If you don't have the professional experience, build it yourself. For the past year I've been using Microsoft Entra ID to manage all objects within my (fictitious) healthcare startup, OSHA, including user accounts, group accounts, devices and applications. OSHA operates across m…
“Tomorrow, 1:00 PM ET: Watch an Attacker Log In Without a Password & Stay In After the Reset” is the kind of headline commonly used to promote a cybersecurity webinar or demonstration focused on identity attacks , particularly attacks that target authentication tokens, sessions,…
A compromised developer account can become a production security incident. Developers routinely work with credentials that connect them to valuable systems: Git repositories. Cloud consoles. CI/CD pipelines. AI coding assistants. Package registries. Databases. Production APIs. I…
“We use passkeys, so phishing can't get us.” I wouldn't be so confident. Passkeys are a major improvement in authentication security. But attackers are adapting around the technology rather than simply attacking the cryptography. Microsoft has documented active campaigns where a…
We spent years securing human users. Now we're creating digital employees that need the same security controls. AI agents are moving beyond answering questions. They're increasingly being given the ability to: → Call APIs → Query databases → Execute code → Access cloud resources…
Schomer — Principal Security Solutions Architect & Founder
Samuel Watua Soita dropped an excellent point recently about how AI is rewriting the economics of phishing. The takeaway is clear: We can no longer train users to spot fakes when the fakes are mathematically perfect copies. Traditional awareness training looks at the perimeter—b…
The next phishing email might not look like phishing at all. For years, security awareness training taught us to look for obvious warning signs: Bad grammar. Strange formatting. Suspicious links. Unusual requests. But AI is changing the economics of social engineering. An attack…
Identity is part of the attack surface. A compromised account is only dangerous because of what that account can access. So during an investigation, don't stop at: “Which account was compromised?” Ask: → What privileges did it have? → What systems could it reach? → What data cou…
OAuth & MCP Investigation Checklist: 4 Steps to Assess Risk As organizations adopt OAuth-connected applications and Model Context Protocol (MCP) integrations, it's important to evaluate how these connections could expose sensitive data or increase attack surface. 1. Inventory Co…
When Machines Act for Us, Integrity Becomes the Security Question Picture a procurement agent asked to cut supplier costs by ten percent. It reads the contracts, finds a cheaper vendor, cancels three standing orders and signs a new agreement before lunch. No attacker was involve…
Cybersecurity is changing — and the attacker doesn't always need malware anymore. One of the most important shifts in the current threat landscape is the move from “break in” to “log in.” Attackers increasingly target: → Stolen credentials → Session tokens and cookies → MFA enro…
Schomer — Principal Security Solutions Architect & Founder
The Changed Locks Paradigm and the Blind Spot of Identity We need to talk about the tactical reality behind the ongoing FortiBleed infrastructure panic. The FBI and Secret Service didn't issue an emergency joint advisory because threat actors are writing complex, flashy zero-day…
North Korean IT workers are using fake identities to get hired by foreign companies. At the same time, fake recruiters are targeting IT professionals through malicious coding assignments and technical interviews. The latest joint advisory from Japanese, US, Australian and German…
CISA Orders Federal Agencies to Patch Four Actively Exploited Zero-Days Within 72 Hours TL;DR: CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting F5 BIG-IP, Arista VeloCloud Orchestrator, and two Check Point pla…
I didn't pick Cloudflare for security. I picked it for caching. Security is just what stuck. New post on how DNS, origin protection, Access, mTLS, and Turnstile turned into an actual architecture decision — and the one feature (WARP) I ditched in 24 hours because it broke my pen…
I was a teacher before I was an auditor. Today GitHub caught me making the same mistake I warn clients about. Got an alert: "Codeanywhere authorized to access your account." I had clicked "Login with GitHub" earlier, then closed the tab. Forgot about it. GitHub did not. My hunte…
Internet Structure, Breaches & Anonymity in OSINT and Cybersecurity: Your Internet Footprint Is Talking: Before an attacker sends a packet, your organization may already be telling a detailed story through public routing data, DNS delegations, certificate logs, peering records,…
Day 1 of Ant Colony Bootcamp: Recruit. You don’t hire access. You hire identity. Recruit Day Day 1 of Ant Colony Bootcamp: Recruit. Before I give any ant a tunnel key, I check: 1. HR ticket exists? 2. manager approved? 3. start date = today? No ticket, no tunnel. That’s NIS2 Art…
Lee Fleming — IAM & GRC Consultant | Identity Governance, Access Control & Security Design
I looked at a small organisation’s Microsoft 365 setup last month. Before admin access was even available, a quick review pointed to around $3,850 to $5,450 a year in potential licensing waste. 5 former staff still had active accounts. 12 Power Automate licences assigned but nev…
Imrane T. — Offensive Security | Attack Chains & Business Logic
Identity-layer exposures rarely trigger alerts. In this case: – GraphQL configuration leakage – Identity-provider mapping exposure – Token issuance inference – API surface discovery Each signal appeared low-risk. Combined, they formed a viable attack path to financial impact. Th…
The Auditor Arrives I’m not in your SIEM. I’m in your anthill. Meet the IAM Auditor Ant 🐜🔍 My job: follow the crumb trail of who got access, when, and why. DORA Art 10 + NIS2 Art 21 both fail on the same thing: no evidence. Today’s 3-minute check: Joiners → account date = HR d…
🚀 Sharing a project I've been working on: ReuNexus AI. This video provides a look at ReuNexus AI, an AI-powered platform I'm developing as part of RemuAI. The project focuses on building practical AI experiences while paying close attention to performance, reliability, user exp…