Broadcom Company Cyber Security Posture
broadcom.comA global infrastructure technology leader built on more than 60 years of innovation, collaboration and engineering excellence.
Broadcom Company Details
broadcom
57691 employees
544017.0
334
Semiconductor Manufacturing
broadcom.com
367
BRO_3083730
In-progress
Broadcom Risk Score (AI oriented)Between 900 and 1000
This score is AI-generated and less favored by cyber insurers, who prefer the TPRM score.
Broadcom Global Score.png)
Broadcom Company Scoring based on AI Models
| Model Name | Date | Description | Current Score Difference | Score |
|---|---|---|---|---|
| AVERAGE-Industry | 03-12-2025 | This score represents the average cybersecurity rating of companies already scanned within the same industry. It provides a benchmark to compare an individual company's security posture against its industry peers. | N/A | Between 900 and 1000 |
Broadcom Company Cyber Security News & History
| Entity | Type | Severity | Impact | Seen | Url ID | Details | View |
|---|---|---|---|---|---|---|---|
| Symantec | Breach | 60 | 3 | 02/2019 | SYM1336271222 | Link | |
Rankiteo Explanation : Attack with significant impact with internal employee data leaksDescription: Security firm Symantec was attacked by a hacker back in February 2021 in which the hackers extracted some of the data. This comprises not only passwords but a list of Symantec clients -- including government agencies. The hacker was able to access a list of clients using Symantec's CloudSOC services, account managers and account numbers. | |||||||
| Symantec | Vulnerability | 60 | 3 | 06/2016 | SYM44121823 | Link | |
Rankiteo Explanation : Attack with significant impact with internal employee data leaksDescription: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel. | |||||||
| Broadcom | Ransomware | 100 | 4 | 5/2025 | BRO325051825 | Link | |
Rankiteo Explanation : Attack with significant impact with customers data leaksDescription: A ransomware attack at a Middle Eastern business partner of payroll company ADP has led to customer data theft at Broadcom. The HR department has begun informing affected current and former staff. The attack, claimed by the El Dorado ransomware group, resulted in the compromise of personal data including National ID numbers, financial account numbers, and personal contact information. The data was made available on the internet, affecting 560 users and potentially opening up the attack surface to 35 additional companies. Broadcom urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity. | |||||||
| Broadcom | Vulnerability | 25 | 1 | 7/2025 | BRO809071525 | Link | |
Rankiteo Explanation : Attack without any consequencesDescription: A critical security vulnerability has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure. The flaw, designated CVE-2025-5333 with a severe CVSS v4.0 score of 9.5, affects multiple versions of the widely-deployed endpoint management solution and has prompted immediate mitigation recommendations from security experts. The vulnerability resides in the Symantec Altiris Inventory Rule Management (IRM) component, specifically targeting an exposed legacy .NET Remoting endpoint. | |||||||
Broadcom Company Subsidiaries
A global infrastructure technology leader built on more than 60 years of innovation, collaboration and engineering excellence.
Access Data Using Our API
Get company history
Rapid.png)
Broadcom Cyber Security News
3 Top Cybersecurity Stocks to Buy in July
Three of the best cybersecurity stocks you can buy in July are Check Point Software Technologies (CHKP 1.93%), International Business Machines ( ...
Broadcom 2024 Partner Awards
We're pleased to announce our Broadcom Partner Awards, where we recognize key partners for their accomplishments and contributions in 2024.
Broadcom urges customers to patch 3 zero-day VMware flaws
Cyberattackers with administrative access are actively exploiting vulnerabilities in ESXi, Workstation and Fusion products.
Broadcom Inc.
Broadcom's story is more than one of innovation: It's a narrative of bold acquisitions, regulatory scrutiny, and efforts to shape the technologies of tomorrow.
CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database
CISA on Monday added two high-severity security flaws impacting Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV ...
Google Cloud and Broadcom reshape AI network security
Google Cloud and Broadcom usher in the AI-driven future of network security, with security service edge and Google Cloud WAN in tow.
Broadcom Unveils AI-Powered Cybersecurity Tool To Disrupt Hackers And Boost Resilience
On Tuesday, Broadcom Inc (NASDAQ:AVGO) announced Incident Prediction, a security capability that extends Adaptive Protection, ...
