Every vulnerability eventually gets patched. Not every attack gets investigated.
Within hours of a critical vulnerability becoming public, security teams around the world begin the same race. Asset inventories are reviewed, exposure is assessed, emergency maintenance windows are scheduled, and vendors publish advisories urging customers to upgrade immediately. Dashboards fill with CVE identifiers, scanners highlight affected systems, and leadership wants a simple answer: “Are we vulnerable?”
It is an important question, but it is rarely the one that determines whether an organization has already been compromised.
A more difficult question often remains unanswered long after the patches have been deployed.
Was someone already there before we fixed it?
This question sits at the heart of almost every major breach involving Internet-facing infrastructure. By the time a vulnerability becomes public knowledge, threat actors are rarely discovering it for the first time. Many vulnerabilities have already been privately researched, weaponized, or incorporated into automated reconnaissance frameworks. Others move from proof-of-concept to mass exploitation within hours of disclosure. The period between public announcement and enterprise-wide remediation is not simply a patching window it is an opportunity window for attackers.
FortiBleed is a good example of why this distinction matters.
Unlike vulnerabilities that immediately crash services or execute arbitrary code, FortiBleed belongs to a category that often attracts less operational attention but can be equally dangerous: memory disclosure. Instead of forcing a device to run attacker-controlled code, the vulnerability can expose portions of memory that were never intended to leave the application. Depending on the state of the system at that moment, this memory may contain authentication material, configuration fragments, session information, application data, or other sensitive artifacts that provide attackers with valuable intelligence.
Memory disclosure attacks frequently leave the targeted application functioning normally. Users continue accessing VPN portals, administrators log into management consoles without interruption, and CPU utilization remains stable. There is no ransomware note, no encrypted filesystem, and often no obvious operational symptom that encourages immediate investigation.
FortiBleed illustrates a broader trend: attackers increasingly target Internet-facing security infrastructure because these systems terminate encrypted sessions, authenticate users, inspect application traffic, enforce policy, and process highly sensitive information in memory. Whether deployed as VPN gateways, secure web gateways, reverse proxies, or integrated security platforms, these devices become attractive intelligence sources.
Traditional controls each provide valuable visibility, yet each is constrained by the telemetry available to it. Vulnerability scanners identify exposed software versions but cannot determine whether exploitation occurred. SIEM platforms correlate only the logs they receive. Endpoint agents generally cannot inspect proprietary security appliances. Signature-based controls struggle when exploitation evolves faster than signatures.
Every attack, however, communicates. Communication leaves traces.
Applications generate logs according to configuration. Network traffic records reality. Before malware executes, packets move. Before credentials are stolen, packets move. Before ransomware encrypts files, packets have already crossed the network thousands of times. Attackers can delete logs and rotate infrastructure, but they cannot retroactively change packets that have already traversed the wire.
This is why Network Detection and Response has become an essential layer for modern security operations. Rather than relying solely on signatures or host telemetry, NDR observes relationships between communications, identifies behavioral anomalies, and correlates activity across the environment. Automation behaves differently from humans, and those differences become visible in network behavior even when payloads are encrypted.
Metadata is valuable, but during forensic investigations it quickly reaches its limits. Knowing that an external host exchanged HTTPS traffic with an appliance is useful. Knowing the exact request, response, timing, retransmissions, and protocol sequence is significantly more valuable.
Full Packet Capture preserves that evidence. Investigators can reconstruct complete TCP sessions, replay HTTP conversations, validate detection logic retrospectively, and determine exactly how exploitation unfolded. As new threat intelligence emerges, historical packet archives allow analysts to revisit previous traffic without relying solely on retained logs.
Viewed through the lens of NDR, FortiBleed is more than a vulnerability. It demonstrates why behavioral analytics combined with Full Packet Capture provide defenders with capabilities that traditional monitoring alone cannot. Analysts can determine whether a vulnerable system was merely exposed or actively targeted, reconstruct attacker activity, and preserve forensic evidence for incident response.
Vehere combines AI-assisted Network Detection and Response with Full Packet Capture to deliver continuous visibility across the network. Deep packet inspection, behavioral analytics, retrospective investigation, and packet-level evidence enable security teams to move beyond simple alerting and understand exactly what occurred. In an era where memory disclosure vulnerabilities may leave little evidence on the affected system, the network becomes the most reliable witness and Full Packet Capture becomes the foundation for answering the question that matters most: What really happened on the wire?
