[{"data":1,"prerenderedAt":32410},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-casb":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,4943,8699,11825,13191,19318,21947,25165,27659,29354,30606,31576],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1864,"faqTitle":2052,"featured":6,"hashTags":59,"meta":2053,"metaTitle":2054,"ogImage":59,"postType":59,"publishedDate":2055,"relatedBlogPostsCollection":2056,"slug":4882,"stem":4883,"subtitle":4884,"summary":4885,"synopsis":4895,"sys":4896,"tagsCollection":4899,"topicsCollection":4908,"__hash__":4942},"blog/blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps.json","Shadow AI: how to discover, govern, and secure AI apps",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Kelly Davenport","Kelly","Product Team",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"json":855,"links":1710},{"nodeType":856,"data":857,"content":858},"document",{},[859,868,875,926,933,940,995,1004,1008,1017,1024,1036,1042,1054,1060,1072,1078,1081,1089,1096,1115,1126,1133,1140,1143,1151,1158,1183,1189,1196,1212,1228,1234,1250,1266,1273,1280,1287,1293,1296,1304,1311,1319,1326,1342,1349,1374,1380,1387,1393,1405,1412,1418,1424,1427,1435,1442,1461,1468,1476,1483,1495,1511,1517,1529,1563,1570,1586,1592,1608,1615,1622,1625,1633,1640,1647,1654,1661,1668,1675,1678,1685,1692],{"nodeType":860,"data":861,"content":862},"paragraph",{},[863],{"nodeType":864,"value":865,"marks":866,"data":867},"text","Every security team that's blocked an AI tool at the network level has had the same experience three months later: The tool they blocked isn't in use, but a dozen they've never heard of are.",[],{},{"nodeType":860,"data":869,"content":870},{},[871],{"nodeType":864,"value":872,"marks":873,"data":874},"The block didn't stop employees from using AI. It just prevented the security team from seeing what’s actually happening.",[],{},{"nodeType":860,"data":876,"content":877},{},[878,882,891,895,901,905,910,914,922],{"nodeType":864,"value":879,"marks":880,"data":881},"The data backs up this pattern. ",[],{},{"nodeType":883,"data":884,"content":886},"hyperlink",{"uri":885},"https://pushsecurity.com/blog/what-push-data-reveals-about-the-state-of-shadow-ai/",[887],{"nodeType":864,"value":888,"marks":889,"data":890},"Push telemetry",[],{},{"nodeType":864,"value":892,"marks":893,"data":894}," shows that the average organization has ",[],{},{"nodeType":864,"value":896,"marks":897,"data":900},"16 AI apps, 17 AI browser extensions,",[898],{"type":899},"bold",{},{"nodeType":864,"value":902,"marks":903,"data":904}," and ",[],{},{"nodeType":864,"value":906,"marks":907,"data":909},"17 AI OAuth integrations",[908],{"type":899},{},{"nodeType":864,"value":911,"marks":912,"data":913}," in active use during a typical week — most unapproved. Meanwhile, ",[],{},{"nodeType":883,"data":915,"content":917},{"uri":916},"https://www.okta.com/newsroom/articles/ai-agents-at-work-2026-agentic-enterprise-security/",[918],{"nodeType":864,"value":919,"marks":920,"data":921},"Okta found",[],{},{"nodeType":864,"value":923,"marks":924,"data":925}," that 80% of employees who use unapproved AI tools do so because it's easier to use their own accounts, and 57% because the approval process is too slow.",[],{},{"nodeType":860,"data":927,"content":928},{},[929],{"nodeType":864,"value":930,"marks":931,"data":932},"The organizations getting this right have stopped treating AI governance as an access-control problem — which tools to allow, which to block — and started treating it as an invitation to build out an infrastructure to enable appropriate use. Employees are going to use the tools they need to get their work done. The question is whether they'll use them on a path you built and instrumented, or on one they carved themselves.",[],{},{"nodeType":860,"data":934,"content":935},{},[936],{"nodeType":864,"value":937,"marks":938,"data":939},"This guide walks through how to build that paved path. Using Push, you can:",[],{},{"nodeType":941,"data":942,"content":943},"unordered-list",{},[944,955,965,975,985],{"nodeType":945,"data":946,"content":947},"list-item",{},[948],{"nodeType":860,"data":949,"content":950},{},[951],{"nodeType":864,"value":952,"marks":953,"data":954},"Identify shadow AI, including personal accounts on approved corporate apps, AI browser extensions, OAuth integrations into sensitive systems, and AI browser usage.",[],{},{"nodeType":945,"data":956,"content":957},{},[958],{"nodeType":860,"data":959,"content":960},{},[961],{"nodeType":864,"value":962,"marks":963,"data":964},"Enforce policies on data flows into and out of AI apps, including blocking unapproved file uploads, downloads, and clipboard pastes; and monitoring AI chat transcripts.",[],{},{"nodeType":945,"data":966,"content":967},{},[968],{"nodeType":860,"data":969,"content":970},{},[971],{"nodeType":864,"value":972,"marks":973,"data":974},"Use just-in-time guardrails to intercept users accessing unapproved AI tools and point them at approved alternatives.",[],{},{"nodeType":945,"data":976,"content":977},{},[978],{"nodeType":860,"data":979,"content":980},{},[981],{"nodeType":864,"value":982,"marks":983,"data":984},"Prevent unwanted MCP connections with app-agnostic controls.",[],{},{"nodeType":945,"data":986,"content":987},{},[988],{"nodeType":860,"data":989,"content":990},{},[991],{"nodeType":864,"value":992,"marks":993,"data":994},"Automate a lot of the work so you don’t burn out your team as the AI landscape continues to shift.",[],{},{"nodeType":996,"data":997,"content":1003},"embedded-entry-block",{"target":998},{"sys":999},{"id":1000,"type":1001,"linkType":1002},"29N8YH9As3GHypOve3br80","Link","Entry",[],{"nodeType":1005,"data":1006,"content":1007},"hr",{},[],{"nodeType":1009,"data":1010,"content":1011},"heading-1",{},[1012],{"nodeType":864,"value":1013,"marks":1014,"data":1016},"What is shadow AI, and why can't you manage it like shadow IT?",[1015],{"type":899},{},{"nodeType":860,"data":1018,"content":1019},{},[1020],{"nodeType":864,"value":1021,"marks":1022,"data":1023},"Shadow AI is any use of AI tools, services, or integrations that happens outside an organization's security governance and visibility. Security teams have been managing shadow SaaS for years, but shadow AI can't be addressed with the same playbook — for three reasons.",[],{},{"nodeType":860,"data":1025,"content":1026},{},[1027,1032],{"nodeType":864,"value":1028,"marks":1029,"data":1031},"First",[1030],{"type":899},{},{"nodeType":864,"value":1033,"marks":1034,"data":1035},", it spans multiple categories that each need different controls: unapproved AI apps, personal accounts on approved corporate AI tools, AI browser extensions, and OAuth integrations into corporate systems. Blocking unapproved apps doesn't address personal accounts on approved ones, and neither solves the extension or OAuth problem. ",[],{},{"nodeType":996,"data":1037,"content":1041},{"target":1038},{"sys":1039},{"id":1040,"type":1001,"linkType":1002},"2hsKQ9DEspflhmtR0bE7QY",[],{"nodeType":860,"data":1043,"content":1044},{},[1045,1050],{"nodeType":864,"value":1046,"marks":1047,"data":1049},"Second",[1048],{"type":899},{},{"nodeType":864,"value":1051,"marks":1052,"data":1053},", the tools most organizations rely on to manage shadow SaaS — SWGs, CASBs, EDR, IdP logs — are structurally blind to shadow AI. An SWG sees that someone visited an AI domain but can't tell you whether they logged in, pasted source code into a prompt, or granted OAuth access to your Google Workspace tenant. EDR doesn't see browser-layer activity at all. IdP logs capture OAuth grants routed through the identity provider but miss tools accessed via direct signup or personal accounts. Instead, the activity security teams need to see happens primarily inside the browser.",[],{},{"nodeType":996,"data":1055,"content":1059},{"target":1056},{"sys":1057},{"id":1058,"type":1001,"linkType":1002},"1vE0dyAKdnTSjyAJ4Xoadd",[],{"nodeType":860,"data":1061,"content":1062},{},[1063,1068],{"nodeType":864,"value":1064,"marks":1065,"data":1067},"Third",[1066],{"type":899},{},{"nodeType":864,"value":1069,"marks":1070,"data":1071},", the risk profile is different. Shadow AI tools increasingly function as hubs — connected via OAuth integrations and MCP to email, cloud storage, code repositories, and other high-value systems. They leak sensitive data outward (employees paste source code, credentials, and internal documents into prompts daily) while simultaneously expanding the attack surface inward (compromise a single AI app and an attacker inherits whatever access the employee granted it, turning one ungoverned tool into a pivot point across the SaaS estate). ",[],{},{"nodeType":996,"data":1073,"content":1077},{"target":1074},{"sys":1075},{"id":1076,"type":1001,"linkType":1002},"3ldZ23OORTu7INBfSnE7R7",[],{"nodeType":1005,"data":1079,"content":1080},{},[],{"nodeType":1009,"data":1082,"content":1083},{},[1084],{"nodeType":864,"value":1085,"marks":1086,"data":1088},"Why blocking AI usage fails",[1087],{"type":899},{},{"nodeType":860,"data":1090,"content":1091},{},[1092],{"nodeType":864,"value":1093,"marks":1094,"data":1095},"The instinct to block AI tools makes sense. Executives are asking about AI risk to the business, a new tool appears every week, and blocking unapproved apps feels like a quick way to stop the bleeding.",[],{},{"nodeType":860,"data":1097,"content":1098},{},[1099,1103,1111],{"nodeType":864,"value":1100,"marks":1101,"data":1102},"Unfortunately, blocking doesn't work for long. The latest security frameworks — including the ",[],{},{"nodeType":883,"data":1104,"content":1106},{"uri":1105},"https://www.sans.org/mlp/2026-ai-security-maturity-model-ebook",[1107],{"nodeType":864,"value":1108,"marks":1109,"data":1110},"SANS AI Security Maturity Model",[],{},{"nodeType":864,"value":1112,"marks":1113,"data":1114}," — all agree: Block-based AI policies drive usage underground rather than preventing it. ",[],{},{"nodeType":1116,"data":1117,"content":1118},"blockquote",{},[1119],{"nodeType":860,"data":1120,"content":1121},{},[1122],{"nodeType":864,"value":1123,"marks":1124,"data":1125},"A block-based AI policy may feel like risk management, but practitioner experience shows that it typically drives AI usage underground rather than preventing it. The goal is not to eliminate AI use; it is to bring it into visibility where it can be governed.",[],{},{"nodeType":860,"data":1127,"content":1128},{},[1129],{"nodeType":864,"value":1130,"marks":1131,"data":1132},"These kinds of barricades also fail for a structural reason: They're built on the network perimeter, and AI usage doesn't cross the perimeter in ways network tools can inspect.",[],{},{"nodeType":860,"data":1134,"content":1135},{},[1136],{"nodeType":864,"value":1137,"marks":1138,"data":1139},"The most damaging consequence of blocking isn't the workarounds themselves — it's the loss of visibility. To begin building a better path for employees, you have to start with seeing what's actually happening.",[],{},{"nodeType":1005,"data":1141,"content":1142},{},[],{"nodeType":1009,"data":1144,"content":1145},{},[1146],{"nodeType":864,"value":1147,"marks":1148,"data":1150},"Using Push to discover, govern, and control shadow AI",[1149],{"type":899},{},{"nodeType":860,"data":1152,"content":1153},{},[1154],{"nodeType":864,"value":1155,"marks":1156,"data":1157},"Push Security is a browser security platform that gets you the vantage point you need to start addressing shadow AI. Push deploys as a lightweight extension to employees' existing browsers rather than requiring a full browser migration, giving security teams visibility into browser-layer activity that network and endpoint tools structurally lack.",[],{},{"nodeType":860,"data":1159,"content":1160},{},[1161,1165,1170,1174,1179],{"nodeType":864,"value":1162,"marks":1163,"data":1164},"Push discovers AI tools through ",[],{},{"nodeType":864,"value":1166,"marks":1167,"data":1169},"automatic",[1168],{"type":899},{},{"nodeType":864,"value":1171,"marks":1172,"data":1173}," ",[],{},{"nodeType":864,"value":1175,"marks":1176,"data":1178},"app discovery",[1177],{"type":899},{},{"nodeType":864,"value":1180,"marks":1181,"data":1182},", allowing you to identify applications from actual browser login events rather than network traffic logs. ",[],{},{"nodeType":996,"data":1184,"content":1188},{"target":1185},{"sys":1186},{"id":1187,"type":1001,"linkType":1002},"4eTkgU2dxhMueHPiwuCWDl",[],{"nodeType":860,"data":1190,"content":1191},{},[1192],{"nodeType":864,"value":1193,"marks":1194,"data":1195},"When an employee signs into a new AI service, Push registers the authentication event, identifies the application, and logs how the employee authenticated — corporate SSO, OIDC, a standalone password, or a personal account. ",[],{},{"nodeType":860,"data":1197,"content":1198},{},[1199,1203,1208],{"nodeType":864,"value":1200,"marks":1201,"data":1202},"Push then applies ",[],{},{"nodeType":864,"value":1204,"marks":1205,"data":1207},"app categories ",[1206],{"type":899},{},{"nodeType":864,"value":1209,"marks":1210,"data":1211},"automatically, classifying the discovered application by type without requiring security teams to build or maintain manual lists.",[],{},{"nodeType":860,"data":1213,"content":1214},{},[1215,1219,1224],{"nodeType":864,"value":1216,"marks":1217,"data":1218},"Push extends the same discovery across the other three shadow AI dimensions. The platform’s ",[],{},{"nodeType":864,"value":1220,"marks":1221,"data":1223},"browser extension discovery ",[1222],{"type":899},{},{"nodeType":864,"value":1225,"marks":1226,"data":1227},"capability catalogs every AI-related extension installed across the workforce, including the specific permissions each extension has requested (access to page content, browsing history, clipboard data), allowing you to review whether those permission combinations could enable data exfiltration or account takeover. ",[],{},{"nodeType":996,"data":1229,"content":1233},{"target":1230},{"sys":1231},{"id":1232,"type":1001,"linkType":1002},"1z56sTWWN9E35dE3HhbRNY",[],{"nodeType":860,"data":1235,"content":1236},{},[1237,1241,1246],{"nodeType":864,"value":1238,"marks":1239,"data":1240},"Push’s ",[],{},{"nodeType":864,"value":1242,"marks":1243,"data":1245},"OAuth integration discovery",[1244],{"type":899},{},{"nodeType":864,"value":1247,"marks":1248,"data":1249}," identifies OAuth connections between AI tools and corporate systems — the grants that create persistent API-level access to platforms like Google Workspace.",[],{},{"nodeType":860,"data":1251,"content":1252},{},[1253,1257,1262],{"nodeType":864,"value":1254,"marks":1255,"data":1256},"For each discovered tool, Push also captures authentication context that points to ",[],{},{"nodeType":864,"value":1258,"marks":1259,"data":1261},"where hidden security risks lie",[1260],{"type":899},{},{"nodeType":864,"value":1263,"marks":1264,"data":1265},": SSO vs. password vs. personal account, MFA status, and password strength. An AI tool accessed via corporate SSO with MFA is a different risk than the same tool accessed through a personal Gmail account with a reused password. Similarly, employees using only a password to access AI tools that they’ve integrated with other sensitive corporate systems introduces another level of downstream risk. That context is what makes the inventory actionable.",[],{},{"nodeType":860,"data":1267,"content":1268},{},[1269],{"nodeType":864,"value":1270,"marks":1271,"data":1272},"Push also detects when employees are adopting agentic browsers — autonomous AI-powered browsers like Comet, Atlas, and Dia that browse the web and interact with applications on behalf of users or automated workflows. ",[],{},{"nodeType":860,"data":1274,"content":1275},{},[1276],{"nodeType":864,"value":1277,"marks":1278,"data":1279},"These represent an emerging category of non-human AI identity. They authenticate to SaaS applications, access corporate data, and make API calls, but they aren't managed through traditional identity infrastructure. Push helps you identify these agentic browsers as they appear in the environment, before they become a blind spot.",[],{},{"nodeType":860,"data":1281,"content":1282},{},[1283],{"nodeType":864,"value":1284,"marks":1285,"data":1286},"Returning to the paved path metaphor, this step is about surveying the site before you figure out where to put in the path. You need to understand who’s already doing what, where, so you can find the risks you need to address.",[],{},{"nodeType":996,"data":1288,"content":1292},{"target":1289},{"sys":1290},{"id":1291,"type":1001,"linkType":1002},"5iXyJbxwWiUt7WoP7FF0Y2",[],{"nodeType":1005,"data":1294,"content":1295},{},[],{"nodeType":1009,"data":1297,"content":1298},{},[1299],{"nodeType":864,"value":1300,"marks":1301,"data":1303},"Step-by-step guide to enforcing AI governance without blocking everything",[1302],{"type":899},{},{"nodeType":860,"data":1305,"content":1306},{},[1307],{"nodeType":864,"value":1308,"marks":1309,"data":1310},"The barricade approach favored by existing solutions like network proxies gives you two options: Allow or block. Enforcing AI policy effectively requires a third approach with a bit more nuance: Guide the user to do the right thing. ",[],{},{"nodeType":1312,"data":1313,"content":1314},"heading-2",{},[1315],{"nodeType":864,"value":1316,"marks":1317,"data":1318},"Building the \"paved path\" with Push",[],{},{"nodeType":860,"data":1320,"content":1321},{},[1322],{"nodeType":864,"value":1323,"marks":1324,"data":1325},"Push provides all three options as configurable enforcement modes for a variety of readymade controls. Progressing between them is how organizations can move from \"we don't know what people are doing with AI\" to evidence-based governance.",[],{},{"nodeType":860,"data":1327,"content":1328},{},[1329,1333,1338],{"nodeType":864,"value":1330,"marks":1331,"data":1332},"Push can be deployed silently and begin observing AI usage with no employee-facing intervention. This is effectively Push in ",[],{},{"nodeType":864,"value":1334,"marks":1335,"data":1337},"Monitor",[1336],{"type":899},{},{"nodeType":864,"value":1339,"marks":1340,"data":1341}," mode.",[],{},{"nodeType":860,"data":1343,"content":1344},{},[1345],{"nodeType":864,"value":1346,"marks":1347,"data":1348},"The platform records which tools are in use, how employees authenticated, and what usage patterns are emerging. Most organizations should start here to generate a baseline. Telemetry can be streamed to your SIEM or other downstream system to get alerted to newly adopted apps and extensions, and to surface security risks like insecure accounts.",[],{},{"nodeType":860,"data":1350,"content":1351},{},[1352,1356,1361,1365,1370],{"nodeType":864,"value":1353,"marks":1354,"data":1355},"Next, most organizations will transition to ",[],{},{"nodeType":864,"value":1357,"marks":1358,"data":1360},"Acknowledge",[1359],{"type":899},{},{"nodeType":864,"value":1362,"marks":1363,"data":1364}," mode for controls like in-browser ",[],{},{"nodeType":864,"value":1366,"marks":1367,"data":1369},"App banners",[1368],{"type":899},{},{"nodeType":864,"value":1371,"marks":1372,"data":1373},". With this control, you can warn employees when they attempt to use an unapproved AI tool and point them to approved alternatives.",[],{},{"nodeType":996,"data":1375,"content":1379},{"target":1376},{"sys":1377},{"id":1378,"type":1001,"linkType":1002},"17nT8JDTyHLExwhb2upb6T",[],{"nodeType":860,"data":1381,"content":1382},{},[1383],{"nodeType":864,"value":1384,"marks":1385,"data":1386},"The employee isn't blocked — they're guided toward the governed path at the moment they're about to step off it. This is more effective than a policy document because it arrives right when they need the reminder. ",[],{},{"nodeType":996,"data":1388,"content":1392},{"target":1389},{"sys":1390},{"id":1391,"type":1001,"linkType":1002},"2lDFCuc48jcGODcwD6nYhK",[],{"nodeType":860,"data":1394,"content":1395},{},[1396,1401],{"nodeType":864,"value":1397,"marks":1398,"data":1400},"Block",[1399],{"type":899},{},{"nodeType":864,"value":1402,"marks":1403,"data":1404}," mode prevents access entirely — Push presents a blocking banner to users who attempt to log in to unapproved apps. ",[],{},{"nodeType":860,"data":1406,"content":1407},{},[1408],{"nodeType":864,"value":1409,"marks":1410,"data":1411},"Push makes the Monitor → Acknowledge → Block progression practical through automatic app categorization. This means that new AI tools inherit whatever governance mode the team has set for that category, without manual blocklist updates. All controls are configurable per user group — the data science team can use AI coding assistants while uploads from finance are restricted — because different teams have different risk profiles.",[],{},{"nodeType":996,"data":1413,"content":1417},{"target":1414},{"sys":1415},{"id":1416,"type":1001,"linkType":1002},"5EBOHy6X6iJfmzJ65txGOv",[],{"nodeType":996,"data":1419,"content":1423},{"target":1420},{"sys":1421},{"id":1422,"type":1001,"linkType":1002},"31JnX2KNCAnlaVS9Qqqh8W",[],{"nodeType":1005,"data":1425,"content":1426},{},[],{"nodeType":1009,"data":1428,"content":1429},{},[1430],{"nodeType":864,"value":1431,"marks":1432,"data":1434},"Guardrails: how to prevent data loss to AI tools",[1433],{"type":899},{},{"nodeType":860,"data":1436,"content":1437},{},[1438],{"nodeType":864,"value":1439,"marks":1440,"data":1441},"Even on the paved path, you need guardrails because preventing data loss to AI tools is a separate problem from controlling which tools employees use. An employee on an approved AI tool can still paste an AWS access key into a prompt, upload a customer spreadsheet, or share confidential documents in a conversation.",[],{},{"nodeType":860,"data":1443,"content":1444},{},[1445,1448,1457],{"nodeType":864,"value":21,"marks":1446,"data":1447},[],{},{"nodeType":883,"data":1449,"content":1450},{"uri":916},[1451],{"nodeType":864,"value":1452,"marks":1453,"data":1456},"Okta's data",[1454],{"type":1455},"underline",{},{"nodeType":864,"value":1458,"marks":1459,"data":1460}," on what employees actually share shows what’s at stake: 54% share internal messages and emails with AI tools, 39% share confidential company documents, and 28% share banking and payment information.",[],{},{"nodeType":860,"data":1462,"content":1463},{},[1464],{"nodeType":864,"value":1465,"marks":1466,"data":1467},"Blocking is too much of a blunt instrument here, as obviously, you want employees to be able to use approved tools. The answer is controlling what data enters them.",[],{},{"nodeType":1312,"data":1469,"content":1470},{},[1471],{"nodeType":864,"value":1472,"marks":1473,"data":1475},"Browser-layer controls for AI data leakage",[1474],{"type":899},{},{"nodeType":860,"data":1477,"content":1478},{},[1479],{"nodeType":864,"value":1480,"marks":1481,"data":1482},"Push addresses this problem with four browser-layer data controls, each targeting a distinct exfiltration path and supporting the same Monitor → Warn → Block enforcement modes:",[],{},{"nodeType":860,"data":1484,"content":1485},{},[1486,1491],{"nodeType":864,"value":1487,"marks":1488,"data":1490},"Clipboard blocking",[1489],{"type":899},{},{"nodeType":864,"value":1492,"marks":1493,"data":1494}," addresses the most common path for sensitive data into AI tools: copy-paste. Push matches clipboard content against preconfigured patterns for AWS access keys, GitHub tokens, API keys, credit card numbers, and personal identifiers, plus custom content rules for organization-specific data like internal project codes. ",[],{},{"nodeType":860,"data":1496,"content":1497},{},[1498,1502,1507],{"nodeType":864,"value":1499,"marks":1500,"data":1501},"In ",[],{},{"nodeType":864,"value":1503,"marks":1504,"data":1506},"Warn",[1505],{"type":899},{},{"nodeType":864,"value":1508,"marks":1509,"data":1510}," mode, Push offers a redacted version of the sensitive data so the employee can continue their work — getting help with their code, for instance — without exposing the actual credential.",[],{},{"nodeType":996,"data":1512,"content":1516},{"target":1513},{"sys":1514},{"id":1515,"type":1001,"linkType":1002},"1JarUdbe8AkJlgB0LjchNR",[],{"nodeType":860,"data":1518,"content":1519},{},[1520,1525],{"nodeType":864,"value":1521,"marks":1522,"data":1524},"File upload blocking",[1523],{"type":899},{},{"nodeType":864,"value":1526,"marks":1527,"data":1528}," prevents files from being uploaded to specific AI apps, configurable by app, user group, and file type (Push provides a list for fast configuration).",[],{},{"nodeType":860,"data":1530,"content":1531},{},[1532,1537,1541,1550,1554,1559],{"nodeType":864,"value":1533,"marks":1534,"data":1536},"File download blocking",[1535],{"type":899},{},{"nodeType":864,"value":1538,"marks":1539,"data":1540}," addresses a different common risk: Employees downloading desktop versions of AI tools, which moves usage outside the browser where Push has visibility. Download blocking also covers files generated inside web applications, such as an AI tool that produces a downloadable asset. (Push’s detection and response capabilities also protect against scenarios in which attackers present users with ",[],{},{"nodeType":883,"data":1542,"content":1544},{"uri":1543},"https://pushsecurity.com/blog/llmshare-malvertising-campaign",[1545],{"nodeType":864,"value":1546,"marks":1547,"data":1549},"faked AI tool download pages",[1548],{"type":1455},{},{"nodeType":864,"value":1551,"marks":1552,"data":1553}," as part of phishing campaigns, a technique we dubbed ",[],{},{"nodeType":864,"value":1555,"marks":1556,"data":1558},"LLMShare",[1557],{"type":899},{},{"nodeType":864,"value":1560,"marks":1561,"data":1562},".)",[],{},{"nodeType":860,"data":1564,"content":1565},{},[1566],{"nodeType":864,"value":1567,"marks":1568,"data":1569},"Push also provides telemetry streams on all file upload and download events in your environment, so you can get a baseline pattern of life and identify anomalies that could indicate insider risk. ",[],{},{"nodeType":860,"data":1571,"content":1572},{},[1573,1577,1582],{"nodeType":864,"value":1574,"marks":1575,"data":1576},"The Push platform also provides the capability to write your own ",[],{},{"nodeType":864,"value":1578,"marks":1579,"data":1581},"custom detections",[1580],{"type":899},{},{"nodeType":864,"value":1583,"marks":1584,"data":1585},", which you can use for other organization-specific use cases, or even to extend your control over GenAI tool usage, such as by blocking unapproved MCP server connections.",[],{},{"nodeType":996,"data":1587,"content":1591},{"target":1588},{"sys":1589},{"id":1590,"type":1001,"linkType":1002},"5XYVgJjgUPUfY1W1Zcgrvm",[],{"nodeType":860,"data":1593,"content":1594},{},[1595,1599,1604],{"nodeType":864,"value":1596,"marks":1597,"data":1598},"Finally, ",[],{},{"nodeType":864,"value":1600,"marks":1601,"data":1603},"AI conversation visibility",[1602],{"type":899},{},{"nodeType":864,"value":1605,"marks":1606,"data":1607}," gives you a window into what is being shared in AI chats, consumable as a stream of events to your SIEM or SOAR. Over time, you can build up a picture of what’s normal or what violates company policy, and create a queryable history to identify potential data loss during an incident response process.",[],{},{"nodeType":860,"data":1609,"content":1610},{},[1611],{"nodeType":864,"value":1612,"marks":1613,"data":1614},"Traditional DLP at the endpoint or network layer misses these paths. Network DLP and SWGs can't inspect clipboard pastes into AI prompts — there's no network event to intercept. Endpoint DLP sees file-system operations but not in-browser activity. ",[],{},{"nodeType":860,"data":1616,"content":1617},{},[1618],{"nodeType":864,"value":1619,"marks":1620,"data":1621},"Push's controls operate where the data is flowing — inside the browser session.",[],{},{"nodeType":1005,"data":1623,"content":1624},{},[],{"nodeType":1312,"data":1626,"content":1627},{},[1628],{"nodeType":864,"value":1629,"marks":1630,"data":1632},"How to keep up with AI tool sprawl",[1631],{"type":899},{},{"nodeType":860,"data":1634,"content":1635},{},[1636],{"nodeType":864,"value":1637,"marks":1638,"data":1639},"Pragmatically, the hardest part of generative AI security isn't the initial steps you take — it's keeping up with the sprawl. Point-in-time audits quickly become outdated when the landscape changes so quickly.",[],{},{"nodeType":860,"data":1641,"content":1642},{},[1643],{"nodeType":864,"value":1644,"marks":1645,"data":1646},"Push addresses this with continuous discovery, telemetry streams for the most important points of user interaction with AI apps, and controls that allow you to adapt quickly with simple configuration changes.",[],{},{"nodeType":860,"data":1648,"content":1649},{},[1650],{"nodeType":864,"value":1651,"marks":1652,"data":1653},"With automatic app categorization, if an employee starts using a new AI code assistant that didn't exist last quarter, Push discovers it, classifies it, and applies your governance rules — no manual intervention required.",[],{},{"nodeType":860,"data":1655,"content":1656},{},[1657],{"nodeType":864,"value":1658,"marks":1659,"data":1660},"All AI-related telemetry — app logins, file uploads and downloads, clipboard events, browser extensions, AI chat transcripts — can be sent as structured data to your SIEM.",[],{},{"nodeType":860,"data":1662,"content":1663},{},[1664],{"nodeType":864,"value":1665,"marks":1666,"data":1667},"This gives you all the information you need to track your progress, check your compliance status, and identify trends in AI usage and risk across your business as you make progress toward your goal, armed with the right data you didn't have before.",[],{},{"nodeType":860,"data":1669,"content":1670},{},[1671],{"nodeType":864,"value":1672,"marks":1673,"data":1674},"The goal isn't perfect control over every AI interaction. It's having enough visibility to make informed decisions and enough control to enforce them, without intensifying the shadow AI usage problem you set out to solve. Push can help you get there.",[],{},{"nodeType":1005,"data":1676,"content":1677},{},[],{"nodeType":860,"data":1679,"content":1680},{},[1681],{"nodeType":864,"value":1682,"marks":1683,"data":1684},"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",[],{},{"nodeType":860,"data":1686,"content":1687},{},[1688],{"nodeType":864,"value":1689,"marks":1690,"data":1691},"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",[],{},{"nodeType":860,"data":1693,"content":1694},{},[1695,1698,1707],{"nodeType":864,"value":21,"marks":1696,"data":1697},[],{},{"nodeType":883,"data":1699,"content":1701},{"uri":1700},"https://pushsecurity.com/demo",[1702],{"nodeType":864,"value":1703,"marks":1704,"data":1706},"Book a live demo to learn more.",[1705],{"type":1455},{},{"nodeType":864,"value":21,"marks":1708,"data":1709},[],{},{"entries":1711},{"hyperlink":1712,"inline":1713,"block":1714},[],[],[1715,1722,1731,1738,1776,1783,1790,1796,1803,1830,1838,1852,1858],{"sys":1716,"__typename":1717,"type":1718,"ctaText":1719,"buttonLabel":1720,"buttonColour":1721,"buttonUrl":58},{"id":1000},"CtaWidget","Custom","Don't miss our upcoming webinar on Shadow AI and how to manage it in your organization.","Register Now","sunny orange",{"sys":1723,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":1727},{"id":1040},"Image","ai-sprawl-infographic","AI sprawl is worse than most organizations realize. ",{"url":1728,"width":1729,"height":1730},"https://images.ctfassets.net/y1cdw1ablpvd/7vCbQdyRkjLs5EmsjBBAQp/3bfb13e7ec19be76325cdc69297c48c3/ai-sprawl-infographic_2x__3_.png",1800,1192,{"sys":1732,"__typename":1724,"title":1733,"caption":1733,"layoutMode":59,"file":1734},{"id":1058},"Shadow AI visibility gaps using traditional tools",{"url":1735,"width":1736,"height":1737},"https://images.ctfassets.net/y1cdw1ablpvd/7HQl2qfsTiCwa2pRzCVqDE/d87180dd96358326097565d8a60e8591/image9.png",1999,1125,{"sys":1739,"__typename":1740,"content":1741,"name":1775,"title":59},{"id":1076},"InsightTextBlockComponent",{"json":1742},{"data":1743,"content":1744,"nodeType":856},{},[1745],{"data":1746,"content":1747,"nodeType":860},{},[1748,1752,1759,1763,1771],{"data":1749,"marks":1750,"value":1751,"nodeType":864},{},[],"Attackers are already exploiting this interconnectivity — from ",{"data":1753,"content":1754,"nodeType":883},{"uri":1543},[1755],{"data":1756,"marks":1757,"value":1758,"nodeType":864},{},[],"malvertising campaigns that impersonate AI tools",{"data":1760,"marks":1761,"value":1762,"nodeType":864},{},[]," to steal credentials, to ",{"data":1764,"content":1766,"nodeType":883},{"uri":1765},"https://pushsecurity.com/blog/analyzing-the-instructure-breach",[1767],{"data":1768,"marks":1769,"value":1770,"nodeType":864},{},[],"leveraging OAuth consent grants in supply chain attacks",{"data":1772,"marks":1773,"value":1774,"nodeType":864},{},[],". ","Shadow AI guide IB3",{"sys":1777,"__typename":1724,"title":1778,"caption":1778,"layoutMode":59,"file":1779},{"id":1187},"Push automatically discovers and inventories AI apps from browser login events.",{"url":1780,"width":1781,"height":1782},"https://images.ctfassets.net/y1cdw1ablpvd/5krEecjMxIJgVCa74A79xa/3bb94ca3b496e9486f94526d708e34d5/image8.png",1469,850,{"sys":1784,"__typename":1724,"title":1785,"caption":1785,"layoutMode":59,"file":1786},{"id":1232},"Push discovers AI browser extensions used by your users, across every browser.",{"url":1787,"width":1788,"height":1789},"https://images.ctfassets.net/y1cdw1ablpvd/14lMFifCBB9RwQpt101tNd/dabe2713e58e787175701ec0d35076ca/image2.png",1470,851,{"sys":1791,"__typename":1724,"title":1792,"caption":1792,"layoutMode":59,"file":1793},{"id":1291},"Push's four-step path to secure AI adoption",{"url":1794,"width":1736,"height":1795},"https://images.ctfassets.net/y1cdw1ablpvd/E1wuJW4EzmjeLTpnHHM9f/895569f4b215b1b7b82e697c40462cbc/image3.png",1013,{"sys":1797,"__typename":1724,"title":1798,"caption":1798,"layoutMode":59,"file":1799},{"id":1378},"Push in-browser warning screen guiding the user toward the preferred AI app",{"url":1800,"width":1801,"height":1802},"https://images.ctfassets.net/y1cdw1ablpvd/3ouLBkKhiEcBmY8V2XAaUz/71a3cb221adba7d2744ff8b02bab3891/image4.png",1435,738,{"sys":1804,"__typename":1740,"content":1805,"name":1829,"title":59},{"id":1391},{"json":1806},{"data":1807,"content":1808,"nodeType":856},{},[1809],{"data":1810,"content":1811,"nodeType":860},{},[1812,1816,1825],{"data":1813,"marks":1814,"value":1815,"nodeType":864},{},[],"“A published policy is not the same thing as people actually doing that,” explains Push customer Stephen Shkardoon, cybersecurity manager at Te Herenga Waka — Victoria University of Wellington in New Zealand, on one of the drivers for their ",{"data":1817,"content":1819,"nodeType":883},{"uri":1818},"https://pushsecurity.com/customer-stories/te-herenga-waka-victoria-university-of-wellington",[1820],{"data":1821,"marks":1822,"value":1824,"nodeType":864},{},[1823],{"type":1455},"selection of Push Security",{"data":1826,"marks":1827,"value":1828,"nodeType":864},{},[]," to get control of AI usage at their organization.","Shadow AI guide IB1",{"sys":1831,"__typename":1724,"title":1832,"caption":1833,"layoutMode":59,"file":1834},{"id":1416},"Rules for AI app controls can be configured on a variety of conditions, including user groups, app attributes, and what mode of enforcement you wish to use.","Rules for AI app controls can be configured on a variety of conditions, including user groups, app attributes, and the mode of enforcement.",{"url":1835,"width":1836,"height":1837},"https://images.ctfassets.net/y1cdw1ablpvd/7czh28QGwm0ZStUmeWXBaq/667ee2441911fa4006a2ec75ebf727ea/image6.png",692,830,{"sys":1839,"__typename":1740,"content":1840,"name":1851,"title":59},{"id":1422},{"json":1841},{"data":1842,"content":1843,"nodeType":856},{},[1844],{"data":1845,"content":1846,"nodeType":860},{},[1847],{"data":1848,"marks":1849,"value":1850,"nodeType":864},{},[],"Push customers love the flexibility of this control compared to an SWG or CASB, which often rely on binary enforcement at the domain level only. ","Shadow AI guide IB2",{"sys":1853,"__typename":1724,"title":1854,"caption":1854,"layoutMode":59,"file":1855},{"id":1515},"Push blocks clipboard copy events that violate your policy.",{"url":1856,"width":1736,"height":1857},"https://images.ctfassets.net/y1cdw1ablpvd/jjUt4bChHcCWQJXqNzyQ8/c16974d72ef2bbc65689bf46bcb59e6f/image5.png",1295,{"sys":1859,"__typename":1724,"title":1860,"caption":1860,"layoutMode":59,"file":1861},{"id":1590},"Push can block unapproved MCP connection requests in real