3 Cybersecurity ETFs To Gain Ground As Threats Go Malware-Free, China Gets Bolder
The CrowdStrike 2025 Global Threat Report is a thriller read. Investors can ride this wave with cybersecurity ETFs like CIBR, HACK, BUG.
CISA tags Broadcom Fabric OS, CommVault flaws as exploited in attacks
CISA is warning of Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients vulnerabilities that are actively exploited in attacks.
Broadcom Similar Companies
Applied Materials
Applied Materials is the leader in materials engineering solutions used to produce virtually every new chip and advanced display in the world. Our expertise in modifying materials at atomic levels enables customers to transform possibilities into reality. These materials engineering solutions are th
Qimonda
Qimonda AG (NYSE: QI) is a leading global memory supplier with a broad diversified DRAM product portfolio. The company generated net sales of Euro 3.61 billion in financial year 2007 and had approximately 13,500 employees worldwide. Qimonda has access to four 300mm manufacturing sites on three conti
MediaTek
MediaTek Incorporated (TWSE: 2454) is a global fabless semiconductor company that enables nearly 2 billion connected devices a year. We are a market leader in developing innovative systems-on-chip (SoC) for mobile, home entertainment, connectivity and IoT products. Our dedication to innovation has p
AMD
We care deeply about transforming lives with AMD technology to enrich our industry, our communities, and the world. Our mission is to build great products that accelerate next-generation computing experiences – the building blocks for the data center, artificial intelligence, PCs, gaming and embedde
ASML
Who are we? ASML is an innovation leader in the global semiconductor industry. We make machines that chipmakers use to mass produce microchips. Founded in 1984 in the Netherlands with just a handful of employees, we’ve now grown to over 40,000 employees, 143 nationalities and more than 60 locations
NXP Semiconductors
We anticipate tomorrow’s needs—navigating a changing world by bringing together technology's brightest minds to build game-changing solutions that propel us forward. NXP Semiconductors N.V. (NASDAQ: NXPI) is the trusted partner for innovative solutions in the automotive, industrial & IoT, mobile, an
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Broadcom CyberSecurity History Information
How many cyber incidents has Broadcom faced?
Total Incidents: According to Rankiteo, Broadcom has faced 4 incidents in the past.
What types of cybersecurity incidents have occurred at Broadcom?
Incident Types: The types of cybersecurity incidents that have occurred incidents Vulnerability, Ransomware and Breach.
How does Broadcom detect and respond to cybersecurity incidents?
Detection and Response: The company detects and responds to cybersecurity incidents through containment measures with Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service and remediation measures with Limit .NET Remoting access to localhost-only in upcoming releases and communication strategy with Urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity.
Incident Details
Can you provide details on each incident?
Incident : Vulnerability
Title: Critical Security Vulnerability in Broadcom’s Symantec Endpoint Management Suite
Description: A critical security vulnerability (CVE-2025-5333) has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure.
Date Detected: May 2025
Type: Vulnerability
Attack Vector: Unauthenticated Remote Code Execution (RCE)
Vulnerability Exploited: CVE-2025-5333
Incident : Ransomware
Title: Ransomware Attack at Broadcom via Middle Eastern Business Partner
Description: A ransomware attack at a Middle Eastern business partner of payroll company ADP has led to customer data theft at Broadcom. The HR department has begun informing affected current and former staff. The attack, claimed by the El Dorado ransomware group, resulted in the compromise of personal data including National ID numbers, financial account numbers, and personal contact information. The data was made available on the internet, affecting 560 users and potentially opening up the attack surface to 35 additional companies. Broadcom urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity.
Type: Ransomware
Attack Vector: Ransomware
Threat Actor: El Dorado ransomware group
Motivation: Data theft and ransom
Incident : Vulnerability Exploit
Title: Symantec and Norton Vulnerabilities Identified by Tavis Ormandy
Description: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel.
Type: Vulnerability Exploit
Attack Vector: Executable File
Vulnerability Exploited: File Decompression in Kernel
Motivation: Data Theft
Incident : Data Breach
Title: Symantec Data Breach
Description: Security firm Symantec was attacked by a hacker in February 2021, resulting in the extraction of data including passwords and a list of Symantec clients, including government agencies.
Date Detected: 2021-02-01
Type: Data Breach
What are the most common types of attacks the company has faced?
