
Ivanti

Working at Ivanti
Company Summary
Overall Rating

On-Par with

Highly rated for 
Work-life balance

Critically rated for
Promotions, Job security
Work Policy




Top Employees Benefits
About Ivanti

Ivanti unifies IT processes and security operations to better manage and secure the digital workplace. For more than three decades, we’ve built our reputation on helping IT professionals fix their security issues and optimize their user experience. Our sought-after systems are some of the best in the industry. From patch and asset management to IT service delivery and security, our software is everything you need to take your IT operations to the next level. We also ensure that supply chains and warehouse teams have the most up-to-date technology in order to perform their essential functions. Follow us for regular expert advice on cybersecurity, IT asset management, IT service management, Windows 10 migration, and much more.

Ivanti Ratings
Overall Rating





Category Ratings
Work-life balance
Company culture
Salary
Work satisfaction
Skill development
Job security
Promotions
Work Policy at Ivanti



Ivanti Reviews
Top mentions in Ivanti Reviews
Compare Ivanti with Similar Companies
![]() | ![]() Change Company | ![]() Change Company | ![]() Change Company | |
---|---|---|---|---|
Overall Rating | 3.7/5 based on 95 reviews | 3.9/5 based on 1.5k reviews | 4.0/5 based on 402 reviews | 3.1/5 based on 485 reviews |
Highly Rated for | Work-life balance | Work-life balance Job security Company culture | ![]() No highly rated category | ![]() No highly rated category |
Critically Rated for | Promotions Job security | ![]() No critically rated category | Promotions Company culture | Job security Promotions Skill development |
Primary Work Policy | Hybrid 74% employees reported | Work from office 38% employees reported | - | Work from office 65% employees reported |
Rating by Women Employees | 3.4 Average rated by 16 women | 3.7 Good rated by 192 women | 3.6 Good rated by 34 women | 2.9 Poor rated by 172 women |
Rating by Men Employees | 3.7 Good rated by 74 men | 3.9 Good rated by 1.2k men | 4.1 Good rated by 352 men | 3.2 Average rated by 300 men |
Job security | 3.1 Average | 4.0 Good | 3.4 Average | 2.7 Poor |
Ivanti Salaries
Senior Software Engineer

Software Engineer

Staff Software Engineer

Technical Solutions Engineer

Associate Software Engineer

Staff Engineer

Software Engineer2

Principal Software Engineer

Senior Software Engineer Testing

Software Developer

Ivanti Interview Questions
Ivanti Jobs
Ivanti News
French government hit by Chinese hackers exploiting Ivanti security flaws
- Chinese state-sponsored threat actors exploited three zero-day vulnerabilities in Ivanti CSA solutions to access French government agencies and other commercial entities such as telcos, finance, and transportation organizations.
- The attackers abused the vulnerabilities to steal login credentials and establish persistence on target endpoints, using techniques like deploying PHP web shells and installing kernel modules acting as a rootkit.
- The attacks were attributed to a group named Houken, known for exploiting vulnerabilities in SAP NetWeaver previously, and sold the gained access to French government devices, believed to be targeting valuable intelligence and sensitive data.
- The French National Agency for the Security of Information Systems (ANSSI) confirmed the breaches, linking the attacks to Chinese state-sponsored actors, while noting the group Houken had targeted various sectors beyond Western entities.

VPN Vulnerabilities You Should Know About in 2025
- VPNs are facing increasing vulnerabilities in both consumer and corporate settings, with hackers exploiting weaknesses regularly.
- In April 2025, CVE-2025-22457, a critical stack-based buffer overflow vulnerability, was identified in Ivanti Connect Secure and Pulse Connect Secure VPN appliances.
- This vulnerability was previously considered non-exploitable but was discovered to be weaponizable by a Chinese APT group.
- CVE-2024-53704 is an authentication bypass vulnerability in SonicWall SSL VPN, allowing remote attackers to hijack active VPN sessions.
- Ivanti disclosed CVE-2025-0282 and CVE-2025-0283, critical stack-based buffer overflows enabling remote code execution and local privilege escalation.
- A DoS vulnerability (CVE-2025-20212) affecting Cisco Meraki AnyConnect VPN servers requires valid user credentials to exploit.
- X41 D-Sec GmbH found a critical vulnerability (CVE-2024-55884) in the Mullvad VPN application, leading to memory corruption and out-of-bounds writes.
- The identified vulnerabilities highlight the ongoing risks associated with VPNs, making them attractive targets for cyber threats.
- A VPN hacking training is scheduled for June 2025 to address these emerging threats.

NHS trusts hit by cyber attack, patient data feared stolen
- NHS trusts in the UK have experienced a cyberattack leading to concerns about patient data being stolen.
- University College London Hospitals NHS Foundation Trust and University Hospital Southampton NHS Foundation Trust were affected by a software vulnerability.
- The cyberattack exploited a vulnerability in Ivanti Endpoint Manager Mobile software, potentially exposing patient records and sensitive information.
- Hackers with an IP address based in China were identified. NHS England and cybersecurity partners are investigating the incident.

China-linked APT UNC5221 started exploiting Ivanti EPMM flaws shortly after their disclosure
- China-linked APT group exploits two Ivanti EPMM flaws, CVE-2025-4427 and CVE-2025-4428, to target organizations in Europe, North America, and Asia-Pacific.
- The flaws include an authentication bypass and a remote code execution vulnerability, allowing attackers to access protected resources and execute arbitrary code.
- Ivanti has released updates addressing the vulnerabilities after threat actors actively exploited them to achieve remote code execution without authentication.
- The attacks are linked to China-linked group UNC5221, which targeted critical sectors and used techniques like Java Reflection and KrustyLoader malware for espionage campaigns.