time.",{"url":1862,"width":1736,"height":1863},"https://images.ctfassets.net/y1cdw1ablpvd/wTAwk90bIA1B3XSkRf4M4/e4d3630af83501e6b4b05217fdf2e600/image1.png",1203,{"items":1865},[1866,1879,1892,1912,1932,1952,1972,1992,2012,2032],{"answer":1867,"question":1878},{"json":1868},{"nodeType":856,"data":1869,"content":1870},{},[1871],{"nodeType":860,"data":1872,"content":1873},{},[1874],{"nodeType":864,"value":1875,"marks":1876,"data":1877},"Network monitoring tools see domain-level traffic but can't tell you what's actually happening inside an AI session — whether an employee is browsing a tool's marketing page or pasting source code into a prompt. IdP logs capture OAuth grants routed through the identity provider but miss AI tools accessed via direct signup or personal accounts. Browser-based security tools like Push Security monitor AI activity where it actually happens: inside the browser session. Push captures login events, clipboard pastes, file uploads, extension installations, and OAuth grants, providing structured telemetry on what data is moving into which AI tools, through which accounts, and whether those accounts are corporate or personal.",[],{},"How do you monitor what employees are doing with AI tools?",{"answer":1880,"question":1891},{"json":1881},{"nodeType":856,"data":1882,"content":1883},{},[1884],{"nodeType":860,"data":1885,"content":1886},{},[1887],{"nodeType":864,"value":1888,"marks":1889,"data":1890},"Binary allow/block decisions — whether enforced through a SWG, CASB, or enterprise browser — treat every AI interaction as equivalent, which pushes employees toward tools you can't see at all. Graduated enforcement offers a middle path. Push Security lets teams start with monitoring to build an accurate picture of AI usage, then introduce in-browser prompts that explain why a tool hasn't been approved and direct employees toward sanctioned alternatives, before applying hard blocks only where the data sensitivity or tool risk justifies it. Controls are configurable per user group, and new AI tools automatically inherit governance rules through automatic categorization — so enforcement keeps pace with the landscape without manual blocklist updates.",[],{},"How do you restrict AI usage without blocking everything?",{"answer":1893,"question":1911},{"json":1894},{"nodeType":856,"data":1895,"content":1896},{},[1897,1904],{"nodeType":860,"data":1898,"content":1899},{},[1900],{"nodeType":864,"value":1901,"marks":1902,"data":1903},"Network monitoring tools, IdP logs, and endpoint agents each catch a slice of shadow AI but miss entire categories. SWGs see domain traffic but can't confirm whether someone authenticated or what they did after login. IdPs capture OAuth grants routed through the identity provider but miss AI tools accessed via direct signup or personal accounts. EDR is blind to browser-layer activity entirely. ",[],{},{"nodeType":860,"data":1905,"content":1906},{},[1907],{"nodeType":864,"value":1908,"marks":1909,"data":1910},"Browser-based security tools like Push Security identify AI tools from actual login events, catching the four categories other tools miss: unapproved AI apps, personal accounts on approved tools, AI browser extensions with broad permissions, and OAuth integrations granting persistent API access to corporate systems. Each discovered app is automatically categorized and enriched with authentication context — SSO vs. password, MFA status, corporate vs. personal account — so security teams can assess actual risk rather than treating every AI tool as equivalent.",[],{},"How do you discover what AI tools employees are using?",{"answer":1913,"question":1931},{"json":1914},{"nodeType":856,"data":1915,"content":1916},{},[1917,1924],{"nodeType":860,"data":1918,"content":1919},{},[1920],{"nodeType":864,"value":1921,"marks":1922,"data":1923},"This is a gap that traditional DLP architectures weren't designed for. Network DLP and SWGs can't intercept clipboard pastes into AI prompts because there's no network event to inspect — the data moves from the clipboard to the browser DOM without crossing the wire. Endpoint DLP sees file-system operations but not in-browser activity. Browser-based controls operate where the paste actually happens. ",[],{},{"nodeType":860,"data":1925,"content":1926},{},[1927],{"nodeType":864,"value":1928,"marks":1929,"data":1930},"Push Security matches clipboard content against patterns for credentials, API keys, credit card numbers, and custom content rules, then offers the employee a redacted version so they can continue working without exposing the actual sensitive data. The same approach extends to file uploads and downloads, covering the exfiltration paths that network and endpoint DLP leave open.",[],{},"How do you prevent sensitive data from being pasted into AI tools?",{"answer":1933,"question":1951},{"json":1934},{"nodeType":856,"data":1935,"content":1936},{},[1937,1944],{"nodeType":860,"data":1938,"content":1939},{},[1940],{"nodeType":864,"value":1941,"marks":1942,"data":1943},"Policy documents distributed during onboarding don't change behavior at the moment someone reaches for an unapproved AI tool. SWGs can block a domain, but they can't explain why or point to an approved alternative — the employee sees an error page. ",[],{},{"nodeType":860,"data":1945,"content":1946},{},[1947],{"nodeType":864,"value":1948,"marks":1949,"data":1950},"Enterprise browsers like Push Security can deliver policy enforcement at the point of decision: when an employee navigates to an unsanctioned AI tool, an in-browser message explains why the tool hasn't been approved and directs them to approved alternatives. Controls are configurable per user group — and new AI tools automatically inherit governance rules through automatic categorization, without manual blocklist updates.",[],{},"How do you enforce an AI acceptable use policy in real time?",{"answer":1953,"question":1971},{"json":1954},{"nodeType":856,"data":1955,"content":1956},{},[1957,1964],{"nodeType":860,"data":1958,"content":1959},{},[1960],{"nodeType":864,"value":1961,"marks":1962,"data":1963},"No single traditional tool covers all aspects of shadow AI (apps, tenants, integrations, extensions) and the user interaction with those categories of tool. SWGs and CASBs see domain-level traffic but can't identify personal account usage, extension activity, or clipboard pastes into AI prompts. IdPs capture federated logins but miss direct signups and personal accounts entirely. EDR doesn't see browser-layer activity. DSPM monitors data at rest in cloud storage but not data in motion through browser sessions. ",[],{},{"nodeType":860,"data":1965,"content":1966},{},[1967],{"nodeType":864,"value":1968,"marks":1969,"data":1970},"Most organizations will need browser-layer visibility alongside their existing stack — not as a replacement, but to close the gaps those tools weren't designed to address. Tools like Push Security operate at the layer where AI activity actually happens, covering all shadow AI categories with graduated enforcement (monitor, warn, block), per-user-group policies, and telemetry on authentication methods, clipboard events, file uploads, and OAuth grants. ",[],{},"What tools do you need to manage shadow AI?",{"answer":1973,"question":1991},{"json":1974},{"nodeType":856,"data":1975,"content":1976},{},[1977,1984],{"nodeType":860,"data":1978,"content":1979},{},[1980],{"nodeType":864,"value":1981,"marks":1982,"data":1983},"AI browser extensions are a blind spot for most security stacks. Endpoint management tools may detect that an extension is installed but typically can't evaluate what permissions it has requested or whether those permissions create data exfiltration risk. SWGs and CASBs don't see extension activity at all — extensions operate within the browser, not over the network. ",[],{},{"nodeType":860,"data":1985,"content":1986},{},[1987],{"nodeType":864,"value":1988,"marks":1989,"data":1990},"Push Security inventories every AI-related extension installed across the workforce, surfaces the specific permissions each extension has requested (access to page content, browsing history, clipboard data), and identifies permission combinations that could enable account takeover or data exfiltration. Security teams can then apply monitor, warn, or block enforcement to extension categories — and new extensions automatically inherit governance rules without maintaining manual allowlists that go stale as new AI extensions appear daily.",[],{},"How do I stop employees installing AI browser extensions?",{"answer":1993,"question":2011},{"json":1994},{"nodeType":856,"data":1995,"content":1996},{},[1997,2004],{"nodeType":860,"data":1998,"content":1999},{},[2000],{"nodeType":864,"value":2001,"marks":2002,"data":2003},"Point-in-time audits — whether run through an IdP, a CASB, or manual surveys — tell you what was true when you ran them. AI tool adoption changes weekly; Gartner projects 150,000 AI agents per Fortune 500 enterprise by 2028. SWGs can log new domains but can't classify them or apply governance rules automatically. ",[],{},{"nodeType":860,"data":2005,"content":2006},{},[2007],{"nodeType":864,"value":2008,"marks":2009,"data":2010},"Push Security discovers new AI tools as employees start using them: when someone logs in to a new AI app, Push identifies it from the login event, automatically categorizes it, and applies the organization's existing governance rules without manual intervention. All AI-related telemetry — app access, file uploads, clipboard events, extension activity — streams as structured data to the customer's SIEM, providing the material for governance dashboards and compliance reporting that stays current as the landscape shifts.",[],{},"How do you get visibility into AI tool sprawl?",{"answer":2013,"question":2031},{"json":2014},{"nodeType":856,"data":2015,"content":2016},{},[2017,2024],{"nodeType":860,"data":2018,"content":2019},{},[2020],{"nodeType":864,"value":2021,"marks":2022,"data":2023},"AI visibility means knowing which AI tools employees are using, how they're accessing them, and what data flows into those tools. AI control is the ability to enforce rules on that usage — blocking unapproved tools, restricting data flows, requiring approved accounts. AI governance is the broader program that encompasses both: defining acceptable use policies, establishing risk frameworks for evaluating new tools, and building the organizational processes that turn visibility and control into sustained security outcomes. ",[],{},{"nodeType":860,"data":2025,"content":2026},{},[2027],{"nodeType":864,"value":2028,"marks":2029,"data":2030},"Most organizations that struggle with AI governance have a visibility problem first — they're trying to write policies for tools they don't know their employees are using. But visibility without control is just watching the problem happen. Push Security provides both: discovery and monitoring across all four categories of shadow AI, plus graduated enforcement controls that let you apply different responses based on the risk profile of each tool, account, and data flow, at the point of interaction in the browser for real-time enforcement.",[],{},"What is the difference between AI governance, AI visibility, and AI control?",{"answer":2033,"question":2051},{"json":2034},{"nodeType":856,"data":2035,"content":2036},{},[2037,2044],{"nodeType":860,"data":2038,"content":2039},{},[2040],{"nodeType":864,"value":2041,"marks":2042,"data":2043},"Data Security Posture Management (DSPM) tools monitor data at rest in cloud storage and SaaS applications, identifying misconfigurations, overly permissive access, and sensitive data exposure. They don't monitor data in motion through browser sessions — which is the primary path for shadow AI risk. ",[],{},{"nodeType":860,"data":2045,"content":2046},{},[2047],{"nodeType":864,"value":2048,"marks":2049,"data":2050},"When an employee pastes source code into an AI prompt or uploads a customer spreadsheet to an unapproved AI tool, that data movement happens entirely inside the browser and never touches the cloud storage layer that DSPM tools monitor. DSPM and browser security are complementary: DSPM secures data where it is stored, while browser-layer tools like Push Security secure data where it moves.",[],{},"Does Data Security Posture Management (DSPM) prevent shadow AI?","Shadow AI discovery and governance: Frequently asked questions",{},"How to discover AI, enforce policies, and prevent data loss","2026-08-13T00:00:00.000Z",{"items":2057},[2058,2741,3626],{"__typename":2059,"sys":2060,"content":2062,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":2724,"authorsCollection":2733},"BlogPosts",{"id":2061},"4NY2NbkAPucFOJY45yrrrE",{"json":2063},{"data":2064,"content":2065,"nodeType":856},{},[2066,2073,2080,2087,2093,2096,2104,2111,2144,2151,2176,2182,2185,2193,2200,2208,2252,2258,2265,2270,2273,2281,2288,2296,2303,2310,2326,2334,2359,2366,2372,2379,2387,2402,2430,2436,2454,2460,2468,2475,2500,2507,2514,2521,2527,2530,2538,2545,2552,2571,2579,2586,2594,2617,2629,2635,2638,2646,2653,2660,2667,2686,2689,2695,2701],{"data":2067,"content":2068,"nodeType":860},{},[2069],{"data":2070,"marks":2071,"value":2072,"nodeType":864},{},[],"Employees have been self-adopting apps, creating unmanaged accounts, and introducing third-party software dependencies into their organizations for years, and the core problem hasn't changed: unmanaged software expanding your attack surface without your knowledge.",{"data":2074,"content":2075,"nodeType":860},{},[2076],{"data":2077,"marks":2078,"value":2079,"nodeType":864},{},[],"But the rate at which employees are signing up for AI tools is unprecedented, and the depth of interconnectivity those tools demand is fundamentally different from traditional shadow SaaS. ",{"data":2081,"content":2082,"nodeType":860},{},[2083],{"data":2084,"marks":2085,"value":2086,"nodeType":864},{},[],"AI tools aren't just standalone apps that employees sign into — they're increasingly used as agents that drive other applications, pulling data from one platform, acting on another — they are becoming a core that other apps are integrating to, and that users are integrating with their wider SaaS stack. It’s becoming a focal integration point for app access and functionality in a way that's more comparable to an enterprise cloud platform than a typical SaaS tool. ",{"data":2088,"content":2092,"nodeType":996},{"target":2089},{"sys":2090},{"id":2091,"type":1001,"linkType":1002},"2Vxb48M5JN9Jdy8BG6nbUJ",[],{"data":2094,"content":2095,"nodeType":1005},{},[],{"data":2097,"content":2098,"nodeType":1009},{},[2099],{"data":2100,"marks":2101,"value":2103,"nodeType":864},{},[2102],{"type":899},"What is shadow AI? A quick 101",{"data":2105,"content":2106,"nodeType":860},{},[2107],{"data":2108,"marks":2109,"value":2110,"nodeType":864},{},[],"Shadow AI is any use of AI tools, services, or integrations that happens outside an organization's security governance and visibility. Shadow AI risks cut in two directions:",{"data":2112,"content":2113,"nodeType":941},{},[2114,2129],{"data":2115,"content":2116,"nodeType":945},{},[2117],{"data":2118,"content":2119,"nodeType":860},{},[2120,2125],{"data":2121,"marks":2122,"value":2124,"nodeType":864},{},[2123],{"type":899},"Data exposure:",{"data":2126,"marks":2127,"value":2128,"nodeType":864},{},[]," source code, credentials, internal documents, and customer data routinely get pasted into AI prompts or uploaded as context, and once shared, that data is outside the organization's control. ",{"data":2130,"content":2131,"nodeType":945},{},[2132],{"data":2133,"content":2134,"nodeType":860},{},[2135,2140],{"data":2136,"marks":2137,"value":2139,"nodeType":864},{},[2138],{"type":899},"Attack surface:",{"data":2141,"marks":2142,"value":2143,"nodeType":864},{},[]," Every shadow AI app is an unmanaged identity with credentials that can be phished or stuffed, OAuth grants that give persistent API access to corporate systems, and browser extensions that can be compromised in supply chain attacks. ",{"data":2145,"content":2146,"nodeType":860},{},[2147],{"data":2148,"marks":2149,"value":2150,"nodeType":864},{},[],"AI tools increasingly function as hubs, connected via OAuth and MCP to email, cloud storage, code repositories, and other high-value systems. Every app connection an employee grants turns that AI tool into a node in a web of interconnected services, which means the more you hook in, the larger the attack surface across all the connected apps — and the greater the blast radius if the account used to access the AI tool is compromised.",{"data":2152,"content":2153,"nodeType":860},{},[2154,2158,2164,2167,2173],{"data":2155,"marks":2156,"value":2157,"nodeType":864},{},[],"Each integration creates a persistent trust relationship that survives password resets and MFA changes. Compromise a single AI app and an attacker inherits whatever access the employee granted it, turning one ungoverned tool into a pivot point across the SaaS estate. Attackers are already exploiting this interconnectivity — from ",{"data":2159,"content":2160,"nodeType":883},{"uri":1543},[2161],{"data":2162,"marks":2163,"value":1758,"nodeType":864},{},[],{"data":2165,"marks":2166,"value":1762,"nodeType":864},{},[],{"data":2168,"content":2169,"nodeType":883},{"uri":1765},[2170],{"data":2171,"marks":2172,"value":1770,"nodeType":864},{},[],{"data":2174,"marks":2175,"value":1774,"nodeType":864},{},[],{"data":2177,"content":2181,"nodeType":996},{"target":2178},{"sys":2179},{"id":2180,"type":1001,"linkType":1002},"1BWCa7AHCMlYw7XgPLx3h7",[],{"data":2183,"content":2184,"nodeType":1005},{},[],{"data":2186,"content":2187,"nodeType":1009},{},[2188],{"data":2189,"marks":2190,"value":2192,"nodeType":864},{},[2191],{"type":899},"The state of shadow AI, using Push data",{"data":2194,"content":2195,"nodeType":860},{},[2196],{"data":2197,"marks":2198,"value":2199,"nodeType":864},{},[],"We analyzed a snapshot of AI activity across Push customers during an average week in April 2026. We wanted to make sure it captured actual activity, not just historical data on apps that were added once and no longer used.",{"data":2201,"content":2202,"nodeType":860},{},[2203],{"data":2204,"marks":2205,"value":2207,"nodeType":864},{},[2206],{"type":899},"The numbers paint a picture that most security teams will find uncomfortable.",{"data":2209,"content":2210,"nodeType":860},{},[2211,2215,2220,2224,2229,2233,2238,2242,2248],{"data":2212,"marks":2213,"value":2214,"nodeType":864},{},[],"The average organization has ",{"data":2216,"marks":2217,"value":2219,"nodeType":864},{},[2218],{"type":899},"16 unique AI apps",{"data":2221,"marks":2222,"value":2223,"nodeType":864},{},[]," in active use, ",{"data":2225,"marks":2226,"value":2228,"nodeType":864},{},[2227],{"type":899},"17 unique AI browser extensions",{"data":2230,"marks":2231,"value":2232,"nodeType":864},{},[],", and ",{"data":2234,"marks":2235,"value":2237,"nodeType":864},{},[2236],{"type":899},"17 unique AI OAuth integrations",{"data":2239,"marks":2240,"value":2241,"nodeType":864},{},[]," connected into just Google Workspace and Microsoft 365 — with some organizations reaching as high as 40 unique AI apps, 163 AI extensions, and 55 OAuth connections to AI apps respectively. At the other end, the smallest organization with the ",{"data":2243,"marks":2244,"value":2247,"nodeType":864},{},[2245],{"type":2246},"italic","lowest",{"data":2249,"marks":2250,"value":2251,"nodeType":864},{},[]," adoption level is actively using two. ",{"data":2253,"content":2257,"nodeType":996},{"target":2254},{"sys":2255},{"id":2256,"type":1001,"linkType":1002},"2AfeiHub5kyZN8wuf6CJch",[],{"data":2259,"content":2260,"nodeType":860},{},[2261],{"data":2262,"marks":2263,"value":2264,"nodeType":864},{},[],"If most organizations have sanctioned one or two core AI assistants/platforms for business use, the gap between what's approved and what's actually happening is significant.",{"data":2266,"content":2269,"nodeType":996},{"target":2267},{"sys":2268},{"id":1040,"type":1001,"linkType":1002},[],{"data":2271,"content":2272,"nodeType":1005},{},[],{"data":2274,"content":2275,"nodeType":1009},{},[2276],{"data":2277,"marks":2278,"value":2280,"nodeType":864},{},[2279],{"type":899},"Understanding the four categories of shadow AI",{"data":2282,"content":2283,"nodeType":860},{},[2284],{"data":2285,"marks":2286,"value":2287,"nodeType":864},{},[],"Shadow SaaS has always been a problem, but in the context of AI apps there are four categories of shadow IT that security teams need to understand, because each one introduces a different kind of risk and requires a different approach to tackling it.",{"data":2289,"content":2290,"nodeType":1312},{},[2291],{"data":2292,"marks":2293,"value":2295,"nodeType":864},{},[2294],{"type":899},"Shadow AI apps",{"data":2297,"content":2298,"nodeType":860},{},[2299],{"data":2300,"marks":2301,"value":2302,"nodeType":864},{},[],"Shadow apps are AI tools that employees have signed up to and are using for business purposes without approval. This is the most visible dimension of the problem, and the one most people think of when they hear \"shadow AI\" — an employee pastes sensitive internal documents into ChatGPT, uploads confidential files to an AI assistant, or uses an unapproved coding tool to generate production code.",{"data":2304,"content":2305,"nodeType":860},{},[2306],{"data":2307,"marks":2308,"value":2309,"nodeType":864},{},[],"All of that is sensitive data leaving the organization through channels the security team can't see - and often accessible using personal accounts that can be compromised on personal devices or workstations. ",{"data":2311,"content":2312,"nodeType":860},{},[2313,2317,2322],{"data":2314,"marks":2315,"value":2316,"nodeType":864},{},[],"The 2026 DBIR's data loss prevention analysis underscores the scale — shadow AI is now the ",{"data":2318,"marks":2319,"value":2321,"nodeType":864},{},[2320],{"type":899},"third most common non-malicious insider action",{"data":2323,"marks":2324,"value":2325,"nodeType":864},{},[]," in DLP data, a 4x increase year-over-year. Across 858,000+ DLP events targeting GenAI tools, the most common data types being submitted were source code (28%), images (16%), structured data (14%), documents (13%), and PDFs (10%). That's not employees asking ChatGPT to fix their grammar — it's core intellectual property, production code, and internal documentation flowing into platforms the security team has no visibility into. But shadow apps themselves are only the most obvious part of the problem.",{"data":2327,"content":2328,"nodeType":1312},{},[2329],{"data":2330,"marks":2331,"value":2333,"nodeType":864},{},[2332],{"type":899},"Shadow tenants",{"data":2335,"content":2336,"nodeType":860},{},[2337,2341,2346,2350,2355],{"data":2338,"marks":2339,"value":2340,"nodeType":864},{},[],"Even when an organization has approved an AI tool — say, an enterprise ChatGPT deployment — employees frequently access the same app with personal accounts, creating shadow tenants that sit entirely outside organizational control. The DBIR found that ",{"data":2342,"marks":2343,"value":2345,"nodeType":864},{},[2344],{"type":899},"67% of GenAI users on corporate devices are using non-corporate accounts",{"data":2347,"marks":2348,"value":2349,"nodeType":864},{},[],", and our own data shows that ",{"data":2351,"marks":2352,"value":2354,"nodeType":864},{},[2353],{"type":899},"38% of file uploads to AI tools are made from shadow accounts",{"data":2356,"marks":2357,"value":2358,"nodeType":864},{},[]," rather than approved organizational ones.",{"data":2360,"content":2361,"nodeType":860},{},[2362],{"data":2363,"marks":2364,"value":2365,"nodeType":864},{},[],"When an organization approves Claude, ChatGPT, or another core AI platform, you typically also approve the OAuth integration and browser extension for core apps (e.g. M365, Google Workspace, and so on). When that integration is approved, it is approved for all tenants — not just your corporate tenant. ",{"data":2367,"content":2371,"nodeType":996},{"target":2368},{"sys":2369},{"id":2370,"type":1001,"linkType":1002},"3Rvw0n28AYIM3FQXtHyafD",[],{"data":2373,"content":2374,"nodeType":860},{},[2375],{"data":2376,"marks":2377,"value":2378,"nodeType":864},{},[],"This means that even if you've deployed enterprise controls around your sanctioned AI tools — DLP policies, retention settings, admin oversight — more than a third of the file uploads hitting AI tools are bypassing those controls entirely because they're happening through personal accounts on corporate devices.",{"data":2380,"content":2381,"nodeType":1312},{},[2382],{"data":2383,"marks":2384,"value":2386,"nodeType":864},{},[2385],{"type":899},"Shadow extensions",{"data":2388,"content":2389,"nodeType":860},{},[2390,2394,2398],{"data":2391,"marks":2392,"value":2393,"nodeType":864},{},[],"Many AI tools come with a browser extension counterpart, and there's a large ecosystem of third-party AI extensions that offer everything from writing assistance to automated data extraction. The average organization in our dataset has ",{"data":2395,"marks":2396,"value":2228,"nodeType":864},{},[2397],{"type":899},{"data":2399,"marks":2400,"value":2401,"nodeType":864},{},[]," deployed across its workforce, with the highest we observed reaching 163 — and since each of those average 17 different extensions may be installed by multiple employees, the actual number of individual extension installs across the organization is much higher still.",{"data":2403,"content":2404,"nodeType":860},{},[2405,2409,2417,2421,2426],{"data":2406,"marks":2407,"value":2408,"nodeType":864},{},[],"The extension dimension is particularly concerning because most extensions operate with significant privilege inside the browser — they can read and modify page content, access cookies and session tokens, and interact with virtually every web application an employee uses. As we detailed in our recent analysis of ",{"data":2410,"content":2412,"nodeType":883},{"uri":2411},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[2413],{"data":2414,"marks":2415,"value":2416,"nodeType":864},{},[],"browser extension risk scoring",{"data":2418,"marks":2419,"value":2420,"nodeType":864},{},[],", at least ",{"data":2422,"marks":2423,"value":2425,"nodeType":864},{},[2424],{"type":899},"46.76% of all extensions across Push customers have the permission combinations needed to perform account takeover with no user interaction",{"data":2427,"marks":2428,"value":2429,"nodeType":864},{},[],", and the extensions involved in every major supply chain breach of the past 18 months scored as normal or low-risk beforehand.",{"data":2431,"content":2435,"nodeType":996},{"target":2432},{"sys":2433},{"id":2434,"type":1001,"linkType":1002},"3z4JOMALI52xoOXZkzPHLD",[],{"data":2437,"content":2438,"nodeType":860},{},[2439,2443,2450],{"data":2440,"marks":2441,"value":2442,"nodeType":864},{},[],"AI extensions add a specific wrinkle to this problem: many are branded to look like official companions to well-known AI tools but are actually third-party creations with no affiliation to the original vendor. They're not necessarily malicious at the point of installation, but they're exactly the kind of extension that's likely to be ",{"data":2444,"content":2445,"nodeType":883},{"uri":2411},[2446],{"data":2447,"marks":2448,"value":2449,"nodeType":864},{},[],"acquired and weaponized",{"data":2451,"marks":2452,"value":2453,"nodeType":864},{},[]," down the line — and in the meantime, they're collecting data that their permissions entitle them to (which, in most cases, means everything the user can see in their browser).",{"data":2455,"content":2459,"nodeType":996},{"target":2456},{"sys":2457},{"id":2458,"type":1001,"linkType":1002},"6K3z67rohss6H3lCsSn12B",[],{"data":2461,"content":2462,"nodeType":1312},{},[2463],{"data":2464,"marks":2465,"value":2467,"nodeType":864},{},[2466],{"type":899},"Shadow integrations",{"data":2469,"content":2470,"nodeType":860},{},[2471],{"data":2472,"marks":2473,"value":2474,"nodeType":864},{},[],"The fourth dimension — and arguably the most dangerous — is shadow integrations: OAuth connections between AI tools and core enterprise apps that aren't known or approved by the security team. Even if an organization has approved an AI tool for standalone use, plugging that tool directly into Google Workspace, Microsoft 365, Salesforce, or any other one of the dozen or so SaaS apps in a typical user’s work stack is a fundamentally different risk decision, because it creates a persistent, programmatic bridge between your environment and a third party.",{"data":2476,"content":2477,"nodeType":860},{},[2478,2482,2487,2491,2496],{"data":2479,"marks":2480,"value":2481,"nodeType":864},{},[],"On average, we see ",{"data":2483,"marks":2484,"value":2486,"nodeType":864},{},[2485],{"type":899},"17 unique AI app OAuth integrations per organization",{"data":2488,"marks":2489,"value":2490,"nodeType":864},{},[]," in ",{"data":2492,"marks":2493,"value":2495,"nodeType":864},{},[2494],{"type":2246},"just",{"data":2497,"marks":2498,"value":2499,"nodeType":864},{},[]," Google Workspace and Microsoft 365 (to be clear: this number excludes the dozens of downstream apps the AI assistants are integrated with as well), with the highest reaching 55. Each of those represents a unique AI product that has been granted OAuth access — the total number of individual consent grants across users is larger, because popular integrations get authorized by multiple employees independently.",{"data":2501,"content":2502,"nodeType":860},{},[2503],{"data":2504,"marks":2505,"value":2506,"nodeType":864},{},[],"The actual number of AI-related OAuth connections across the full SaaS estate is considerably higher again, because AI tools that automate workflows need to be connected to be useful — pulling data from one app, analyzing it in another, presenting results in a third.",{"data":2508,"content":2509,"nodeType":860},{},[2510],{"data":2511,"marks":2512,"value":2513,"nodeType":864},{},[],"MCP connections use OAuth to achieve this interconnectivity in the same way, and AI coding agents create a particularly concentrated version of the risk: a single agent configuration can hold OAuth tokens for Jira, Confluence, Salesforce, GitHub, and more, meaning that compromising one agent — whether through prompt injection, a malicious repository config, or a supply chain attack on an MCP server — yields persistent, broadly scoped tokens for every service it was connected to, tokens that survive session restarts and generate audit log entries indistinguishable from legitimate user activity.",{"data":2515,"content":2516,"nodeType":860},{},[2517],{"data":2518,"marks":2519,"value":2520,"nodeType":864},{},[],"It's also worth noting that OAuth blast radius is almost always larger than organizations expect. A single well-permissioned user can expose secrets, dashboards, and internal tooling without tenant-wide admin access. And every new AI tool an employee connects makes the web of abusable permissions a little wider.",{"data":2522,"content":2526,"nodeType":996},{"target":2523},{"sys":2524},{"id":2525,"type":1001,"linkType":1002},"4SnzJ9T93gHzFIUASx7Yb3",[],{"data":2528,"content":2529,"nodeType":1005},{},[],{"data":2531,"content":2532,"nodeType":1009},{},[2533],{"data":2534,"marks":2535,"value":2537,"nodeType":864},{},[2536],{"type":899},"Why shadow AI needs a different solution to shadow SaaS",{"data":2539,"content":2540,"nodeType":860},{},[2541],{"data":2542,"marks":2543,"value":2544,"nodeType":864},{},[],"The reason it's worth distinguishing between these four dimensions isn't academic. Each one requires a different control, and addressing one doesn't solve the others.",{"data":2546,"content":2547,"nodeType":860},{},[2548],{"data":2549,"marks":2550,"value":2551,"nodeType":864},{},[],"Blocking unsanctioned AI apps does nothing for the personal accounts accessing approved ones, and neither addresses the average 17 different AI extensions running with broad browser permissions, let alone the dozens of OAuth integrations that have already been granted persistent access to core enterprise apps — and even auditing OAuth in Google Workspace and Microsoft 365, where the controls are relatively mature, leaves the broader SaaS estate unaddressed, where admin tooling is inconsistent and visibility is limited.",{"data":2553,"content":2554,"nodeType":860},{},[2555,2559,2567],{"data":2556,"marks":2557,"value":2558,"nodeType":864},{},[],"The tooling gap compounds the policy gap. ",{"data":2560,"content":2562,"nodeType":883},{"uri":2561},"https://pushsecurity.com/blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market/",[2563],{"data":2564,"marks":2565,"value":2566,"nodeType":864},{},[],"Omdia found",{"data":2568,"marks":2569,"value":2570,"nodeType":864},{},[]," that 58% of organizations rely on secure web gateways to secure GenAI usage — but an SWG can tell you that a user visited ChatGPT, not whether they pasted your source code into the prompt. That link between knowing where data went and knowing what the user actually did is the fundamental visibility gap that makes GenAI policies unenforceable without browser-layer tooling.",{"data":2572,"content":2573,"nodeType":1312},{},[2574],{"data":2575,"marks":2576,"value":2578,"nodeType":864},{},[2577],{"type":899},"Advice for security teams",{"data":2580,"content":2581,"nodeType":860},{},[2582],{"data":2583,"marks":2584,"value":2585,"nodeType":864},{},[],"The principles behind managing shadow AI are the same ones that have governed shadow SaaS and software supply chain management for years: default-deny where feasible, comprehensive inventory where it isn't, and continuous monitoring for changes that signal increased risk. But it's vital that teams act fast to stop the snowball.",{"data":2587,"content":2588,"nodeType":860},{},[2589],{"data":2590,"marks":2591,"value":2593,"nodeType":864},{},[2592],{"type":899},"That starts with visibility into which AI tools employees are actually using and which accounts they're using to access them — without that baseline, every other control is built on assumptions.",{"data":2595,"content":2596,"nodeType":860},{},[2597,2602,2606,2613],{"data":2598,"marks":2599,"value":2601,"nodeType":864},{},[2600],{"type":899},"Extensions",{"data":2603,"marks":2604,"value":2605,"nodeType":864},{},[]," need the same ",{"data":2607,"content":2608,"nodeType":883},{"uri":2411},[2609],{"data":2610,"marks":2611,"value":2612,"nodeType":864},{},[],"default-deny allowlisting approach",{"data":2614,"marks":2615,"value":2616,"nodeType":864},{},[]," that has been best practice for software management elsewhere: build a complete inventory, allowlist what's vetted, block everything else, and monitor the approved set for changes that precede weaponization.",{"data":2618,"content":2619,"nodeType":860},{},[2620,2625],{"data":2621,"marks":2622,"value":2624,"nodeType":864},{},[2623],{"type":899},"OAuth",{"data":2626,"marks":2627,"value":2628,"nodeType":864},{},[]," demands the most urgency, because each unmanaged integration is a persistent trust relationship that survives password resets and MFA changes — adopt default-deny for consent grants in your primary enterprise apps, routinely audit what's already connected, and critically extend that visibility beyond Google and Microsoft to the broader SaaS estate where the controls are weaker and the sprawl is harder to track.",{"data":2630,"content":2634,"nodeType":996},{"target":2631},{"sys":2632},{"id":2633,"type":1001,"linkType":1002},"3RFLFtJtDXvhTz1mVztfV9",[],{"data":2636,"content":2637,"nodeType":1005},{},[],{"data":2639,"content":2640,"nodeType":1009},{},[2641],{"data":2642,"marks":2643,"value":2645,"nodeType":864},{},[2644],{"type":899},"Browser visibility and control is key to de-risking AI adoption",{"data":2647,"content":2648,"nodeType":860},{},[2649],{"data":2650,"marks":2651,"value":2652,"nodeType":864},{},[],"AI usage is fundamentally browser-based activity — every LLM interaction, every prompt containing sensitive data, every AI agent authorization, every OAuth consent grant happens inside a browser session — which makes the browser the natural control point for AI governance across the workforce. ",{"data":2654,"content":2655,"nodeType":860},{},[2656],{"data":2657,"marks":2658,"value":2659,"nodeType":864},{},[],"Push tracks AI app usage and login security across the workforce, inventories and controls AI browser extensions, monitors and blocks OAuth consent flows across any app (not just the primary enterprise platforms), and gives security teams a single view of the full shadow AI picture across all four dimensions.",{"data":2661,"content":2662,"nodeType":860},{},[2663],{"data":2664,"marks":2665,"value":2666,"nodeType":864},{},[],"Shadow AI isn't a problem that will age well if ignored. Every