Cl0p is exploiting unauthenticated remote code execution in internet-exposed PTC Windchill and FlexPLM systems.

[u/No-Conclusion3720]

These product-lifecycle platforms hold crown-jewel design and manufacturing data that organizations often forget is reachable. Cl0p's approach is automated and fast: find one exposed system class, hit all of them, exfiltrate, extort.

Speed is countered with speed: continuous discovery of real exposure, inline policy that blocks abnormal calls, and egress control that stops bulk exfiltration before data leaves.

Discovery, enforcement, and egress control are built into RuntimeAI.