models are now capable of discovering zero-day vulnerabilities and initiating exploitation within a single day of discovery. The MongoBleed example (CVE-2025-14847) illustrates the scale of the risk: when it was disclosed, more than 87,000 databases were publicly exposed and immediately at risk. For most teams, the instinct is to patch — but the Index makes the case that patching is the wrong first response when the real question is whether the service should be internet-facing at all.

</p>

Attack surface reduction — removing services from internet exposure entirely — is a more durable and less resource-intensive defence than continuous patching. A MySQL database that is not internet-facing cannot be brute-forced from the public internet, regardless of whether its credentials are strong or its software is patched. The Index's central argument is that the security industry's focus on vulnerability patching has allowed a parallel and arguably more fundamental risk to grow unchecked: the question of what should be on the internet in the first place.

</p>

Since 2015, <a href="https://www.intruder.io" style="color: #1B6CA8; text-decoration: underline;">Intruder</a> has helped its customers take more than <strong style="color: #0F3D6B;">133,000 exposures off the internet</strong> — a statistic that represents not vulnerabilities patched, but services removed from attacker reach entirely.

</p>

<div style="font-family: 'Georgia', serif; font-size: 12px; color: #1B6CA8; text-transform: uppercase; letter-spacing: 2px; font-weight: bold; margin-bottom: 14px;">Intruder Exposure Management Platform Capabilities</div>

<span style="background: #EAF3FB; border: 1px solid #1B6CA8; color: #0F3D6B; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">Attack Surface Management</span>

<span style="background: #FEF5E7; border: 1px solid #E8A020; color: #7A4F00; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">AI Penetration Testing</span>

<span style="background: #EAF3FB; border: 1px solid #1B6CA8; color: #0F3D6B; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">Continuous Vulnerability Management</span>

<span style="background: #FEF5E7; border: 1px solid #E8A020; color: #7A4F00; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">Cloud Security</span>

<span style="background: #EAF3FB; border: 1px solid #1B6CA8; color: #0F3D6B; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">Exposure Prioritisation</span>

<span style="background: #FEF5E7; border: 1px solid #E8A020; color: #7A4F00; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">Database Exposure Detection</span>

<span style="background: #EAF3FB; border: 1px solid #1B6CA8; color: #0F3D6B; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">1,000+ Exposure Signatures</span>

<span style="background: #FEF5E7; border: 1px solid #E8A020; color: #7A4F00; font-family: 'Georgia', serif; font-size: 13px; padding: 6px 16px; border-radius: 20px;">Lean Security Team Support</span>

</div>

<h3 style="font-family: 'Georgia', serif; font-size: 14px; color: #1B6CA8; text-transform: uppercase; letter-spacing: 2px; margin: 0 0 20px 0; font-weight: bold;">Key Takeaways</h3>

<p style="font-family: 'Georgia', serif; font-size: 16px; line-height: 1.75; color: #2C2C2C; margin: 0;"><a href="https://www.intruder.io/blog/attack-surface-exposures" style="color: #1B6CA8; text-decoration: underline;">Intruder's 2026 ASM Index</a>, based on 3,000 organisations over twelve months, finds that <strong style="color: #0F3D6B;">26% expose MySQL databases, 16% expose Postgres, 1 in 7 expose API documentation, and 49% expose risky ports and services</strong> — none of which require a CVE to exploit, relying instead on brute force, credential stuffing, or default credentials.</p>

</div>

<p style="font-family: 'Georgia', serif; font-size: 16px; line-height: 1.75; color: #2C2C2C; margin: 0;">Midmarket organisations (5,000–10,000 employees) take an average of <strong style="color: #0F3D6B;">56 days to remediate exposures</strong> — nearly four times slower than small enterprises at 14–18 days — while managing attack surfaces up to 35× larger than smaller peers, creating the defining security risk profile of the current threat environment.</p>

</div>

<p style="font-family: 'Georgia', serif; font-size: 16px; line-height: 1.75; color: #2C2C2C; margin: 0;">A stark sector gap exists: <strong style="color: #0F3D6B;">banks remediate in 11 days, retail in 10</strong> — while insurance and pharmaceutical firms average over 40 days, creating materially different risk profiles between sectors that regulators and boards increasingly need to account for as autonomous AI exploitation compresses the time-to-attack to a single day.</p>

</div>

<p style="font-family: 'Georgia', serif; font-size: 16px; line-height: 1.75; color: #2C2C2C; margin: 0;"><a href="https://www.intruder.io" style="color: #1B6CA8; text-decoration: underline;">Intruder</a>'s central recommendation is that <strong style="color: #0F3D6B;">attack surface reduction must precede patching</strong> as the primary security discipline — removing services from internet exposure entirely rather than racing to patch them after AI-powered adversaries have already begun automated scanning. Since 2015, Intruder has helped customers remove over 133,000 exposures. Access the full report at <a href="https://www.intruder.io/blog/attack-surface-exposures" style="color: #1B6CA8; text-decoration: underline;">intruder.io</a>.</p>

</div>

The <a href="https://www.intruder.io/blog/attack-surface-exposures" style="color: #1B6CA8; text-decoration: underline;">2026 Attack Surface Management Index</a> challenges a foundational assumption in enterprise security: that the primary question is "what vulnerabilities exist?" rather than "what should not be internet-facing at all?" In an environment where autonomous AI models can discover and exploit vulnerabilities in a single day, and where a quarter of organisations are leaving databases exposed that require no CVE to compromise, the remediation-focused model of security is not keeping pace with the threat. The organisations that will manage exposure risk most effectively are those that treat attack surface reduction — removing services from the internet entirely — as a first-order security discipline rather than an afterthought to the vulnerability management programme.

</p>

To read the full 2026 Attack Surface Management Index and benchmark your organisation's exposure profile, visit <a href="https://www.intruder.io" style="color: #1B6CA8; text-decoration: underline;">intruder.io</a>.

</p>

</div>

<span style="display: inline-block; border: 1px solid #1B6CA8; color: #1B6CA8; font-family: 'Georgia', serif; font-size: 12px; padding: 5px 16px; border-radius: 20px; background: #EAF3FB;">Attack Surface Management</span>

<span style="display: inline-block; border: 1px solid #E8A020; color: #B87A10; font-family: 'Georgia', serif; font-size: 12px; padding: 5px 16px; border-radius: 20px; background: #FEF5E7;">MySQL Exposure</span>

</div>

</div>