week that passes without visibility adds more apps, more extensions, more integrations, and more potential breach paths into the environment — and as the Vercel breach demonstrated, it only takes one forgotten OAuth grant to turn an employee's idle curiosity into an organization-wide incident.",{"data":2668,"content":2669,"nodeType":860},{},[2670,2674,2682],{"data":2671,"marks":2672,"value":2673,"nodeType":864},{},[],"Learn more about how you can tackle ",{"data":2675,"content":2677,"nodeType":883},{"uri":2676},"https://pushsecurity.com/uc/shadow-ai",[2678],{"data":2679,"marks":2680,"value":580,"nodeType":864},{},[2681],{"type":1455},{"data":2683,"marks":2684,"value":2685,"nodeType":864},{},[]," with Push. ",{"data":2687,"content":2688,"nodeType":1005},{},[],{"data":2690,"content":2691,"nodeType":860},{},[2692],{"data":2693,"marks":2694,"value":1682,"nodeType":864},{},[],{"data":2696,"content":2697,"nodeType":860},{},[2698],{"data":2699,"marks":2700,"value":1689,"nodeType":864},{},[],{"data":2702,"content":2703,"nodeType":860},{},[2704,2708,2716],{"data":2705,"marks":2706,"value":2707,"nodeType":864},{},[],"Book a ",{"data":2709,"content":2710,"nodeType":883},{"uri":1700},[2711],{"data":2712,"marks":2713,"value":2715,"nodeType":864},{},[2714],{"type":1455},"live demo",{"data":2717,"marks":2718,"value":2719,"nodeType":864},{},[]," to learn more.","Shadow AI: what Push data reveals about the scale of the problem","Push telemetry shows the average organization has 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in use. Here's what it means for security.","2026-05-28T00:00:00.000Z","what-push-data-reveals-about-the-state-of-shadow-ai",{"items":2725},[2726,2730],{"sys":2727,"name":2729},{"id":2728},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"sys":2731,"name":297},{"id":2732},"3pjES4THCIfSAwhGdNwBcy",{"items":2734},[2735],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":2739},"Dan Green","Dan","Threat Research",{"url":2740},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":2059,"sys":2742,"content":2744,"title":3608,"synopsis":3609,"hashTags":59,"publishedDate":3610,"slug":3611,"tagsCollection":3612,"authorsCollection":3618},{"id":2743},"6Xn377JQfbDz49Np74cbGl",{"json":2745},{"data":2746,"content":2747,"nodeType":856},{},[2748,2755,2786,2804,2809,2816,2832,2835,2843,2861,2925,2932,2938,2945,3028,3035,3042,3058,3061,3069,3076,3083,3091,3098,3110,3116,3123,3130,3137,3140,3148,3164,3180,3187,3194,3201,3222,3308,3315,3322,3325,3333,3349,3356,3363,3371,3374,3382,3400,3407,3414,3447,3454,3461,3464,3472,3479,3491,3497,3509,3521,3527,3539,3561,3568,3571,3579,3586,3592],{"data":2749,"content":2750,"nodeType":860},{},[2751],{"data":2752,"marks":2753,"value":2754,"nodeType":864},{},[],"Most security leaders I talk to know they have an AI problem. They've seen the board questions, read the reports, maybe even drafted a policy. But when they start measuring where they stand — not plans or roadmaps, but actual current state — the gap between awareness and operational capability comes into focus.",{"data":2756,"content":2757,"nodeType":860},{},[2758,2762,2770,2774,2782],{"data":2759,"marks":2760,"value":2761,"nodeType":864},{},[],"The ",{"data":2763,"content":2765,"nodeType":883},{"uri":2764},"https://pushsecurity.com/blog/verizon-dbir-2026-review",[2766],{"data":2767,"marks":2768,"value":2769,"nodeType":864},{},[],"2026 Verizon DBIR",{"data":2771,"marks":2772,"value":2773,"nodeType":864},{},[]," quantifies the scale: 45% of employees are now regular AI users on corporate devices (up from 15% the prior year), with 67% using personal accounts. ",{"data":2775,"content":2777,"nodeType":883},{"uri":2776},"https://pushsecurity.com/blog/what-push-data-reveals-about-the-state-of-shadow-ai",[2778],{"data":2779,"marks":2780,"value":2781,"nodeType":864},{},[],"Push data",{"data":2783,"marks":2784,"value":2785,"nodeType":864},{},[]," further shows that 38% of file uploads to AI tools come from those shadow accounts rather than approved organizational ones — and the DBIR shows what's going into them: of 858,000+ DLP events targeting GenAI applications, the most common data types were source code (28%), structured data (14%), and documents and PDFs (23% combined).",{"data":2787,"content":2788,"nodeType":860},{},[2789,2793,2800],{"data":2790,"marks":2791,"value":2792,"nodeType":864},{},[],"The average organization now has ",{"data":2794,"content":2795,"nodeType":883},{"uri":2776},[2796],{"data":2797,"marks":2798,"value":2799,"nodeType":864},{},[],"16 unique AI apps, 17 AI browser extensions, and 17 AI OAuth integrations",{"data":2801,"marks":2802,"value":2803,"nodeType":864},{},[]," in active use, most unapproved. Shadow AI was the third most common non-malicious insider action in the DBIR, up 4x year over year.",{"data":2805,"content":2808,"nodeType":996},{"target":2806},{"sys":2807},{"id":1040,"type":1001,"linkType":1002},[],{"data":2810,"content":2811,"nodeType":860},{},[2812],{"data":2813,"marks":2814,"value":2815,"nodeType":864},{},[],"These statistics expose an attack surface and unmanaged risks at a high level. But the real problem is that most organizations can't produce a basic inventory of which AI tools are in use, let alone demonstrate controls around any of them. ",{"data":2817,"content":2818,"nodeType":860},{},[2819,2823,2828],{"data":2820,"marks":2821,"value":2822,"nodeType":864},{},[],"That gap between awareness and capability is where most organizations are stuck. And understanding ",{"data":2824,"marks":2825,"value":2827,"nodeType":864},{},[2826],{"type":2246},"why",{"data":2829,"marks":2830,"value":2831,"nodeType":864},{},[]," they're stuck requires a framework for what progress actually looks like.",{"data":2833,"content":2834,"nodeType":1005},{},[],{"data":2836,"content":2837,"nodeType":1009},{},[2838],{"data":2839,"marks":2840,"value":2842,"nodeType":864},{},[2841],{"type":899},"A model for measuring what most organizations already feel",{"data":2844,"content":2845,"nodeType":860},{},[2846,2850,2857],{"data":2847,"marks":2848,"value":2849,"nodeType":864},{},[],"Chris Cochran's ",{"data":2851,"content":2853,"nodeType":883},{"uri":2852},"https://sansorg.egnyte.com/dl/XtgqfjkjBjp8",[2854],{"data":2855,"marks":2856,"value":1108,"nodeType":864},{},[],{"data":2858,"marks":2859,"value":2860,"nodeType":864},{},[],", published earlier this year, provides a framework for addressing this gap. It defines five stages of AI security maturity across three pillars:",{"data":2862,"content":2863,"nodeType":941},{},[2864,2880,2896],{"data":2865,"content":2866,"nodeType":945},{},[2867],{"data":2868,"content":2869,"nodeType":860},{},[2870,2876],{"data":2871,"marks":2872,"value":2875,"nodeType":864},{},[2873,2874],{"type":899},{"type":1455},"Protect AI:",{"data":2877,"marks":2878,"value":2879,"nodeType":864},{},[]," Defending against AI-enabled threats like adversarial attacks, prompt injection, compromised browser extensions, and AI agents operating with unchecked permissions.",{"data":2881,"content":2882,"nodeType":945},{},[2883],{"data":2884,"content":2885,"nodeType":860},{},[2886,2892],{"data":2887,"marks":2888,"value":2891,"nodeType":864},{},[2889,2890],{"type":899},{"type":1455},"Utilize AI:",{"data":2893,"marks":2894,"value":2895,"nodeType":864},{},[]," Using AI to strengthen security operations by using AI-powered detection and triage, behavioral analytics, and automated response playbooks.",{"data":2897,"content":2898,"nodeType":945},{},[2899],{"data":2900,"content":2901,"nodeType":860},{},[2902,2908,2912,2921],{"data":2903,"marks":2904,"value":2907,"nodeType":864},{},[2905,2906],{"type":899},{"type":1455},"Govern AI:",{"data":2909,"marks":2910,"value":2911,"nodeType":864},{},[]," Managing how the organization adopts and uses AI tools. Things like acceptable use policies, shadow AI discovery, data classification, access controls, and risk assessment. This is the pillar that gets the most attention in boardroom conversations today, driven in part by ",{"data":2913,"content":2915,"nodeType":883},{"uri":2914},"https://pushsecurity.com/blog/browser-visibility-and-control-can-achieve-ai-compliance",[2916],{"data":2917,"marks":2918,"value":2920,"nodeType":864},{},[2919],{"type":1455},"regulatory pressure",{"data":2922,"marks":2923,"value":2924,"nodeType":864},{},[],".",{"data":2926,"content":2927,"nodeType":860},{},[2928],{"data":2929,"marks":2930,"value":2931,"nodeType":864},{},[],"How an organization invests across these three pillars, and whether it invests across all of them, determines whether it advances toward maturity in this area or stalls out at the early steps.",{"data":2933,"content":2937,"nodeType":996},{"target":2934},{"sys":2935},{"id":2936,"type":1001,"linkType":1002},"1JV3KG97JQNFKwODnMCMq2",[],{"data":2939,"content":2940,"nodeType":860},{},[2941],{"data":2942,"marks":2943,"value":2944,"nodeType":864},{},[],"The SANS AI maturity model outlines 5 stages that organizations must progress through in order to reach an optimal security posture:",{"data":2946,"content":2947,"nodeType":941},{},[2948,2964,2980,2996,3012],{"data":2949,"content":2950,"nodeType":945},{},[2951],{"data":2952,"content":2953,"nodeType":860},{},[2954,2960],{"data":2955,"marks":2956,"value":2959,"nodeType":864},{},[2957,2958],{"type":899},{"type":1455},"Stage 1 (Unaware / Ad Hoc)",{"data":2961,"marks":2962,"value":2963,"nodeType":864},{},[]," is where employees are freely using AI tools with no oversight, no inventory exists, and leadership may not even know how much AI is in use. There's no policy to violate, so technically it's not even shadow AI yet; it's just unmanaged adoption.",{"data":2965,"content":2966,"nodeType":945},{},[2967],{"data":2968,"content":2969,"nodeType":860},{},[2970,2976],{"data":2971,"marks":2972,"value":2975,"nodeType":864},{},[2973,2974],{"type":899},{"type":1455},"Stage 2 (Reactive / Policy-Emerging)",{"data":2977,"marks":2978,"value":2979,"nodeType":864},{},[]," means a policy exists, but it's course-grained: \"Don't use AI\" or \"use with caution.\" Known AI tools may be blocked at the network level. Security teams are learning about AI-specific threats but don't have dedicated expertise or tooling.",{"data":2981,"content":2982,"nodeType":945},{},[2983],{"data":2984,"content":2985,"nodeType":860},{},[2986,2992],{"data":2987,"marks":2988,"value":2991,"nodeType":864},{},[2989,2990],{"type":899},{"type":1455},"Stage 3 (Defined / Risk-Informed)",{"data":2993,"marks":2994,"value":2995,"nodeType":864},{},[]," is where things get intentional. AI usage is governed through enterprise tools rather than outright bans. AI systems are included in security assessments. The organization can demonstrate mature governance to regulators and partners. For many organizations, this is a strong and defensible operating position.",{"data":2997,"content":2998,"nodeType":945},{},[2999],{"data":3000,"content":3001,"nodeType":860},{},[3002,3008],{"data":3003,"marks":3004,"value":3007,"nodeType":864},{},[3005,3006],{"type":899},{"type":1455},"Stage 4 (Managed / Integrated)",{"data":3009,"marks":3010,"value":3011,"nodeType":864},{},[]," means AI is deeply embedded in security operations with measurable outcomes. AI systems are secured by design. Risk is quantified, not estimated. Decisions are data-driven. This is where organizations can handle AI-specific threats and operate at the tempo that AI-augmented adversaries demand.",{"data":3013,"content":3014,"nodeType":945},{},[3015],{"data":3016,"content":3017,"nodeType":860},{},[3018,3024],{"data":3019,"marks":3020,"value":3023,"nodeType":864},{},[3021,3022],{"type":899},{"type":1455},"Stage 5 (Optimizing / Adaptive)",{"data":3025,"marks":3026,"value":3027,"nodeType":864},{},[]," is the frontier of AI-native security with self-improving defenses. Elements of this stage exist primarily in large technology companies, defense contractors, and AI-native firms. For most organizations, this is a multi-year journey.",{"data":3029,"content":3030,"nodeType":860},{},[3031],{"data":3032,"marks":3033,"value":3034,"nodeType":864},{},[],"Most of the security leaders I talk to land between Stage 1 and Stage 2. They have awareness, maybe a policy, but not the tooling or telemetry to demonstrate much beyond that. ",{"data":3036,"content":3037,"nodeType":860},{},[3038],{"data":3039,"marks":3040,"value":3041,"nodeType":864},{},[],"The model is pragmatic about these challenges. It doesn't expect every organization to reach Stage 5, and it adjusts maturity targets by sector. ",{"data":3043,"content":3044,"nodeType":860},{},[3045,3049,3054],{"data":3046,"marks":3047,"value":3048,"nodeType":864},{},[],"But it ",{"data":3050,"marks":3051,"value":3053,"nodeType":864},{},[3052],{"type":2246},"does",{"data":3055,"marks":3056,"value":3057,"nodeType":864},{},[]," require evidence of progress, not just intent. And for the majority sitting at Stage 2, the hard part is identifying the right steps to move from being merely reactive to a posture of operational readiness. That’s the chasm to cross.",{"data":3059,"content":3060,"nodeType":1005},{},[],{"data":3062,"content":3063,"nodeType":1009},{},[3064],{"data":3065,"marks":3066,"value":3068,"nodeType":864},{},[3067],{"type":899},"The chasm",{"data":3070,"content":3071,"nodeType":860},{},[3072],{"data":3073,"marks":3074,"value":3075,"nodeType":864},{},[],"For the organizations sitting at Stage 2, current state often looks like this: They've written an AI acceptable use policy, and maybe they've blocked known AI apps at the network level. They've trained employees on what's allowed and what isn't. ",{"data":3077,"content":3078,"nodeType":860},{},[3079],{"data":3080,"marks":3081,"value":3082,"nodeType":864},{},[],"To be sure, blocking is the fastest lever a security team can pull, and it represents visible progress to the business. The problem is that it rarely stays effective. ",{"data":3084,"content":3085,"nodeType":860},{},[3086],{"data":3087,"marks":3088,"value":3090,"nodeType":864},{},[3089],{"type":899},"SANS calls the pattern that traps most organizations at Stage 2 the \"Framework of No.\" ",{"data":3092,"content":3093,"nodeType":860},{},[3094],{"data":3095,"marks":3096,"value":3097,"nodeType":864},{},[],"\"A block-based AI policy may feel like risk management, but practitioner experience shows it typically drives AI usage underground rather than preventing it,” the report notes. “This is the pattern SANS has documented as the 'Framework of No,' and it is why the Stage 2 to Stage 3 transition is so critical.\"",{"data":3099,"content":3100,"nodeType":860},{},[3101,3106],{"data":3102,"marks":3103,"value":3105,"nodeType":864},{},[3104],{"type":2246},"This",{"data":3107,"marks":3108,"value":3109,"nodeType":864},{},[]," is the chasm. On one side: awareness and policy. On the other: operational capability - the tooling, telemetry, and controls that let a security team see what's happening and respond to it. Most organizations are standing on the awareness side, looking across, not sure how to get over.",{"data":3111,"content":3115,"nodeType":996},{"target":3112},{"sys":3113},{"id":3114,"type":1001,"linkType":1002},"187mKPZV8tVbsw17L2cWIU",[],{"data":3117,"content":3118,"nodeType":860},{},[3119],{"data":3120,"marks":3121,"value":3122,"nodeType":864},{},[],"The model is specific about what crossing requires. The steps from Stage 2 to Stage 3 include technical BYOAI discovery (not a survey, but automated discovery), AI-specific data classification, AI-aware controls, and a cross-functional governance body. Data classification is a critical prerequisite: \"You cannot write an effective AI policy without knowing where sensitive data lives,\" the report emphasizes.",{"data":3124,"content":3125,"nodeType":860},{},[3126],{"data":3127,"marks":3128,"value":3129,"nodeType":864},{},[],"These are visibility and measurement problems before they're policy problems. You can't govern what you can't see. You can't classify risk you can't measure. And a blocklist that pushes usage underground doesn't give you either: it just makes the gap between your policy and your reality harder to detect.",{"data":3131,"content":3132,"nodeType":860},{},[3133],{"data":3134,"marks":3135,"value":3136,"nodeType":864},{},[],"Getting this visibility right is necessary for crossing the chasm. But it’s not the only step organizations must undertake if they want to address their AI risk.",{"data":3138,"content":3139,"nodeType":1005},{},[],{"data":3141,"content":3142,"nodeType":1009},{},[3143],{"data":3144,"marks":3145,"value":3147,"nodeType":864},{},[3146],{"type":899},"Governance is key, but don't forget about protection",{"data":3149,"content":3150,"nodeType":860},{},[3151,3155,3160],{"data":3152,"marks":3153,"value":3154,"nodeType":864},{},[],"Most AI security conversations today - the vendor pitches, board decks, and compliance checklists - are about the ",{"data":3156,"marks":3157,"value":3159,"nodeType":864},{},[3158],{"type":899},"Govern",{"data":3161,"marks":3162,"value":3163,"nodeType":864},{},[]," pillar. Shadow AI discovery. Usage policies. Data classification. Controls around what employees paste into AI prompts or upload to AI tools. It's important work.",{"data":3165,"content":3166,"nodeType":860},{},[3167,3171,3176],{"data":3168,"marks":3169,"value":3170,"nodeType":864},{},[],"But the SANS model gives roughly equal weight to a second pillar that gets almost no attention: ",{"data":3172,"marks":3173,"value":3175,"nodeType":864},{},[3174],{"type":899},"Protect",{"data":3177,"marks":3178,"value":3179,"nodeType":864},{},[]," - defending against AI-enabled attacks.",{"data":3181,"content":3182,"nodeType":860},{},[3183],{"data":3184,"marks":3185,"value":3186,"nodeType":864},{},[],"The Protect pillar starts from a stark baseline. At Stage 1, most organizations have no visibility into which AI agents or browser extensions have access to their corporate environment, let alone a framework for understanding how those could be attacked. ",{"data":3188,"content":3189,"nodeType":860},{},[3190],{"data":3191,"marks":3192,"value":3193,"nodeType":864},{},[],"By Stage 3, the model expects runtime validation of AI tools and plugins, detection capabilities mapped to AI-specific attack frameworks, and controls that cover the growing surface area of agentic AI. ",{"data":3195,"content":3196,"nodeType":860},{},[3197],{"data":3198,"marks":3199,"value":3200,"nodeType":864},{},[],"By Stage 4, organizations need real-time monitoring of AI agent behavior and defenses against attacks that exploit trust relationships between AI systems — capabilities most security teams haven't started scoping, much less building or procuring.",{"data":3202,"content":3203,"nodeType":860},{},[3204,3208,3218],{"data":3205,"marks":3206,"value":3207,"nodeType":864},{},[],"These are detection and response capabilities, not governance exercises — and the attacks they address are already well underway. ",{"data":3209,"content":3211,"nodeType":883},{"uri":3210},"https://pushsecurity.com/blog/the-cisos-data-problem-and-how-browser-telemetry-can-help/",[3212],{"data":3213,"marks":3214,"value":3217,"nodeType":864},{},[3215,3216],{"type":1455},{"type":899},"One in three phishing payloads",{"data":3219,"marks":3220,"value":3221,"nodeType":864},{},[]," intercepted by Push arrive outside of email, through channels where most security controls don't exist. Evidence of the growth of browser-based attack methods enabled by AI tooling abounds:",{"data":3223,"content":3224,"nodeType":941},{},[3225,3247,3269],{"data":3226,"content":3227,"nodeType":945},{},[3228],{"data":3229,"content":3230,"nodeType":860},{},[3231,3235,3243],{"data":3232,"marks":3233,"value":3234,"nodeType":864},{},[],"CrowdStrike's 2026 Global Threat Report documented a ",{"data":3236,"content":3238,"nodeType":883},{"uri":3237},"https://www.crowdstrike.com/explore/2026-global-threat-report",[3239],{"data":3240,"marks":3241,"value":3242,"nodeType":864},{},[],"563% increase in ClickFix lures",{"data":3244,"marks":3245,"value":3246,"nodeType":864},{},[]," — fake CAPTCHA pages that trick users into executing malicious commands on their own machines.",{"data":3248,"content":3249,"nodeType":945},{},[3250],{"data":3251,"content":3252,"nodeType":860},{},[3253,3257,3265],{"data":3254,"marks":3255,"value":3256,"nodeType":864},{},[],"Push has tracked a ",{"data":3258,"content":3260,"nodeType":883},{"uri":3259},"https://pushsecurity.com/blog/device-code-phishing/",[3261],{"data":3262,"marks":3263,"value":3264,"nodeType":864},{},[],"37x increase in device code phishing",{"data":3266,"marks":3267,"value":3268,"nodeType":864},{},[]," since the start of 2026, with 18+ distinct kits now offering the technique.",{"data":3270,"content":3271,"nodeType":945},{},[3272],{"data":3273,"content":3274,"nodeType":860},{},[3275,3278,3287,3291,3296,3300,3305],{"data":3276,"marks":3277,"value":21,"nodeType":864},{},[],{"data":3279,"content":3281,"nodeType":883},{"uri":3280},"https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack",[3282],{"data":3283,"marks":3284,"value":3286,"nodeType":864},{},[3285],{"type":1455},"Anthropic",{"data":3288,"marks":3289,"value":3290,"nodeType":864},{},[]," identified ",{"data":3292,"marks":3293,"value":3295,"nodeType":864},{},[3294],{"type":899},"793 threat actors using AI",{"data":3297,"marks":3298,"value":3299,"nodeType":864},{},[]," for malicious cybersecurity purposes between March 2025 and February 2026, with the 2026 Verizon DBIR finding that ",{"data":3301,"marks":3302,"value":3304,"nodeType":864},{},[3303],{"type":899},"44% of AI-assisted initial access was phishing-related",{"data":3306,"marks":3307,"value":2924,"nodeType":864},{},[],{"data":3309,"content":3310,"nodeType":860},{},[3311],{"data":3312,"marks":3313,"value":3314,"nodeType":864},{},[],"Attackers are already vibecoding phishing kits, rotating infrastructure daily, and exploiting identity flows that traditional endpoint and network tools can't see.",{"data":3316,"content":3317,"nodeType":860},{},[3318],{"data":3319,"marks":3320,"value":3321,"nodeType":864},{},[],"The SANS model makes the speed argument a central focus at Stage 4: Detection built for human-pace adversaries is increasingly insufficient when threats operate at machine speed. For organizations investing exclusively in AI governance, AI-enabled threats represent an entire category of risk that is not being addressed.",{"data":3323,"content":3324,"nodeType":1005},{},[],{"data":3326,"content":3327,"nodeType":1312},{},[3328],{"data":3329,"marks":3330,"value":3332,"nodeType":864},{},[3331],{"type":899},"Why governance alone can't close the gap",{"data":3334,"content":3335,"nodeType":860},{},[3336,3340,3345],{"data":3337,"marks":3338,"value":3339,"nodeType":864},{},[],"An organization can have an AI policy, shadow AI discovery, data classification, and usage controls, and ",{"data":3341,"marks":3342,"value":3344,"nodeType":864},{},[3343],{"type":2246},"still",{"data":3346,"marks":3347,"value":3348,"nodeType":864},{},[]," be exposed. When an employee hits a device code phishing page or a ClickFix lure, the governance program documented the risk perfectly. It just couldn't stop the attack. The policy existed but the detection (and ideally, mitigation) didn't.",{"data":3350,"content":3351,"nodeType":860},{},[3352],{"data":3353,"marks":3354,"value":3355,"nodeType":864},{},[],"The reverse is equally true, and it's why the SANS model treats the pillars as interdependent rather than sequential. Detection capabilities that fire into a void with no policy to act on findings, no classification to assess exposure, and no governance body to shape proactive policy just create alerts, not security. ",{"data":3357,"content":3358,"nodeType":860},{},[3359],{"data":3360,"marks":3361,"value":3362,"nodeType":864},{},[],"Yet most organizations are only investing heavily in one side of the solution, which is almost always Govern. The maturity model is explicit about the risks of this approach: Governance with no attack detection leaves a critical gap. ",{"data":3364,"content":3365,"nodeType":860},{},[3366],{"data":3367,"marks":3368,"value":3370,"nodeType":864},{},[3369],{"type":899},"Closing the gap requires a control point where both problems are visible and addressable.",{"data":3372,"content":3373,"nodeType":1005},{},[],{"data":3375,"content":3376,"nodeType":1009},{},[3377],{"data":3378,"marks":3379,"value":3381,"nodeType":864},{},[3380],{"type":899},"Crossing the chasm requires addressing both pillars at once",{"data":3383,"content":3384,"nodeType":860},{},[3385,3389,3396],{"data":3386,"marks":3387,"value":3388,"nodeType":864},{},[],"The bottleneck for most security programs ",{"data":3390,"content":3391,"nodeType":883},{"uri":3210},[3392],{"data":3393,"marks":3394,"value":3395,"nodeType":864},{},[],"isn't frameworks or strategy — it's data quality",{"data":3397,"marks":3398,"value":3399,"nodeType":864},{},[],". For teams taking on the dual problems of shadow AI and AI-enabled attacks, browser telemetry is the foundation to any meaningful solution. That’s because both problems converge in the same place.",{"data":3401,"content":3402,"nodeType":860},{},[3403],{"data":3404,"marks":3405,"value":3406,"nodeType":864},{},[],"AI-enabled phishing attacks, credential theft, malicious browser extensions, and OAuth exploitation happen in the browser. So do shadow AI adoption, sensitive data pasted into AI prompts, file uploads to unapproved tools, and unauthorized integrations. The browser is where external attacks and internal misuse are both visible and stoppable.",{"data":3408,"content":3409,"nodeType":860},{},[3410],{"data":3411,"marks":3412,"value":3413,"nodeType":864},{},[],"For the security team trying to advance past the Framework of No, browser telemetry replaces the blunt instrument of network-level blocking with actual visibility:",{"data":3415,"content":3416,"nodeType":941},{},[3417,3427,3437],{"data":3418,"content":3419,"nodeType":945},{},[3420],{"data":3421,"content":3422,"nodeType":860},{},[3423],{"data":3424,"marks":3425,"value":3426,"nodeType":864},{},[],"which AI apps are in use (including personal account usage)",{"data":3428,"content":3429,"nodeType":945},{},[3430],{"data":3431,"content":3432,"nodeType":860},{},[3433],{"data":3434,"marks":3435,"value":3436,"nodeType":864},{},[],"what data is moving into them (file uploads, clipboard activity)",{"data":3438,"content":3439,"nodeType":945},{},[3440],{"data":3441,"content":3442,"nodeType":860},{},[3443],{"data":3444,"marks":3445,"value":3446,"nodeType":864},{},[],"graduated controls - per-app, per-user group, per-content pattern - that can monitor, warn, or block based on context rather than allow/deny",{"data":3448,"content":3449,"nodeType":860},{},[3450],{"data":3451,"marks":3452,"value":3453,"nodeType":864},{},[],"The same browser-layer instrumentation can also provide real-time detection of credential phishing, ClickFix, adversary-in-the-middle attacks, and device code phishing. And it can detect and disable malicious browser extensions based on confirmed threat intelligence, monitor OAuth integrations, and generate the identity attack surface data (login behaviors, MFA gaps, SSO coverage) that the Protect pillar requires at Stage 3 maturity and beyond.",{"data":3455,"content":3456,"nodeType":860},{},[3457],{"data":3458,"marks":3459,"value":3460,"nodeType":864},{},[],"We built Push around this insight: that the browser is where both problems converge, and a single deployment can advance AI security maturity in both areas simultaneously. The SANS model makes the same argument.",{"data":3462,"content":3463,"nodeType":1005},{},[],{"data":3465,"content":3466,"nodeType":1009},{},[3467],{"data":3468,"marks":3469,"value":3471,"nodeType":864},{},[3470],{"type":899},"Where to start: 5 steps to maturity with Push",{"data":3473,"content":3474,"nodeType":860},{},[3475],{"data":3476,"marks":3477,"value":3478,"nodeType":864},{},[],"The chasm closes when organizations make meaningful strides forward in both AI governance and proactive defense against AI-enabled attacks. Here's the starting plan that I'd recommend, and Push can provide the tooling to automate these steps:",{"data":3480,"content":3481,"nodeType":860},{},[3482,3487],{"data":3483,"marks":3484,"value":3486,"nodeType":864},{},[3485],{"type":899},"1. Build an AI inventory automatically.",{"data":3488,"marks":3489,"value":3490,"nodeType":864},{},[]," Every stage transition in the SANS model starts with knowing what's in your environment. A manual survey won't cut it; employees won't self-report the tools they're not sure they're allowed to use, and may overlook apps where AI is a feature but not the core function (AI-enabled apps). Instead, organizations should deploy automated discovery for AI apps, browser extensions, and OAuth integrations across the workforce - including the ones using personal accounts. Until this inventory exists, every policy decision is based on incomplete information.",{"data":3492,"content":3496,"nodeType":996},{"target":3493},{"sys":3494},{"id":3495,"type":1001,"linkType":1002},"2t3u0NydllImv6NzvAY058",[],{"data":3498,"content":3499,"nodeType":860},{},[3500,3505],{"data":3501,"marks":3502,"value":3504,"nodeType":864},{},[3503],{"type":899},"2. Classify what you find.",{"data":3506,"marks":3507,"value":3508,"nodeType":864},{},[]," Not all AI usage carries the same risk. A developer pasting code into ChatGPT and a salesperson using an AI notetaker are different problems. Once you can see the tools, categorize them by data sensitivity, authorization status, and access scope. The SANS model calls out data classification as a critical prerequisite; you can't write an effective AI policy without knowing where sensitive data lives.",{"data":3510,"content":3511,"nodeType":860},{},[3512,3517],{"data":3513,"marks":3514,"value":3516,"nodeType":864},{},[3515],{"type":899},"3. Turn on browser-layer detection.",{"data":3518,"marks":3519,"value":3520,"nodeType":864},{},[]," This is the step most organizations skip, and it's why addressing only the Protect pillar will keep you at Stage 1. AI-enabled phishing, ClickFix attacks, device code phishing, malicious extension updates, and OAuth exploitation all execute in the browser. Without detection in that layer, there's no visibility into the fastest-growing attack category, and no path to advancing beyond basic AI usage awareness.",{"data":3522,"content":3526,"nodeType":996},{"target":3523},{"sys":3524},{"id":3525,"type":1001,"linkType":1002},"1fzuGjA6VSbVl1p7vM1mt7",[],{"data":3528,"content":3529,"nodeType":860},{},[3530,3535],{"data":3531,"marks":3532,"value":3534,"nodeType":864},{},[3533],{"type":899},"4. Move from blocking to graduated controls.",{"data":3536,"marks":3537,"value":3538,"nodeType":864},{},[]," The Framework of No fails because it's binary: allow or deny, with nothing in between. Organizations that cross the chasm adopt monitor, warn, and block modes — per app, per user group, per content pattern. Monitor first to see what's happening, warn to change behavior without disrupting workflows, and block only where the risk justifies it. This is the operational difference between Stage 2 and Stage 3.",{"data":3540,"content":3541,"nodeType":860},{},[3542,3547,3551,3557],{"data":3543,"marks":3544,"value":3546,"nodeType":864},{},[3545],{"type":899},"5. Assess yourself honestly against evidence, not aspiration.",{"data":3548,"marks":3549,"value":3550,"nodeType":864},{},[]," The ",{"data":3552,"content":3553,"nodeType":883},{"uri":2852},[3554],{"data":3555,"marks":3556,"value":1108,"nodeType":864},{},[],{"data":3558,"marks":3559,"value":3560,"nodeType":864},{},[]," includes a self-assessment and industry-specific weighting profiles. The value isn't in the score, but in identifying which pillar is keeping you from advancing.",{"data":3562,"content":3563,"nodeType":860},{},[3564],{"data":3565,"marks":3566,"value":3567,"nodeType":864},{},[],"The organizations that cross the AI security chasm will be the ones that recognize early that AI security isn't one problem with one solution. It's two problems that happen to share a control point. The most efficient path forward is a platform that addresses both.",{"data":3569,"content":3570,"nodeType":1005},{},[],{"data":3572,"content":3573,"nodeType":1009},{},[3574],{"data":3575,"marks":3576,"value":3578,"nodeType":864},{},[3577],{"type":899},"Learn more about Push",{"data":3580,"content":3581,"nodeType":860},{},[3582],{"data":3583,"marks":3584,"value":3585,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser - high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":3587,"content":3588,"nodeType":860},{},[3589],{"data":3590,"marks":3591,"value":1689,"nodeType":864},{},[],{"data":3593,"content":3594,"nodeType":860},{},[3595,3598,3605],{"data":3596,"marks":3597,"value":2707,"nodeType":864},{},[],{"data":3599,"content":3600,"nodeType":883},{"uri":1700},[3601],{"data":3602,"marks":3603,"value":2715,"nodeType":864},{},[3604],{"type":1455},{"data":3606,"marks":3607,"value":2719,"nodeType":864},{},[],"Crossing the AI security chasm with the SANS AI security maturity model","Most organizations know they have an AI security problem. A new SANS framework shows why so few are making progress - and what it actually takes to get unstuck.","2026-06-24T00:00:00.000Z","crossing-the-ai-security-chasm-sans-security-maturity-model",{"items":3613},[3614,3616],{"sys":3615,"name":297},{"id":2732},{"sys":3617,"name":2729},{"id":2728},{"items":3619},[3620],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":3624},"Mark Orlando","Mark","Field CTO",{"url":3625},"https://images.ctfassets.net/y1cdw1ablpvd/592PMwIQQFaa24k5SKBEKF/a33090d0ad95d1e3081f5d16a46ba826/image__68_.png",{"__typename":2059,"sys":3627,"content":3629,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":4869,"authorsCollection":4875},{"id":3628},"6MoHWfQlVildcFYKSbfMcE",{"json":3630},{"data":3631,"content":3632,"nodeType":856},{},[3633,3649,3655,3662,3669,3675,3678,3686,3694,3713,3761,3767,3782,3785,3793,3800,3828,3869,3876,3879,3887,3895,3902,3908,3915,3918,3926,3933,3975,4011,4018,4021,4029,4036,4061,4068,4113,4120,4123,4131,4139,4184,4191,4197,4200,4208,4216,4248,4255,4261,4268,4271,4279,4287,4316,4323,4330,4337,4340,4348,4356,4363,4369,4376,4399,4428,4431,4439,4447,4454,4461,4464,4472,4534,4537,4545,4552,4846,4849],{"data":3634,"content":3635,"nodeType":860},{},[3636,3640,3645],{"data":3637,"marks":3638,"value":3639,"nodeType":864},{},[],"Browser security solutions are one of the most significant additions to the enterprise security stack in recent years — and the data shows it. The browser is where ",{"data":3641,"marks":3642,"value":3644,"nodeType":864},{},[3643],{"type":899},"85% of work now happens",{"data":3646,"marks":3647,"value":3648,"nodeType":864},{},[],", where AI tools are accessed, and where attackers increasingly choose to strike.",{"data":3650,"content":3654,"nodeType":996},{"target":3651},{"sys":3652},{"id":3653,"type":1001,"linkType":1002},"5P6PyFbn4EakRNlIWtNzyL",[],{"data":3656,"content":3657,"nodeType":860},{},[3658],{"data":3659,"marks":3660,"value":3661,"nodeType":864},{},[],"But browser security is a nascent category. Getting a clear picture of which solution is right for your team, and how to get the most out of it, isn't straightforward. Current solutions on the market serve a wide range of IT and security use cases, with varying degrees of depth and differentiation across them. Not all use cases are equal in terms of their security value, and not all of them are best addressed in the browser.",{"data":3663,"content":3664,"nodeType":860},{},[3665],{"data":3666,"marks":3667,"value":3668,"nodeType":864},{},[],"This article ranks the security problems that browser security solutions can address by the value they deliver: a combination of the risk reduction on offer, and the degree to which the browser is genuinely the best (or only) layer to solve the problem. ",{"data":3670,"content":3674,"nodeType":996},{"target":3671},{"sys":3672},{"id":3673,"type":1001,"linkType":1002},"6SJPvEHizSYk29lEvVVNj",[],{"data":3676,"content":3677,"nodeType":1005},{},[],{"data":3679,"content":3680,"nodeType":1009},{},[3681],{"data":3682,"marks":3683,"value":3685,"nodeType":864},{},[3684],{"type":899},"#1 — Account takeover prevention: detecting credential attacks across all vectors",{"data":3687,"content":3688,"nodeType":860},{},[3689],{"data":3690,"marks":3691,"value":3693,"nodeType":864},{},[3692],{"type":899},"Security value: Very high | Browser fit: Uniquely suited",{"data":3695,"content":3696,"nodeType":860},{},[3697,3701,3709],{"data":3698,"marks":3699,"value":3700,"nodeType":864},{},[],"Account takeover (ATO) is the dominant entry point for enterprise breaches: ",{"data":3702,"content":3704,"nodeType":883},{"uri":3703},"https://www.crowdstrike.com/en-gb/resources/infographics/identity-security-risk-review/",[3705],{"data":3706,"marks":3707,"value":3708,"nodeType":864},{},[],"80% of all modern breaches involve compromised or stolen identities",{"data":3710,"marks":3711,"value":3712,"nodeType":864},{},[],". The attack surface is far wider than most identity tooling can see: credential stuffing, password spraying, ghost logins (password-based fallback authentication that persists after SSO is configured), weak or reused credentials on shadow SaaS apps, and accounts where MFA was never enforced.",{"data":3714,"content":3715,"nodeType":860},{},[3716,3720,3728,3732,3737,3740,3745,3749,3757],{"data":3717,"marks":3718,"value":3719,"nodeType":864},{},[],"According to ",{"data":3721,"content":3723,"nodeType":883},{"uri":3722},"https://cf-assets.www.cloudflare.com/slt3lc6tev37/sWDBUMNVtEJB9ZFLt1dUU/8d69e92de2edfb3bf59e7d21d57e7e1a/Cloudflare-2026-threat-report.pdf",[3724],{"data":3725,"marks":3726,"value":3727,"nodeType":864},{},[],"Cloudflare's 2026 Threat Report",{"data":3729,"marks":3730,"value":3731,"nodeType":864},{},[],", ",{"data":3733,"marks":3734,"value":3736,"nodeType":864},{},[3735],{"type":899},"63% of all human logins involve credentials already compromised elsewhere",{"data":3738,"marks":3739,"value":2232,"nodeType":864},{},[],{"data":3741,"marks":3742,"value":3744,"nodeType":864},{},[3743],{"type":899},"94% of all login attempts originate from bots",{"data":3746,"marks":3747,"value":3748,"nodeType":864},{},[],". The ",{"data":3750,"content":3752,"nodeType":883},{"uri":3751},"https://pushsecurity.com/blog/snowflake-retro/",[3753],{"data":3754,"marks":3755,"value":3756,"nodeType":864},{},[],"Snowflake breach",{"data":3758,"marks":3759,"value":3760,"nodeType":864},{},[]," — 165+ organizations compromised, 1 billion+ records stolen — was powered almost entirely by ghost logins: accounts missing MFA that were susceptible to credential stuffing. It's particularly telling that 80% of the accounts impacted had prior breach exposure.",{"data":3762,"content":3766,"nodeType":996},{"target":3763},{"sys":3764},{"id":3765,"type":1001,"linkType":1002},"HbZ66kp5DiAZtwNGFJK7d",[],{"data":3768,"content":3769,"nodeType":860},{},[3770,3774,3779],{"data":3771,"marks":3772,"value":3773,"nodeType":864},{},[],"For organizations with contractors and BYOD users, the browser extension is also the only enterprise control deployable on devices that can't be MDM-enrolled — extending ATO detection to exactly the place where, per Verizon DBIR 2025, ",{"data":3775,"marks":3776,"value":3778,"nodeType":864},{},[3777],{"type":899},"46% of infostealer infections originate",{"data":3780,"marks":3781,"value":2924,"nodeType":864},{},[],{"data":3783,"content":3784,"nodeType":1005},{},[],{"data":3786,"content":3787,"nodeType":1009},{},[3788],{"data":3789,"marks":3790,"value":3792,"nodeType":864},{},[3791],{"type":899},"#2 — Detecting and stopping advanced phishing: AiTM, multi-channel delivery, and zero-day lures",{"data":3794,"content":3795,"nodeType":860},{},[3796],{"data":3797,"marks":3798,"value":3693,"nodeType":864},{},[3799],{"type":899},{"data":3801,"content":3802,"nodeType":860},{},[3803,3807,3815,3819,3824],{"data":3804,"marks":3805,"value":3806,"nodeType":864},{},[],"Adversary-in-the-Middle (AiTM) phishing — where an attacker's reverse proxy intercepts credentials and session tokens in real time — has become the standard technique for bypassing MFA at scale. ",{"data":3808,"content":3810,"nodeType":883},{"uri":3809},"https://www.esentire.com/resources/library/2026-threat-report",[3811],{"data":3812,"marks":3813,"value":3814,"nodeType":864},{},[],"eSentire's 2026 Threat Report",{"data":3816,"marks":3817,"value":3818,"nodeType":864},{},[]," attributes ",{"data":3820,"marks":3821,"value":3823,"nodeType":864},{},[3822],{"type":899},"63% of account compromise incidents to PhaaS kits",{"data":3825,"marks":3826,"value":3827,"nodeType":864},{},[],", with account compromise surging 389% year-over-year.",{"data":3829,"content":3830,"nodeType":860},{},[3831,3835,3843,3847,3852,3856,3865],{"data":3832,"marks":3833,"value":3834,"nodeType":864},{},[],"Traditional phishing controls are also no longer in the right place to intercept these attacks. The delivery channel has shifted decisively away from email: ",{"data":3836,"content":3838,"nodeType":883},{"uri":3837},"https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026",[3839],{"data":3840,"marks":3841,"value":3842,"nodeType":864},{},[],"Mandiant M-Trends 2026",{"data":3844,"marks":3845,"value":3846,"nodeType":864},{},[]," found email phishing dropped from 14% to 6% as an infection vector, and Push data shows ",{"data":3848,"marks":3849,"value":3851,"nodeType":864},{},[3850],{"type":899},"roughly 1 in 3 phishing payloads intercepted were delivered outside email entirely",{"data":3853,"marks":3854,"value":3855,"nodeType":864},{},[]," — via search engine malvertising, social platforms, and compromised websites. Meanwhile, ",{"data":3857,"content":3859,"nodeType":883},{"uri":3858},"https://www.spamhaus.com/resource-center/supporting-researchers-with-passive-dns/",[3860],{"data":3861,"marks":3862,"value":3864,"nodeType":864},{},[3863],{"type":899},"89% of phishing domains are active for less than two days",{"data":3866,"marks":3867,"value":3868,"nodeType":864},{},[],", making blocklist-based detection structurally too slow — attackers can spin up, tear down, and move on before blocklists can catch up.",{"data":3870,"content":3871,"nodeType":860},{},[3872],{"data":3873,"marks":3874,"value":3875,"nodeType":864},{},[],"Modern phishing plays out entirely inside the browser session. The only detection layer that can see the phishing page structure, the credential entry, and the anomalous token context is the browser itself. Browser-native detection analyses page behavior rather than matching known-bad domains, which means it fires on zero-day kits regardless of how recently the infrastructure was stood up. Controls like credential entry guardrails add an additional layer — blocking corporate passwords from being submitted to unauthorized domains independently of content and behavior-based detections.",{"data":3877,"content":3878,"nodeType":1005},{},[],{"data":3880,"content":3881,"nodeType":1009},{},[3882],{"data":3883,"marks":3884,"value":3886,"nodeType":864},{},[3885],{"type":899},"#3 — Identity posture hardening: enforcing security across the apps your IdP doesn't manage",{"data":3888,"content":3889,"nodeType":860},{},[3890],{"data":3891,"marks":3892,"value":3894,"nodeType":864},{},[3893],{"type":899},"Security value: High | Browser fit: Uniquely suited",{"data":3896,"content":3897,"nodeType":860},{},[3898],{"data":3899,"marks":3900,"value":3901,"nodeType":864},{},[],"The first challenge is knowing what you're protecting. Every identity an employee creates — every app they sign up to, every password they set, every login that bypasses SSO — is an authentication event that happens inside a browser session. The browser is the only layer that observes all of these events regardless of whether the app is sanctioned, managed, or even known to IT. Solutions that rely on API-level integrations with known apps, network traffic inspection, or email sign-up notifications can only ever build a partial picture, because they can only see apps they already know about. The browser sees the login itself, which means it discovers the identity at the moment it's created or used — authentication method, password strength, MFA status, and all.",{"data":3903,"content":3907,"nodeType":996},{"target":3904},{"sys":3905},{"id":3906,"type":1001,"linkType":1002},"HETvBCPsKGkqLVtaasXH0",[],{"data":3909,"content":3910,"nodeType":860},{},[3911],{"data":3912,"marks":3913,"value":3914,"nodeType":864},{},[],"But discovery without enforcement is just an inventory problem. Being in the browser means that you're in a great position to act on what it finds at the moment of authentication. Browser-native guardrails that prompt MFA enrollment, guide users toward stronger credentials, and redirect to SSO login paths close the gap at scale, on every app, including those the IdP has never seen. They also produce the continuous, auditable evidence of MFA coverage and credential hygiene across the full application estate that regulators, insurers, and auditors increasingly require — evidence that no IdP-centric tool can provide for apps outside its scope.",{"data":3916,"content":3917,"nodeType":1005},{},[],{"data":3919,"content":3920,"nodeType":1009},{},[3921],{"data":3922,"marks":3923,"value":3925,"nodeType":864},{},[3924],{"type":899},"#4 — Browser extension security",{"data":3927,"content":3928,"nodeType":860},{},[3929],{"data":3930,"marks":3931,"value":3894,"nodeType":864},{},[3932],{"type":899},{"data":3934,"content":3935,"nodeType":860},{},[3936,3940,3949,3952,3960,3963,3971],{"data":3937,"marks":3938,"value":3939,"nodeType":864},{},[],"Browser extensions have become one of the most talked-about attack surfaces in security over the past 18 months, and understandably so — a string of high-profile supply chain compromises have collectively impacted tens of millions of users since late 2024 (",{"data":3941,"content":3943,"nodeType":883},{"uri":3942},"https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it",[3944],{"data":3945,"marks":3946,"value":3948,"nodeType":864},{},[3947],{"type":1455},"Cyberhaven",{"data":3950,"marks":3951,"value":3731,"nodeType":864},{},[],{"data":3953,"content":3955,"nodeType":883},{"uri":3954},"https://thehackernews.com/2025/12/darkspectre-browser-extension-campaigns.html",[3956],{"data":3957,"marks":3958,"value":3959,"nodeType":864},{},[],"DarkSpectre",{"data":3961,"marks":3962,"value":3731,"nodeType":864},{},[],{"data":3964,"content":3966,"nodeType":883},{"uri":3965},"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html",[3967],{"data":3968,"marks":3969,"value":3970,"nodeType":864},{},[],"Trust Wallet",{"data":3972,"marks":3973,"value":3974,"nodeType":864},{},[],", among many others).",{"data":3976,"content":3977,"nodeType":860},{},[3978,3981,3989,3993,3998,4002,4007],{"data":3979,"marks":3980,"value":21,"nodeType":864},{},[],{"data":3982,"content":3983,"nodeType":883},{"uri":2411},[3984],{"data":3985,"marks":3986,"value":3988,"nodeType":864},{},[3987],{"type":1455},"Analysis of 20,000+ extensions across Push customers",{"data":3990,"marks":3991,"value":3992,"nodeType":864},{},[]," found ",{"data":3994,"marks":3995,"value":3997,"nodeType":864},{},[3996],{"type":899},"46.76% have the permission combinations needed to perform account takeover with no user interaction",{"data":3999,"marks":4000,"value":4001,"nodeType":864},{},[],", making permissions-based risk scoring effectively useless as a triage tool. The real threat model is not malicious extensions at install time — it's legitimate extensions that ",{"data":4003,"marks":4004,"value":4006,"nodeType":864},{},[4005],{"type":2246},"become",{"data":4008,"marks":4009,"value":4010,"nodeType":864},{},[]," malicious after an ownership transfer, developer account compromise, or silent update push. Every major extension supply chain breach of the past 18 months scored as low-risk immediately before compromise.",{"data":4012,"content":4013,"nodeType":860},{},[4014],{"data":4015,"marks":4016,"value":4017,"nodeType":864},{},[],"SWGs and network tools are structurally blind to this attack surface: a malicious extension exfiltrating session tokens generates no anomalous network signal — its traffic is indistinguishable from normal browsing. Endpoint agents have no visibility into extension behavior at the session level. Extension inventory, supply chain change monitoring — ownership transfers, permission escalations, developer contact changes — and enforcement all require browser-layer access by definition.",{"data":4019,"content":4020,"nodeType":1005},{},[],{"data":4022,"content":4023,"nodeType":1009},{},[4024],{"data":4025,"marks":4026,"value":4028,"nodeType":864},{},[4027],{"type":899},"#5 — Shadow SaaS discovery and OAuth integration governance",{"data":4030,"content":4031,"nodeType":860},{},[4032],{"data":4033,"marks":4034,"value":3894,"nodeType":864},{},[4035],{"type":899},{"data":4037,"content":4038,"nodeType":860},{},[4039,4043,4048,4052,4057],{"data":4040,"marks":4041,"value":4042,"nodeType":864},{},[],"Shadow SaaS discovery shares DNA with identity posture hardening (#3) — both start with the same browser-native visibility into login events that no other layer can replicate. Where identity posture focuses on hardening ",{"data":4044,"marks":4045,"value":4047,"nodeType":864},{},[4046],{"type":2246},"how",{"data":4049,"marks":4050,"value":4051,"nodeType":864},{},[]," employees authenticate, shadow SaaS discovery focuses on ",{"data":4053,"marks":4054,"value":4056,"nodeType":864},{},[4055],{"type":2246},"what",{"data":4058,"marks":4059,"value":4060,"nodeType":864},{},[]," they authenticate to: surfacing the full estate of applications in use across the organization, including those that IT has never sanctioned or even heard of.",{"data":4062,"content":4063,"nodeType":860},{},[4064],{"data":4065,"marks":4066,"value":4067,"nodeType":864},{},[],"OAuth integration governance is the component of shadow SaaS that is both the most potentially damaging and the hardest to surface through other means. The SaaS-to-SaaS OAuth pivot is now an industrialized attack pattern.",{"data":4069,"content":4070,"nodeType":941},{},[4071,4092],{"data":4072,"content":4073,"nodeType":945},{},[4074],{"data":4075,"content":4076,"nodeType":860},{},[4077,4080,4088],{"data":4078,"marks":4079,"value":2761,"nodeType":864},{},[],{"data":4081,"content":4083,"nodeType":883},{"uri":4082},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[4084],{"data":4085,"marks":4086,"value":4087,"nodeType":864},{},[],"ShinyHunters",{"data":4089,"marks":4090,"value":4091,"nodeType":864},{},[]," Salesforce campaign — which compromised 1,000+ organizations and 1.5 billion records — demonstrated the full chain: the attacker didn't stop at stealing customer data but harvested OAuth tokens, AWS access keys, and Snowflake tokens from breached tenants and pivoted through connected services like Salesloft, Drift, and Gainsight to reach hundreds more organizations.",{"data":4093,"content":4094,"nodeType":945},{},[4095],{"data":4096,"content":4097,"nodeType":860},{},[4098,4101,4109],{"data":4099,"marks":4100,"value":2761,"nodeType":864},{},[],{"data":4102,"content":4104,"nodeType":883},{"uri":4103},"https://pushsecurity.com/blog/unpacking-the-vercel-breach/",[4105],{"data":4106,"marks":4107,"value":4108,"nodeType":864},{},[],"Context.ai → Vercel",{"data":4110,"marks":4111,"value":4112,"nodeType":864},{},[]," chain followed the same logic — stored OAuth tokens from a forgotten AI app trial provided the bridge into Google Workspace, internal dashboards, and API keys. These are not isolated incidents; they are the repeatable playbook for extracting maximum value from a single compromise through the trust relationships that OAuth connections encode.",{"data":4114,"content":4115,"nodeType":860},{},[4116],{"data":4117,"marks":4118,"value":4119,"nodeType":864},{},[],"Every OAuth consent grant transits the browser — the authorization prompt, the scope disclosure, the user's approval click, and the redirect that completes the grant all happen inside a browser session — which makes the browser the only layer where an unwanted grant can be intercepted before the token is issued and the persistent access path is created. Once a token exists, the damage is done: it survives password resets, MFA changes, and session revocations, and revoking it after the fact requires first knowing it was granted, which most organizations do not.",{"data":4121,"content":4122,"nodeType":1005},{},[],{"data":4124,"content":4125,"nodeType":1009},{},[4126],{"data":4127,"marks":4128,"value":4130,"nodeType":864},{},[4129],{"type":899},"#6 — Blocking ClickFix and social engineering-based malware delivery",{"data":4132,"content":4133,"nodeType":860},{},[4134],{"data":4135,"marks":4136,"value":4138,"nodeType":864},{},[4137],{"type":899},"Security value: High | Browser fit: Strong for interception — shared with endpoint security for execution. ConsentFix is a browser-native exception that is T1-aligned.",{"data":4140,"content":4141,"nodeType":860},{},[4142,4146,4151,4155,4162,4166,4171,4175,4180],{"data":4143,"marks":4144,"value":4145,"nodeType":864},{},[],"ClickFix was the most common initial access vector reported by Microsoft in 2025, accounting for ",{"data":4147,"marks":4148,"value":4150,"nodeType":864},{},[4149],{"type":899},"47% of observed attacks",{"data":4152,"marks":4153,"value":4154,"nodeType":864},{},[],". CrowdStrike's ",{"data":4156,"content":4157,"nodeType":883},{"uri":3237},[4158],{"data":4159,"marks":4160,"value":4161,"nodeType":864},{},[],"2026 Global Threat Report",{"data":4163,"marks":4164,"value":4165,"nodeType":864},{},[]," identified fake CAPTCHA lures as the most common malware download type, increasing ",{"data":4167,"marks":4168,"value":4170,"nodeType":864},{},[4169],{"type":899},"563% year-over-year",{"data":4172,"marks":4173,"value":4174,"nodeType":864},{},[],". The technique writes a malicious command to the victim's clipboard and social-engineers them into executing it. It is fileless (bypassing download scanning), user-executed (bypassing endpoint behavioral detections), and ",{"data":4176,"marks":4177,"value":4179,"nodeType":864},{},[4178],{"type":899},"4 in 5 ClickFix payloads intercepted by Push arrived via search engines",{"data":4181,"marks":4182,"value":4183,"nodeType":864},{},[]," — not email (bypassing email anti-phishing controls).",{"data":4185,"content":4186,"nodeType":860},{},[4187],{"data":4188,"marks":4189,"value":4190,"nodeType":864},{},[],"The browser is the earliest and most effective intervention point — detecting the clipboard injection and social engineering lure before anything reaches the endpoint in executable form. But the problem doesn't end at the browser boundary: once the command has been pasted and run, detection and remediation become endpoint problems, and a mature defense requires both layers. The broader *Fix family — FileFix, InstallFix, and similar derivatives — follows the same pattern, with the browser providing the critical early-warning layer within a defense that spans browser and endpoint.",{"data":4192,"content":4196,"nodeType":996},{"target":4193},{"sys":4194},{"id":4195,"type":1001,"linkType":1002},"39alMHtw9FPHbQINqbAgBN",[],{"data":4198,"content":4199,"nodeType":1005},{},[],{"data":4201,"content":4202,"nodeType":1009},{},[4203],{"data":4204,"marks":4205,"value":4207,"nodeType":864},{},[4206],{"type":899},"#7 — AI visibility and control: enforcing which AI tools employees can use and how",{"data":4209,"content":4210,"nodeType":860},{},[4211],{"data":4212,"marks":4213,"value":4215,"nodeType":864},{},[4214],{"type":899},"Security value: High | Browser fit: Strong for access enforcement — but AI governance is not a new security problem so much as a force multiplier on existing ones",{"data":4217,"content":4218,"nodeType":860},{},[4219,4223,4231,4235,4244],{"data":4220,"marks":4221,"value":4222,"nodeType":864},{},[],"AI adoption is outpacing security governance at nearly every organization, and ",{"data":4224,"content":4225,"nodeType":883},{"uri":2561},[4226],{"data":4227,"marks":4228,"value":4230,"nodeType":864},{},[4229],{"type":899},"71% of organizations are concerned about data leakage via unsanctioned AI apps",{"data":4232,"marks":4233,"value":4234,"nodeType":864},{},[],". But the security problems that AI creates are not, for the most part, novel — they are existing Tier 1 problems amplified by a new category of tooling. Shadow AI apps are shadow SaaS (#5). AI OAuth integrations are OAuth governance (#5). AI browser extensions are extension security (#4). The risk of employees using personal AI accounts — ",{"data":4236,"content":4238,"nodeType":883},{"uri":4237},"https://keepaware.com/blog/46-of-sensitive-data-bypasses-your-dlp",[4239],{"data":4240,"marks":4241,"value":4243,"nodeType":864},{},[4242],{"type":899},"46% of sensitive inputs to AI tools are sent via personal accounts",{"data":4245,"marks":4246,"value":4247,"nodeType":864},{},[]," — is an identity posture problem (#3).",{"data":4249,"content":4250,"nodeType":860},{},[4251],{"data":4252,"marks":4253,"value":4254,"nodeType":864},{},[],"The component parts that allow you to govern AI are individually Tier 1 capabilities, and the browser is the best single layer for gaining visibility and control over AI usage — it sees the apps, the OAuth grants, the extensions, and the account context. But a complete end-to-end solution also requires a presence on the endpoint layer (for local AI tools, IDE-integrated agents, and API-level usage that never touches the browser), and prompt-level DLP on sanctioned tools is better handled by platform-native controls than by browser-layer observation.",{"data":4256,"content":4260,"nodeType":996},{"target":4257},{"sys":4258},{"id":4259,"type":1001,"linkType":1002},"6Py3z9VgjhKrchmYvhmbsq",[],{"data":4262,"content":4263,"nodeType":860},{},[4264],{"data":4265,"marks":4266,"value":4267,"nodeType":864},{},[],"The browser is what makes platform controls effective — if employees are using personal accounts, there are no enterprise audit logs to inspect. And for the growing category of AI agents, agentic browsers, and MCP-connected tools that operate through OAuth grants rather than direct user interaction, the browser is where the consent decisions that authorize those agents are made.",{"data":4269,"content":4270,"nodeType":1005},{},[],{"data":4272,"content":4273,"nodeType":1009},{},[4274],{"data":4275,"marks":4276,"value":4278,"nodeType":864},{},[4277],{"type":899},"#8 — Investigation acceleration and incident response: closing the missing middle",{"data":4280,"content":4281,"nodeType":860},{},[4282],{"data":4283,"marks":4284,"value":4286,"nodeType":864},{},[4285],{"type":899},"Security value: High | Browser fit: Strong — fills a structural gap complementary to endpoint, network, and identity telemetry",{"data":4288,"content":4289,"nodeType":860},{},[4290,4294,4299,4303,4312],{"data":4291,"marks":4292,"value":4293,"nodeType":864},{},[],"Endpoint logs show what processes executed. Network logs show traffic destinations. IdP logs show authentication events. None of them show what happened ",{"data":4295,"marks":4296,"value":4298,"nodeType":864},{},[4297],{"type":2246},"inside the browser session",{"data":4300,"marks":4301,"value":4302,"nodeType":864},{},[]," — the phishing page the user saw, the credentials they entered, the malicious OAuth consent grant, the data uploaded or pasted to an unsanctioned service. This is the missing middle of modern incident investigations, and for the ",{"data":4304,"content":4306,"nodeType":883},{"uri":4305},"https://www.paloaltonetworks.co.uk/resources/research/unit-42-incident-response-report",[4307],{"data":4308,"marks":4309,"value":4311,"nodeType":864},{},[4310],{"type":899},"48% of intrusions involving browser-based activity",{"data":4313,"marks":4314,"value":4315,"nodeType":864},{},[],", the absence of browser telemetry is a significant investigative gap.",{"data":4317,"content":4318,"nodeType":860},{},[4319],{"data":4320,"marks":4321,"value":4322,"nodeType":864},{},[],"Browser-layer telemetry fills that gap with a fundamentally different quality of signal: what users actually clicked, what pages loaded and how they behaved, what credentials were entered, what session activity followed — structured, high-fidelity data from inside the session where the attack played out. That's the difference between inferring what happened and seeing it directly, and it determines scope, drives containment decisions, and provides the direct evidential record that neither endpoint DLP nor network monitoring can supply for browser-native attacks.",{"data":4324,"content":4325,"nodeType":860},{},[4326],{"data":4327,"marks":4328,"value":4329,"nodeType":864},{},[],"Browser telemetry is a key addition to the investigative picture. Investigations are inherently multi-source — without browser data, reconstructing an incident from EDR, network, and IdP logs won't tell you the full picture (particularly when attacks are increasingly delivered outside of email, intercepting users as they browse the internet normally).",{"data":4331,"content":4332,"nodeType":860},{},[4333],{"data":4334,"marks":4335,"value":4336,"nodeType":864},{},[],"The browser provides the causal link that other sources miss: the bridge between \"a user visited a URL\" and \"credentials were submitted to a phishing page that issued a session token now being replayed from an attacker-controlled browser.\" Integrated with SIEM and SOAR platforms, that signal enables automated response workflows to execute on high-confidence detections without waiting for manual triage.",{"data":4338,"content":4339,"nodeType":1005},{},[],{"data":4341,"content":4342,"nodeType":1009},{},[4343],{"data":4344,"marks":4345,"value":4347,"nodeType":864},{},[4346],{"type":899},"#9 — Infostealer defense: detecting exposure and blocking delivery",{"data":4349,"content":4350,"nodeType":860},{},[4351],{"data":4352,"marks":4353,"value":4355,"nodeType":864},{},[4354],{"type":899},"Security value: High | Browser fit: Strong for delivery interception and stolen factor detection — complementary to endpoint security for execution",{"data":4357,"content":4358,"nodeType":860},{},[4359],{"data":4360,"marks":4361,"value":4362,"nodeType":864},{},[],"Infostealers are the upstream supply chain for a disproportionate share of the most damaging enterprise attacks — harvesting credentials, session cookies, and browser profile data en masse from infected devices, then selling the outputs on infostealer markets for use in credential stuffing, ATO, and ransomware campaigns.",{"data":4364,"content":4368,"nodeType":996},{"target":4365},{"sys":4366},{"id":4367,"type":1001,"linkType":1002},"5NF1afwu3zFGThZTtStVQA",[],{"data":4370,"content":4371,"nodeType":860},{},[4372],{"data":4373,"marks":4374,"value":4375,"nodeType":864},{},[],"The browser is relevant at two points in the infostealer kill chain. First, delivery interception: ClickFix (covered in #6) is now the primary infostealer delivery mechanism, and the browser is the only layer that can intercept it before execution. Second, detecting stolen factors when attackers attempt to use them — and infostealers produce two categories of stolen factor that the browser can guard against.",{"data":4377,"content":4378,"nodeType":941},{},[4379,4389],{"data":4380,"content":4381,"nodeType":945},{},[4382],{"data":4383,"content":4384,"nodeType":860},{},[4385],{"data":4386,"marks":4387,"value":4388,"nodeType":864},{},[],"Stolen credentials can be identified at the point of login: browser-layer detection flags credentials that appear in known breach datasets, catching infostealer-harvested passwords being replayed in credential stuffing campaigns before the account is compromised.",{"data":4390,"content":4391,"nodeType":945},{},[4392],{"data":4393,"content":4394,"nodeType":860},{},[4395],{"data":4396,"marks":4397,"value":4398,"nodeType":864},{},[],"Stolen session tokens are caught through a different mechanism: sessions originating in instrumented browsers carry a marker, and when a token subsequently appears in an un-instrumented browser it is a confirmed stolen session — catching infostealer-harvested cookies being replayed regardless of how or where the token was originally harvested.",{"data":4400,"content":4401,"nodeType":860},{},[4402,4406,4415,4419,4424],{"data":4403,"marks":4404,"value":4405,"nodeType":864},{},[],"This is particularly critical for the ",{"data":4407,"content":4409,"nodeType":883},{"uri":4408},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[4410],{"data":4411,"marks":4412,"value":4414,"nodeType":864},{},[4413],{"type":899},"46% of infected devices that are unmanaged",{"data":4416,"marks":4417,"value":4418,"nodeType":864},{},[]," where EDR is absent and the stolen credentials and session tokens will never be detected at the endpoint. Infostealer ",{"data":4420,"marks":4421,"value":4423,"nodeType":864},{},[4422],{"type":2246},"execution",{"data":4425,"marks":4426,"value":4427,"nodeType":864},{},[]," remains an endpoint problem; the browser closes the delivery and replay gaps that endpoint tools miss.",{"data":4429,"content":4430,"nodeType":1005},{},[],{"data":4432,"content":4433,"nodeType":1009},{},[4434],{"data":4435,"marks":4436,"value":4438,"nodeType":864},{},[4437],{"type":899},"#10 — Data loss prevention: a key component of effective DLP, but not the full picture",{"data":4440,"content":4441,"nodeType":860},{},[4442],{"data":4443,"marks":4444,"value":4446,"nodeType":864},{},[4445],{"type":899},"Security value: Medium-high | Browser fit: Partial — complementary to dedicated DLP",{"data":4448,"content":4449,"nodeType":860},{},[4450],{"data":4451,"marks":4452,"value":4453,"nodeType":864},{},[],"File uploads to unsanctioned services, sensitive data pasted into AI tools, and exfiltration through personal accounts are genuine and growing risks that traditional email and endpoint-centric DLP tools were not designed to catch. Browser-layer controls provide real value here — particularly for BYOD users and contractors, where endpoint DLP agents cannot be deployed and the browser is the only available data loss visibility.",{"data":4455,"content":4456,"nodeType":860},{},[4457],{"data":4458,"marks":4459,"value":4460,"nodeType":864},{},[],"The honest scope: browser-layer DLP does not cover email-based loss, endpoint-to-endpoint transfers, or cloud API exfiltration. It closes specific and important gaps within a broader DLP strategy, not a replacement for one. A further distinction for organizations evaluating browser DLP for secure third-party access: full-stack enterprise browsers can enforce deeper output controls — watermarking, obfuscation, screenshot and print restrictions — at the OS rendering level that browser extensions cannot reliably replicate. Extension-based browser DLP is strongest for upload, input, and access control use cases rather than OS-level output restriction.",{"data":4462,"content":4463,"nodeType":1005},{},[],{"data":4465,"content":4466,"nodeType":1009},{},[4467],{"data":4468,"marks":4469,"value":4471,"nodeType":864},{},[4470],{"type":899},"Tier 3 — Lower Value: A problem best addressed outside of the browser",{"data":4473,"content":4474,"nodeType":941},{},[4475,4490,4505,4520],{"data":4476,"content":4477,"nodeType":945},{},[4478],{"data":4479,"content":4480,"nodeType":860},{},[4481,4486],{"data":4482,"marks":4483,"value":4485,"nodeType":864},{},[4484],{"type":899},"Browser exploit protection",{"data":4487,"marks":4488,"value":4489,"nodeType":864},{},[]," (narrow RCE/sandbox sense) ranks lower because browser zero-days represent just 9% of all zero-days reported to Google, and 82% of attack detections are now malware-free (CrowdStrike 2026). This is a problem for browser vendors to solve, and it's not a big enough problem to warrant enterprises investing in additional mitigating controls.",{"data":4491,"content":4492,"nodeType":945},{},[4493],{"data":4494,"content":4495,"nodeType":860},{},[4496,4501],{"data":4497,"marks":4498,"value":4500,"nodeType":864},{},[4499],{"type":899},"Domain and URL category controls",{"data":4502,"marks":4503,"value":4504,"nodeType":864},{},[]," offer genuine browser-layer value but are commoditized by SWG and DNS filtering tools most organizations already operate. This can be provided in the browser, sure (and it's something we do at Push) but offers limited security value in terms of making a difference against modern attacks that quickly rotate these kinds of indicators and are designed to blend in.",{"data":4506,"content":4507,"nodeType":945},{},[4508],{"data":4509,"content":4510,"nodeType":860},{},[4511,4516],{"data":4512,"marks":4513,"value":4515,"nodeType":864},{},[4514],{"type":899},"Access management",{"data":4517,"marks":4518,"value":4519,"nodeType":864},{},[]," — ZTNA, VPN replacement, PAM, BYOD access control — is an IT infrastructure and access architecture problem, not a security operations problem, and belongs to a different buyer with a different evaluation frame. There are numerous (typically full-stack) Enterprise Browser solutions on the market that address IT use cases like this well.",{"data":4521,"content":4522,"nodeType":945},{},[4523],{"data":4524,"content":4525,"nodeType":860},{},[4526,4530],{"data":4527,"marks":4528,"value":781,"nodeType":864},{},[4529],{"type":899},{"data":4531,"marks":4532,"value":4533,"nodeType":864},{},[]," addresses browser exploit risk rather than the identity-first attacks that represent the majority of current enterprise browser risk, and introduces UX friction that limits deployment at scale. When it triggers, it introduces latency but still fails to detect and stop browser-native attacks.",{"data":4535,"content":4536,"nodeType":1005},{},[],{"data":4538,"content":4539,"nodeType":1009},{},[4540],{"data":4541,"marks":4542,"value":4544,"nodeType":864},{},[4543],{"type":899},"How Push Security maps to the highest-value security use cases",{"data":4546,"content":4547,"nodeType":860},{},[4548],{"data":4549,"marks":4550,"value":4551,"nodeType":864},{},[],"Push is purpose-built to address all of these problems using a flexible browser extension — plug into any browser with no migration, no host agent deployment, and no IT overhead — that delivers telemetry and control from day one, and extends coverage to every enrolled browser regardless of device ownership.",{"data":4553,"content":4554,"nodeType":4845},{},[4555,4582,4606,4630,4654,4678,4702,4726,4750,4774,4798,4822],{"data":4556,"content":4557,"nodeType":4581},{},[4558,4570],{"data":4559,"content":4560,"nodeType":4569},{},[4561],{"data":4562,"content":4563,"nodeType":860},{},[4564],{"data":4565,"marks":4566,"value":4568,"nodeType":864},{},[4567],{"type":899},"Security use case","table-cell",{"data":4571,"content":4572,"nodeType":4569},{},[4573],{"data":4574,"content":4575,"nodeType":860},{},[4576],{"data":4577,"marks":4578,"value":4580,"nodeType":864},{},[4579],{"type":899},"How Push addresses it","table-row",{"data":4583,"content":4584,"nodeType":4581},{},[4585,4596],{"data":4586,"content":4587,"nodeType":4569},{},[4588],{"data":4589,"content":4590,"nodeType":860},{},[4591],{"data":4592,"marks":4593,"value":4595,"nodeType":864},{},[4594],{"type":899},"Account takeover prevention",{"data":4597,"content":4598,"nodeType":4569},{},[4599],{"data":4600,"content":4601,"nodeType":860},{},[4602],{"data":4603,"marks":4604,"value":4605,"nodeType":864},{},[],"Surfaces and fixes ghost logins, weak and breached credentials and missing MFA controls across every app and device — including shadow SaaS and unmanaged devices invisible to the IdP. Push also detects and stops the attack techniques that typically lead to ATO early in the kill chain and before an account can be compromised.",{"data":4607,"content":4608,"nodeType":4581},{},[4609,4620],{"data":4610,"content":4611,"nodeType":4569},{},[4612],{"data":4613,"content":4614,"nodeType":860},{},[4615],{"data":4616,"marks":4617,"value":4619,"nodeType":864},{},[4618],{"type":899},"Advanced phishing detection",{"data":4621,"content":4622,"nodeType":4569},{},[4623],{"data":4624,"content":4625,"nodeType":860},{},[4626],{"data":4627,"marks":4628,"value":4629,"nodeType":864},{},[],"Behavioral page analysis detects phishing kits regardless of whether the domain is known-bad. Credential entry guardrails block corporate passwords from being submitted to unauthorized domains. TTP-based detection remains effective as attacker infrastructure rotates.",{"data":4631,"content":4632,"nodeType":4581},{},[4633,4644],{"data":4634,"content":4635,"nodeType":4569},{},[4636],{"data":4637,"content":4638,"nodeType":860},{},[4639],{"data":4640,"marks":4641,"value":4643,"nodeType":864},{},[4642],{"type":899},"Identity posture hardening",{"data":4645,"content":4646,"nodeType":4569},{},[4647],{"data":4648,"content":4649,"nodeType":860},{},[4650],{"data":4651,"marks":4652,"value":4653,"nodeType":864},{},[],"Enforces MFA, strong credentials, and SSO adoption across every app the IdP doesn't manage. Produces continuous, auditable MFA coverage and credential hygiene evidence across the full application and device estate.",{"data":4655,"content":4656,"nodeType":4581},{},[4657,4668],{"data":4658,"content":4659,"nodeType":4569},{},[4660],{"data":4661,"content":4662,"nodeType":860},{},[4663],{"data":4664,"marks":4665,"value":4667,"nodeType":864},{},[4666],{"type":899},"Browser