Milvus
Milvus is an open-source, highly scalable vector database designed to store, index, and manage massive embedding vectors generated by deep neural networks and machine learning models. Originally created by Zilliz and now hosted by the Linux Foundation, Milvus is a foundational component for Retrieval-Augmented Generation (RAG) and generative AI applications.
In the context of cybersecurity, Milvus serves two distinct roles. First, it is a powerful defensive engine that enables security teams to process unstructured data—such as network logs, file hashes, and behavioral patterns—to detect anomalies and identify advanced threats at scale. Second, as a critical infrastructure component in enterprise AI pipelines, an improperly secured Milvus deployment represents a high-value target for threat actors seeking to compromise proprietary AI data or achieve Remote Code Execution (RCE).
Top Cybersecurity Use Cases for Milvus
Security operations centers (SOC) and threat intelligence teams use Milvus to accelerate threat detection and response by moving beyond exact-keyword matching to semantic and pattern-based searches.
Real-Time Malware and Virus Detection: Cybersecurity firms use Milvus to convert known malware signatures and mobile application packages into high-dimensional vectors. When a new, unknown file is scanned, it is vectorized and compared against the database using similarity search to instantly identify variations of existing or obfuscated malware.
Anomaly and Intrusion Detection: By vectorizing network traffic parameters—such as request timing, payload structures, and user input patterns—Milvus can establish a baseline of normal behavior. Incoming HTTP requests that deviate significantly from this baseline or exhibit strong vector similarity to known exploit payloads (e.g., SQL injection) are flagged in real time.
Alert Correlation and Triage: Modern SOCs generate thousands of security alerts daily. Milvus can embed alerts from endpoint detection tools into vectors, incorporating severity, process lineage, and event timing. This allows the system to automatically correlate low-severity alerts into a single massive incident if they share similar vector characteristics, drastically reducing alert fatigue.
Phishing and Fraud Prevention: Security teams use Milvus to analyze permutations of domain names, URL structures, and promotional keywords. By clustering similar events, the database helps identify coordinated phishing campaigns and blocks fraudulent transactions based on semantic similarity to past scams.
Core Security Risks and Known Vulnerabilities
While Milvus empowers defenders, the database itself must be heavily secured. Because it hosts the core memory of an organization's AI agents, a compromised Milvus cluster can enable massive data exfiltration, model poisoning, and complete infrastructure takeover.
Recent critical vulnerabilities highlight the risks associated with exposing Milvus deployments to untrusted networks:
Authentication Bypass (CVE-2025-64513): A critical vulnerability discovered in the Milvus Proxy component allowed unauthenticated attackers to bypass all authentication mechanisms. This granted full administrative access to the cluster, enabling threat actors to read, modify, or delete vector data, or perform privileged administrative operations.
Deserialization Remote Code Execution (CVE-2025-15453): A severe flaw in the expression execution functionality of the Milvus HTTP endpoint. Because of improper input validation, an attacker could send specially crafted serialized payloads to execute arbitrary code remotely on the host server.
Unauthenticated Debug Endpoints (CVE-2026-26190): Vulnerable versions of Milvus exposed specific TCP ports by default for debugging. The endpoint used a predictable default authentication token, and the REST API on the metrics port lacked authentication, allowing attackers to access business operations and manipulate data without credentials.
Best Practices for Securing Milvus Deployments
To safely use Milvus in an enterprise environment, security and infrastructure teams must implement defense-in-depth strategies:
Strict Network Isolation: Never expose the Milvus Proxy or HTTP endpoints to the public internet. Deploy the database within a Virtual Private Cloud (VPC), use strict firewall rules, and place it behind an API gateway or load balancer that sanitizes incoming requests.
Enforce Authentication and Role-Based Access Control (RBAC): Disable default credentials immediately upon installation. Enforce strong authentication for all API and gRPC connections, and use RBAC to ensure that AI applications only have the minimum necessary permissions to query or insert data.
Patch Management: Continuously monitor the Milvus community for security advisories and apply patches immediately. If immediate patching is impossible, apply network-level mitigations, such as dropping specific HTTP headers at the gateway level to prevent exploit delivery.
Data Privacy and Encryption: Vector embeddings can often be reverse-engineered to reveal the sensitive, unstructured data (such as PII or proprietary code) they represent. Ensure that data is encrypted both at rest and in transit using TLS to prevent unauthorized interception.
