Symantec Company Cyber Security Posture
broadcom.comYour backstage pass to the most epic cybersecurity solutions on the market for Endpoint, Network, Data and Cloud security. Featuring worldwide (yet local-to-you) partner experts with the chops to deliver enterprise-grade security, whether you're a solo act or a supergroup. Be first in line to experience defense that goes to 11. Hit us up: https://engage.broadcom.com/ESG-contact-us
Symantec Company Details
symantec
13228 employees
438120.0
511
Software Development
broadcom.com
Scan still pending
SYM_1101791
In-progress
Symantec Risk Score (AI oriented)Between 900 and 1000
This score is AI-generated and less favored by cyber insurers, who prefer the TPRM score.
Symantec Global Score.png)
Symantec Company Scoring based on AI Models
| Model Name | Date | Description | Current Score Difference | Score |
|---|---|---|---|---|
| AVERAGE-Industry | 03-12-2025 | This score represents the average cybersecurity rating of companies already scanned within the same industry. It provides a benchmark to compare an individual company's security posture against its industry peers. | N/A | Between 900 and 1000 |
Symantec Company Cyber Security News & History
| Entity | Type | Severity | Impact | Seen | Url ID | Details | View |
|---|---|---|---|---|---|---|---|
| Symantec | Breach | 60 | 3 | 02/2019 | SYM1336271222 | Link | |
Rankiteo Explanation : Attack with significant impact with internal employee data leaksDescription: Security firm Symantec was attacked by a hacker back in February 2021 in which the hackers extracted some of the data. This comprises not only passwords but a list of Symantec clients -- including government agencies. The hacker was able to access a list of clients using Symantec's CloudSOC services, account managers and account numbers. | |||||||
| Broadcom | Ransomware | 100 | 4 | 5/2025 | BRO325051825 | Link | |
Rankiteo Explanation : Attack with significant impact with customers data leaksDescription: A ransomware attack at a Middle Eastern business partner of payroll company ADP has led to customer data theft at Broadcom. The HR department has begun informing affected current and former staff. The attack, claimed by the El Dorado ransomware group, resulted in the compromise of personal data including National ID numbers, financial account numbers, and personal contact information. The data was made available on the internet, affecting 560 users and potentially opening up the attack surface to 35 additional companies. Broadcom urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity. | |||||||
| Symantec | Vulnerability | 60 | 3 | 06/2016 | SYM44121823 | Link | |
Rankiteo Explanation : Attack with significant impact with internal employee data leaksDescription: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel. | |||||||
| Broadcom | Vulnerability | 25 | 1 | 7/2025 | BRO809071525 | Link | |
Rankiteo Explanation : Attack without any consequencesDescription: A critical security vulnerability has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure. The flaw, designated CVE-2025-5333 with a severe CVSS v4.0 score of 9.5, affects multiple versions of the widely-deployed endpoint management solution and has prompted immediate mitigation recommendations from security experts. The vulnerability resides in the Symantec Altiris Inventory Rule Management (IRM) component, specifically targeting an exposed legacy .NET Remoting endpoint. | |||||||
Symantec Company Subsidiaries
Your backstage pass to the most epic cybersecurity solutions on the market for Endpoint, Network, Data and Cloud security. Featuring worldwide (yet local-to-you) partner experts with the chops to deliver enterprise-grade security, whether you're a solo act or a supergroup. Be first in line to experience defense that goes to 11. Hit us up: https://engage.broadcom.com/ESG-contact-us
Access Data Using Our API
Get company history
Rapid.png)
Symantec Cyber Security News
Broadcom Named One of America’s Best Cybersecurity Companies 2025
Newsweek, in conjunction with Statista R, just named Broadcom one of America's Best Cybersecurity Companies 2025. In the listing, which “honors ...
Symantec to Acquire Blue Coat and Define the Future of Cybersecurity
With the acquisition of Blue Coat, Symantec will enhance its leadership position to define the future of cybersecurity and set the pace for ...
In Other News: Law Firm Hacked by China, Symantec Flaw, Meta AI Hack, FIDO Key Bypass
Powerful US law firm hacked by China, Symantec product flaw, $10000 Meta AI hack, cryptocurrency thieves bypassing FIDO keys.
US org with ‘significant presence in China’ targeted by hackers, Symantec says
A China-based threat actor likely attacked a large U.S. organization with a significant presence in the country earlier this year, researchers ...
Upcoming Events
Symantec is a cybersecurity legend, producing all-time hits since 1982 and pioneering chart-toppers in endpoint, data, email, network, and cloud security. As a ...