extension security",{"data":4669,"content":4670,"nodeType":4569},{},[4671],{"data":4672,"content":4673,"nodeType":860},{},[4674],{"data":4675,"marks":4676,"value":4677,"nodeType":864},{},[],"Live extension inventory with supply chain change event monitoring — ownership transfers, permission escalations, developer contact changes — rather than static risk scoring. Supports default-deny allowlisting and remote extension removal. Blocks known-bad malicious extensions automatically.",{"data":4679,"content":4680,"nodeType":4581},{},[4681,4692],{"data":4682,"content":4683,"nodeType":4569},{},[4684],{"data":4685,"content":4686,"nodeType":860},{},[4687],{"data":4688,"marks":4689,"value":4691,"nodeType":864},{},[4690],{"type":899},"Shadow SaaS and OAuth governance",{"data":4693,"content":4694,"nodeType":4569},{},[4695],{"data":4696,"content":4697,"nodeType":860},{},[4698],{"data":4699,"marks":4700,"value":4701,"nodeType":864},{},[],"Discovers shadow SaaS from actual login events with full authentication context. Monitors and blocks OAuth consent flows — including AI and MCP integrations — in real time before persistent access paths are created.",{"data":4703,"content":4704,"nodeType":4581},{},[4705,4716],{"data":4706,"content":4707,"nodeType":4569},{},[4708],{"data":4709,"content":4710,"nodeType":860},{},[4711],{"data":4712,"marks":4713,"value":4715,"nodeType":864},{},[4714],{"type":899},"ClickFix and the *Fix family",{"data":4717,"content":4718,"nodeType":4569},{},[4719],{"data":4720,"content":4721,"nodeType":860},{},[4722],{"data":4723,"marks":4724,"value":4725,"nodeType":864},{},[],"Detects and blocks ClickFix lures, clipboard injection, and browser-native variants like ConsentFix in real time — before the payload executes or OAuth key material is captured.",{"data":4727,"content":4728,"nodeType":4581},{},[4729,4740],{"data":4730,"content":4731,"nodeType":4569},{},[4732],{"data":4733,"content":4734,"nodeType":860},{},[4735],{"data":4736,"marks":4737,"value":4739,"nodeType":864},{},[4738],{"type":899},"AI visibility & control",{"data":4741,"content":4742,"nodeType":4569},{},[4743],{"data":4744,"content":4745,"nodeType":860},{},[4746],{"data":4747,"marks":4748,"value":4749,"nodeType":864},{},[],"Enforces which AI tools employees can access and routes usage to corporate tenants. Governs AI browser extensions and blocks OAuth consent grants to unapproved AI applications — drawing on the same Tier 1 capabilities (OAuth governance, extension security, shadow SaaS discovery) that make this possible.",{"data":4751,"content":4752,"nodeType":4581},{},[4753,4764],{"data":4754,"content":4755,"nodeType":4569},{},[4756],{"data":4757,"content":4758,"nodeType":860},{},[4759],{"data":4760,"marks":4761,"value":4763,"nodeType":864},{},[4762],{"type":899},"Security investigations & incident response",{"data":4765,"content":4766,"nodeType":4569},{},[4767],{"data":4768,"content":4769,"nodeType":860},{},[4770],{"data":4771,"marks":4772,"value":4773,"nodeType":864},{},[],"High-fidelity session telemetry — page loads, credential entries, DOM changes, OAuth grants — fills the missing middle that endpoint, network, and IdP logs leave open. Feeds directly into SIEM and SOAR for automated response.",{"data":4775,"content":4776,"nodeType":4581},{},[4777,4788],{"data":4778,"content":4779,"nodeType":4569},{},[4780],{"data":4781,"content":4782,"nodeType":860},{},[4783],{"data":4784,"marks":4785,"value":4787,"nodeType":864},{},[4786],{"type":899},"Infostealer defense",{"data":4789,"content":4790,"nodeType":4569},{},[4791],{"data":4792,"content":4793,"nodeType":860},{},[4794],{"data":4795,"marks":4796,"value":4797,"nodeType":864},{},[],"Intercepts ClickFix-based infostealer delivery before execution. Detects token replay in unenrolled browser contexts — catching post-theft abuse from AiTM-sourced tokens and infostealer-harvested cookies, including from unmanaged devices.",{"data":4799,"content":4800,"nodeType":4581},{},[4801,4812],{"data":4802,"content":4803,"nodeType":4569},{},[4804],{"data":4805,"content":4806,"nodeType":860},{},[4807],{"data":4808,"marks":4809,"value":4811,"nodeType":864},{},[4810],{"type":899},"Data loss prevention",{"data":4813,"content":4814,"nodeType":4569},{},[4815],{"data":4816,"content":4817,"nodeType":860},{},[4818],{"data":4819,"marks":4820,"value":4821,"nodeType":864},{},[],"Observes file uploads, downloads, and sensitive data inputs across all applications. Extends data loss visibility to BYOD and contractor devices where endpoint DLP cannot reach.",{"data":4823,"content":4824,"nodeType":4581},{},[4825,4835],{"data":4826,"content":4827,"nodeType":4569},{},[4828],{"data":4829,"content":4830,"nodeType":860},{},[4831],{"data":4832,"marks":4833,"value":4500,"nodeType":864},{},[4834],{"type":899},{"data":4836,"content":4837,"nodeType":4569},{},[4838],{"data":4839,"content":4840,"nodeType":860},{},[4841],{"data":4842,"marks":4843,"value":4844,"nodeType":864},{},[],"Custom URL blocklists with wildcard support and REST API management for threat intelligence feed sync. Application category blocking restricts access to classes of apps (file-sharing, unsanctioned AI tools) configurable by user group. Domain categorization bringing SWG-style category blocking natively to the browser without a network proxy.","table",{"data":4847,"content":4848,"nodeType":1005},{},[],{"data":4850,"content":4851,"nodeType":860},{},[4852,4856,4862],{"data":4853,"marks":4854,"value":4855,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":4857,"content":4858,"nodeType":883},{"uri":1700},[4859],{"data":4860,"marks":4861,"value":1703,"nodeType":864},{},[],{"data":4863,"marks":4864,"value":21,"nodeType":864},{},[],"The top 10 security problems you can solve in the browser — ranked by value","Ranking the security problems you can solve in the browser by security value and browser fit.","2026-05-14T00:00:00.000Z","the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value",{"items":4870},[4871,4873],{"sys":4872,"name":297},{"id":2732},{"sys":4874,"name":2729},{"id":2728},{"items":4876},[4877],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":4880},"Alex Henshall","Alex",{"url":4881},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg","shadow-ai-how-to-discover-govern-and-secure-ai-apps","blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps","Why you need paved paths, not barricades, for secure AI adoption",{"json":4886},{"data":4887,"content":4888,"nodeType":856},{},[4889],{"data":4890,"content":4891,"nodeType":860},{},[4892],{"data":4893,"marks":4894,"value":4895,"nodeType":864},{},[],"Blocking AI tools doesn't stop employees from using AI — it stops you seeing how they use it. The solution: make the governed path easier than the workaround.",{"id":4897,"publishedAt":4898},"7MB9tEe6mrdNXbkYVhgyWn","2026-08-13T13:06:46.644Z",{"items":4900},[4901,4905],{"sys":4902,"name":4904},{"id":4903},"3SA5H01UkKauuiTdt0KC6q","Shadow IT",{"sys":4906,"name":545},{"id":4907},"7ohk9lIkxMvJMwnp2Lhuad",{"items":4909},[4910,4912,4914,4916,4918,4920,4922,4924,4926,4928,4930,4932,4934,4936,4938,4940],{"sys":4911,"name":580,"slug":581,"tier":45},{"id":577},{"sys":4913,"name":589,"slug":590,"tier":45},{"id":586},{"sys":4915,"name":633,"slug":634,"tier":45},{"id":630},{"sys":4917,"name":624,"slug":625,"tier":45},{"id":621},{"sys":4919,"name":545,"slug":546,"tier":31},{"id":542},{"sys":4921,"name":484,"slug":485,"tier":45},{"id":481},{"sys":4923,"name":431,"slug":432,"tier":45},{"id":428},{"sys":4925,"name":413,"slug":414,"tier":31},{"id":410},{"sys":4927,"name":368,"slug":369,"tier":45},{"id":365},{"sys":4929,"name":351,"slug":352,"tier":45},{"id":348},{"sys":4931,"name":306,"slug":307,"tier":45},{"id":303},{"sys":4933,"name":288,"slug":289,"tier":45},{"id":285},{"sys":4935,"name":297,"slug":298,"tier":31},{"id":294},{"sys":4937,"name":252,"slug":253,"tier":45},{"id":249},{"sys":4939,"name":235,"slug":236,"tier":31},{"id":232},{"sys":4941,"name":244,"slug":245,"tier":45},{"id":241},"Zx6fn8UdirkncRHJf51fcJD_Tl5wsbmvST1BUx0fsQ8",{"id":4944,"title":4945,"authorsCollection":4946,"content":4952,"extension":228,"faqItemsCollection":6300,"faqTitle":59,"featured":6,"hashTags":59,"meta":6302,"metaTitle":6303,"ogImage":59,"postType":6304,"publishedDate":6305,"relatedBlogPostsCollection":6306,"slug":8641,"stem":8642,"subtitle":59,"summary":8643,"synopsis":8654,"sys":8655,"tagsCollection":8658,"topicsCollection":8664,"__hash__":8698},"blog/blog/making-the-business-case-for-a-browser-security-solution.json","How to make the business case for a browser security solution",{"items":4947},[4948],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":4949,"profilePicture":4951},[4950],"https://www.linkedin.com/in/alexhenshall/",{"url":4881},{"json":4953,"links":6159},{"data":4954,"content":4955,"nodeType":856},{},[4956,4974,4981,4988,4995,5002,5008,5011,5019,5026,5033,5051,5070,5077,5084,5091,5134,5141,5210,5222,5225,5233,5240,5246,5253,5260,5279,5286,5315,5348,5355,5361,5368,5375,5382,5473,5480,5487,5493,5500,5507,5531,5550,5573,5592,5611,5618,5625,5631,5638,5645,5676,5695,5701,5708,5727,5734,5741,5786,5793,5796,5804,5811,5818,5837,5844,5886,5905,5908,5916,5923,6062,6070,6089,6096,6103,6106,6114,6121,6128,6131,6137,6143],{"data":4957,"content":4958,"nodeType":860},{},[4959,4962,4970],{"data":4960,"marks":4961,"value":21,"nodeType":864},{},[],{"data":4963,"content":4964,"nodeType":883},{"uri":2561},[4965],{"data":4966,"marks":4967,"value":4969,"nodeType":864},{},[4968],{"type":1455},"Omdia's 2026 research",{"data":4971,"marks":4972,"value":4973,"nodeType":864},{},[]," found that 86% of organizations have already increased browser security spending in response to emerging threats, and 85% expect to spend more over the next 12–24 months. ",{"data":4975,"content":4976,"nodeType":860},{},[4977],{"data":4978,"marks":4979,"value":4980,"nodeType":864},{},[],"But finding budget for browser security solutions can be harder than it is for other security tools. Both Gartner and Omdia independently confirm that browser security is predominantly additive; Gartner states explicitly that secure enterprise browsers augment rather than replace existing security controls, and Omdia found that 80% of organizations expect to deploy browser security alongside their current stack.",{"data":4982,"content":4983,"nodeType":860},{},[4984],{"data":4985,"marks":4986,"value":4987,"nodeType":864},{},[],"In practice, that means there's typically no legacy line item to redirect or renewal to swap out. Instead, security leaders are left needing to build a business case from scratch, creating more work on top of an already demanding role. Having a proven framework that other security leaders are already using successfully makes that process significantly faster.",{"data":4989,"content":4990,"nodeType":860},{},[4991],{"data":4992,"marks":4993,"value":4994,"nodeType":864},{},[],"Push helps security leaders build these business cases every day and we've seen firsthand what works and where the budget comes from. ",{"data":4996,"content":4997,"nodeType":860},{},[4998],{"data":4999,"marks":5000,"value":5001,"nodeType":864},{},[],"This article distills those patterns into a practical framework you can use to build your own investment case, as well as provides real-world examples of how Push's customers have found budget to make their own investments in browser security tooling:",{"data":5003,"content":5007,"nodeType":996},{"target":5004},{"sys":5005},{"id":5006,"type":1001,"linkType":1002},"3qR5t9Y5wgRfzGqcRNXfNa",[],{"data":5009,"content":5010,"nodeType":1005},{},[],{"data":5012,"content":5013,"nodeType":1009},{},[5014],{"data":5015,"marks":5016,"value":5018,"nodeType":864},{},[5017],{"type":899},"The strategic imperatives that resonate with non-security executives",{"data":5020,"content":5021,"nodeType":860},{},[5022],{"data":5023,"marks":5024,"value":5025,"nodeType":864},{},[],"Two distinct strategic initiatives consistently prove to be effective in unlocking browser security budget. They come from different directions; one is driven by the board down to security, the other is driven by security up to the board. But both lead to the same investment and can be used in conjunction with one another.",{"data":5027,"content":5028,"nodeType":1312},{},[5029],{"data":5030,"marks":5031,"value":5032,"nodeType":864},{},[],"Option A | AI visibility and control: the mandate security teams are responding to",{"data":5034,"content":5035,"nodeType":860},{},[5036,5040,5047],{"data":5037,"marks":5038,"value":5039,"nodeType":864},{},[],"AI adoption isn't a security initiative; it's a business strategy decision that executives and boards are driving. They know the organization needs to harness AI to remain competitive, and most have already committed to accelerating its use. But they also know that ",{"data":5041,"content":5042,"nodeType":883},{"uri":885},[5043],{"data":5044,"marks":5045,"value":5046,"nodeType":864},{},[],"adoption without visibility creates risks they can't quantify or manage",{"data":5048,"marks":5049,"value":5050,"nodeType":864},{},[],", and they expect security to have the visibility and controls to close that gap.",{"data":5052,"content":5053,"nodeType":860},{},[5054,5058,5066],{"data":5055,"marks":5056,"value":5057,"nodeType":864},{},[],"The browser is the most practical place for security teams to get that visibility and control over AI usage. All AI tool usage — whether that's web apps, extensions, OAuth consent flows, data uploads — traverses the browser. A browser security platform like Push can ",{"data":5059,"content":5061,"nodeType":883},{"uri":5060},"https://pushsecurity.com/solution/achieve-security-outcomes/secure-ai",[5062],{"data":5063,"marks":5064,"value":5065,"nodeType":864},{},[],"discover which AI tools employees are actually using",{"data":5067,"marks":5068,"value":5069,"nodeType":864},{},[],", monitor how they're being used, track which AI services have been granted access to corporate systems, and enforce policy in real time.",{"data":5071,"content":5072,"nodeType":860},{},[5073],{"data":5074,"marks":5075,"value":5076,"nodeType":864},{},[],"What makes this particularly effective in a budget conversation is that security teams don’t need to explain or sell a new security risk or initiative, instead they're responding to one their executive team has already identified. When security can demonstrate a concrete plan to deliver AI visibility and control, the funding conversation is significantly shorter. The investment addresses the executive mandate while simultaneously providing additional capabilities for the security team like threat protection, identity and shadow IT security, and investigation support.",{"data":5078,"content":5079,"nodeType":1312},{},[5080],{"data":5081,"marks":5082,"value":5083,"nodeType":864},{},[],"Option B | Modern breaches that originate in the browser: the gap the existing stack wasn't designed to cover",{"data":5085,"content":5086,"nodeType":860},{},[5087],{"data":5088,"marks":5089,"value":5090,"nodeType":864},{},[],"The second strategic imperative requires more educating on the part of the security leader.",{"data":5092,"content":5093,"nodeType":860},{},[5094,5098,5106,5110,5118,5122,5130],{"data":5095,"marks":5096,"value":5097,"nodeType":864},{},[],"The highest-profile breaches in recent years — MGM, Caesars, Ticketmaster, M&S, Jaguar Land Rover — were all carried out by threat groups like ",{"data":5099,"content":5101,"nodeType":883},{"uri":5100},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[5102],{"data":5103,"marks":5104,"value":5105,"nodeType":864},{},[],"Scattered Spider",{"data":5107,"marks":5108,"value":5109,"nodeType":864},{},[]," using cloud-native, ",{"data":5111,"content":5113,"nodeType":883},{"uri":5112},"https://pushsecurity.com/blog/introducing-the-browser-and-identity-attacks-matrix/",[5114],{"data":5115,"marks":5116,"value":5117,"nodeType":864},{},[],"identity-based attack techniques",{"data":5119,"marks":5120,"value":5121,"nodeType":864},{},[],". They didn't compromise endpoints or exploit zero-day vulnerabilities. Instead, they compromised employees' cloud app accounts by targeting them with techniques that ",{"data":5123,"content":5125,"nodeType":883},{"uri":5124},"https://pushsecurity.com/thank-you/browser-attacks-report",[5126],{"data":5127,"marks":5128,"value":5129,"nodeType":864},{},[],"play out inside browser sessions",{"data":5131,"marks":5132,"value":5133,"nodeType":864},{},[]," where existing endpoint, network, and email controls have no visibility.",{"data":5135,"content":5136,"nodeType":860},{},[5137],{"data":5138,"marks":5139,"value":5140,"nodeType":864},{},[],"That doesn't mean your existing security investments are failing. Endpoint, network, and email controls have become effective enough that threat groups are now actively avoiding them by rerouting their attacks via the browser.",{"data":5142,"content":5143,"nodeType":941},{},[5144,5166,5188],{"data":5145,"content":5146,"nodeType":945},{},[5147],{"data":5148,"content":5149,"nodeType":860},{},[5150,5153,5162],{"data":5151,"marks":5152,"value":21,"nodeType":864},{},[],{"data":5154,"content":5156,"nodeType":883},{"uri":5155},"https://www.crowdstrike.com/en-us/global-threat-report/",[5157],{"data":5158,"marks":5159,"value":5161,"nodeType":864},{},[5160],{"type":1455},"CrowdStrike's 2026 data",{"data":5163,"marks":5164,"value":5165,"nodeType":864},{},[]," shows 82% of attack detections are now malware-free. A new capability is needed to address this new playbook, and browser security closes that gap by detecting attacker behavior inside the session, where these attacks actually execute.",{"data":5167,"content":5168,"nodeType":945},{},[5169],{"data":5170,"content":5171,"nodeType":860},{},[5172,5175,5184],{"data":5173,"marks":5174,"value":21,"nodeType":864},{},[],{"data":5176,"content":5178,"nodeType":883},{"uri":5177},"https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/",[5179],{"data":5180,"marks":5181,"value":5183,"nodeType":864},{},[5182],{"type":1455},"Unit 42",{"data":5185,"marks":5186,"value":5187,"nodeType":864},{},[]," found that identity weaknesses played a material role in almost 90% of their investigations, and across more than 750 incident response engagements, 48% involved browser-based activity.",{"data":5189,"content":5190,"nodeType":945},{},[5191],{"data":5192,"content":5193,"nodeType":860},{},[5194,5197,5206],{"data":5195,"marks":5196,"value":21,"nodeType":864},{},[],{"data":5198,"content":5200,"nodeType":883},{"uri":5199},"https://services.google.com/fh/files/misc/m-trends-2025-en.pdf",[5201],{"data":5202,"marks":5203,"value":5205,"nodeType":864},{},[5204],{"type":1455},"Mandiant's data",{"data":5207,"marks":5208,"value":5209,"nodeType":864},{},[]," tells a similar story: threat actors exploited identity issues to gain initial access in 83% of incidents involving cloud and SaaS environments.",{"data":5211,"content":5212,"nodeType":860},{},[5213,5218],{"data":5214,"marks":5215,"value":5217,"nodeType":864},{},[5216],{"type":899},"Identity-based attacks executed via the browser are now the dominant attack pattern.",{"data":5219,"marks":5220,"value":5221,"nodeType":864},{},[]," That framing works in a budget conversation because it identifies a gap rather than asking to improve something that's already covered by an existing solution. It's also reinforced by the fact that the breaches and groups behind them like Scattered Spider were all reported on by the mainstream media, meaning non-security stakeholders are likely to already be somewhat aware of the risks and potential implications of them being realized.",{"data":5223,"content":5224,"nodeType":1005},{},[],{"data":5226,"content":5227,"nodeType":1009},{},[5228],{"data":5229,"marks":5230,"value":5232,"nodeType":864},{},[5231],{"type":899},"The economic case: five value drivers",{"data":5234,"content":5235,"nodeType":860},{},[5236],{"data":5237,"marks":5238,"value":5239,"nodeType":864},{},[],"Those strategic imperatives establish why something needs to be done, but they don't quantify the cost of inaction or demonstrate how the investment pays for itself. A CFO wants to see where the money comes from, what existing spend it offsets, and what measurable return it delivers. The economic investment case draws on five distinct value drivers, each grounded in capabilities specific to operating inside the browser session.",{"data":5241,"content":5245,"nodeType":996},{"target":5242},{"sys":5243},{"id":5244,"type":1001,"linkType":1002},"2W1G5GZWXLbo2hi6bTxAVs",[],{"data":5247,"content":5248,"nodeType":1312},{},[5249],{"data":5250,"marks":5251,"value":5252,"nodeType":864},{},[],"1. Avoided breach costs",{"data":5254,"content":5255,"nodeType":860},{},[5256],{"data":5257,"marks":5258,"value":5259,"nodeType":864},{},[],"This is the largest single value driver, but it's also the hardest to measure because the return is defined by the absence of an event rather than the presence of a saving. That said, the methodology is well-established in risk management, and CFOs already accept this logic for insurance and business continuity investments.",{"data":5261,"content":5262,"nodeType":860},{},[5263,5267,5275],{"data":5264,"marks":5265,"value":5266,"nodeType":864},{},[],"The detection gap described above has a direct financial consequence: every attack that slips through undetected is a potential breach incurring significant direct and indirect costs. Push helps you avoid these costs by detecting ",{"data":5268,"content":5270,"nodeType":883},{"uri":5269},"https://pushsecurity.com/solution/achieve-security-outcomes/stop-account-takeover",[5271],{"data":5272,"marks":5273,"value":5274,"nodeType":864},{},[],"browser-native attack TTPs",{"data":5276,"marks":5277,"value":5278,"nodeType":864},{},[]," and blocking them in real-time to prevent breaches at the earliest opportunity.",{"data":5280,"content":5281,"nodeType":860},{},[5282],{"data":5283,"marks":5284,"value":5285,"nodeType":864},{},[],"Even though the breach itself is unrealized, there are tangible leading indicators of success: reduced MTTD/MTTR, and fewer attacks progressing to account takeover or endpoint compromise; the stages at which incidents become more expensive to clean up.",{"data":5287,"content":5288,"nodeType":860},{},[5289,5293,5300,5303,5311],{"data":5290,"marks":5291,"value":5292,"nodeType":864},{},[],"Quantifying the savings generated by avoiding breaches requires an ",{"data":5294,"content":5295,"nodeType":883},{"uri":3210},[5296],{"data":5297,"marks":5298,"value":5299,"nodeType":864},{},[],"estimation of your organization's breach probability and likely cost",{"data":5301,"marks":5302,"value":2924,"nodeType":864},{},[],{"data":5304,"content":5306,"nodeType":883},{"uri":5305},"https://www.ibm.com/reports/data-breach",[5307],{"data":5308,"marks":5309,"value":5310,"nodeType":864},{},[]," IBM's cost of a data breach report",{"data":5312,"marks":5313,"value":5314,"nodeType":864},{},[]," provides industry-specific benchmarks, though a more grounded alternative is to look at the disclosed costs of the breaches mentioned above and assess your exposure to the same techniques:",{"data":5316,"content":5317,"nodeType":941},{},[5318,5328,5338],{"data":5319,"content":5320,"nodeType":945},{},[5321],{"data":5322,"content":5323,"nodeType":860},{},[5324],{"data":5325,"marks":5326,"value":5327,"nodeType":864},{},[],"MGM reported over $100M in direct impact plus a $45M class-action settlement.",{"data":5329,"content":5330,"nodeType":945},{},[5331],{"data":5332,"content":5333,"nodeType":860},{},[5334],{"data":5335,"marks":5336,"value":5337,"nodeType":864},{},[],"M&S lost £300M in profits with almost £1B wiped off its market valuation.",{"data":5339,"content":5340,"nodeType":945},{},[5341],{"data":5342,"content":5343,"nodeType":860},{},[5344],{"data":5345,"marks":5346,"value":5347,"nodeType":864},{},[],"The JLR breach was severe enough for the UK government to underwrite a $1.5B loan to mitigate supply chain damage.",{"data":5349,"content":5350,"nodeType":860},{},[5351],{"data":5352,"marks":5353,"value":5354,"nodeType":864},{},[],"Your own incident data, red team results, or phishing simulation outcomes will increase accuracy further.",{"data":5356,"content":5360,"nodeType":996},{"target":5357},{"sys":5358},{"id":5359,"type":1001,"linkType":1002},"3SgrdUcQnQsnNLIR9UgBB",[],{"data":5362,"content":5363,"nodeType":1312},{},[5364],{"data":5365,"marks":5366,"value":5367,"nodeType":864},{},[],"2. Accelerated and safe AI adoption",{"data":5369,"content":5370,"nodeType":860},{},[5371],{"data":5372,"marks":5373,"value":5374,"nodeType":864},{},[],"Without effective AI visibility and control tooling, your security team becomes either the bottleneck for AI adoption or allows the risks to go unchecked. Every month that adoption is restricted or ungoverned has a productivity cost that compounds.",{"data":5376,"content":5377,"nodeType":860},{},[5378],{"data":5379,"marks":5380,"value":5381,"nodeType":864},{},[],"There's been plenty of research into the productivity impact of AI:",{"data":5383,"content":5384,"nodeType":941},{},[5385,5407,5429,5451],{"data":5386,"content":5387,"nodeType":945},{},[5388],{"data":5389,"content":5390,"nodeType":860},{},[5391,5394,5403],{"data":5392,"marks":5393,"value":21,"nodeType":864},{},[],{"data":5395,"content":5397,"nodeType":883},{"uri":5396},"https://www.nber.org/system/files/working_papers/w31161/w31161.pdf",[5398],{"data":5399,"marks":5400,"value":5402,"nodeType":864},{},[5401],{"type":1455},"Stanford and MIT research",{"data":5404,"marks":5405,"value":5406,"nodeType":864},{},[]," found that workers with access to a generative AI assistant were 14% more productive on average, with novice workers seeing a 34% improvement.",{"data":5408,"content":5409,"nodeType":945},{},[5410],{"data":5411,"content":5412,"nodeType":860},{},[5413,5416,5425],{"data":5414,"marks":5415,"value":21,"nodeType":864},{},[],{"data":5417,"content":5419,"nodeType":883},{"uri":5418},"https://www.accenture.com/us-en/insights/strategy/productivity-payoff",[5420],{"data":5421,"marks":5422,"value":5424,"nodeType":864},{},[5423],{"type":1455},"Accenture's research",{"data":5426,"marks":5427,"value":5428,"nodeType":864},{},[]," estimates approximately $7,800 per employee per year in productivity value from generative AI for knowledge workers.",{"data":5430,"content":5431,"nodeType":945},{},[5432],{"data":5433,"content":5434,"nodeType":860},{},[5435,5438,5447],{"data":5436,"marks":5437,"value":21,"nodeType":864},{},[],{"data":5439,"content":5441,"nodeType":883},{"uri":5440},"https://www.stlouisfed.org/on-the-economy/2025/feb/impact-generative-ai-work-productivity",[5442],{"data":5443,"marks":5444,"value":5446,"nodeType":864},{},[5445],{"type":1455},"The Federal Reserve",{"data":5448,"marks":5449,"value":5450,"nodeType":864},{},[]," independently quantified it at 5.4% of work hours saved, roughly one full working day reclaimed per month.",{"data":5452,"content":5453,"nodeType":945},{},[5454],{"data":5455,"content":5456,"nodeType":860},{},[5457,5460,5469],{"data":5458,"marks":5459,"value":21,"nodeType":864},{},[],{"data":5461,"content":5463,"nodeType":883},{"uri":5462},"https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai",[5464],{"data":5465,"marks":5466,"value":5468,"nodeType":864},{},[5467],{"type":1455},"McKinsey's 2025 data",{"data":5470,"marks":5471,"value":5472,"nodeType":864},{},[]," shows organizations leading on AI adoption report 5.8x average ROI within 14 months, and they outperform laggards in both profitability and revenue growth.",{"data":5474,"content":5475,"nodeType":860},{},[5476],{"data":5477,"marks":5478,"value":5479,"nodeType":864},{},[],"A browser security platform like Push removes the governance blocker. When you can see which AI tools employees are using, what data they're sharing, and what permissions they've granted, and enforce policy in real time, the answer to \"can our people use this?\" shifts from \"not yet, we need to assess the risk\" to \"yes, with our sensible guardrails.\"",{"data":5481,"content":5482,"nodeType":860},{},[5483],{"data":5484,"marks":5485,"value":5486,"nodeType":864},{},[],"Push delivers this by discovering every AI web app, browser, browser extension, and OAuth integration in use. It monitors data sharing through file uploads and clipboard activity, tracks OAuth consent flows where AI services request access to corporate tenants, and enforces policy at the point of action. This allows your team to very quickly get a handle on AI usage, mitigate risks and guide the business on how to best drive safe adoption.",{"data":5488,"content":5492,"nodeType":996},{"target":5489},{"sys":5490},{"id":5491,"type":1001,"linkType":1002},"6i7Z6jwFaztuoUCynXfrVH",[],{"data":5494,"content":5495,"nodeType":1312},{},[5496],{"data":5497,"marks":5498,"value":5499,"nodeType":864},{},[],"3. Greater return from existing security investments",{"data":5501,"content":5502,"nodeType":860},{},[5503],{"data":5504,"marks":5505,"value":5506,"nodeType":864},{},[],"Push generates direct labor savings in two ways that other tools can't replicate.",{"data":5508,"content":5509,"nodeType":860},{},[5510,5515,5519,5527],{"data":5511,"marks":5512,"value":5514,"nodeType":864},{},[5513],{"type":899},"First, identity hygiene remediation at scale.",{"data":5516,"marks":5517,"value":5518,"nodeType":864},{},[]," Push's customer data shows that for every 1,000 employees, an organization will typically have just over ",{"data":5520,"content":5522,"nodeType":883},{"uri":5521},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[5523],{"data":5524,"marks":5525,"value":5526,"nodeType":864},{},[],"2,500 identity security vulnerabilities",{"data":5528,"marks":5529,"value":5530,"nodeType":864},{},[]," (missing MFA or weak, breached, reused passwords, etc).",{"data":5532,"content":5533,"nodeType":860},{},[5534,5538,5546],{"data":5535,"marks":5536,"value":5537,"nodeType":864},{},[],"Without Push, you could conservatively estimate that each vulnerability takes 5–10 minutes to resolve manually (inclusive of project management and reporting time) which translates to between 26 and 52 FTE days per thousand employees. ",{"data":5539,"content":5541,"nodeType":883},{"uri":5540},"https://pushsecurity.com/solution/achieve-security-outcomes/harden-unmanaged-identities",[5542],{"data":5543,"marks":5544,"value":5545,"nodeType":864},{},[],"Push automates this through in-browser guardrails",{"data":5547,"marks":5548,"value":5549,"nodeType":864},{},[]," that prompt users to fix issues at the point of login. That's thousands of identity vulnerabilities resolved without a single ticket being filed, and weeks of analyst time recovered annually at fully burdened rates.",{"data":5551,"content":5552,"nodeType":860},{},[5553,5558,5562,5570],{"data":5554,"marks":5555,"value":5557,"nodeType":864},{},[5556],{"type":899},"Second, investigation efficiency.",{"data":5559,"marks":5560,"value":5561,"nodeType":864},{},[]," Push detects attacks at the earliest and safest opportunity, as the attacker is attempting to gain initial access via the browser. The telemetry Push provides analysts with ",{"data":5563,"content":5565,"nodeType":883},{"uri":5564},"https://pushsecurity.com/solution/achieve-security-outcomes/investigate-browser-related-incidents",[5566],{"data":5567,"marks":5568,"value":5569,"nodeType":864},{},[],"accelerates their investigations across both external and insider threats",{"data":5571,"marks":5572,"value":2924,"nodeType":864},{},[],{"data":5574,"content":5575,"nodeType":860},{},[5576,5580,5588],{"data":5577,"marks":5578,"value":5579,"nodeType":864},{},[],"Here’s one example of that in action: Push eliminates ",{"data":5581,"content":5583,"nodeType":883},{"uri":5582},"https://pushsecurity.com/blog/verified-stolen-credential-detection/",[5584],{"data":5585,"marks":5586,"value":5587,"nodeType":864},{},[],"over 99% of compromised credential false positives",{"data":5589,"marks":5590,"value":5591,"nodeType":864},{},[]," in common TI feeds by only surfacing credentials actively being used and observed in the browser. Much like the first direct labour saving, Push saves your team weeks of effort confirming false positives and investigating complex account compromise incidents. It also reduces the likelihood of an incident progressing to the stage where a (costly) external incident response provider is needed. ",{"data":5593,"content":5594,"nodeType":860},{},[5595,5599,5607],{"data":5596,"marks":5597,"value":5598,"nodeType":864},{},[],"By automatically remediating identity security issues at scale, and accelerating investigations, Push eliminates much of the work that analysts typically find tedious and frustrating: manually chasing password resets, triaging false positives, ",{"data":5600,"content":5602,"nodeType":883},{"uri":5601},"https://pushsecurity.com/blog/fixing-secops-alert-fatigue-with-browser-telemetry/",[5603],{"data":5604,"marks":5605,"value":5606,"nodeType":864},{},[],"trawling through web proxy logs",{"data":5608,"marks":5609,"value":5610,"nodeType":864},{},[],". Removing that work means they can spend more time on the interesting, high-value aspects of their roles, which directly improves morale and retention.",{"data":5612,"content":5613,"nodeType":860},{},[5614],{"data":5615,"marks":5616,"value":5617,"nodeType":864},{},[],"In a market where replacing a fully ramped security analyst costs 80–150% of their annual salary and the new hire takes months to reach the same productivity, reduced attrition generates its own measurable saving in avoided recruitment, training, and lost productivity during the ramp-up period.",{"data":5619,"content":5620,"nodeType":860},{},[5621],{"data":5622,"marks":5623,"value":5624,"nodeType":864},{},[],"In addition to direct labor savings, Push improves the return on every other security investment in your stack. Browser-layer telemetry feeds into SIEM and SOAR platforms, enriching correlation rules and enabling custom detections that weren't previously possible, a multiplier on the value you're already getting from your existing security investments.",{"data":5626,"content":5630,"nodeType":996},{"target":5627},{"sys":5628},{"id":5629,"type":1001,"linkType":1002},"7EwWz1orX6QQtm5MHnaXDQ",[],{"data":5632,"content":5633,"nodeType":1312},{},[5634],{"data":5635,"marks":5636,"value":5637,"nodeType":864},{},[],"4. Reduced compliance and audit exposure",{"data":5639,"content":5640,"nodeType":860},{},[5641],{"data":5642,"marks":5643,"value":5644,"nodeType":864},{},[],"Every major security compliance framework — SOC 2, ISO 27001, HIPAA, PCI DSS, NIST, GDPR — requires MFA on accounts, strong and unique passwords, and visibility into which third-party applications are being entrusted with corporate data. These are foundational requirements and they apply across every application employees use, not just the ones IT has provisioned. Self-adopted Shadow IT and unmanaged identities create compliance gaps against these requirements that most organizations don't know they have until an auditor finds them.",{"data":5646,"content":5647,"nodeType":860},{},[5648,5651,5660,5664,5672],{"data":5649,"marks":5650,"value":21,"nodeType":864},{},[],{"data":5652,"content":5654,"nodeType":883},{"uri":5653},"https://pushsecurity.com/resources/mfa-regulation-compliance",[5655],{"data":5656,"marks":5657,"value":5659,"nodeType":864},{},[5658],{"type":1455},"The consequences of gaps in these controls are increasingly financial.",{"data":5661,"marks":5662,"value":5663,"nodeType":864},{},[]," The City of Hamilton had its $18.3M cyber insurance claim denied after a ransomware attack because MFA wasn't fully implemented. The insurer ruled that incomplete MFA coverage voided the policy. ",{"data":5665,"content":5667,"nodeType":883},{"uri":5666},"https://pushsecurity.com/blog/what-the-expansion-of-nydfs-nycrr-part-500-means-for-mfa-compliance/",[5668],{"data":5669,"marks":5670,"value":5671,"nodeType":864},{},[],"NYDFS has levied $14 million in fines",{"data":5673,"marks":5674,"value":5675,"nodeType":864},{},[]," from companies with inadequate MFA. These aren't hypothetical risks, and they apply to requirements that Push can help you meet continuously rather than scrambling to find evidence during an audit or after an incident.",{"data":5677,"content":5678,"nodeType":860},{},[5679,5683,5691],{"data":5680,"marks":5681,"value":5682,"nodeType":864},{},[],"Push addresses these compliance requirements directly. It ",{"data":5684,"content":5686,"nodeType":883},{"uri":5685},"https://pushsecurity.com/solution/achieve-security-outcomes/secure-shadow-saas",[5687],{"data":5688,"marks":5689,"value":5690,"nodeType":864},{},[],"discovers