Common Attack Types: The most common types of attacks the company has faced is Vulnerability.
How does the company identify the attack vectors used in incidents?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Port 4011 and Executable File.
Impact of the Incidents
What was the impact of each incident?
Incident : Vulnerability BRO809071525
Systems Affected: Symantec Endpoint Management Suite 8.6.x-8.8
Incident : Ransomware BRO325051825
Data Compromised: National ID numbers, financial account numbers, personal contact information
Identity Theft Risk: True
Payment Information Risk: True
Incident : Vulnerability Exploit SYM44121823
Systems Affected: Symantec Enterprise Products
Incident : Data Breach SYM1336271222
Data Compromised: passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers, account numbers
What types of data are most commonly compromised in incidents?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are National ID numbers, financial account numbers, personal contact information, passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers and account numbers.
Which entities were affected by each incident?
Response to the Incidents
What measures were taken in response to each incident?
Incident : Vulnerability BRO809071525
Containment Measures: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service
Remediation Measures: Limit .NET Remoting access to localhost-only in upcoming releases
Incident : Ransomware BRO325051825
Communication Strategy: Urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity
Data Breach Information
What type of data was compromised in each breach?
Incident : Ransomware BRO325051825
Type of Data Compromised: National ID numbers, financial account numbers, personal contact information
Number of Records Exposed: 560
Sensitivity of Data: High
Data Exfiltration: True
Personally Identifiable Information: True
Incident : Data Breach SYM1336271222
Type of Data Compromised: passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers, account numbers
Data Exfiltration: True
What measures does the company take to prevent data exfiltration?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Limit .NET Remoting access to localhost-only in upcoming releases.
How does the company handle incidents involving personally identifiable information (PII)?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through were Block port 4011 on firewalls and Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service.
Ransomware Information
Was ransomware involved in any of the incidents?
Lessons Learned and Recommendations
What recommendations were made to prevent future incidents?
Incident : Vulnerability BRO809071525
Recommendations: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases
What recommendations has the company implemented to improve cybersecurity?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases.
References
Where can I find more information about each incident?
Incident : Vulnerability BRO809071525
Source: Broadcom PSIRT
Incident : Vulnerability BRO809071525
Source: LRQA security researchers
Where can stakeholders find additional resources on cybersecurity best practices?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Broadcom PSIRT, and Source: LRQA security researchers.
Investigation Status
How does the company communicate the status of incident investigations to stakeholders?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through was Urged affected individuals to enable multi-factor authentication and monitor financial records for unauthorized activity.
Initial Access Broker
How did the initial access broker gain entry for each incident?
Incident : Vulnerability BRO809071525
Entry Point: Port 4011
Incident : Vulnerability Exploit SYM44121823
Entry Point: Executable File
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident?
Incident : Vulnerability BRO809071525
Root Causes: Insecure deserialization of .NET objects through the BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full
Corrective Actions: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases
What corrective actions has the company taken based on post-incident analysis?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases.
Additional Questions
General Information
Who was the attacking group in the last incident?
Last Attacking Group: The attacking group in the last incident was an El Dorado ransomware group.
Incident Details
What was the most recent incident detected?
Most Recent Incident Detected: The most recent incident detected was on May 2025.
Impact of the Incidents
What was the most significant data compromised in an incident?
Most Significant Data Compromised: The most significant data compromised in an incident were National ID numbers, financial account numbers, personal contact information, passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers and account numbers.
What was the most significant system affected in an incident?
Most Significant System Affected: The most significant system affected in an incident was Symantec Endpoint Management Suite 8.6.x-8.8 and Symantec Enterprise Products.
Response to the Incidents
What containment measures were taken in the most recent incident?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Block port 4011 on firewalls and Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service.
Data Breach Information
What was the most sensitive data compromised in a breach?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were National ID numbers, financial account numbers, personal contact information, passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers and account numbers.
What was the number of records exposed in the most significant breach?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 560.0.
Lessons Learned and Recommendations
What was the most significant recommendation implemented to improve cybersecurity?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases.
References
What is the most recent source of information about an incident?
Most Recent Source: The most recent source of information about an incident are Broadcom PSIRT and LRQA security researchers.
Initial Access Broker
What was the most recent entry point used by an initial access broker?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Port 4011 and Executable File.
What Do We Measure?
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