Ivanti makes dedicated fans of Chinese spies who just can't resist attacking its buggy kit
- Chinese government spy group suspected behind attacks exploiting two Ivanti bugs allowing unauthenticated remote code execution.
- Attacks targeted organizations in healthcare, telecommunications, aviation, government, finance, defense sectors across Europe, North America, and Asia-Pacific.
- Ivanti products affected by CVE-2025-4427 and CVE-2025-4428 allowing malware execution on vulnerable deployments.
- UNC5221 group linked to previous Ivanti attacks exploited bugs. Recent incidents involve cloud-hosted virtual appliances, with ongoing exploitation.

U.S. CISA adds a Samsung MagicINFO 9 Server flaw to its Known Exploited Vulnerabilities catalog
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Samsung MagicINFO 9 Server vulnerability, tracked as CVE-2025-4632 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
- The vulnerability is an improper limitation of a pathname to a restricted directory vulnerability that impacts Samsung MagicINFO 9 Server version before 21.1052, allowing attackers to write arbitrary files as system authority.
- CISA issued Binding Operational Directive (BOD) 22-01 to address identified vulnerabilities by June 12, 2025, for Federal Civilian Executive Branch (FCEB) agencies, urging private organizations to review the Catalog and address vulnerabilities in their infrastructure.
- This week, CISA also added Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog.

'Ongoing' Ivanti hijack bug exploitation reaches clouds
- Ongoing exploitation of Ivanti bugs extends to customers' cloud instances beyond on-premises environments.
- Two critical bugs, CVE-2025-4427 and CVE-2025-4428, allow attackers to run malware and hijack vulnerable deployments in Ivanti Endpoint Manager Mobile (EPMM).
- Proof-of-concept exploits for these vulnerabilities are circulating, emphasizing the urgency to patch the affected systems.
- US govt's CISA added both bugs to its Known Exploited Vulnerabilities Catalog, considering them critical when combined. Exploitation involves deploying malicious payloads, including the remote-control program Sliver.

CVE-2025-4427 and CVE-2025-4428 Detection: Ivanti EPMM Exploit Chain Leading to RCE
- Two new security flaws, CVE-2025-4427 and CVE-2025-4428, in Ivanti Endpoint Manager Mobile (EPMM) software have been discovered, allowing for remote code execution without authentication.
- The importance of proactive threat detection in light of the increasing number of vulnerabilities, as seen with over 18,000 logged by NIST in the first half of 2025, is emphasized.
- Ivanti has addressed the vulnerabilities in the API component of EPMM software, where CVE-2025-4427 is an authentication bypass, and CVE-2025-4428 is an RCE flaw, impacting on-premises EPMM instances.
- Defenders recommend applying the available patches to mitigate the risks associated with CVE-2025-4427 and CVE-2025-4428, found in EPMM versions up to 12.5.0.0.

Shrink exploit windows, slash MTTP: Why ring deployment is now a must for enterprise defense
- Unpatched systems pose a significant risk, with many breaches being preventable through available patches, according to cyberattack victims.
- Organizations take 43 days on average to detect cyberattacks after a patch is released, leading to increased vulnerability exploitation by attackers.
- Manual or partially automated patching processes are burdensome, pushing patching down on teams' priority lists.
- Legacy vulnerabilities are aggressively exploited by attackers, with some vulnerabilities being over a decade old.
- Misalignment between IT and security teams delays patching, with many lacking cohesive patch strategies and disagreeing on patch schedules.
- Ring deployment offers a phased, automated strategy to minimize breach risks and reduce disruptions in patch management.
- Ivanti's ring deployment provides greater control over patch deployment, aiming to address patching issues early and minimize risks.
- Combining ring deployment with dynamic VRR technology reduces Mean-Time-to-Patch (MTTP) and exposure windows for attackers.
- Patching must be complemented with compensating controls like EPP and network segmentation to reinforce security beyond basic patching.
- Ivanti Neurons for Patch Management integrates risk assessments, ring deployments, and automated workflows to enhance enterprise patch management.
- Integrating ring deployment with compensating controls transforms patch management into a strategic advantage, improving cyber risk management.

Shrink exploit windows, slash MTTP: Why ring deployment is now a must for enterprise defense
- Unpatched systems pose a significant risk, with available patches seen as crucial in preventing breaches.
- Organizations take an average of 43 days to detect cyberattacks post-patch release, leading to increased vulnerability exploitation.
- Manual and partially automated patching systems are deemed burdensome, reducing emphasis on patching.
- Legacy vulnerabilities are exploited by attackers, with some CVEs being over 10 years old.
- Challenges in manual patch management are exacerbated by IT-security misalignment and an increasing patch backlog.
- Ring deployment offers a phased, automated strategy to minimize breach risks and vulnerabilities.
- Automation of patch management aims to bridge the gap between IT and security teams, improving efficiency.
- Enterprise struggles to keep pace with patching, leading to increased risk as attackers target legacy vulnerabilities.
- Ring deployment, exemplified by Ivanti Neurons, achieves a high success rate in patch deployment within 24 hours.
- Combining ring deployment with dynamic VRR technology reduces Mean-Time-to-Patch and exposure windows for attackers.


Compare Ivanti with




















Contribute & help others!
Companies Similar to Ivanti












Ivanti FAQs


Reviews
Interviews
Salaries
Users