every application employees actually use",{"data":5692,"marks":5693,"value":5694,"nodeType":864},{},[]," — directly from the login event in the browser, not from network traffic patterns. It also observes the authentication method, password strength, and MFA status for each account. The inventory provided by Push replaces weeks of manual spreadsheet work during audit preparation and gives your GRC team continuous evidence rather than a point-in-time snapshot assembled under pressure.",{"data":5696,"content":5700,"nodeType":996},{"target":5697},{"sys":5698},{"id":5699,"type":1001,"linkType":1002},"36lm2TMvlpEPrFfM8KEUqB",[],{"data":5702,"content":5703,"nodeType":1312},{},[5704],{"data":5705,"marks":5706,"value":5707,"nodeType":864},{},[],"5. Consolidated capability and reallocated spend",{"data":5709,"content":5710,"nodeType":860},{},[5711,5715,5723],{"data":5712,"marks":5713,"value":5714,"nodeType":864},{},[],"Push delivers against a ",{"data":5716,"content":5718,"nodeType":883},{"uri":5717},"https://pushsecurity.com/blog/the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value/",[5719],{"data":5720,"marks":5721,"value":5722,"nodeType":864},{},[],"wide range of use cases",{"data":5724,"marks":5725,"value":5726,"nodeType":864},{},[]," — threat detection, AI governance, identity security, investigation support — that would otherwise require separate point solutions to address. That breadth of coverage from a single platform and deployment creates natural opportunities to consolidate spend.",{"data":5728,"content":5729,"nodeType":860},{},[5730],{"data":5731,"marks":5732,"value":5733,"nodeType":864},{},[],"AI governance is the most immediate example. Nearly every enterprise is evaluating standalone AI monitoring tools right now, and the price tags are significant. If your browser security platform already delivers the AI visibility and control capabilities like Push's described above — app discovery, data sharing monitoring, OAuth consent tracking, real-time policy enforcement — the case for a separate AI governance purchase weakens considerably. Paying separately for a tool that only does AI governance, when your browser security platform delivers it alongside detection, identity security, and investigation capability, is a hard spend to justify.",{"data":5735,"content":5736,"nodeType":860},{},[5737],{"data":5738,"marks":5739,"value":5740,"nodeType":864},{},[],"There's also a broader resource reallocation opportunity. Platforms like Push represent a new generation of security tooling that addresses the challenges posed by modern work and cyber attacks. The ROI they provide is high now and is likely to increase as the platform evolves alongside the threats and risks it addresses. Meanwhile, much of the legacy stack is moving in the opposite direction.",{"data":5742,"content":5743,"nodeType":941},{},[5744,5766,5776],{"data":5745,"content":5746,"nodeType":945},{},[5747],{"data":5748,"content":5749,"nodeType":860},{},[5750,5754,5762],{"data":5751,"marks":5752,"value":5753,"nodeType":864},{},[],"Network-centric tools like ",{"data":5755,"content":5757,"nodeType":883},{"uri":5756},"https://pushsecurity.com/blog/push-plus-network-security/",[5758],{"data":5759,"marks":5760,"value":5761,"nodeType":864},{},[],"SWGs and CASBs are becoming increasingly legacy",{"data":5763,"marks":5764,"value":5765,"nodeType":864},{},[]," as more activity moves off the traditional network and into the browser.",{"data":5767,"content":5768,"nodeType":945},{},[5769],{"data":5770,"content":5771,"nodeType":860},{},[5772],{"data":5773,"marks":5774,"value":5775,"nodeType":864},{},[],"RBI deployments are difficult to justify when a browser extension achieves better security outcomes without the user experience penalty.",{"data":5777,"content":5778,"nodeType":945},{},[5779],{"data":5780,"content":5781,"nodeType":860},{},[5782],{"data":5783,"marks":5784,"value":5785,"nodeType":864},{},[],"Phishing simulation programs — whose ROI has long been questioned by practitioners — are harder to justify when attackers are using AI to craft lures and pages that are indistinguishable from the real thing for even the most trained employees. If your browser security platform is already blocking real phishing attempts and delivering contextual security guidance at the actual point of risk, the marginal value of a simulation exercise weeks later diminishes considerably.",{"data":5787,"content":5788,"nodeType":860},{},[5789],{"data":5790,"marks":5791,"value":5792,"nodeType":864},{},[],"As legacy tooling becomes less relevant and more commoditized, you should expect to spend less on it. What you save can then be reallocated towards capabilities like Push that address the current threat landscape rather than the previous one legacy tools were designed for.",{"data":5794,"content":5795,"nodeType":1005},{},[],{"data":5797,"content":5798,"nodeType":1009},{},[5799],{"data":5800,"marks":5801,"value":5803,"nodeType":864},{},[5802],{"type":899},"Investment risk management",{"data":5805,"content":5806,"nodeType":860},{},[5807],{"data":5808,"marks":5809,"value":5810,"nodeType":864},{},[],"The final component of the business case is assessing the investment risk. Given that browser security solutions are typically a new capability, and therefore a new form of investment, there will naturally be questions about how safe an investment it is.",{"data":5812,"content":5813,"nodeType":860},{},[5814],{"data":5815,"marks":5816,"value":5817,"nodeType":864},{},[],"Browser security takes many forms and approaches, so this section speaks specifically to Push and why it represents a low-risk investment to make.",{"data":5819,"content":5820,"nodeType":860},{},[5821,5825,5833],{"data":5822,"marks":5823,"value":5824,"nodeType":864},{},[],"Push is simple to deploy. It installs as a browser extension via existing MDM tooling — it works on the browsers employees already use, with no migration to a new browser, no user retraining, and no change to workflows. ",{"data":5826,"content":5828,"nodeType":883},{"uri":5827},"https://pushsecurity.com/customer-stories",[5829],{"data":5830,"marks":5831,"value":5832,"nodeType":864},{},[],"Customers have rolled Push out to over 100,000 users in under an hour",{"data":5834,"marks":5835,"value":5836,"nodeType":864},{},[]," during normal office hours with zero downtime.",{"data":5838,"content":5839,"nodeType":860},{},[5840],{"data":5841,"marks":5842,"value":5843,"nodeType":864},{},[],"You start seeing findings and detections from day one, not after a months-long implementation project. That compresses time-to-value to a matter of hours, which directly de-risks the investment from a finance perspective. Push's high-fidelity telemetry results in a negligible false positive rate, minimizing the operational cost of running the platform. Push integrates into your existing security workflows and tools, like your SIEM, SOAR, and IdP, and doesn't require a dedicated team to manage, so you gain a new capability without taking on a new operational burden.",{"data":5845,"content":5846,"nodeType":860},{},[5847,5851,5859,5863,5871,5874,5882],{"data":5848,"marks":5849,"value":5850,"nodeType":864},{},[],"Push supports advanced security teams in highly targeted and regulated industries, with over 3 million browsers deployed worldwide. As one of the first browser security extensions, launched in 2022, Push has one of the longest track records in the space, and its research team regularly discovers novel attack techniques, including ",{"data":5852,"content":5854,"nodeType":883},{"uri":5853},"https://pushsecurity.com/blog/consentfix/",[5855],{"data":5856,"marks":5857,"value":5858,"nodeType":864},{},[],"ConsentFix",{"data":5860,"marks":5861,"value":5862,"nodeType":864},{},[],",",{"data":5864,"content":5866,"nodeType":883},{"uri":5865},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[5867],{"data":5868,"marks":5869,"value":5870,"nodeType":864},{},[]," ghost logins",{"data":5872,"marks":5873,"value":5862,"nodeType":864},{},[],{"data":5875,"content":5877,"nodeType":883},{"uri":5876},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[5878],{"data":5879,"marks":5880,"value":5881,"nodeType":864},{},[]," SAMLjacking",{"data":5883,"marks":5884,"value":5885,"nodeType":864},{},[],", and regularly publishes campaign analysis referenced across the security community.",{"data":5887,"content":5888,"nodeType":860},{},[5889,5893,5901],{"data":5890,"marks":5891,"value":5892,"nodeType":864},{},[],"Finally, Push actively hunts for new and novel threats across your estate using its research and ",{"data":5894,"content":5896,"nodeType":883},{"uri":5895},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline/",[5897],{"data":5898,"marks":5899,"value":5900,"nodeType":864},{},[],"agentic detection pipeline",{"data":5902,"marks":5903,"value":5904,"nodeType":864},{},[],", with no customer input required. That means you remain protected as the threat landscape evolves, and the capability continues to advance and deliver recurring value over the full contract period without additional effort from your team.",{"data":5906,"content":5907,"nodeType":1005},{},[],{"data":5909,"content":5910,"nodeType":1009},{},[5911],{"data":5912,"marks":5913,"value":5915,"nodeType":864},{},[5914],{"type":899},"Where has the budget actually come from for Push’s customers?",{"data":5917,"content":5918,"nodeType":860},{},[5919],{"data":5920,"marks":5921,"value":5922,"nodeType":864},{},[],"Push's customers have funded their browser security investment through several well-established routes:",{"data":5924,"content":5925,"nodeType":941},{},[5926,5947,5982,6025,6047],{"data":5927,"content":5928,"nodeType":945},{},[5929],{"data":5930,"content":5931,"nodeType":860},{},[5932,5936,5943],{"data":5933,"marks":5934,"value":5935,"nodeType":864},{},[],"Many teams had funded projects to increase their ",{"data":5937,"content":5938,"nodeType":883},{"uri":5060},[5939],{"data":5940,"marks":5941,"value":5942,"nodeType":864},{},[],"visibility and control over AI use",{"data":5944,"marks":5945,"value":5946,"nodeType":864},{},[]," in their organizations. Push gave them the instrumentation they needed to address their needs while also allowing them to address other valuable security use cases.",{"data":5948,"content":5949,"nodeType":945},{},[5950],{"data":5951,"content":5952,"nodeType":860},{},[5953,5957,5965,5969,5978],{"data":5954,"marks":5955,"value":5956,"nodeType":864},{},[],"Push is frequently purchased following a security incident such as an ",{"data":5958,"content":5960,"nodeType":883},{"uri":5959},"https://pushsecurity.com/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks",[5961],{"data":5962,"marks":5963,"value":5964,"nodeType":864},{},[],"AitM phishing breach",{"data":5966,"marks":5967,"value":5968,"nodeType":864},{},[]," or a ",{"data":5970,"content":5972,"nodeType":883},{"uri":5971},"https://pushsecurity.com/solution/stop-browser-based-attacks/clickfix-fix-variants",[5973],{"data":5974,"marks":5975,"value":5977,"nodeType":864},{},[5976],{"type":1455},"ClickFix breach",{"data":5979,"marks":5980,"value":5981,"nodeType":864},{},[]," that existing tools failed to detect and stop.",{"data":5983,"content":5984,"nodeType":945},{},[5985],{"data":5986,"content":5987,"nodeType":860},{},[5988,5992,6000,6003,6010,6013,6021],{"data":5989,"marks":5990,"value":5991,"nodeType":864},{},[],"Another leverage point has been ",{"data":5993,"content":5995,"nodeType":883},{"uri":5994},"https://pushsecurity.com/solution/tool-replacements/cloud-access-security-broker",[5996],{"data":5997,"marks":5998,"value":306,"nodeType":864},{},[5999],{"type":1455},{"data":6001,"marks":6002,"value":3731,"nodeType":864},{},[],{"data":6004,"content":6006,"nodeType":883},{"uri":6005},"https://pushsecurity.com/solution/tool-replacements/secure-web-gateways",[6007],{"data":6008,"marks":6009,"value":624,"nodeType":864},{},[],{"data":6011,"marks":6012,"value":2232,"nodeType":864},{},[],{"data":6014,"content":6016,"nodeType":883},{"uri":6015},"https://pushsecurity.com/solution/tool-replacements/remote-browser-isolation",[6017],{"data":6018,"marks":6019,"value":6020,"nodeType":864},{},[],"RBI",{"data":6022,"marks":6023,"value":6024,"nodeType":864},{},[]," renewals. The browser-native capabilities of a tool like Push let you either replace or reduce the scope — and cost — on those contracts without losing coverage.",{"data":6026,"content":6027,"nodeType":945},{},[6028],{"data":6029,"content":6030,"nodeType":860},{},[6031,6035,6043],{"data":6032,"marks":6033,"value":6034,"nodeType":864},{},[],"A number of Push customers rolled out ",{"data":6036,"content":6038,"nodeType":883},{"uri":6037},"https://pushsecurity.com/solution/achieve-security-outcomes/secure-chromebooks",[6039],{"data":6040,"marks":6041,"value":6042,"nodeType":864},{},[],"Chromebooks",{"data":6044,"marks":6045,"value":6046,"nodeType":864},{},[]," to parts of their workforce and used the savings that generated to pay for Push. These devices fell outside of their standard EDR coverage and they found that Push provided all the visibility and protection they needed for Chromebook users.",{"data":6048,"content":6049,"nodeType":945},{},[6050],{"data":6051,"content":6052,"nodeType":860},{},[6053,6057],{"data":6054,"marks":6055,"value":6056,"nodeType":864},{},[],"But overall, most customers choose to build the net-new case using ROI projections alone. Push customers see direct savings that cover the cost of deploying Push and indirect savings that run into the millions of dollars. ",{"data":6058,"marks":6059,"value":6061,"nodeType":864},{},[6060],{"type":899},"For every $1 invested, Push generates a return of $5 - $15 through a mixture of direct and indirect savings aligned to the five economic value drivers.",{"data":6063,"content":6064,"nodeType":1312},{},[6065],{"data":6066,"marks":6067,"value":6069,"nodeType":864},{},[6068],{"type":899},"Strengthening your case with PoV data",{"data":6071,"content":6072,"nodeType":860},{},[6073,6077,6085],{"data":6074,"marks":6075,"value":6076,"nodeType":864},{},[],"One practical step that strengthens any business case significantly is to ",{"data":6078,"content":6080,"nodeType":883},{"uri":6079},"https://pushsecurity.com/blog/how-to-avoid-the-browser-security-buyers-trap/",[6081],{"data":6082,"marks":6083,"value":6084,"nodeType":864},{},[],"run a proof of value",{"data":6086,"marks":6087,"value":6088,"nodeType":864},{},[],". A PoV deployment generates findings specific to your organization: real instances of employees being targeted in their browsers, the actual scale of your identity attack surface, and concrete shadow SaaS and AI usage data.",{"data":6090,"content":6091,"nodeType":860},{},[6092],{"data":6093,"marks":6094,"value":6095,"nodeType":864},{},[],"That evidence can be far more compelling to a CFO than generic industry benchmarks, and it hones the projected value from the framework using real-world data taken from your own environment. ",{"data":6097,"content":6098,"nodeType":860},{},[6099],{"data":6100,"marks":6101,"value":6102,"nodeType":864},{},[],"The drawback is that the kind of PoV that generates this type of evidence requires more time and effort to run. Security teams typically opt for this approach when they know they'll encounter stronger resistance to budget being made available and they'll really need to evidence the need in absolutely concrete terms.",{"data":6104,"content":6105,"nodeType":1005},{},[],{"data":6107,"content":6108,"nodeType":1009},{},[6109],{"data":6110,"marks":6111,"value":6113,"nodeType":864},{},[6112],{"type":899},"Closing thoughts: “nothing worth having comes easy”",{"data":6115,"content":6116,"nodeType":860},{},[6117],{"data":6118,"marks":6119,"value":6120,"nodeType":864},{},[],"The budget conversation for browser security takes more work than it does for a like-for-like tool replacement — but the security leaders who've been through it consistently find that the economic case is stronger than they expected going in. ",{"data":6122,"content":6123,"nodeType":860},{},[6124],{"data":6125,"marks":6126,"value":6127,"nodeType":864},{},[],"Both strategic imperatives are grounded in data any CFO can verify independently, the financial impact is quantifiable across multiple dimensions, and the routes to funding are well-established across organizations that have already made this investment.",{"data":6129,"content":6130,"nodeType":1005},{},[],{"data":6132,"content":6133,"nodeType":860},{},[6134],{"data":6135,"marks":6136,"value":1682,"nodeType":864},{},[],{"data":6138,"content":6139,"nodeType":860},{},[6140],{"data":6141,"marks":6142,"value":1689,"nodeType":864},{},[],{"data":6144,"content":6145,"nodeType":860},{},[6146,6149,6156],{"data":6147,"marks":6148,"value":2707,"nodeType":864},{},[],{"data":6150,"content":6152,"nodeType":883},{"uri":6151},"https://pushsecurity.com/demo/",[6153],{"data":6154,"marks":6155,"value":2715,"nodeType":864},{},[],{"data":6157,"marks":6158,"value":2719,"nodeType":864},{},[],{"entries":6160},{"hyperlink":6161,"inline":6162,"block":6163},[],[],[6164,6171,6197,6221,6248,6274],{"sys":6165,"__typename":1724,"title":6166,"caption":59,"layoutMode":59,"file":6167},{"id":5006},"business case framework",{"url":6168,"width":6169,"height":6170},"https://images.ctfassets.net/y1cdw1ablpvd/1TIwUkTfu8uJkxpF3vS8jS/e93b6ddfa432874452812c2566b5e031/business_case_framework_2x__4_.png",3200,2302,{"sys":6172,"__typename":1740,"content":6173,"name":6196,"title":59},{"id":5244},{"json":6174},{"nodeType":856,"data":6175,"content":6176},{},[6177,6184],{"nodeType":860,"data":6178,"content":6179},{},[6180],{"nodeType":864,"value":6181,"marks":6182,"data":6183},"To illustrate the potential economic impact, each value driver below includes an estimate for a hypothetical 1,000-employee US technology company called ACME. The assumptions used are conservative and the benchmarks are publicly available. And while your own numbers will differ, the methodology used is transferable. ",[],{},{"nodeType":860,"data":6185,"content":6186},{},[6187,6191],{"nodeType":864,"value":6188,"marks":6189,"data":6190},"Using these estimates, ACME can conservatively expect a return of ",[],{},{"nodeType":864,"value":6192,"marks":6193,"data":6195},"$435K–$925K in combined annual value from direct labor savings, risk-adjusted cost avoidance, and accelerated productivity gains.",[6194],{"type":899},{},"Browser business case IB1",{"sys":6198,"__typename":1740,"content":6199,"name":6220,"title":59},{"id":5359},{"json":6200},{"nodeType":856,"data":6201,"content":6202},{},[6203],{"nodeType":860,"data":6204,"content":6205},{},[6206,6211,6215],{"nodeType":864,"value":6207,"marks":6208,"data":6210},"ACME example: ",[6209],{"type":899},{},{"nodeType":864,"value":6212,"marks":6213,"data":6214},"IBM's data puts the average breach cost for a technology company at approximately $4.9M. Assuming a conservative 5–8% annual breach probability, and given that 80% of breaches are now identity-based and execute via the browser, the question is how much of that exposure Push eliminates. Push detects and blocks browser-native, identity-based attacks in real time. Even using a conservative 80% effectiveness estimate ",[],{},{"nodeType":864,"value":6216,"marks":6217,"data":6219},"the expected annual value is $150K–$250K.",[6218],{"type":899},{},"Browser business case IB2",{"sys":6222,"__typename":1740,"content":6223,"name":6247,"title":59},{"id":5491},{"json":6224},{"nodeType":856,"data":6225,"content":6226},{},[6227],{"nodeType":860,"data":6228,"content":6229},{},[6230,6234,6238,6243],{"nodeType":864,"value":6207,"marks":6231,"data":6233},[6232],{"type":899},{},{"nodeType":864,"value":6235,"marks":6236,"data":6237},"for a 1,000-employee technology company where 60% of the workforce are knowledge workers, accelerating safe AI adoption by three to six months for 25–40% of those workers captures ",[],{},{"nodeType":864,"value":6239,"marks":6240,"data":6242},"$150K–$400K",[6241],{"type":899},{},{"nodeType":864,"value":6244,"marks":6245,"data":6246}," in productivity value.",[],{},"Browser business case IB3",{"sys":6249,"__typename":1740,"content":6250,"name":6273,"title":59},{"id":5629},{"json":6251},{"nodeType":856,"data":6252,"content":6253},{},[6254],{"nodeType":860,"data":6255,"content":6256},{},[6257,6261,6265,6270],{"nodeType":864,"value":6207,"marks":6258,"data":6260},[6259],{"type":899},{},{"nodeType":864,"value":6262,"marks":6263,"data":6264},"Automated identity remediation across approximately 2,500 vulnerabilities recovers $25K–$35K in analyst time annually. Investigation efficiency gains from earlier detection and the elimination of compromised credential false positives save a further $45K–$65K. Reduced analyst attrition, driven by the removal of tedious manual work, avoids $15K–$25K in recruitment and ramp-up costs. Combined, this value driver represents ",[],{},{"nodeType":864,"value":6266,"marks":6267,"data":6269},"$85K–$125K annually",[6268],{"type":899},{},{"nodeType":864,"value":2924,"marks":6271,"data":6272},[],{},"Browser business case IB4",{"sys":6275,"__typename":1740,"content":6276,"name":6299,"title":59},{"id":5699},{"json":6277},{"nodeType":856,"data":6278,"content":6279},{},[6280],{"nodeType":860,"data":6281,"content":6282},{},[6283,6287,6291,6296],{"nodeType":864,"value":6207,"marks":6284,"data":6286},[6285],{"type":899},{},{"nodeType":864,"value":6288,"marks":6289,"data":6290},"Push's automated inventory and continuous compliance evidence replaces approximately 1,000 hours of annual audit preparation effort, generating $8K–$25K in direct savings. The larger value is in risk avoidance: assuming a conservative 3–5% annual probability of a compliance-related financial event (e.g. a denied insurance claim or a regulatory fine) and an average impact of $5–8M, even a 30% reduction in that exposure represents $45K–$120K in expected annual value. ",[],{},{"nodeType":864,"value":6292,"marks":6293,"data":6295},"Combined: $50K–$150K",[6294],{"type":899},{},{"nodeType":864,"value":2924,"marks":6297,"data":6298},[],{},"Browser business case IB5",{"items":6301},[],{},"How to make the business case for browser security","thought-leadership","2026-05-29T00:00:00.000Z",{"items":6307},[6308,7011,7560],{"__typename":2059,"sys":6309,"content":6311,"title":6997,"synopsis":6998,"hashTags":59,"publishedDate":6999,"slug":7000,"tagsCollection":7001,"authorsCollection":7007},{"id":6310},"1ThCW6Cx8Zcq2flramQdoj",{"json":6312},{"data":6313,"content":6314,"nodeType":856},{},[6315,6322,6329,6351,6358,6365,6372,6375,6383,6390,6409,6416,6423,6471,6478,6486,6493,6500,6507,6510,6518,6525,6537,6544,6552,6571,6577,6617,6623,6630,6642,6648,6655,6672,6680,6687,6706,6712,6720,6727,6882,6885,6893,6900,6907,6910,6918,6925,6937,6949,6961,6973,6980],{"data":6316,"content":6317,"nodeType":860},{},[6318],{"data":6319,"marks":6320,"value":6321,"nodeType":864},{},[],"At first, it may seem like an obvious choice, partly because the category name \"Secure Enterprise Browser\" implies the answer is a full-stack browser. Plus, the most visible vendors in the space have spent the past few years marketing that exact choice as the only one. ",{"data":6323,"content":6324,"nodeType":860},{},[6325],{"data":6326,"marks":6327,"value":6328,"nodeType":864},{},[],"But the market tells a different story. The majority of vendors Gartner places in the SEB category are now extensions rather than full browsers, and Gartner explicitly notes that extensions have become the preferred option. ",{"data":6330,"content":6331,"nodeType":1116},{},[6332],{"data":6333,"content":6334,"nodeType":860},{},[6335,6339,6347],{"data":6336,"marks":6337,"value":6338,"nodeType":864},{},[],"The buyer-side data tells the same story: In ",{"data":6340,"content":6341,"nodeType":883},{"uri":2561},[6342],{"data":6343,"marks":6344,"value":6346,"nodeType":864},{},[6345],{"type":1455},"Omdia's 2026 survey of 400 IT and security professionals",{"data":6348,"marks":6349,"value":6350,"nodeType":864},{},[],", 48% of organizations cited the ability to use their existing browsers as an important attribute in a secure browsing solution.",{"data":6352,"content":6353,"nodeType":860},{},[6354],{"data":6355,"marks":6356,"value":6357,"nodeType":864},{},[],"The truth is: Full-stack enterprise browsers and browser security extensions like Push aren’t competing products. They serve different needs for different teams, though they often get evaluated against each other.",{"data":6359,"content":6360,"nodeType":860},{},[6361],{"data":6362,"marks":6363,"value":6364,"nodeType":864},{},[],"Full-stack enterprise browsers serve the IT team's need to control the workspace. Browser security extensions like Push meet the security team's need to protect their users as they work in their browsers — a fundamentally different problem. ",{"data":6366,"content":6367,"nodeType":860},{},[6368],{"data":6369,"marks":6370,"value":6371,"nodeType":864},{},[],"In this article, we’ll cover why a feature-by-feature checklist is the wrong approach when selecting a secure browser platform, and what questions to consider instead. We’ll also discuss what each type of solution excels at, where Push fits in, and how to map your needs to the right solution.",{"data":6373,"content":6374,"nodeType":1005},{},[],{"data":6376,"content":6377,"nodeType":1009},{},[6378],{"data":6379,"marks":6380,"value":6382,"nodeType":864},{},[6381],{"type":899},"Full-stack enterprise browsers meet the IT team's need to control a workspace",{"data":6384,"content":6385,"nodeType":860},{},[6386],{"data":6387,"marks":6388,"value":6389,"nodeType":864},{},[],"Full-stack enterprise browsers like Island, Prisma Browser, and SURF Security are best understood as managed workspace platforms rather than browsers in the conventional sense. ",{"data":6391,"content":6392,"nodeType":1116},{},[6393],{"data":6394,"content":6395,"nodeType":860},{},[6396,6400,6405],{"data":6397,"marks":6398,"value":6399,"nodeType":864},{},[],"Island's own CEO Mike Fey has described the company's strategy as transforming the browser into ",{"data":6401,"marks":6402,"value":6404,"nodeType":864},{},[6403],{"type":2246},"\"a centralized, enterprise-grade platform, eliminating layers of legacy IT infrastructure by building more functionality in the browser.\"",{"data":6406,"marks":6407,"value":6408,"nodeType":864},{},[]," ",{"data":6410,"content":6411,"nodeType":860},{},[6412],{"data":6413,"marks":6414,"value":6415,"nodeType":864},{},[],"Chrome Enterprise and Edge for Business occupy a related space as productivity-suite browsers extended with native security controls, sold as part of the broader Google and Microsoft workplace stacks. Different products with different lineage, but all of them converge on the same owner: an IT organization solving for workspace control.",{"data":6417,"content":6418,"nodeType":860},{},[6419],{"data":6420,"marks":6421,"value":6422,"nodeType":864},{},[],"The IT team is trying to achieve workspace policy compliance and access governance. Their primary use case is typically reducing reliance on legacy IT tools like VDI, VPN, remote browser isolation, DaaS, web filtering, and CASBs. In this world, the use cases look like: ",{"data":6424,"content":6425,"nodeType":941},{},[6426,6441,6456],{"data":6427,"content":6428,"nodeType":945},{},[6429],{"data":6430,"content":6431,"nodeType":860},{},[6432,6437],{"data":6433,"marks":6434,"value":6436,"nodeType":864},{},[6435],{"type":899},"Securing third-party contractors or BYOD",{"data":6438,"marks":6439,"value":6440,"nodeType":864},{},[]," where the workspace itself is the access control. ",{"data":6442,"content":6443,"nodeType":945},{},[6444],{"data":6445,"content":6446,"nodeType":860},{},[6447,6452],{"data":6448,"marks":6449,"value":6451,"nodeType":864},{},[6450],{"type":899},"Regulated populations",{"data":6453,"marks":6454,"value":6455,"nodeType":864},{},[]," like call centers, BPO workforces, finance teams handling sensitive material, where output controls like watermarking, screenshot restriction, and print blocking need to be enforced at the OS rendering layer. ",{"data":6457,"content":6458,"nodeType":945},{},[6459],{"data":6460,"content":6461,"nodeType":860},{},[6462,6467],{"data":6463,"marks":6464,"value":6466,"nodeType":864},{},[6465],{"type":899},"Legacy app support",{"data":6468,"marks":6469,"value":6470,"nodeType":864},{},[]," including IE-mode rendering for applications that have never been modernized. ",{"data":6472,"content":6473,"nodeType":860},{},[6474],{"data":6475,"marks":6476,"value":6477,"nodeType":864},{},[],"For these use cases, the architecture is well-suited, and there are numerous full-stack SEB solutions that address them well. Where the full-stack approach runs into trouble is in getting users to migrate onto a new browser and in justifying the cost of doing so. Both problems scale with the size of the workforce. ",{"data":6479,"content":6480,"nodeType":1312},{},[6481],{"data":6482,"marks":6483,"value":6485,"nodeType":864},{},[6484],{"type":899},"Cost of deployment is a significant blocker for full-stack browsers",{"data":6487,"content":6488,"nodeType":860},{},[6489],{"data":6490,"marks":6491,"value":6492,"nodeType":864},{},[],"The migration costs are easy to predict: deployment and configuration effort, help desk volume and — biggest of all — user resistance. But it’s the license cost that limits deployments in many organizations going from a free consumer browser to a paid replacement for the first time. ",{"data":6494,"content":6495,"nodeType":860},{},[6496],{"data":6497,"marks":6498,"value":6499,"nodeType":864},{},[],"In fact, Gartner notes that most buyers start with a single use case like covering contractors and rarely pursue organization-wide deployment for a full-stack enterprise browser. ",{"data":6501,"content":6502,"nodeType":860},{},[6503],{"data":6504,"marks":6505,"value":6506,"nodeType":864},{},[],"For organizations that do achieve a full-coverage deployment for these full-stack browsers, the need to manage drift in employee behavior over time gets harder. Agentic browsers like Comet, Atlas, and Dia are already starting to pull users toward AI-native workflows that consumer browsers don’t offer and full-stack enterprise browsers don’t currently match.",{"data":6508,"content":6509,"nodeType":1005},{},[],{"data":6511,"content":6512,"nodeType":1009},{},[6513],{"data":6514,"marks":6515,"value":6517,"nodeType":864},{},[6516],{"type":899},"What a browser security extension built for the security team looks like",{"data":6519,"content":6520,"nodeType":860},{},[6521],{"data":6522,"marks":6523,"value":6524,"nodeType":864},{},[],"Most browser security extensions on the market were built to address this migration hurdle. They attempt to take as many of the features of a full-stack browser as possible, but make it possible to deploy into users’ existing browsers, sidestepping a lot of the cost and rollout problems.",{"data":6526,"content":6527,"nodeType":860},{},[6528,6532],{"data":6529,"marks":6530,"value":6531,"nodeType":864},{},[],"LayerX, Seraphic, SquareX, and Keep Aware have all at some point echoed this approach in their product descriptions with the line ",{"data":6533,"marks":6534,"value":6536,"nodeType":864},{},[6535],{"type":2246},"\"make any browser an enterprise browser.