Medusa Ransomware Hits 40+ Victims in 2025, Demands $100K–$15M Ransom
The threat actors behind the Medusa ransomware have claimed nearly 400 victims since it first emerged in January 2023, with the financially motivated attacks ...
Rob Greer | Complete hybrid cloud cybersecurity
It is clear, there is no letup in cyberattacks, so the timing could not be better for Broadcom to bring Carbon Black and Symantec together.
Broadcom's Symantec solutions achieve IRAP certification, meeting Australian government standards
Features · Rethinking OT cybersecurity training as operators remain unprepared for converged, escalating threat landscape · Industrial ...
Accenture Acquires Symantec MSSP Business, SOCs From Broadcom -
Accenture is acquiring Symantec's Cyber Security Services Business -- which includes major MSSP capabilities -- from Broadcom.
Symantec Similar Companies
PedidosYa
We’re the delivery market leader in Latin America. Our platform connects over 77.000 restaurants, supermarkets, pharmacies and stores with millions of users. Nowadays we operate in more than 500 cities in Latinamerica. And we are now over 3.400 employees. PedidosYa is available for iOS, Android and
Expedia Group
At Expedia Group (NASDAQ: EXPE), we believe travel is a force for good – it opens minds, builds connections, and bridges divides. We create transformative tech that enables unforgettable experiences for all travelers, everywhere. Our trusted family of brands are known and loved by millions, and we p
Infor
As a global leader in business cloud software specialized by industry. Infor develops complete solutions for its focus industries, including industrial manufacturing, distribution, healthcare, food & beverage, automotive, aerospace & defense, hospitality, and high tech. Infor’s mission-critical ente
Pitney Bowes
Pitney Bowes (NYSE: PBI) is a technology-driven company that provides SaaS shipping solutions, mailing innovation, and financial services to clients around the world – including more than 90 percent of the Fortune 500. Small businesses to large enterprises, and government entities rely on Pitney Bow
Meituan
Adhering to the ‘Retail + Technology’ strategy, Meituan commits to its mission that 'We help people eat better, live better'. Since its establishment in March 2010, Meituan has advanced the digital upgrading of services and goods retail on both supply and demand sides. Together with our partners we
A problem isn't truly solved until it's solved for all. Googlers build products that help create opportunities for everyone, whether down the street or across the globe. Bring your insight, imagination and a healthy disregard for the impossible. Bring everything that makes you unique. Together, we c
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Symantec CyberSecurity History Information
How many cyber incidents has Symantec faced?
Total Incidents: According to Rankiteo, Symantec has faced 4 incidents in the past.
What types of cybersecurity incidents have occurred at Symantec?
Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach and Ransomware.
How does Symantec detect and respond to cybersecurity incidents?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with block port 4011 on firewalls, configure the irm_hostedserviceurl core setting with an empty value and restart the altiris inventory rule management service and remediation measures with limit .net remoting access to localhost-only in upcoming releases and communication strategy with urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity.
Incident Details
Can you provide details on each incident?
Incident : Vulnerability
Title: Critical Security Vulnerability in Broadcom’s Symantec Endpoint Management Suite
Description: A critical security vulnerability (CVE-2025-5333) has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure.
Date Detected: May 2025
Type: Vulnerability
Attack Vector: Unauthenticated Remote Code Execution (RCE)
Vulnerability Exploited: CVE-2025-5333
Incident : Ransomware
Title: Ransomware Attack at Broadcom via Middle Eastern Business Partner
Description: A ransomware attack at a Middle Eastern business partner of payroll company ADP has led to customer data theft at Broadcom. The HR department has begun informing affected current and former staff. The attack, claimed by the El Dorado ransomware group, resulted in the compromise of personal data including National ID numbers, financial account numbers, and personal contact information. The data was made available on the internet, affecting 560 users and potentially opening up the attack surface to 35 additional companies. Broadcom urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity.
Type: Ransomware
Attack Vector: Ransomware
Threat Actor: El Dorado ransomware group
Motivation: Data theft and ransom
Incident : Vulnerability Exploit
Title: Symantec and Norton Vulnerabilities Identified by Tavis Ormandy
Description: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel.
Type: Vulnerability Exploit
Attack Vector: Executable File
Vulnerability Exploited: File Decompression in Kernel
Motivation: Data Theft
Incident : Data Breach
Title: Symantec Data Breach
Description: Security firm Symantec was attacked by a hacker in February 2021, resulting in the extraction of data including passwords and a list of Symantec clients, including government agencies.
