Eclypsium launches InfraTrust to flag the infrastructure flaws no one is patching

Key points

• Eclypsium launched InfraTrust as a free knowledge base tracking vulnerabilities in infrastructure gear including routers, firewalls, servers and firmware.
• The company will publish a monthly InfraTrust Pulse report ranking which flaws defenders should patch first.
• Infrastructure devices are increasingly targeted by state-linked hackers and ransomware crews because they sit outside normal antivirus tools.
• The service targets security teams struggling to triage open bugs across network and edge equipment.

Eclypsium, a firm that specialises in the security of firmware (the low-level code baked into hardware like network switches and servers), has launched a free service called InfraTrust. Alongside it comes a monthly bulletin called InfraTrust Pulse, ranking the infrastructure vulnerabilities defenders should fix first. The launch was first reported by BleepingComputer.

Why does another vulnerability list matter?

Security teams are drowning, and the gear that runs the internet has become a favourite target.

Every week brings fresh bugs in edge devices, meaning the appliances that sit at the boundary between a company's network and the public internet. Firewalls from Fortinet, Ivanti, Palo Alto Networks and Cisco have all been hit hard in the past two years, as have file-transfer servers and VPN concentrators. We covered one of the larger Fortinet incidents on 19 June 2026, when Russian-speaking operators were working through 86,644 exposed FortiGate boxes.

These devices are attractive to attackers for a straightforward reason: they're exposed to the internet by design, they often run for years without updates, and antivirus software can't see inside them.

Eclypsium argues that defenders lack a clear signal for which bugs actually matter. A CVE (a public identifier assigned to a software flaw in the format CVE-YYYY-NNNNN) can carry a scary severity score but never appear in a real attack. Another might look mild on paper and end up in every ransomware playbook within a month.

What will the service actually publish?

The knowledge base will track vulnerabilities across infrastructure devices, firmware, networking gear and edge equipment. Each entry is expected to describe the flaw in plain terms, note whether it's being exploited in the wild, and flag which vendors and models are affected. The monthly Pulse report will pull out the bugs the company believes deserve urgent attention.

That kind of curation already exists elsewhere. The US Cybersecurity and Infrastructure Security Agency runs a Known Exploited Vulnerabilities catalogue, which federal agencies must patch on a deadline. Eclypsium's angle is narrower and more technical, focused on the hardware layer where its own products operate. It's a similar instinct to the one behind the White House's Gold Eagle program, which we reported on 15 July 2026: a federal push to sort and prioritise software vulnerabilities using AI, though InfraTrust is a private-sector product with no government mandate behind it.

Should you worry?

Mostly this is a tool for people who keep large networks running: hospital IT teams, bank security staff, government network administrators.

But the consequences reach further. A hospital's firewall breached through an unpatched flaw means patient records leak. A telecom's edge router hijacked means calls and messages can be intercepted. The Salt Typhoon intrusions into US telecom networks, blamed on hackers linked to China, hinged on exactly this kind of infrastructure weakness.

Eclypsium is a commercial vendor, so InfraTrust is also a marketing vehicle. The company sells a platform that scans firmware and infrastructure for known issues; a free public feed builds credibility and steers buyers toward paid products. That's worth keeping in mind when reading its prioritisation calls.

Still, defenders will take useful triage wherever they can find it. The queue of unpatched infrastructure bugs isn't getting shorter.