\"",{"data":6538,"content":6539,"nodeType":860},{},[6540],{"data":6541,"marks":6542,"value":6543,"nodeType":864},{},[],"Ultimately, that approach is still aimed at solving problems for the IT team more than the security team.",{"data":6545,"content":6546,"nodeType":1312},{},[6547],{"data":6548,"marks":6549,"value":6551,"nodeType":864},{},[6550],{"type":899},"Push is different — we built a browser extension to meet the security team's needs",{"data":6553,"content":6554,"nodeType":860},{},[6555,6559,6567],{"data":6556,"marks":6557,"value":6558,"nodeType":864},{},[],"Push set out to meet a different need. Our team's background has always been in defending organizations against advanced attacks. We spent our careers working in red and blue teams throughout the network and endpoint eras of cyber attacks. The mission we started with in 2022 was to defend organizations against the ",{"data":6560,"content":6561,"nodeType":883},{"uri":5124},[6562],{"data":6563,"marks":6564,"value":6566,"nodeType":864},{},[6565],{"type":1455},"new era of damaging cyber attacks that originate in the browser",{"data":6568,"marks":6569,"value":6570,"nodeType":864},{},[],". ",{"data":6572,"content":6576,"nodeType":996},{"target":6573},{"sys":6574},{"id":6575,"type":1001,"linkType":1002},"6BwJl8ZkiMore2o1BKx2w6",[],{"data":6578,"content":6579,"nodeType":860},{},[6580,6584,6593,6597,6602,6606,6614],{"data":6581,"marks":6582,"value":6583,"nodeType":864},{},[],"We chose a browser extension as the approach for our solution, not because we wanted to build an easier-to-deploy enterprise browser, but so we could use it as a security agent to collect high-fidelity telemetry for TTP-based detections, and apply real-time controls to stop attacks at the earliest opportunity in the modern  — ",{"data":6585,"content":6587,"nodeType":883},{"uri":6586},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[6588],{"data":6589,"marks":6590,"value":6592,"nodeType":864},{},[6591],{"type":1455},"browser and identity native",{"data":6594,"marks":6595,"value":6596,"nodeType":864},{},[],"  — kill chain. ",{"data":6598,"marks":6599,"value":6601,"nodeType":864},{},[6600],{"type":899},"In effect, we created EDR, but for the browser. ",{"data":6603,"marks":6604,"value":6605,"nodeType":864},{},[],"This is what gives Push the edge compared to other Secure Enterprise Browser solutions when it comes to tackling the highest priority threats in the browser — ",{"data":6607,"content":6608,"nodeType":883},{"uri":6079},[6609],{"data":6610,"marks":6611,"value":6613,"nodeType":864},{},[6612],{"type":1455},"we’re optimized for this problem area",{"data":6615,"marks":6616,"value":6570,"nodeType":864},{},[],{"data":6618,"content":6622,"nodeType":996},{"target":6619},{"sys":6620},{"id":6621,"type":1001,"linkType":1002},"4nGzT9cNG0Yid93uUCCuTt",[],{"data":6624,"content":6625,"nodeType":860},{},[6626],{"data":6627,"marks":6628,"value":6629,"nodeType":864},{},[],"For a security team using Push’s extension, this means attacks get stopped at the earliest opportunity in the kill chain and before they cause harm. ",{"data":6631,"content":6632,"nodeType":860},{},[6633,6637],{"data":6634,"marks":6635,"value":6636,"nodeType":864},{},[],"When a user lands on a phishing page built to harvest their credentials, Push sees the page rendering and the JavaScript executing inside the DOM, and can block the credential submission before the form posts. When a user is being walked through a ClickFix or ConsentFix social engineering flow, Push sees the clipboard writes and the OAuth consent flow parameters being prepared, and can intervene before the user completes the action. When a session token is stolen and replayed against a different device, Push sees the session activity and surfaces the compromise. ",{"data":6638,"marks":6639,"value":6641,"nodeType":864},{},[6640],{"type":899},"Push does all of this from a browser extension, without needing to replace the user's browser. ",{"data":6643,"content":6647,"nodeType":996},{"target":6644},{"sys":6645},{"id":6646,"type":1001,"linkType":1002},"1FZEbn0K80d1jHRRTk7kL7",[],{"data":6649,"content":6650,"nodeType":860},{},[6651],{"data":6652,"marks":6653,"value":6654,"nodeType":864},{},[],"The same underlying technology also addresses other high-value security use cases: Visibility and control over AI usage; hardening identities and surfacing shadow IT; and supporting insider investigations and preventing data loss. ",{"data":6656,"content":6657,"nodeType":860},{},[6658,6661,6668],{"data":6659,"marks":6660,"value":2761,"nodeType":864},{},[],{"data":6662,"content":6663,"nodeType":883},{"uri":5717},[6664],{"data":6665,"marks":6666,"value":6667,"nodeType":864},{},[],"highest-value use cases",{"data":6669,"marks":6670,"value":6671,"nodeType":864},{},[]," the browser can address are all powered by the same underlying technical capability, which is why Push's single extension can address four major security use cases rather than four separate tools needing four separate deployments. The success metric for security teams using Push is attacks averted or stopped, cyber risk reduced, and security posture and resilience strengthened — not workspace policy compliance.",{"data":6673,"content":6674,"nodeType":1312},{},[6675],{"data":6676,"marks":6677,"value":6679,"nodeType":864},{},[6678],{"type":899},"Proven at scale: What security leaders are saying",{"data":6681,"content":6682,"nodeType":860},{},[6683],{"data":6684,"marks":6685,"value":6686,"nodeType":864},{},[],"Push launched its browser extension in 2022, making it one of the first and longest-running browser security extensions in the category, and it is now deployed across more than three million browsers worldwide.",{"data":6688,"content":6689,"nodeType":860},{},[6690,6694,6702],{"data":6691,"marks":6692,"value":6693,"nodeType":864},{},[],"Many ",{"data":6695,"content":6696,"nodeType":883},{"uri":5827},[6697],{"data":6698,"marks":6699,"value":6701,"nodeType":864},{},[6700],{"type":1455},"Push customers",{"data":6703,"marks":6704,"value":6705,"nodeType":864},{},[]," were initially considering full-stack enterprise browsers, but found that Push provided all the visibility and control they needed without the migration headache.",{"data":6707,"content":6711,"nodeType":996},{"target":6708},{"sys":6709},{"id":6710,"type":1001,"linkType":1002},"4RDIOAuVN10mZCtjltJCB4",[],{"data":6713,"content":6714,"nodeType":1312},{},[6715],{"data":6716,"marks":6717,"value":6719,"nodeType":864},{},[6718],{"type":899},"The extension matters, but it's what we built around it that really counts",{"data":6721,"content":6722,"nodeType":860},{},[6723],{"data":6724,"marks":6725,"value":6726,"nodeType":864},{},[],"The extension is the most visible part of the Push platform, but what Push has built around it makes the solution the most powerful security tool in the browser:",{"data":6728,"content":6729,"nodeType":941},{},[6730,6777,6814,6852,6867],{"data":6731,"content":6732,"nodeType":945},{},[6733],{"data":6734,"content":6735,"nodeType":860},{},[6736,6741,6745,6751,6754,6762,6766,6773],{"data":6737,"marks":6738,"value":6740,"nodeType":864},{},[6739],{"type":899},"In-house threat research that discovers attack techniques as they emerge.",{"data":6742,"marks":6743,"value":6744,"nodeType":864},{},[]," Push researchers track real-world adversary activity and discover new techniques as they appear, including ",{"data":6746,"content":6747,"nodeType":883},{"uri":5853},[6748],{"data":6749,"marks":6750,"value":5858,"nodeType":864},{},[],{"data":6752,"marks":6753,"value":5862,"nodeType":864},{},[],{"data":6755,"content":6757,"nodeType":883},{"uri":6756},"https://pushsecurity.com/blog/installfix/",[6758],{"data":6759,"marks":6760,"value":6761,"nodeType":864},{},[]," InstallFix",{"data":6763,"marks":6764,"value":6765,"nodeType":864},{},[],", and creating the ",{"data":6767,"content":6768,"nodeType":883},{"uri":5112},[6769],{"data":6770,"marks":6771,"value":6772,"nodeType":864},{},[],"Browser & Identity Attacks Matrix",{"data":6774,"marks":6775,"value":6776,"nodeType":864},{},[],". Detection is only as good as the threat understanding behind it, and research is what keeps that understanding ahead of what attackers are doing in the wild.",{"data":6778,"content":6779,"nodeType":945},{},[6780],{"data":6781,"content":6782,"nodeType":860},{},[6783,6788,6792,6798,6802,6810],{"data":6784,"marks":6785,"value":6787,"nodeType":864},{},[6786],{"type":899},"Agentic threat hunting and detection engineering at machine speed.",{"data":6789,"marks":6790,"value":6791,"nodeType":864},{},[]," Push's ",{"data":6793,"content":6794,"nodeType":883},{"uri":5895},[6795],{"data":6796,"marks":6797,"value":5900,"nodeType":864},{},[],{"data":6799,"marks":6800,"value":6801,"nodeType":864},{},[]," operationalizes the research, generating new behavioral detections in minutes rather than quarterly releases — covering the ",{"data":6803,"content":6805,"nodeType":883},{"uri":6804},"https://pushsecurity.com/blog/how-the-browser-became-the-main-cyber-battleground/",[6806],{"data":6807,"marks":6808,"value":6809,"nodeType":864},{},[],"techniques behind the Scattered Spider, Scattered Lapsus$ Hunters, and ShinyHunters breaches",{"data":6811,"marks":6812,"value":6813,"nodeType":864},{},[]," of the past three years. Attackers are using AI to accelerate the pace at which they generate new lures, kits, and infrastructure; Push keeps security teams in front by advancing the capability at machine speed and scale.",{"data":6815,"content":6816,"nodeType":945},{},[6817],{"data":6818,"content":6819,"nodeType":860},{},[6820,6825,6829,6836,6840,6848],{"data":6821,"marks":6822,"value":6824,"nodeType":864},{},[6823],{"type":899},"Collecting the right telemetry to surface both attacker behavior and risky user action.",{"data":6826,"marks":6827,"value":6828,"nodeType":864},{},[]," Telemetry by itself is just data — the value comes from knowing what to collect, why it matters, and how to turn it into detections and controls. Push combines deep instrumentation of the browser with the expertise to use what we collect: the same browser-layer telemetry that detects AiTM kits, ClickFix and ConsentFix lures, and session token replay also surfaces what users are pasting into AI tools, which ",{"data":6830,"content":6831,"nodeType":883},{"uri":5865},[6832],{"data":6833,"marks":6834,"value":6835,"nodeType":864},{},[],"SaaS apps they're logging into outside the IdP",{"data":6837,"marks":6838,"value":6839,"nodeType":864},{},[],", which OAuth grants are being made, and which ",{"data":6841,"content":6843,"nodeType":883},{"uri":6842},"https://pushsecurity.com/blog/browser-extension-management-guide/",[6844],{"data":6845,"marks":6846,"value":6847,"nodeType":864},{},[],"extensions are running in their browsers",{"data":6849,"marks":6850,"value":6851,"nodeType":864},{},[],". The threat detection and the identity, AI, and DLP use cases are not separate features — they are different applications of the same underlying telemetry, surfaced because Push knows what to look for.",{"data":6853,"content":6854,"nodeType":945},{},[6855],{"data":6856,"content":6857,"nodeType":860},{},[6858,6863],{"data":6859,"marks":6860,"value":6862,"nodeType":864},{},[6861],{"type":899},"Enforcing the right controls at the right place at the right moment.",{"data":6864,"marks":6865,"value":6866,"nodeType":864},{},[]," Visibility without actionability is only half a solution. Push turns the browser into a strong control point for stopping attacks and risky user behaviors in real time — reusing passwords, intercepting credential submission to non-IdP domains, blocking ClickFix clipboard payloads before paste-execute, prompting MFA enrollment at the point of login, warning on weak or breached passwords at credential entry, and surfacing app banners that communicate policy at the moment of use. The same control surface that stops attackers stops the user's mistakes that lead to the next breach.",{"data":6868,"content":6869,"nodeType":945},{},[6870],{"data":6871,"content":6872,"nodeType":860},{},[6873,6878],{"data":6874,"marks":6875,"value":6877,"nodeType":864},{},[6876],{"type":899},"Balancing security and privacy.",{"data":6879,"marks":6880,"value":6881,"nodeType":864},{},[]," Push is designed to give security teams the telemetry they need without monitoring personal browsing. By default, only logins to configured corporate domains are observed; personal browsing is not collected. (Though administrators have the option to observe personal account logins to work apps, and identify where browsers are being synced to personal accounts, which can result in password loss.) Plaintext passwords and form inputs are never transmitted — passwords are analyzed locally using salted partial hashes. Broader browser metadata is stored on the device and only transmitted when it matches a detection rule. Push does not train AI models on customer telemetry.",{"data":6883,"content":6884,"nodeType":1005},{},[],{"data":6886,"content":6887,"nodeType":1009},{},[6888],{"data":6889,"marks":6890,"value":6892,"nodeType":864},{},[6891],{"type":899},"Full-stack enterprise browsers and Push’s browser extension are not mutually exclusive",{"data":6894,"content":6895,"nodeType":860},{},[6896],{"data":6897,"marks":6898,"value":6899,"nodeType":864},{},[],"It’s worth pausing on a point that often gets lost in the way the market discusses this choice. Full-stack enterprise browsers and Push’s extension-based solution are not mutually exclusive. They do different things for different teams, and they run together. ",{"data":6901,"content":6902,"nodeType":860},{},[6903],{"data":6904,"marks":6905,"value":6906,"nodeType":864},{},[],"Push supports enterprise browsers like Island and Prisma Browser. Many of Push’s customers use a full-stack browser for the contractor population or regulated workload where the IT team needs workspace controls, and Push across the rest of the workforce to provide the deep security capabilities that the IT team is not measured on but the security team is. The right framing for many enterprises is not whether to choose full-stack or extension. It is full-stack for the IT use cases that need it, and Push everywhere else.",{"data":6908,"content":6909,"nodeType":1005},{},[],{"data":6911,"content":6912,"nodeType":1009},{},[6913],{"data":6914,"marks":6915,"value":6917,"nodeType":864},{},[6916],{"type":899},"Which one is right for your security team?",{"data":6919,"content":6920,"nodeType":860},{},[6921],{"data":6922,"marks":6923,"value":6924,"nodeType":864},{},[],"The answer follows from the need you are trying to meet. The scenarios below cover the most common real-world situations and the approach that fits each.",{"data":6926,"content":6927,"nodeType":860},{},[6928,6933],{"data":6929,"marks":6930,"value":6932,"nodeType":864},{},[6931],{"type":899},"Is your priority detecting and stopping attacks in the browser?",{"data":6934,"marks":6935,"value":6936,"nodeType":864},{},[]," Go with Push. Push detects and stops the threats actually breaching enterprises — AiTM phishing, ClickFix, OAuth abuse, malicious browser extensions. It also provides valuable additional insight during investigations to understand incidents better and decide how to respond to them. ",{"data":6938,"content":6939,"nodeType":860},{},[6940,6945],{"data":6941,"marks":6942,"value":6944,"nodeType":864},{},[6943],{"type":899},"Do you have a large contractor or third-party population needing locked-down workspace controls?",{"data":6946,"marks":6947,"value":6948,"nodeType":864},{},[]," Use a full-stack enterprise browser for that population and Push for everyone else. Watermarking, screenshot blocking and print restriction are OS-level controls that extensions cannot reliably replicate.",{"data":6950,"content":6951,"nodeType":860},{},[6952,6957],{"data":6953,"marks":6954,"value":6956,"nodeType":864},{},[6955],{"type":899},"Do you have a multi-browser estate including a mix of consumer and agentic browsers?",{"data":6958,"marks":6959,"value":6960,"nodeType":864},{},[]," Push will provide the coverage you need to secure users. The browser options are growing, and locking your workforce into a single corporate browser becomes harder every time a new productivity-shaping browser ships. Push regularly adds support for emerging browsers.",{"data":6962,"content":6963,"nodeType":860},{},[6964,6969],{"data":6965,"marks":6966,"value":6968,"nodeType":864},{},[6967],{"type":899},"Is significant BYOD or unmanaged-device coverage required.",{"data":6970,"marks":6971,"value":6972,"nodeType":864},{},[]," Push is a great option, particularly if you also have Chromebooks that fall outside of your EDR coverage. The extension can easily be installed via email or landing page self-enrollment, with options to enforce coverage through conditional access policies. This provides full threat detection and policy enforcement on devices the organization does not own.",{"data":6974,"content":6975,"nodeType":860},{},[6976],{"data":6977,"marks":6978,"value":6979,"nodeType":864},{},[],"In short, if you are solving for workspace control, the right tool is a full-stack enterprise browser. If you’re solving for protecting users as they work in their browsers, Push is the tool built specifically for that need — with the research depth, detection engineering, and operational scale to do the job.",{"data":6981,"content":6982,"nodeType":860},{},[6983,6986,6994],{"data":6984,"marks":6985,"value":21,"nodeType":864},{},[],{"data":6987,"content":6988,"nodeType":883},{"uri":1700},[6989],{"data":6990,"marks":6991,"value":6993,"nodeType":864},{},[6992],{"type":1455},"Book a live demo to learn more",{"data":6995,"marks":6996,"value":2924,"nodeType":864},{},[],"Enterprise browser vs. browser extension: Which should your security team choose?","If you're building a shortlist of browser security vendors, do you need a full-stack enterprise browser, or browser security extension? ","2026-05-21T00:00:00.000Z","enterprise-browser-vs-browser-extension-which-should-your-security-team-choose",{"items":7002},[7003,7005],{"sys":7004,"name":297},{"id":2732},{"sys":7006,"name":2729},{"id":2728},{"items":7008},[7009],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":7010},{"url":4881},{"__typename":2059,"sys":7012,"content":7014,"title":7544,"synopsis":7545,"hashTags":59,"publishedDate":7546,"slug":7547,"tagsCollection":7548,"authorsCollection":7556},{"id":7013},"7sZs2lHCTN8oYc2OIGCIQG",{"json":7015},{"data":7016,"content":7017,"nodeType":856},{},[7018,7025,7028,7036,7052,7059,7066,7072,7080,7087,7094,7100,7117,7123,7139,7147,7163,7170,7177,7180,7188,7204,7210,7228,7234,7242,7266,7273,7276,7284,7291,7297,7304,7322,7330,7346,7349,7357,7373,7380,7387,7405,7408,7416,7423,7430,7437,7443,7451,7467,7474,7491,7494,7502,7509,7516,7522,7528],{"data":7019,"content":7020,"nodeType":860},{},[7021],{"data":7022,"marks":7023,"value":7024,"nodeType":864},{},[],"The headline finding getting the most airtime in 2026 is that vulnerability exploitation has overtaken credential abuse as the top single initial access vector, jumping to 31% from 20% the year before. The vulnerability management crisis driving this statistic is one of the most important stories in this year's data. But reading it as evidence that identity threats are receding would be a mistake, because the DBIR's own data tells a more complicated and more useful story when you look at the full picture.",{"data":7026,"content":7027,"nodeType":1005},{},[],{"data":7029,"content":7030,"nodeType":1009},{},[7031],{"data":7032,"marks":7033,"value":7035,"nodeType":864},{},[7034],{"type":899},"Vulnerability exploitation has caught up with identity — not replaced it",{"data":7037,"content":7038,"nodeType":860},{},[7039,7043,7048],{"data":7040,"marks":7041,"value":7042,"nodeType":864},{},[],"The DBIR's headline comparison pits vulnerability exploitation (31%) against credential abuse (13%) as individual vectors. That comparison is accurate but incomplete, because the DBIR tracks identity-related initial access across ",{"data":7044,"marks":7045,"value":7047,"nodeType":864},{},[7046],{"type":899},"three",{"data":7049,"marks":7050,"value":7051,"nodeType":864},{},[]," separate categories: phishing (16%), credential abuse (13%), and pretexting (6%). Before interpreting those numbers, there's a methodological wrinkle worth understanding.",{"data":7053,"content":7054,"nodeType":860},{},[7055],{"data":7056,"marks":7057,"value":7058,"nodeType":864},{},[],"This year's report added pretexting as a newly tracked initial access vector, reclassifying some incidents previously counted as credential abuse. The DBIR is transparent about the effect: without that change, credential abuse would have been 16% rather than 13%. On an apples-to-apples basis, identity-related initial access (phishing 16% + credential abuse 16%) comes to 32% — versus 31% for vulnerability exploitation.",{"data":7060,"content":7061,"nodeType":860},{},[7062],{"data":7063,"marks":7064,"value":7065,"nodeType":864},{},[],"To be precise about what moved: phishing held roughly flat year over year, but credential abuse saw a modest decline even on the adjusted basis (from 22% to 16%). Overall, the identity picture is broadly stable. The reason the two categories have converged is that vulnerability exploitation surged 55%, not that identity attacks meaningfully receded.",{"data":7067,"content":7071,"nodeType":996},{"target":7068},{"sys":7069},{"id":7070,"type":1001,"linkType":1002},"5GvSsSY4R6X34ZBMidZ54X",[],{"data":7073,"content":7074,"nodeType":1312},{},[7075],{"data":7076,"marks":7077,"value":7079,"nodeType":864},{},[7078],{"type":899},"The taxonomy gap",{"data":7081,"content":7082,"nodeType":860},{},[7083],{"data":7084,"marks":7085,"value":7086,"nodeType":864},{},[],"It's also worth asking how much the DBIR's initial access taxonomy can tell us. The figure that everyone is citing — Figure 10 — is labelled \"select enumerations,\" and the four tracked vectors (vulnerability exploitation, phishing, credential abuse, pretexting) add up to only 66% of initial access. A third of the picture isn't represented in the headline breakdown at all.",{"data":7088,"content":7089,"nodeType":860},{},[7090],{"data":7091,"marks":7092,"value":7093,"nodeType":864},{},[],"The cluster boundaries and where you draw them also changes the story. The DBIR classifies ClickFix under \"baiting\" — a category that covers malicious downloads and SEO poisoning — rather than phishing, even though the end goal is often the same: getting a user to execute something they shouldn't. Pretexting absorbed incidents that were previously credential abuse, shifting the numbers between categories. These are useful analytical clusters, but they aren't clean divisions of a neatly partitioned attack surface.",{"data":7095,"content":7099,"nodeType":996},{"target":7096},{"sys":7097},{"id":7098,"type":1001,"linkType":1002},"7t6ZcHDycaPOyLstX4r8zl",[],{"data":7101,"content":7102,"nodeType":860},{},[7103,7107,7114],{"data":7104,"marks":7105,"value":7106,"nodeType":864},{},[],"These are identity attacks at scale, and it isn't clear where — or whether — they show up in the DBIR's initial access vectors. This lack of depth in identity and in-browser attack vectors is common in many defensive models, which is why we've created our own ",{"data":7108,"content":7109,"nodeType":883},{"uri":6586},[7110],{"data":7111,"marks":7112,"value":7113,"nodeType":864},{},[],"Browser and Identity Attacks Matrix",{"data":7115,"marks":7116,"value":2924,"nodeType":864},{},[],{"data":7118,"content":7122,"nodeType":996},{"target":7119},{"sys":7120},{"id":7121,"type":1001,"linkType":1002},"53U3LHhhHFYnEpShdLmDqs",[],{"data":7124,"content":7125,"nodeType":860},{},[7126,7130,7135],{"data":7127,"marks":7128,"value":7129,"nodeType":864},{},[],"That convergence at initial access also understates the role credentials play across full breach chains. The DBIR states plainly that credential abuse at any point in the breach progression — not just as the first action — appears in ",{"data":7131,"marks":7132,"value":7134,"nodeType":864},{},[7133],{"type":899},"39% of all breaches",{"data":7136,"marks":7137,"value":7138,"nodeType":864},{},[],", making it the single most pervasive technique in the dataset. Credentials don't just open the front door; they unlock lateral movement, privilege escalation, and persistence throughout the attack chain.",{"data":7140,"content":7141,"nodeType":1312},{},[7142],{"data":7143,"marks":7144,"value":7146,"nodeType":864},{},[7145],{"type":899},"The vulnerability treadmill",{"data":7148,"content":7149,"nodeType":860},{},[7150,7154,7159],{"data":7151,"marks":7152,"value":7153,"nodeType":864},{},[],"The vulnerability exploitation surge itself is driven by a structural capacity crisis rather than a shift in attacker preference. Edge devices and VPNs now account for 22% of vulnerability-exploitation breaches, up from 3% the prior year — a ",{"data":7155,"marks":7156,"value":7158,"nodeType":864},{},[7157],{"type":2246},"sevenfold",{"data":7160,"marks":7161,"value":7162,"nodeType":864},{},[]," increase. Organizations face 50% more CISA KEV vulnerabilities to remediate than a year ago, median remediation time has increased from 32 to 43 days, and the volume of vulnerability records in the dataset has grown roughly eightfold.",{"data":7164,"content":7165,"nodeType":860},{},[7166],{"data":7167,"marks":7168,"value":7169,"nodeType":864},{},[],"This trend was already visible in last year's DBIR, when vulnerability exploitation jumped from 15% to 20%. AI-assisted exploit development may be compounding the problem — the DBIR's own data shows 32% of AI-assisted initial access targeting vulnerability exploitation — but the structural capacity crisis was accelerating well before AI became a meaningful factor in the attacker toolkit.",{"data":7171,"content":7172,"nodeType":860},{},[7173],{"data":7174,"marks":7175,"value":7176,"nodeType":864},{},[],"The vulnerability treadmill is accelerating, and the DBIR's remediation data shows defenders losing ground. But this is an additive problem, not a substitution. Both attack surfaces are growing. ",{"data":7178,"content":7179,"nodeType":1005},{},[],{"data":7181,"content":7182,"nodeType":1009},{},[7183],{"data":7184,"marks":7185,"value":7187,"nodeType":864},{},[7186],{"type":899},"Phishing has left the inbox",{"data":7189,"content":7190,"nodeType":860},{},[7191,7195,7200],{"data":7192,"marks":7193,"value":7194,"nodeType":864},{},[],"41% percent of social engineering breaches now involve vectors other than email, with approximately a quarter coming from social media or phone-based channels. Voice phishing simulations show a ",{"data":7196,"marks":7197,"value":7199,"nodeType":864},{},[7198],{"type":899},"40% higher success rate",{"data":7201,"marks":7202,"value":7203,"nodeType":864},{},[]," than email phishing — a median click rate of 2% versus 1.4%.",{"data":7205,"content":7209,"nodeType":996},{"target":7206},{"sys":7207},{"id":7208,"type":1001,"linkType":1002},"7pK8qqIDDNmHmJmlcybNoe",[],{"data":7211,"content":7212,"nodeType":860},{},[7213,7217,7224],{"data":7214,"marks":7215,"value":7216,"nodeType":864},{},[],"Even within the email channel, the data confirms what ",{"data":7218,"content":7219,"nodeType":883},{"uri":5717},[7220],{"data":7221,"marks":7222,"value":7223,"nodeType":864},{},[],"browser-level detection data has been showing",{"data":7225,"marks":7226,"value":7227,"nodeType":864},{},[],": credential harvesting dominates. The DBIR's email security gateway breakdown shows 80% of blocked attacks are credential or session phishing, with only 10% involving malware delivery, 5% callback phishing, and 3% BEC. If you're running an email security gateway, the vast majority of what it catches is credential phishing — and 41% of social engineering is arriving through channels it can't see at all.",{"data":7229,"content":7233,"nodeType":996},{"target":7230},{"sys":7231},{"id":7232,"type":1001,"linkType":1002},"6CvwzQA3gJ8B3RFzLrH7Kp",[],{"data":7235,"content":7236,"nodeType":1312},{},[7237],{"data":7238,"marks":7239,"value":7241,"nodeType":864},{},[7240],{"type":899},"The ClickFix detection gap",{"data":7243,"content":7244,"nodeType":860},{},[7245,7249,7257,7261],{"data":7246,"marks":7247,"value":7248,"nodeType":864},{},[],"The DBIR reports ClickFix at only 2.7% of attacks detected at the browser level. For context, ",{"data":7250,"content":7252,"nodeType":883},{"uri":7251},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection/",[7253],{"data":7254,"marks":7255,"value":7256,"nodeType":864},{},[],"CrowdStrike reported a 563% increase in ClickFix lures",{"data":7258,"marks":7259,"value":7260,"nodeType":864},{},[]," over the same period and Microsoft identified it as the most common initial access point at 47% of observed attacks. Push's own data shows ClickFix at a significantly higher proportion of browser-level detections, ",{"data":7262,"marks":7263,"value":7265,"nodeType":864},{},[7264],{"type":899},"with 4 in 5 delivered via search engines specifically.",{"data":7267,"content":7268,"nodeType":860},{},[7269],{"data":7270,"marks":7271,"value":7272,"nodeType":864},{},[],"The gap is striking, and the most likely explanation is a visibility one. ClickFix attacks result in a malware download or script execution on the endpoint — and without browser-layer context, that execution looks like any other malware delivery. If a contributing organization doesn't have visibility into the browser session that preceded the payload, they'd attribute the incident to \"malware download\" or \"user execution\" rather than ClickFix specifically. The DBIR's 2.7% probably reflects how often contributors could trace the chain back to a ClickFix page, not how often ClickFix was actually the delivery mechanism.",{"data":7274,"content":7275,"nodeType":1005},{},[],{"data":7277,"content":7278,"nodeType":1009},{},[7279],{"data":7280,"marks":7281,"value":7283,"nodeType":864},{},[7282],{"type":899},"Stolen credentials are the ransomware on-ramp",{"data":7285,"content":7286,"nodeType":860},{},[7287],{"data":7288,"marks":7289,"value":7290,"nodeType":864},{},[],"One of the most powerful findings in this year's DBIR is the quantification of the relationship between credential compromise and ransomware outcomes. Fifty percent of ransomware victims had a credential or infostealer event occur within 95 days prior to the ransomware attack, drawing a causal line from credential theft to ransomware deployment.",{"data":7292,"content":7296,"nodeType":996},{"target":7293},{"sys":7294},{"id":7295,"type":1001,"linkType":1002},"3ZwG5UiweFR4fYiDaxJJDm",[],{"data":7298,"content":7299,"nodeType":860},{},[7300],{"data":7301,"marks":7302,"value":7303,"nodeType":864},{},[],"The infostealer supply chain data reinforces the picture. Infostealers are surfacing an average of 2,362 breached corporate credentials per month from organizational email domains in stealer log datasets, and 54% of devices in Initial Access Broker logs had at least one infostealer installed. The 95-day median window is consistent with the known timeline from credential harvest to ransomware deployment.",{"data":7305,"content":7306,"nodeType":860},{},[7307,7311,7318],{"data":7308,"marks":7309,"value":7310,"nodeType":864},{},[],"That timeline reinforces an argument we've been making about ",{"data":7312,"content":7313,"nodeType":883},{"uri":3210},[7314],{"data":7315,"marks":7316,"value":7317,"nodeType":864},{},[],"where the intervention point needs to be",{"data":7319,"marks":7320,"value":7321,"nodeType":864},{},[],": detecting credential compromise upstream — at the point of credential entry, session creation, or stolen credential reuse — rather than waiting for the ransomware deployment that follows weeks or months later.",{"data":7323,"content":7324,"nodeType":1312},{},[7325],{"data":7326,"marks":7327,"value":7329,"nodeType":864},{},[7328],{"type":899},"Post-compromise tradecraft is shifting",{"data":7331,"content":7332,"nodeType":860},{},[7333,7337,7342],{"data":7334,"marks":7335,"value":7336,"nodeType":864},{},[],"The DBIR's post-compromise data adds another dimension. RMM tool abuse by threat actors showed a ",{"data":7338,"marks":7339,"value":7341,"nodeType":864},{},[7340],{"type":899},"240% increase",{"data":7343,"marks":7344,"value":7345,"nodeType":864},{},[]," over the prior year, while traditional backdoor and C2 malware usage fell 27%. Attackers are increasingly living off the land with the same remote access tools IT teams use. Post-compromise detection is getting harder, which makes catching the initial credential compromise upstream that much more valuable.",{"data":7347,"content":7348,"nodeType":1005},{},[],{"data":7350,"content":7351,"nodeType":1009},{},[7352],{"data":7353,"marks":7354,"value":7356,"nodeType":864},{},[7355],{"type":899},"Your vendors are half the problem",{"data":7358,"content":7359,"nodeType":860},{},[7360,7364,7369],{"data":7361,"marks":7362,"value":7363,"nodeType":864},{},[],"Third-party involvement in breaches reached ",{"data":7365,"marks":7366,"value":7368,"nodeType":864},{},[7367],{"type":899},"48%",{"data":7370,"marks":7371,"value":7372,"nodeType":864},{},[]," this year, up from 30% — a 60% increase that follows a prior year where the figure had already doubled.",{"data":7374,"content":7375,"nodeType":860},{},[7376],{"data":7377,"marks":7378,"value":7379,"nodeType":864},{},[],"The DBIR's root cause analysis maps directly to identity security: insecure authentication — absent MFA, improper credential rotation — and lack of least privilege enforcement account for a substantial share of cloud-based third-party incidents. Only 23% of third-party organizations fully remediated missing or improperly secured MFA on cloud accounts, and weak password and permission misconfigurations took a median of 8 months to resolve 50% of findings.",{"data":7381,"content":7382,"nodeType":860},{},[7383],{"data":7384,"marks":7385,"value":7386,"nodeType":864},{},[],"Eight months. That's the median timeline for third-party vendors to resolve the identity hygiene issues that create the attack surface in their environments — environments that your data lives in.",{"data":7388,"content":7389,"nodeType":860},{},[7390,7394,7401],{"data":7391,"marks":7392,"value":7393,"nodeType":864},{},[],"Extend that posture gap across every vendor and third-party integration, and you start to see why the third-party breach figure keeps climbing. Visibility into ",{"data":7395,"content":7396,"nodeType":883},{"uri":4103},[7397],{"data":7398,"marks":7399,"value":7400,"nodeType":864},{},[],"OAuth consent flows and third-party integration sprawl",{"data":7402,"marks":7403,"value":7404,"nodeType":864},{},[]," is the starting point for getting ahead of a supply chain problem that is structurally getting worse.",{"data":7406,"content":7407,"nodeType":1005},{},[],{"data":7409,"content":7410,"nodeType":1009},{},[7411],{"data":7412,"marks":7413,"value":7415,"nodeType":864},{},[7414],{"type":899},"AI is scaling known techniques — and creating new blind spots from the inside",{"data":7417,"content":7418,"nodeType":860},{},[7419],{"data":7420,"marks":7421,"value":7422,"nodeType":864},{},[],"The DBIR's AI analysis this year is grounded in a collaboration with Anthropic covering 793 threat actors who received enforcement action for violating acceptable use policy between March 2025 and February 2026. The findings are measured rather than alarmist: in the median case, actors sought AI assistance across about 15 distinct ATT&CK techniques, 44% of AI-assisted initial access was phishing-related, and less than 2.5% of techniques observed were classified as rare.",{"data":7424,"content":7425,"nodeType":860},{},[7426],{"data":7427,"marks":7428,"value":7429,"nodeType":864},{},[],"AI is currently an operational tool for attackers — automating and scaling known techniques rather than unlocking novel ones. Despite heavy AI-assisted focus on phishing, the DBIR's own incident dataset shows phishing as an initial access vector has barely changed year over year — suggesting AI may be uplifting less-experienced attackers to a higher baseline of lure quality without meaningfully increasing success rates against organizations that already have detection in place.",{"data":7431,"content":7432,"nodeType":860},{},[7433],{"data":7434,"marks":7435,"value":7436,"nodeType":864},{},[],"The more concerning number is the 32% of AI-assisted initial access targeting vulnerability exploitation — compounding the patching capacity crisis discussed earlier in a trend that was already accelerating before AI entered the picture.",{"data":7438,"content":7442,"nodeType":996},{"target":7439},{"sys":7440},{"id":7441,"type":1001,"linkType":1002},"4bFTnVx1SXMQzZSaICCJOn",[],{"data":7444,"content":7445,"nodeType":1312},{},[7446],{"data":7447,"marks":7448,"value":7450,"nodeType":864},{},[7449],{"type":899},"Shadow AI is the bigger problem",{"data":7452,"content":7453,"nodeType":860},{},[7454,7458,7463],{"data":7455,"marks":7456,"value":7457,"nodeType":864},{},[],"The sharper AI risk for most organizations, though, is internal. Forty-five percent of employees are now regular AI users on corporate devices — up from 15%, a threefold increase — and ",{"data":7459,"marks":7460,"value":7462,"nodeType":864},{},[7461],{"type":899},"67% of them use non-corporate accounts",{"data":7464,"marks":7465,"value":7466,"nodeType":864},{},[],". Shadow AI has become the third most common non-malicious insider action in DLP data, a fourfold increase over the prior year, with source code as the leading data type submitted to unauthorized AI platforms by a wide margin.",{"data":7468,"content":7469,"nodeType":860},{},[7470],{"data":7471,"marks":7472,"value":7473,"nodeType":864},{},[],"The browser extension angle is particularly relevant. More than 15% of users had unauthorized AI browser extensions installed, and the DBIR specifically notes that these extensions collect and retain browsing context from internal sites — creating a data exfiltration pathway that operates independently of traditional DLP controls.",{"data":7475,"content":7476,"nodeType":860},{},[7477,7481,7488],{"data":7478,"marks":7479,"value":7480,"nodeType":864},{},[],"This is moving faster than any previous shadow IT wave, and the data loss vector is the browser — where users interact with AI tools, where extensions collect context, and where OAuth consent grants connect AI services to corporate data. Visibility and control at that layer isn't a nice-to-have for AI governance; ",{"data":7482,"content":7483,"nodeType":883},{"uri":6842},[7484],{"data":7485,"marks":7486,"value":7487,"nodeType":864},{},[],"it's the minimum viable starting point",{"data":7489,"marks":7490,"value":2924,"nodeType":864},{},[],{"data":7492,"content":7493,"nodeType":1005},{},[],{"data":7495,"content":7496,"nodeType":1009},{},[7497],{"data":7498,"marks":7499,"value":7501,"nodeType":864},{},[7500],{"type":899},"What this means for defenders",{"data":7503,"content":7504,"nodeType":860},{},[7505],{"data":7506,"marks":7507,"value":7508,"nodeType":864},{},[],"The DBIR's 2026 data paints a picture of converging pressures rather than shifting priorities. Vulnerability exploitation surged, but identity-related initial access is broadly stable and credential abuse at 39% across full breach chains remains the single most pervasive technique in the dataset. Phishing is arriving through channels that email gateways can't see. The infostealer-to-ransomware pipeline now has longitudinal data behind it. Third-party involvement keeps climbing because vendor identity hygiene takes months to remediate. And shadow AI is creating data exposure pathways that most security stacks weren't designed to see.",{"data":7510,"content":7511,"nodeType":860},{},[7512],{"data":7513,"marks":7514,"value":7515,"nodeType":864},{},[],"The common thread across all of these findings is that the browser — where credentials are entered, sessions are created, OAuth consent is granted, AI tools are accessed, and extensions collect data — is the layer where these risks converge and where defenders need visibility and control if they're going to address them at the point of risk rather than after the fact.",{"data":7517,"content":7518,"nodeType":860},{},[7519],{"data":7520,"marks":7521,"value":1682,"nodeType":864},{},[],{"data":7523,"content":7524,"nodeType":860},{},[7525],{"data":7526,"marks":7527,"value":1689,"nodeType":864},{},[],{"data":7529,"content":7530,"nodeType":860},{},[7531,7534,7541],{"data":7532,"marks":7533,"value":21,"nodeType":864},{},[],{"data":7535,"content":7536,"nodeType":883},{"uri":1700},[7537],{"data":7538,"marks":7539,"value":1703,"nodeType":864},{},[7540],{"type":1455},{"data":7542,"marks":7543,"value":21,"nodeType":864},{},[],"What the Verizon DBIR tells us about how breaches happen in 