Date Detected: 2021-02-01
Type: Data Breach
What are the most common types of attacks the company has faced?
Common Attack Types: The most common types of attacks the company has faced is Vulnerability.
How does the company identify the attack vectors used in incidents?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Port 4011 and Executable File.
Impact of the Incidents
What was the impact of each incident?
Incident : Vulnerability BRO809071525
Systems Affected: Symantec Endpoint Management Suite 8.6.x-8.8
Incident : Ransomware BRO325051825
Data Compromised: National ID numbers, financial account numbers, personal contact information
Identity Theft Risk: True
Payment Information Risk: True
Incident : Vulnerability Exploit SYM44121823
Systems Affected: Symantec Enterprise Products
Incident : Data Breach SYM1336271222
Data Compromised: passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers, account numbers
What types of data are most commonly compromised in incidents?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are National ID numbers, financial account numbers, personal contact information, passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers and account numbers.
Which entities were affected by each incident?
Response to the Incidents
What measures were taken in response to each incident?
Incident : Vulnerability BRO809071525
Containment Measures: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service
Remediation Measures: Limit .NET Remoting access to localhost-only in upcoming releases
Incident : Ransomware BRO325051825
Communication Strategy: Urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity
Data Breach Information
What type of data was compromised in each breach?
Incident : Ransomware BRO325051825
Type of Data Compromised: National ID numbers, financial account numbers, personal contact information
Number of Records Exposed: 560
Sensitivity of Data: High
Data Exfiltration: True
Personally Identifiable Information: True
Incident : Data Breach SYM1336271222
Type of Data Compromised: passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers, account numbers
Data Exfiltration: True
What measures does the company take to prevent data exfiltration?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Limit .NET Remoting access to localhost-only in upcoming releases.
How does the company handle incidents involving personally identifiable information (PII)?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by block port 4011 on firewalls and configure the irm_hostedserviceurl core setting with an empty value and restart the altiris inventory rule management service.
Ransomware Information
Was ransomware involved in any of the incidents?
Lessons Learned and Recommendations
What recommendations were made to prevent future incidents?
Incident : Vulnerability BRO809071525
Recommendations: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases
What recommendations has the company implemented to improve cybersecurity?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases.
References
Where can I find more information about each incident?
Incident : Vulnerability BRO809071525
Source: Broadcom PSIRT
Incident : Vulnerability BRO809071525
Source: LRQA security researchers
Where can stakeholders find additional resources on cybersecurity best practices?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Broadcom PSIRT, and Source: LRQA security researchers.
Investigation Status
How does the company communicate the status of incident investigations to stakeholders?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through was Urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity.
Initial Access Broker
How did the initial access broker gain entry for each incident?
Incident : Vulnerability BRO809071525
Entry Point: Port 4011
Incident : Vulnerability Exploit SYM44121823
Entry Point: Executable File
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident?
Incident : Vulnerability BRO809071525
Root Causes: Insecure deserialization of .NET objects through the BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full
Corrective Actions: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases
What corrective actions has the company taken based on post-incident analysis?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases.
Additional Questions
General Information
Who was the attacking group in the last incident?
Last Attacking Group: The attacking group in the last incident was an El Dorado ransomware group.
Incident Details
What was the most recent incident detected?
Most Recent Incident Detected: The most recent incident detected was on May 2025.
Impact of the Incidents
What was the most significant data compromised in an incident?
Most Significant Data Compromised: The most significant data compromised in an incident were National ID numbers, financial account numbers, personal contact information, passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers and account numbers.
What was the most significant system affected in an incident?
Most Significant System Affected: The most significant system affected in an incident was Symantec Endpoint Management Suite 8.6.x-8.8 and Symantec Enterprise Products.
Response to the Incidents
What containment measures were taken in the most recent incident?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Block port 4011 on firewalls and Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service.
Data Breach Information
What was the most sensitive data compromised in a breach?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were National ID numbers, financial account numbers, personal contact information, passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers and account numbers.
What was the number of records exposed in the most significant breach?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 560.0.
Lessons Learned and Recommendations
What was the most significant recommendation implemented to improve cybersecurity?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases.
References
What is the most recent source of information about an incident?
Most Recent Source: The most recent source of information about an incident are Broadcom PSIRT and LRQA security researchers.
Initial Access Broker
What was the most recent entry point used by an initial access broker?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Port 4011 and Executable File.
What Do We Measure?
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
