--- title: Your Biggest Cyber Risk Could Be What You Already Trust description: Threat actors are increasingly moving away from malware, and instead, using trusted tools within your environment to carry out successful attacks. image: https://businessinsights.bitdefender.com/hubfs/trusted-tools-cyberrisk-blog.png --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) ![trusted-tools-cyberrisk-blog](https://businessinsights.bitdefender.com/hubfs/trusted-tools-cyberrisk-blog.png) [#SMB Security](https://businessinsights.bitdefender.com/topic/smb-security) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) [#Endpoint Protection & Management](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) By [**Cristian Iordache**](https://businessinsights.bitdefender.com/author/cristian-iordache) / Mar 31, 2026 # Your Biggest Cyber Risk Could Be What You Already Trust Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools&utm_medium=social&utm_source=facebook) For years, cybersecurity strategies have been built around a simple assumption: stop malicious files, stop the attack. *Threat actors have evolved.* Today’s attackers don’t need to bring [malware](https://www.bitdefender.com/en-us/business/infozone/what-is-malware) into your environment. They’re using what’s already there — trusted tools and legitimate administrative utilities — to move undetected, escalate privileges, and operate in plain sight. And the hardest reality to accept is this: most organizations don’t know how exposed they are until it’s too late. ## **Legitimate Tool Abuse You Can’t See** A recent [analysis](https://www.bitdefender.com/en-us/blog/businessinsights/700000-security-incidents-analyzed-living-off-land-tactics) of 700,000 high-severity security incidents revealed two unsettling findings. - **First: 84% of cyberattacks now abuse legitimate tools to evade detection** - **Second: Specific types of tools and their capabilities are at higher risk of abuse** Upon further analysis, we found that up to 95% of access to these risky tools is completely unnecessary. This is not an edge-case scenario. Consider a clean **Windows 11** environment. A standard installation includes **well over a hundred native binaries that can be abused for Living off the Land (LOTL) attacks** — tools like PowerShell, WMIC, Certutil, and others that were not designed with adversarial use in mind. These binaries are trusted by default, deeply embedded in the operating system, and often required for legitimate administrative tasks or necessary for other applications to work. That makes it difficult to restrict them without impacting productivity or creating an administrative nightmare. Trying to detect malicious activity after bad actors have started to abuse these tools is unsustainable because of the difficulty in discerning intent and the speed of modern, AI-enabled attacks. The risk isn’t just that these tools exist, it’s that most organizations have little visibility into how widely they’re accessible, who can use them, and whether that access is necessary in the first place. This creates **a vast, largely unmanaged attack surface hiding in plain sight.** Adding to the problem is that detection and response tools struggle to discern between malicious intent and legitimate work when risky tools trigger alerts. Security teams are left investigating activity that looks routine, often recognizing the threat only after damage has been done. In effect, your environment can be compromised without triggering the alerts you rely on. Investing in [EDR](https://www.bitdefender.com/en-us/business/infozone/what-is-edr) and [XDR](https://www.bitdefender.com/en-us/business/infozone/what-is-xdr) remains critical. But if users, or attackers, have unnecessary access to powerful tools, your attack surface is far larger than you realize. Every unnecessary permission creates another potential path an attacker can exploit, without introducing anything suspicious into your environment. ## **Investigating Legitimate Tool Abuse** If this feels like something you should investigate, you’re right. But most security teams don’t have the time or resources to map how trusted tools are used across the organization. Identifying where access is excessive, where shadow usage exists, and how those patterns translate into real attack paths is complex and time-consuming. Even when teams suspect the risk, proving it and prioritizing it is difficult. That’s why this problem often goes unaddressed. Not because it isn’t important, but because it isn’t visible. ## **Start With More Insight, Not More Tools** Closing this gap starts with understanding your actual exposure and how attackers can exploit it. But it does not need to be complicated or time-consuming if you utilize the complimentary [Bitdefender Internal Attack Surface Assessment](https://www.bitdefender.com/en-us/business/products/gravityzone-phasr/free-internal-attack-surface-assessment). It’s designed to provide a clear, data-driven view into how trusted tools could be used against your organization. And rather than asking your team to run a trial or deploy new tooling, the assessment is structured to be low-bandwidth and guided. It focuses on identifying unnecessary access, highlighting where risk exists, and providing prioritized recommendations, without disrupting users or adding operational burden. In the end, you’ll get the clarity you need to act with confidence. ## **From Reactive to Proactive** Security strategies have long focused on detecting and responding to threats. But LOTL attacks demand a shift in thinking. We must couple strong detection with another approach: reducing the number of ways attacks can succeed in the first place. What if the most effective control isn’t detecting misuse but preventing it altogether? This is where proactive security begins and where many organizations still have blind spots. ## **See Your Environment the Way Attackers Do** You no longer need to guess where your risks are. You can see them. Bitdefender’s complimentary [Internal Attack Surface Assessment](https://www.bitdefender.com/en-us/business/products/gravityzone-phasr/free-internal-attack-surface-assessment) helps you understand how attackers could move through your environment by living off the land and abusing the tools you already trust. ### [**Request your free Internal Attack Surface Assessment**](https://www.bitdefender.com/en-us/business/products/gravityzone-phasr/free-internal-attack-surface-assessment) ### Explore More Topics - [Enterprise Security (759)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (206)](https://businessinsights.bitdefender.com/topic/threat-research) - [SMB Security (186)](https://businessinsights.bitdefender.com/topic/smb-security) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [Ransomware (170)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (139)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (136)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (133)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (127)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (121)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [Threat Intelligence (80)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [IT Compliance & Regulations (73)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (58)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (54)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (47)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (39)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (23)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (9)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (5)](https://businessinsights.bitdefender.com/topic/podcast) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [How Much Ransomware Can Cost Your City and Your Business](https://businessinsights.bitdefender.com/how-much-ransomware-can-cost-your-city-and-your-business?hsLang=en-us) ### [A Single Data Breach Can Rob You of 78% of Your Customers, Study Indicates](https://businessinsights.bitdefender.com/a-single-data-breach-can-rob-you-of-78-of-your-customers-study-indicates?hsLang=en-us) ### [Machine Learning Could Save Your Business from a Breach](https://businessinsights.bitdefender.com/machine-learning-could-save-your-business-from-a-breach?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ![](https://px.spiceworks.com/px/5rec) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cristian Iordache", "url" : "https://businessinsights.bitdefender.com/author/cristian-iordache" }, "dateModified" : "2026-09-21T08:08:09.262Z", "datePublished" : "2026-03-31T13:00:00.000Z", "headline" : "Your Biggest Cyber Risk Could Be What You Already Trust", "image" : [ "https://businessinsights.bitdefender.com/hubfs/trusted-tools-cyberrisk-blog.png" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/biggest-cyber-risk-trusted-tools", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```