Frequently Asked Questions (FAQs)
Why use a vector database like Milvus instead of a traditional relational database for security?
Traditional databases rely on scalar values and exact keyword matches, which struggle to identify obfuscated malware or subtle behavioral anomalies. Milvus processes high-dimensional data and performs approximate nearest-neighbor (ANN) searches, enabling it to find threats that are mathematically similar, even if they are not exact matches.
Can Milvus be run on-premises entirely?
Yes. While Milvus is available as a managed cloud service, the open-source version can be deployed entirely on-premises using Docker or Kubernetes. This is critical for cybersecurity teams handling highly sensitive, classified, or regulated data that cannot legally leave the corporate network.
Does Milvus automatically sanitize malicious vectors?
No. Milvus is a storage and retrieval engine. It does not natively analyze whether an inserted vector represents a malicious payload or a safe document. Security teams must implement application-level sanitization and input validation before vectorizing and storing data to prevent model poisoning and adversarial attacks.
How ThreatNG Secures Organizations Against Milvus and Shadow AI Risks
The deployment of vector databases like Milvus is essential for powering modern Retrieval-Augmented Generation (RAG) and generative AI applications. However, when development teams deploy these complex data stores outside of strict corporate governance, they create high-risk "shadow AI" environments. Because Milvus holds the mathematical embeddings of highly sensitive corporate data, an exposed cluster is a lucrative target for attackers seeking to exfiltrate proprietary information or exploit unauthenticated endpoints. ThreatNG acts as an invisible, frictionless engine that secures the external attack surface against these specific risks by continuously mapping the digital footprint, evaluating risk, and seamlessly cooperating with complementary solutions.
External Discovery of Unmanaged Vector Databases
ThreatNG maps an organization's true external attack surface through purely external, unauthenticated discovery, using no connectors. By eliminating the need for internal agents, API keys, or restrictive seed data, ThreatNG identifies the rogue infrastructure that internal security tools are structurally incapable of finding.
When developers bypass corporate IT to install Milvus clusters on external cloud instances or inadvertently expose local server ports, ThreatNG detects these external exposures. It continuously hunts for misconfigured external environments and rogue infrastructure spun up outside the known network, ensuring that no unmanaged AI gateway is left hidden.
Deep Dive: ThreatNG External Assessment
ThreatNG moves beyond basic asset discovery by performing rigorous external assessments that evaluate the definitive risk of the discovered infrastructure from the exact perspective of an unauthenticated attacker.
Detailed examples of ThreatNG’s external assessment capabilities include:
Web Application Hijack Susceptibility: ThreatNG evaluates the presence or absence of key security headers on subdomains, specifically analyzing targets for missing Content-Security-Policy, HTTP Strict-Transport-Security (HSTS), X-Content-Type, and X-Frame-Options headers. This identifies unprotected administrative interfaces or API gateways that attackers could exploit to hijack the AI's data stream.
Cyber Risk Exposure: The platform evaluates all discovered subdomains for exposed ports and private IPs. If an employee misconfigures a Milvus deployment and exposes its API or debugging ports to the public internet, ThreatNG immediately flags this unauthorized external gateway.
Subdomain Takeover Susceptibility: AI experimentation often leaves behind abandoned cloud infrastructure. ThreatNG checks for takeover susceptibility by identifying all associated subdomains and using DNS enumeration to find CNAME records pointing to third-party services. It cross-references the external service hostname against a comprehensive vendor list and performs a specific validation check to determine if the resource is inactive or unclaimed, prioritizing the actual exploit path.
Detailed Investigation Modules
ThreatNG uses specialized investigation modules to extract granular security intelligence, uncovering the specific threats posed by shadow AI applications and vector databases.
Detailed examples of these modules include:
Subdomain Infrastructure Exposure: This module aggressively hunts down the unchecked sprawl of agentic frameworks. It proactively identifies misconfigured Vector Databases (such as Qdrant, Milvus, and Pinecone) to definitively prevent devastating "Knowledge Base Leaks" of proprietary training data.
Sensitive Code Exposure: Because deploying remote databases requires robust authentication, this module deeply scans public code repositories and cloud environments for leaked secrets. It explicitly hunts for exposed API keys, generic credentials, database passwords, and exposed configuration files that a Milvus deployment might have inadvertently leaked.
Technology Stack Investigation: ThreatNG performs an exhaustive, unauthenticated discovery of nearly 4,000 technologies comprising a target's external attack surface. It uncovers the specific vendors and technologies across the digital supply chain, identifying the use of continuous AI model platforms, NoSQL & Search Stores, and cloud infrastructure to map the exact technology footprint that the vector database relies upon.
Reporting and Continuous Monitoring
ThreatNG provides continuous visibility and monitoring of the external attack surface and digital risks. The platform is driven by a policy management engine, DarcRadar, which allows administrators to apply customizable and granular risk configuration and scoring aligned with their specific organizational risk tolerance.
The platform translates complex technical findings into clear Security Ratings ranging from A to F. For instance, the discovery of an exposed, unauthenticated vector database endpoint would lead to a critical downgrade in ratings such as Data Leak Susceptibility and Cyber Risk Exposure. Furthermore, ThreatNG generates External GRC Assessment reports that map these discovered vulnerabilities directly to compliance frameworks like PCI DSS, HIPAA, GDPR, and NIST CSF, providing objective evidence for executive leadership.
Intelligence Repositories (DarCache)
ThreatNG powers its assessments through continuously updated intelligence repositories, collectively known as DarCache.
These repositories include:
DarCache Vulnerability: A strategic risk engine that fuses foundational severity from the National Vulnerability Database (NVD), predictive foresight via the Exploit Prediction Scoring System (EPSS), real-time urgency from Known Exploited Vulnerabilities (KEV), and verified Proof-of-Concept exploits. This ensures that patching efforts for vulnerable Milvus deployments are prioritized based on actual, real-world exploitation trends.
DarCache Dark Web: The first level of the Dark Web archived, normalized, sanitized, and indexed for searching. This allows organizations to safely search for mentions of their brand, compromised credentials, or malicious scripts being traded by threat actors.
DarCache Rupture: A comprehensive database of all organizational emails associated with breaches, providing immediate context if a compromised AI project leaks employee access data.
Cooperation with Complementary Solutions
ThreatNG's highly structured intelligence output serves as a powerful data-enrichment engine, designed to work with complementary solutions. By providing a validated "outside-in" adversary view, it perfectly balances and enhances internal security tools.
ThreatNG actively works with these complementary solutions:
Cyber Asset Attack Surface Management (CAASM): While CAASM acts as the internal "Quartermaster" that inventories known, managed assets within the corporate network, ThreatNG acts as the external "Scout". ThreatNG finds the unmanaged (shadow) estate that API connectors cannot reach, allowing security teams to feed these newly discovered Milvus instances into the CAASM platform for centralized governance.
Cyber Risk Quantification (CRQ): ThreatNG replaces statistical guesses with behavioral facts by feeding real-time indicators of compromise into CRQ models. When ThreatNG detects an exposed Milvus database or an abandoned subdomain related to an AI project, it dynamically adjusts the CRQ platform's "Likelihood" variable based on the company's actual digital behavior, making the financial risk quantification defensible to the board.
Security Monitoring (SIEM/XDR): ThreatNG feeds prioritized technology risk prioritization and confirmed exposure data directly into Vulnerability and Risk Management or Security Monitoring (SIEM/XDR) solutions. If ThreatNG discovers a leaked access token tied to a shadow Milvus cluster, it enriches the internal SIEM alerts with this critical external context, transforming low-priority events into high-fidelity, actionable defense protocols.
Frequently Asked Questions (FAQs)
Does ThreatNG require agents to locate exposed vector databases, such as Milvus?
No, ThreatNG operates on a completely agentless, permissionless basis. It performs purely external, unauthenticated discovery using no connectors to map your digital footprint exactly as an external adversary would see it, without requiring internal access or restrictive seed data.
How does ThreatNG prioritize AI and database vulnerabilities?
ThreatNG prioritizes risks by moving beyond theoretical vulnerabilities. It correlates external technical findings with real-world threat intelligence using DarCache Vulnerability. By integrating NVD severity, EPSS predictive scores, KEV data, and verified Proof-of-Concept exploits, ThreatNG confirms if an exposure is actively exploited, allowing you to prioritize the remediation of critical infrastructure.
Can ThreatNG detect leaked credentials used to connect to vector databases?
Yes. ThreatNG's Sensitive Code Exposure investigation module actively hunts for leaked secrets within public code repositories and cloud environments. It identifies the exposed API keys, generic credentials, database connection strings, and configuration files that attackers require to hijack data pipelines.