2026","What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.","2026-05-20T00:00:00.000Z","verizon-dbir-2026-review",{"items":7549},[7550,7552],{"sys":7551,"name":297},{"id":2732},{"sys":7553,"name":7555},{"id":7554},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"items":7557},[7558],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":7559},{"url":3625},{"__typename":2059,"sys":7561,"content":7562,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":8631,"authorsCollection":8637},{"id":3628},{"json":7563},{"data":7564,"content":7565,"nodeType":856},{},[7566,7579,7584,7590,7596,7601,7604,7611,7618,7633,7671,7676,7689,7692,7699,7706,7728,7760,7766,7769,7776,7783,7789,7794,7800,7803,7810,7817,7851,7881,7887,7890,7897,7904,7924,7930,7969,7975,7978,7985,7992,8028,8034,8039,8042,8049,8056,8082,8088,8093,8099,8102,8109,8116,8139,8145,8151,8157,8160,8167,8174,8180,8185,8191,8212,8235,8238,8245,8252,8258,8264,8267,8274,8329,8332,8339,8345,8613,8616],{"data":7567,"content":7568,"nodeType":860},{},[7569,7572,7576],{"data":7570,"marks":7571,"value":3639,"nodeType":864},{},[],{"data":7573,"marks":7574,"value":3644,"nodeType":864},{},[7575],{"type":899},{"data":7577,"marks":7578,"value":3648,"nodeType":864},{},[],{"data":7580,"content":7583,"nodeType":996},{"target":7581},{"sys":7582},{"id":3653,"type":1001,"linkType":1002},[],{"data":7585,"content":7586,"nodeType":860},{},[7587],{"data":7588,"marks":7589,"value":3661,"nodeType":864},{},[],{"data":7591,"content":7592,"nodeType":860},{},[7593],{"data":7594,"marks":7595,"value":3668,"nodeType":864},{},[],{"data":7597,"content":7600,"nodeType":996},{"target":7598},{"sys":7599},{"id":3673,"type":1001,"linkType":1002},[],{"data":7602,"content":7603,"nodeType":1005},{},[],{"data":7605,"content":7606,"nodeType":1009},{},[7607],{"data":7608,"marks":7609,"value":3685,"nodeType":864},{},[7610],{"type":899},{"data":7612,"content":7613,"nodeType":860},{},[7614],{"data":7615,"marks":7616,"value":3693,"nodeType":864},{},[7617],{"type":899},{"data":7619,"content":7620,"nodeType":860},{},[7621,7624,7630],{"data":7622,"marks":7623,"value":3700,"nodeType":864},{},[],{"data":7625,"content":7626,"nodeType":883},{"uri":3703},[7627],{"data":7628,"marks":7629,"value":3708,"nodeType":864},{},[],{"data":7631,"marks":7632,"value":3712,"nodeType":864},{},[],{"data":7634,"content":7635,"nodeType":860},{},[7636,7639,7645,7648,7652,7655,7659,7662,7668],{"data":7637,"marks":7638,"value":3719,"nodeType":864},{},[],{"data":7640,"content":7641,"nodeType":883},{"uri":3722},[7642],{"data":7643,"marks":7644,"value":3727,"nodeType":864},{},[],{"data":7646,"marks":7647,"value":3731,"nodeType":864},{},[],{"data":7649,"marks":7650,"value":3736,"nodeType":864},{},[7651],{"type":899},{"data":7653,"marks":7654,"value":2232,"nodeType":864},{},[],{"data":7656,"marks":7657,"value":3744,"nodeType":864},{},[7658],{"type":899},{"data":7660,"marks":7661,"value":3748,"nodeType":864},{},[],{"data":7663,"content":7664,"nodeType":883},{"uri":3751},[7665],{"data":7666,"marks":7667,"value":3756,"nodeType":864},{},[],{"data":7669,"marks":7670,"value":3760,"nodeType":864},{},[],{"data":7672,"content":7675,"nodeType":996},{"target":7673},{"sys":7674},{"id":3765,"type":1001,"linkType":1002},[],{"data":7677,"content":7678,"nodeType":860},{},[7679,7682,7686],{"data":7680,"marks":7681,"value":3773,"nodeType":864},{},[],{"data":7683,"marks":7684,"value":3778,"nodeType":864},{},[7685],{"type":899},{"data":7687,"marks":7688,"value":2924,"nodeType":864},{},[],{"data":7690,"content":7691,"nodeType":1005},{},[],{"data":7693,"content":7694,"nodeType":1009},{},[7695],{"data":7696,"marks":7697,"value":3792,"nodeType":864},{},[7698],{"type":899},{"data":7700,"content":7701,"nodeType":860},{},[7702],{"data":7703,"marks":7704,"value":3693,"nodeType":864},{},[7705],{"type":899},{"data":7707,"content":7708,"nodeType":860},{},[7709,7712,7718,7721,7725],{"data":7710,"marks":7711,"value":3806,"nodeType":864},{},[],{"data":7713,"content":7714,"nodeType":883},{"uri":3809},[7715],{"data":7716,"marks":7717,"value":3814,"nodeType":864},{},[],{"data":7719,"marks":7720,"value":3818,"nodeType":864},{},[],{"data":7722,"marks":7723,"value":3823,"nodeType":864},{},[7724],{"type":899},{"data":7726,"marks":7727,"value":3827,"nodeType":864},{},[],{"data":7729,"content":7730,"nodeType":860},{},[7731,7734,7740,7743,7747,7750,7757],{"data":7732,"marks":7733,"value":3834,"nodeType":864},{},[],{"data":7735,"content":7736,"nodeType":883},{"uri":3837},[7737],{"data":7738,"marks":7739,"value":3842,"nodeType":864},{},[],{"data":7741,"marks":7742,"value":3846,"nodeType":864},{},[],{"data":7744,"marks":7745,"value":3851,"nodeType":864},{},[7746],{"type":899},{"data":7748,"marks":7749,"value":3855,"nodeType":864},{},[],{"data":7751,"content":7752,"nodeType":883},{"uri":3858},[7753],{"data":7754,"marks":7755,"value":3864,"nodeType":864},{},[7756],{"type":899},{"data":7758,"marks":7759,"value":3868,"nodeType":864},{},[],{"data":7761,"content":7762,"nodeType":860},{},[7763],{"data":7764,"marks":7765,"value":3875,"nodeType":864},{},[],{"data":7767,"content":7768,"nodeType":1005},{},[],{"data":7770,"content":7771,"nodeType":1009},{},[7772],{"data":7773,"marks":7774,"value":3886,"nodeType":864},{},[7775],{"type":899},{"data":7777,"content":7778,"nodeType":860},{},[7779],{"data":7780,"marks":7781,"value":3894,"nodeType":864},{},[7782],{"type":899},{"data":7784,"content":7785,"nodeType":860},{},[7786],{"data":7787,"marks":7788,"value":3901,"nodeType":864},{},[],{"data":7790,"content":7793,"nodeType":996},{"target":7791},{"sys":7792},{"id":3906,"type":1001,"linkType":1002},[],{"data":7795,"content":7796,"nodeType":860},{},[7797],{"data":7798,"marks":7799,"value":3914,"nodeType":864},{},[],{"data":7801,"content":7802,"nodeType":1005},{},[],{"data":7804,"content":7805,"nodeType":1009},{},[7806],{"data":7807,"marks":7808,"value":3925,"nodeType":864},{},[7809],{"type":899},{"data":7811,"content":7812,"nodeType":860},{},[7813],{"data":7814,"marks":7815,"value":3894,"nodeType":864},{},[7816],{"type":899},{"data":7818,"content":7819,"nodeType":860},{},[7820,7823,7830,7833,7839,7842,7848],{"data":7821,"marks":7822,"value":3939,"nodeType":864},{},[],{"data":7824,"content":7825,"nodeType":883},{"uri":3942},[7826],{"data":7827,"marks":7828,"value":3948,"nodeType":864},{},[7829],{"type":1455},{"data":7831,"marks":7832,"value":3731,"nodeType":864},{},[],{"data":7834,"content":7835,"nodeType":883},{"uri":3954},[7836],{"data":7837,"marks":7838,"value":3959,"nodeType":864},{},[],{"data":7840,"marks":7841,"value":3731,"nodeType":864},{},[],{"data":7843,"content":7844,"nodeType":883},{"uri":3965},[7845],{"data":7846,"marks":7847,"value":3970,"nodeType":864},{},[],{"data":7849,"marks":7850,"value":3974,"nodeType":864},{},[],{"data":7852,"content":7853,"nodeType":860},{},[7854,7857,7864,7867,7871,7874,7878],{"data":7855,"marks":7856,"value":21,"nodeType":864},{},[],{"data":7858,"content":7859,"nodeType":883},{"uri":2411},[7860],{"data":7861,"marks":7862,"value":3988,"nodeType":864},{},[7863],{"type":1455},{"data":7865,"marks":7866,"value":3992,"nodeType":864},{},[],{"data":7868,"marks":7869,"value":3997,"nodeType":864},{},[7870],{"type":899},{"data":7872,"marks":7873,"value":4001,"nodeType":864},{},[],{"data":7875,"marks":7876,"value":4006,"nodeType":864},{},[7877],{"type":2246},{"data":7879,"marks":7880,"value":4010,"nodeType":864},{},[],{"data":7882,"content":7883,"nodeType":860},{},[7884],{"data":7885,"marks":7886,"value":4017,"nodeType":864},{},[],{"data":7888,"content":7889,"nodeType":1005},{},[],{"data":7891,"content":7892,"nodeType":1009},{},[7893],{"data":7894,"marks":7895,"value":4028,"nodeType":864},{},[7896],{"type":899},{"data":7898,"content":7899,"nodeType":860},{},[7900],{"data":7901,"marks":7902,"value":3894,"nodeType":864},{},[7903],{"type":899},{"data":7905,"content":7906,"nodeType":860},{},[7907,7910,7914,7917,7921],{"data":7908,"marks":7909,"value":4042,"nodeType":864},{},[],{"data":7911,"marks":7912,"value":4047,"nodeType":864},{},[7913],{"type":2246},{"data":7915,"marks":7916,"value":4051,"nodeType":864},{},[],{"data":7918,"marks":7919,"value":4056,"nodeType":864},{},[7920],{"type":2246},{"data":7922,"marks":7923,"value":4060,"nodeType":864},{},[],{"data":7925,"content":7926,"nodeType":860},{},[7927],{"data":7928,"marks":7929,"value":4067,"nodeType":864},{},[],{"data":7931,"content":7932,"nodeType":941},{},[7933,7951],{"data":7934,"content":7935,"nodeType":945},{},[7936],{"data":7937,"content":7938,"nodeType":860},{},[7939,7942,7948],{"data":7940,"marks":7941,"value":2761,"nodeType":864},{},[],{"data":7943,"content":7944,"nodeType":883},{"uri":4082},[7945],{"data":7946,"marks":7947,"value":4087,"nodeType":864},{},[],{"data":7949,"marks":7950,"value":4091,"nodeType":864},{},[],{"data":7952,"content":7953,"nodeType":945},{},[7954],{"data":7955,"content":7956,"nodeType":860},{},[7957,7960,7966],{"data":7958,"marks":7959,"value":2761,"nodeType":864},{},[],{"data":7961,"content":7962,"nodeType":883},{"uri":4103},[7963],{"data":7964,"marks":7965,"value":4108,"nodeType":864},{},[],{"data":7967,"marks":7968,"value":4112,"nodeType":864},{},[],{"data":7970,"content":7971,"nodeType":860},{},[7972],{"data":7973,"marks":7974,"value":4119,"nodeType":864},{},[],{"data":7976,"content":7977,"nodeType":1005},{},[],{"data":7979,"content":7980,"nodeType":1009},{},[7981],{"data":7982,"marks":7983,"value":4130,"nodeType":864},{},[7984],{"type":899},{"data":7986,"content":7987,"nodeType":860},{},[7988],{"data":7989,"marks":7990,"value":4138,"nodeType":864},{},[7991],{"type":899},{"data":7993,"content":7994,"nodeType":860},{},[7995,7998,8002,8005,8011,8014,8018,8021,8025],{"data":7996,"marks":7997,"value":4145,"nodeType":864},{},[],{"data":7999,"marks":8000,"value":4150,"nodeType":864},{},[8001],{"type":899},{"data":8003,"marks":8004,"value":4154,"nodeType":864},{},[],{"data":8006,"content":8007,"nodeType":883},{"uri":3237},[8008],{"data":8009,"marks":8010,"value":4161,"nodeType":864},{},[],{"data":8012,"marks":8013,"value":4165,"nodeType":864},{},[],{"data":8015,"marks":8016,"value":4170,"nodeType":864},{},[8017],{"type":899},{"data":8019,"marks":8020,"value":4174,"nodeType":864},{},[],{"data":8022,"marks":8023,"value":4179,"nodeType":864},{},[8024],{"type":899},{"data":8026,"marks":8027,"value":4183,"nodeType":864},{},[],{"data":8029,"content":8030,"nodeType":860},{},[8031],{"data":8032,"marks":8033,"value":4190,"nodeType":864},{},[],{"data":8035,"content":8038,"nodeType":996},{"target":8036},{"sys":8037},{"id":4195,"type":1001,"linkType":1002},[],{"data":8040,"content":8041,"nodeType":1005},{},[],{"data":8043,"content":8044,"nodeType":1009},{},[8045],{"data":8046,"marks":8047,"value":4207,"nodeType":864},{},[8048],{"type":899},{"data":8050,"content":8051,"nodeType":860},{},[8052],{"data":8053,"marks":8054,"value":4215,"nodeType":864},{},[8055],{"type":899},{"data":8057,"content":8058,"nodeType":860},{},[8059,8062,8069,8072,8079],{"data":8060,"marks":8061,"value":4222,"nodeType":864},{},[],{"data":8063,"content":8064,"nodeType":883},{"uri":2561},[8065],{"data":8066,"marks":8067,"value":4230,"nodeType":864},{},[8068],{"type":899},{"data":8070,"marks":8071,"value":4234,"nodeType":864},{},[],{"data":8073,"content":8074,"nodeType":883},{"uri":4237},[8075],{"data":8076,"marks":8077,"value":4243,"nodeType":864},{},[8078],{"type":899},{"data":8080,"marks":8081,"value":4247,"nodeType":864},{},[],{"data":8083,"content":8084,"nodeType":860},{},[8085],{"data":8086,"marks":8087,"value":4254,"nodeType":864},{},[],{"data":8089,"content":8092,"nodeType":996},{"target":8090},{"sys":8091},{"id":4259,"type":1001,"linkType":1002},[],{"data":8094,"content":8095,"nodeType":860},{},[8096],{"data":8097,"marks":8098,"value":4267,"nodeType":864},{},[],{"data":8100,"content":8101,"nodeType":1005},{},[],{"data":8103,"content":8104,"nodeType":1009},{},[8105],{"data":8106,"marks":8107,"value":4278,"nodeType":864},{},[8108],{"type":899},{"data":8110,"content":8111,"nodeType":860},{},[8112],{"data":8113,"marks":8114,"value":4286,"nodeType":864},{},[8115],{"type":899},{"data":8117,"content":8118,"nodeType":860},{},[8119,8122,8126,8129,8136],{"data":8120,"marks":8121,"value":4293,"nodeType":864},{},[],{"data":8123,"marks":8124,"value":4298,"nodeType":864},{},[8125],{"type":2246},{"data":8127,"marks":8128,"value":4302,"nodeType":864},{},[],{"data":8130,"content":8131,"nodeType":883},{"uri":4305},[8132],{"data":8133,"marks":8134,"value":4311,"nodeType":864},{},[8135],{"type":899},{"data":8137,"marks":8138,"value":4315,"nodeType":864},{},[],{"data":8140,"content":8141,"nodeType":860},{},[8142],{"data":8143,"marks":8144,"value":4322,"nodeType":864},{},[],{"data":8146,"content":8147,"nodeType":860},{},[8148],{"data":8149,"marks":8150,"value":4329,"nodeType":864},{},[],{"data":8152,"content":8153,"nodeType":860},{},[8154],{"data":8155,"marks":8156,"value":4336,"nodeType":864},{},[],{"data":8158,"content":8159,"nodeType":1005},{},[],{"data":8161,"content":8162,"nodeType":1009},{},[8163],{"data":8164,"marks":8165,"value":4347,"nodeType":864},{},[8166],{"type":899},{"data":8168,"content":8169,"nodeType":860},{},[8170],{"data":8171,"marks":8172,"value":4355,"nodeType":864},{},[8173],{"type":899},{"data":8175,"content":8176,"nodeType":860},{},[8177],{"data":8178,"marks":8179,"value":4362,"nodeType":864},{},[],{"data":8181,"content":8184,"nodeType":996},{"target":8182},{"sys":8183},{"id":4367,"type":1001,"linkType":1002},[],{"data":8186,"content":8187,"nodeType":860},{},[8188],{"data":8189,"marks":8190,"value":4375,"nodeType":864},{},[],{"data":8192,"content":8193,"nodeType":941},{},[8194,8203],{"data":8195,"content":8196,"nodeType":945},{},[8197],{"data":8198,"content":8199,"nodeType":860},{},[8200],{"data":8201,"marks":8202,"value":4388,"nodeType":864},{},[],{"data":8204,"content":8205,"nodeType":945},{},[8206],{"data":8207,"content":8208,"nodeType":860},{},[8209],{"data":8210,"marks":8211,"value":4398,"nodeType":864},{},[],{"data":8213,"content":8214,"nodeType":860},{},[8215,8218,8225,8228,8232],{"data":8216,"marks":8217,"value":4405,"nodeType":864},{},[],{"data":8219,"content":8220,"nodeType":883},{"uri":4408},[8221],{"data":8222,"marks":8223,"value":4414,"nodeType":864},{},[8224],{"type":899},{"data":8226,"marks":8227,"value":4418,"nodeType":864},{},[],{"data":8229,"marks":8230,"value":4423,"nodeType":864},{},[8231],{"type":2246},{"data":8233,"marks":8234,"value":4427,"nodeType":864},{},[],{"data":8236,"content":8237,"nodeType":1005},{},[],{"data":8239,"content":8240,"nodeType":1009},{},[8241],{"data":8242,"marks":8243,"value":4438,"nodeType":864},{},[8244],{"type":899},{"data":8246,"content":8247,"nodeType":860},{},[8248],{"data":8249,"marks":8250,"value":4446,"nodeType":864},{},[8251],{"type":899},{"data":8253,"content":8254,"nodeType":860},{},[8255],{"data":8256,"marks":8257,"value":4453,"nodeType":864},{},[],{"data":8259,"content":8260,"nodeType":860},{},[8261],{"data":8262,"marks":8263,"value":4460,"nodeType":864},{},[],{"data":8265,"content":8266,"nodeType":1005},{},[],{"data":8268,"content":8269,"nodeType":1009},{},[8270],{"data":8271,"marks":8272,"value":4471,"nodeType":864},{},[8273],{"type":899},{"data":8275,"content":8276,"nodeType":941},{},[8277,8290,8303,8316],{"data":8278,"content":8279,"nodeType":945},{},[8280],{"data":8281,"content":8282,"nodeType":860},{},[8283,8287],{"data":8284,"marks":8285,"value":4485,"nodeType":864},{},[8286],{"type":899},{"data":8288,"marks":8289,"value":4489,"nodeType":864},{},[],{"data":8291,"content":8292,"nodeType":945},{},[8293],{"data":8294,"content":8295,"nodeType":860},{},[8296,8300],{"data":8297,"marks":8298,"value":4500,"nodeType":864},{},[8299],{"type":899},{"data":8301,"marks":8302,"value":4504,"nodeType":864},{},[],{"data":8304,"content":8305,"nodeType":945},{},[8306],{"data":8307,"content":8308,"nodeType":860},{},[8309,8313],{"data":8310,"marks":8311,"value":4515,"nodeType":864},{},[8312],{"type":899},{"data":8314,"marks":8315,"value":4519,"nodeType":864},{},[],{"data":8317,"content":8318,"nodeType":945},{},[8319],{"data":8320,"content":8321,"nodeType":860},{},[8322,8326],{"data":8323,"marks":8324,"value":781,"nodeType":864},{},[8325],{"type":899},{"data":8327,"marks":8328,"value":4533,"nodeType":864},{},[],{"data":8330,"content":8331,"nodeType":1005},{},[],{"data":8333,"content":8334,"nodeType":1009},{},[8335],{"data":8336,"marks":8337,"value":4544,"nodeType":864},{},[8338],{"type":899},{"data":8340,"content":8341,"nodeType":860},{},[8342],{"data":8343,"marks":8344,"value":4551,"nodeType":864},{},[],{"data":8346,"content":8347,"nodeType":4845},{},[8348,8371,8393,8415,8437,8459,8481,8503,8525,8547,8569,8591],{"data":8349,"content":8350,"nodeType":4581},{},[8351,8361],{"data":8352,"content":8353,"nodeType":4569},{},[8354],{"data":8355,"content":8356,"nodeType":860},{},[8357],{"data":8358,"marks":8359,"value":4568,"nodeType":864},{},[8360],{"type":899},{"data":8362,"content":8363,"nodeType":4569},{},[8364],{"data":8365,"content":8366,"nodeType":860},{},[8367],{"data":8368,"marks":8369,"value":4580,"nodeType":864},{},[8370],{"type":899},{"data":8372,"content":8373,"nodeType":4581},{},[8374,8384],{"data":8375,"content":8376,"nodeType":4569},{},[8377],{"data":8378,"content":8379,"nodeType":860},{},[8380],{"data":8381,"marks":8382,"value":4595,"nodeType":864},{},[8383],{"type":899},{"data":8385,"content":8386,"nodeType":4569},{},[8387],{"data":8388,"content":8389,"nodeType":860},{},[8390],{"data":8391,"marks":8392,"value":4605,"nodeType":864},{},[],{"data":8394,"content":8395,"nodeType":4581},{},[8396,8406],{"data":8397,"content":8398,"nodeType":4569},{},[8399],{"data":8400,"content":8401,"nodeType":860},{},[8402],{"data":8403,"marks":8404,"value":4619,"nodeType":864},{},[8405],{"type":899},{"data":8407,"content":8408,"nodeType":4569},{},[8409],{"data":8410,"content":8411,"nodeType":860},{},[8412],{"data":8413,"marks":8414,"value":4629,"nodeType":864},{},[],{"data":8416,"content":8417,"nodeType":4581},{},[8418,8428],{"data":8419,"content":8420,"nodeType":4569},{},[8421],{"data":8422,"content":8423,"nodeType":860},{},[8424],{"data":8425,"marks":8426,"value":4643,"nodeType":864},{},[8427],{"type":899},{"data":8429,"content":8430,"nodeType":4569},{},[8431],{"data":8432,"content":8433,"nodeType":860},{},[8434],{"data":8435,"marks":8436,"value":4653,"nodeType":864},{},[],{"data":8438,"content":8439,"nodeType":4581},{},[8440,8450],{"data":8441,"content":8442,"nodeType":4569},{},[8443],{"data":8444,"content":8445,"nodeType":860},{},[8446],{"data":8447,"marks":8448,"value":4667,"nodeType":864},{},[8449],{"type":899},{"data":8451,"content":8452,"nodeType":4569},{},[8453],{"data":8454,"content":8455,"nodeType":860},{},[8456],{"data":8457,"marks":8458,"value":4677,"nodeType":864},{},[],{"data":8460,"content":8461,"nodeType":4581},{},[8462,8472],{"data":8463,"content":8464,"nodeType":4569},{},[8465],{"data":8466,"content":8467,"nodeType":860},{},[8468],{"data":8469,"marks":8470,"value":4691,"nodeType":864},{},[8471],{"type":899},{"data":8473,"content":8474,"nodeType":4569},{},[8475],{"data":8476,"content":8477,"nodeType":860},{},[8478],{"data":8479,"marks":8480,"value":4701,"nodeType":864},{},[],{"data":8482,"content":8483,"nodeType":4581},{},[8484,8494],{"data":8485,"content":8486,"nodeType":4569},{},[8487],{"data":8488,"content":8489,"nodeType":860},{},[8490],{"data":8491,"marks":8492,"value":4715,"nodeType":864},{},[8493],{"type":899},{"data":8495,"content":8496,"nodeType":4569},{},[8497],{"data":8498,"content":8499,"nodeType":860},{},[8500],{"data":8501,"marks":8502,"value":4725,"nodeType":864},{},[],{"data":8504,"content":8505,"nodeType":4581},{},[8506,8516],{"data":8507,"content":8508,"nodeType":4569},{},[8509],{"data":8510,"content":8511,"nodeType":860},{},[8512],{"data":8513,"marks":8514,"value":4739,"nodeType":864},{},[8515],{"type":899},{"data":8517,"content":8518,"nodeType":4569},{},[8519],{"data":8520,"content":8521,"nodeType":860},{},[8522],{"data":8523,"marks":8524,"value":4749,"nodeType":864},{},[],{"data":8526,"content":8527,"nodeType":4581},{},[8528,8538],{"data":8529,"content":8530,"nodeType":4569},{},[8531],{"data":8532,"content":8533,"nodeType":860},{},[8534],{"data":8535,"marks":8536,"value":4763,"nodeType":864},{},[8537],{"type":899},{"data":8539,"content":8540,"nodeType":4569},{},[8541],{"data":8542,"content":8543,"nodeType":860},{},[8544],{"data":8545,"marks":8546,"value":4773,"nodeType":864},{},[],{"data":8548,"content":8549,"nodeType":4581},{},[8550,8560],{"data":8551,"content":8552,"nodeType":4569},{},[8553],{"data":8554,"content":8555,"nodeType":860},{},[8556],{"data":8557,"marks":8558,"value":4787,"nodeType":864},{},[8559],{"type":899},{"data":8561,"content":8562,"nodeType":4569},{},[8563],{"data":8564,"content":8565,"nodeType":860},{},[8566],{"data":8567,"marks":8568,"value":4797,"nodeType":864},{},[],{"data":8570,"content":8571,"nodeType":4581},{},[8572,8582],{"data":8573,"content":8574,"nodeType":4569},{},[8575],{"data":8576,"content":8577,"nodeType":860},{},[8578],{"data":8579,"marks":8580,"value":4811,"nodeType":864},{},[8581],{"type":899},{"data":8583,"content":8584,"nodeType":4569},{},[8585],{"data":8586,"content":8587,"nodeType":860},{},[8588],{"data":8589,"marks":8590,"value":4821,"nodeType":864},{},[],{"data":8592,"content":8593,"nodeType":4581},{},[8594,8604],{"data":8595,"content":8596,"nodeType":4569},{},[8597],{"data":8598,"content":8599,"nodeType":860},{},[8600],{"data":8601,"marks":8602,"value":4500,"nodeType":864},{},[8603],{"type":899},{"data":8605,"content":8606,"nodeType":4569},{},[8607],{"data":8608,"content":8609,"nodeType":860},{},[8610],{"data":8611,"marks":8612,"value":4844,"nodeType":864},{},[],{"data":8614,"content":8615,"nodeType":1005},{},[],{"data":8617,"content":8618,"nodeType":860},{},[8619,8622,8628],{"data":8620,"marks":8621,"value":4855,"nodeType":864},{},[],{"data":8623,"content":8624,"nodeType":883},{"uri":1700},[8625],{"data":8626,"marks":8627,"value":1703,"nodeType":864},{},[],{"data":8629,"marks":8630,"value":21,"nodeType":864},{},[],{"items":8632},[8633,8635],{"sys":8634,"name":297},{"id":2732},{"sys":8636,"name":2729},{"id":2728},{"items":8638},[8639],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":8640},{"url":4881},"making-the-business-case-for-a-browser-security-solution","blog/making-the-business-case-for-a-browser-security-solution",{"json":8644},{"data":8645,"content":8646,"nodeType":856},{},[8647],{"data":8648,"content":8649,"nodeType":860},{},[8650],{"data":8651,"marks":8652,"value":8653,"nodeType":864},{},[],"Browser security is one of the fastest-growing investment areas in enterprise security. It's clear that security teams need browser security solutions, but the challenge is often figuring out how to fund it.","Browser security is one of the fastest-growing investment areas in enterprise security. Here's our proven framework to create budget for browser security tools.",{"id":8656,"publishedAt":8657},"3u4XQlYOFzwY1nKVFaovos","2026-08-12T12:00:51.400Z",{"items":8659},[8660,8662],{"sys":8661,"name":297},{"id":2732},{"sys":8663,"name":2729},{"id":2728},{"items":8665},[8666,8668,8670,8672,8674,8676,8678,8680,8682,8684,8686,8688,8690,8692,8694,8696],{"sys":8667,"name":297,"slug":298,"tier":31},{"id":294},{"sys":8669,"name":413,"slug":414,"tier":31},{"id":410},{"sys":8671,"name":235,"slug":236,"tier":31},{"id":232},{"sys":8673,"name":279,"slug":280,"tier":31},{"id":276},{"sys":8675,"name":624,"slug":625,"tier":45},{"id":621},{"sys":8677,"name":306,"slug":307,"tier":45},{"id":303},{"sys":8679,"name":377,"slug":378,"tier":45},{"id":374},{"sys":8681,"name":580,"slug":581,"tier":45},{"id":577},{"sys":8683,"name":252,"slug":253,"tier":45},{"id":249},{"sys":8685,"name":589,"slug":590,"tier":45},{"id":586},{"sys":8687,"name":261,"slug":262,"tier":45},{"id":258},{"sys":8689,"name":315,"slug":316,"tier":45},{"id":312},{"sys":8691,"name":457,"slug":458,"tier":45},{"id":454},{"sys":8693,"name":502,"slug":503,"tier":45},{"id":499},{"sys":8695,"name":633,"slug":634,"tier":45},{"id":630},{"sys":8697,"name":386,"slug":387,"tier":45},{"id":383},"bBKwW9E1rG-3LgBNn6aPFkmENwD8ArxqVXJcqXlDmIg",{"id":8700,"title":6997,"authorsCollection":8701,"content":8706,"extension":228,"faqItemsCollection":9323,"faqTitle":59,"featured":6,"hashTags":59,"meta":9325,"metaTitle":9326,"ogImage":59,"postType":6304,"publishedDate":6999,"relatedBlogPostsCollection":9327,"slug":7000,"stem":11778,"subtitle":59,"summary":11779,"synopsis":6998,"sys":11790,"tagsCollection":11792,"topicsCollection":11798,"__hash__":11824},"blog/blog/enterprise-browser-vs-browser-extension-which-should-your-security-team-choose.json",{"items":8702},[8703],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":8704,"profilePicture":8705},[4950],{"url":4881},{"json":8707,"links":9294},{"data":8708,"content":8709,"nodeType":856},{},[8710,8716,8722,8741,8747,8753,8759,8762,8769,8775,8791,8797,8803,8845,8851,8858,8864,8870,8876,8879,8886,8892,8902,8908,8915,8931,8936,8969,8974,8980,8990,8995,9001,9016,9023,9029,9045,9050,9057,9063,9194,9197,9204,9210,9216,9219,9226,9232,9242,9252,9262,9272,9278],{"data":8711,"content":8712,"nodeType":860},{},[8713],{"data":8714,"marks":8715,"value":6321,"nodeType":864},{},[],{"data":8717,"content":8718,"nodeType":860},{},[8719],{"data":8720,"marks":8721,"value":6328,"nodeType":864},{},[],{"data":8723,"content":8724,"nodeType":1116},{},[8725],{"data":8726,"content":8727,"nodeType":860},{},[8728,8731,8738],{"data":8729,"marks":8730,"value":6338,"nodeType":864},{},[],{"data":8732,"content":8733,"nodeType":883},{"uri":2561},[8734],{"data":8735,"marks":8736,"value":6346,"nodeType":864},{},[8737],{"type":1455},{"data":8739,"marks":8740,"value":6350,"nodeType":864},{},[],{"data":8742,"content":8743,"nodeType":860},{},[8744],{"data":8745,"marks":8746,"value":6357,"nodeType":864},{},[],{"data":8748,"content":8749,"nodeType":860},{},[8750],{"data":8751,"marks":8752,"value":6364,"nodeType":864},{},[],{"data":8754,"content":8755,"nodeType":860},{},[8756],{"data":8757,"marks":8758,"value":6371,"nodeType":864},{},[],{"data":8760,"content":8761,"nodeType":1005},{},[],{"data":8763,"content":8764,"nodeType":1009},{},[8765],{"data":8766,"marks":8767,"value":6382,"nodeType":864},{},[8768],{"type":899},{"data":8770,"content":8771,"nodeType":860},{},[8772],{"data":8773,"marks":8774,"value":6389,"nodeType":864},{},[],{"data":8776,"content":8777,"nodeType":1116},{},[8778],{"data":8779,"content":8780,"nodeType":860},{},[8781,8784,8788],{"data":8782,"marks":8783,"value":6399,"nodeType":864},{},[],{"data":8785,"marks":8786,"value":6404,"nodeType":864},{},[8787],{"type":2246},{"data":8789,"marks":8790,"value":6408,"nodeType":864},{},[],{"data":8792,"content":8793,"nodeType":860},{},[8794],{"data":8795,"marks":8796,"value":6415,"nodeType":864},{},[],{"data":8798,"content":8799,"nodeType":860},{},[8800],{"data":8801,"marks":8802,"value":6422,"nodeType":864},{},[],{"data":8804,"content":8805,"nodeType":941},{},[8806,8819,8832],{"data":8807,"content":8808,"nodeType":945},{},[8809],{"data":8810,"content":8811,"nodeType":860},{},[8812,8816],{"data":8813,"marks":8814,"value":6436,"nodeType":864},{},[8815],{"type":899},{"data":8817,"marks":8818,"value":6440,"nodeType":864},{},[],{"data":8820,"content":8821,"nodeType":945},{},[8822],{"data":8823,"content":8824,"nodeType":860},{},[8825,8829],{"data":8826,"marks":8827,"value":6451,"nodeType":864},{},[8828],{"type":899},{"data":8830,"marks":8831,"value":6455,"nodeType":864},{},[],{"data":8833,"content":8834,"nodeType":945},{},[8835],{"data":8836,"content":8837,"nodeType":860},{},[8838,8842],{"data":8839,"marks":8840,"value":6466,"nodeType":864},{},[8841],{"type":899},{"data":8843,"marks":8844,"value":6470,"nodeType":864},{},[],{"data":8846,"content":8847,"nodeType":860},{},[8848],{"data":8849,"marks":8850,"value":6477,"nodeType":864},{},[],{"data":8852,"content":8853,"nodeType":1312},{},[8854],{"data":8855,"marks":8856,"value":6485,"nodeType":864},{},[8857],{"type":899},{"data":8859,"content":8860,"nodeType":860},{},[8861],{"data":8862,"marks":8863,"value":6492,"nodeType":864},{},[],{"data":8865,"content":8866,"nodeType":860},{},[8867],{"data":8868,"marks":8869,"value":6499,"nodeType":864},{},[],{"data":8871,"content":8872,"nodeType":860},{},[8873],{"data":8874,"marks":8875,"value":6506,"nodeType":864},{},[],{"data":8877,"content":8878,"nodeType":1005},{},[],{"data":8880,"content":8881,"nodeType":1009},{},[8882],{"data":8883,"marks":8884,"value":6517,"nodeType":864},{},[8885],{"type":899},{"data":8887,"content":8888,"nodeType":860},{},[8889],{"data":8890,"marks":8891,"value":6524,"nodeType":864},{},[],{"data":8893,"content":8894,"nodeType":860},{},[8895,8898],{"data":8896,"marks":8897,"value":6531,"nodeType":864},{},[],{"data":8899,"marks":8900,"value":6536,"nodeType":864},{},[8901],{"type":2246},{"data":8903,"content":8904,"nodeType":860},{},[8905],{"data":8906,"marks":8907,"value":6543,"nodeType":864},{},[],{"data":8909,"content":8910,"nodeType":1312},{},[8911],{"data":8912,"marks":8913,"value":6551,"nodeType":864},{},[8914],{"type":899},{"data":8916,"content":8917,"nodeType":860},{},[8918,8921,8928],{"data":8919,"marks":8920,"value":6558,"nodeType":864},{},[],{"data":8922,"content":8923,"nodeType":883},{"uri":5124},[8924],{"data":8925,"marks":8926,"value":6566,"nodeType":864},{},[8927],{"type":1455},{"data":8929,"marks":8930,"value":6570,"nodeType":864},{},[],{"data":8932,"content":8935,"nodeType":996},{"target":8933},{"sys":8934},{"id":6575,"type":1001,"linkType":1002},[],{"data":8937,"content":8938,"nodeType":860},{},[8939,8942,8949,8952,8956,8959,8966],{"data":8940,"marks":8941,"value":6583,"nodeType":864},{},[],{"data":8943,"content":8944,"nodeType":883},{"uri":6586},[8945],{"data":8946,"marks":8947,"value":6592,"nodeType":864},{},[8948],{"type":1455},{"data":8950,"marks":8951,"value":6596,"nodeType":864},{},[],{"data":8953,"marks":8954,"value":6601,"nodeType":864},{},[8955],{"type":899},{"data":8957,"marks":8958,"value":6605,"nodeType":864},{},[],{"data":8960,"content":8961,"nodeType":883},{"uri":6079},[8962],{"data":8963,"marks":8964,"value":6613,"nodeType":864},{},[8965],{"type":1455},{"data":8967,"marks":8968,"value":6570,"nodeType":864},{},[],{"data":8970,"content":8973,"nodeType":996},{"target":8971},{"sys":8972},{"id":6621,"type":1001,"linkType":1002},[],{"data":8975,"content":8976,"nodeType":860},{},[8977],{"data":8978,"marks":8979,"value":6629,"nodeType":864},{},[],{"data":8981,"content":8982,"nodeType":860},{},[8983,8986],{"data":8984,"marks":8985,"value":6636,"nodeType":864},{},[],{"data":8987,"marks":8988,"value":6641,"nodeType":864},{},[8989],{"type":899},{"data":8991,"content":8994,"nodeType":996},{"target":8992},{"sys":8993},{"id":6646,"type":1001,"linkType":1002},[],{"data":8996,"content":8997,"nodeType":860},{},[8998],{"data":8999,"marks":9000,"value":6654,"nodeType":864},{},[],{"data":9002,"content":9003,"nodeType":860},{},[9004,9007,9013],{"data":9005,"marks":9006,"value":2761,"nodeType":864},{},[],{"data":9008,"content":9009,"nodeType":883},{"uri":5717},[9010],{"data":9011,"marks":9012,"value":6667,"nodeType":864},{},[],{"data":9014,"marks":9015,"value":6671,"nodeType":864},{},[],{"data":9017,"content":9018,"nodeType":1312},{},[9019],{"data":9020,"marks":9021,"value":6679,"nodeType":864},{},[9022],{"type":899},{"data":9024,"content":9025,"nodeType":860},{},[9026],{"data":9027,"marks":9028,"value":6686,"nodeType":864},{},[],{"data":9030,"content":9031,"nodeType":860},{},[9032,9035,9042],{"data":9033,"marks":9034,"value":6693,"nodeType":864},{},[],{"data":9036,"content":9037,"nodeType":883},{"uri":5827},[9038],{"data":9039,"marks":9040,"value":6701,"nodeType":864},{},[9041],{"type":1455},{"data":9043,"marks":9044,"value":6705,"nodeType":864},{},[],{"data":9046,"content":9049,"nodeType":996},{"target":9047},{"sys":9048},{"id":6710,"type":1001,"linkType":1002},[],{"data":9051,"content":9052,"nodeType":1312},{},[9053],{"data":9054,"marks":9055,"value":6719,"nodeType":864},{},[9056],{"type":899},{"data":9058,"content":9059,"nodeType":860},{},[9060],{"data":9061,"marks":9062,"value":6726,"nodeType":864},{},[],{"data":9064,"content":9065,"nodeType":941},{},[9066,9106,9137,9168,9181],{"data":9067,"content":9068,"nodeType":945},{},[9069],{"data":9070,"content":9071,"nodeType":860},{},[9072,9076,9079,9085,9088,9094,9097,9103],{"data":9073,"marks":9074,"value":6740,"nodeType":864},{},[9075],{"type":899},{"data":9077,"marks":9078,"value":6744,"nodeType":864},{},[],{"data":9080,"content":9081,"nodeType":883},{"uri":5853},[9082],{"data":9083,"marks":9084,"value":5858,"nodeType":864},{},[],{"data":9086,"marks":9087,"value":5862,"nodeType":864},{},[],{"data":9089,"content":9090,"nodeType":883},{"uri":6756},[9091],{"data":9092,"marks":9093,"value":6761,"nodeType":864},{},[],{"data":9095,"marks":9096,"value":6765,"nodeType":864},{},[],{"data":9098,"content":9099,"nodeType":883},{"uri":5112},[9100],{"data":9101,"marks":9102,"value":6772,"nodeType":864},{},[],{"data":9104,"marks":9105,"value":6776,"nodeType":864},{},[],{"data":9107,"content":9108,"nodeType":945},{},[9109],{"data":9110,"content":9111,"nodeType":860},{},[9112,9116,9119,9125,9128,9134],{"data":9113,"marks":9114,"value":6787,"nodeType":864},{},[9115],{"type":899},{"data":9117,"marks":9118,"value":6791,"nodeType":864},{},[],{"data":9120,"content":9121,"nodeType":883},{"uri":5895},[9122],{"data":9123,"marks":9124,"value":5900,"nodeType":864},{},[],{"data":9126,"marks":9127,"value":6801,"nodeType":864},{},[],{"data":9129,"content":9130,"nodeType":883},{"uri":6804},[9131],{"data":9132,"marks":9133,"value":6809,"nodeType":864},{},[],{"data":9135,"marks":9136,"value":6813,"nodeType":864},{},[],{"data":9138,"content":9139,"nodeType":945},{},[9140],{"data":9141,"content":9142,"nodeType":860},{},[9143,9147,9150,9156,9159,9165],{"data":9144,"marks":9145,"value":6824,"nodeType":864},{},[9146],{"type":899},{"data":9148,"marks":9149,"value":6828,"nodeType":864},{},[],{"data":9151,"content":9152,"nodeType":883},{"uri":5865},[9153],{"data":9154,"marks":9155,"value":6835,"nodeType":864},{},[],{"data":9157,"marks":9158,"value":6839,"nodeType":864},{},[],{"data":9160,"content":9161,"nodeType":883},{"uri":6842},[9162],{"data":9163,"marks":9164,"value":6847,"nodeType":864},{},[],{"data":9166,"marks":9167,"value":6851,"nodeType":864},{},[],{"data":9169,"content":9170,"nodeType":945},{},[9171],{"data":9172,"content":9173,"nodeType":860},{},[9174,9178],{"data":9175,"marks":9176,"value":6862,"nodeType":864},{},[9177],{"type":899},{"data":9179,"marks":9180,"value":6866,"nodeType":864},{},[],{"data":9182,"content":9183,"nodeType":945},{},[9184],{"data":9185,"content":9186,"nodeType":860},{},[9187,9191],{"data":9188,"marks":9189,"value":6877,"nodeType":864},{},[9190],{"type":899},{"data":9192,"marks":9193,"value":6881,"nodeType":864},{},[],{"data":9195,"content":9196,"nodeType":1005},{},[],{"data":9198,"content":9199,"nodeType":1009},{},[9200],{"data":9201,"marks":9202,"value":6892,"nodeType":864},{},[9203],{"type":899},{"data":9205,"content":9206,"nodeType":860},{},[9207],{"data":9208,"marks":9209,"value":6899,"nodeType":864},{},[],{"data":9211,"content":9212,"nodeType":860},{},[9213],{"data":9214,"marks":9215,"value":6906,"nodeType":864},{},[],{"data":9217,"content":9218,"nodeType":1005},{},[],{"data":9220,"content":9221,"nodeType":1009},{},[9222],{"data":9223,"marks":9224,"value":6917,"nodeType":864},{},[9225],{"type":899},{"data":9227,"content":9228,"nodeType":860},{},[9229],{"data":9230,"marks":9231,"value":6924,"nodeType":864},{},[],{"data":9233,"content":9234,"nodeType":860},{},[9235,9239],{"data":9236,"marks":9237,"value":6932,"nodeType":864},{},[9238],{"type":899},{"data":9240,"marks":9241,"value":6936,"nodeType":864},{},[],{"data":9243,"content":9244,"nodeType":860},{},[9245,9249],{"data":9246,"marks":9247,"value":6944,"nodeType":864},{},[9248],{"type":899},{"data":9250,"marks":9251,"value":6948,"nodeType":864},{},[],{"data":9253,"content":9254,"nodeType":860},{},[9255,9259],{"data":9256,"marks":9257,"value":6956,"nodeType":864},{},[9258],{"type":899},{"data":9260,"marks":9261,"value":6960,"nodeType":864},{},[],{"data":9263,"content":9264,"nodeType":860},{},[9265,9269],{"data":9266,"marks":9267,"value":6968,"nodeType":864},{},[9268],{"type":899},{"data":9270,"marks":9271,"value":6972,"nodeType":864},{},[],{"data":9273,"content":9274,"nodeType":860},{},[9275],{"data":9276,"marks":9277,"value":6979,"nodeType":864},{},[],{"data":9279,"content":9280,"nodeType":860},{},[9281,9284,9291],{"data":9282,"marks":9283,"value":21,"nodeType":864},{},[],{"data":9285,"content":9286,"nodeType":883},{"uri":1700},[9287],{"data":9288,"marks":9289,"value":6993,"nodeType":864},{},[9290],{"type":1455},{"data":9292,"marks":9293,"value":2924,"nodeType":864},{},[],{"entries":9295},{"hyperlink":9296,"inline":9297,"block":9298},[],[],[9299,9302,9310,9315],{"sys":9300,"__typename":1717,"type":1718,"ctaText":9301,"buttonLabel":151,"buttonColour":1721,"buttonUrl":5124},{"id":6575},"Read our report on the browser attack techniques security teams need to contend with in 2026 (no gates!)",{"sys":9303,"__typename":1724,"title":9304,"caption":9305,"layoutMode":59,"file":9306},{"id":6621},"Comparing ease of deployment x security value for browser security solutions","Comparing ease of deployment x security value for browser security solutions.",{"url":9307,"width":9308,"height":9309},"https://images.ctfassets.net/y1cdw1ablpvd/4z1RAFROesqaBF4H3qR8yu/1e21a68602402773bfa843fd0208d4ca/Screenshot_2026-07-27_at_10.36.43.png",1408,952,{"sys":9311,"__typename":1717,"type":1718,"ctaText":9312,"buttonLabel":9313,"buttonColour":1721,"buttonUrl":9314},{"id":6646},"Read our blog for a step-by-step guide to how Push protects against browser-based attacks. ","Read the blog","https://pushsecurity.com/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks/",{"sys":9316,"__typename":1724,"title":9317,"caption":9318,"layoutMode":59,"file":9319},{"id":6710},"SEB Blog Quote Callout","What security leaders have to say about Push.",{"url":9320,"width":9321,"height":9322},"https://images.ctfassets.net/y1cdw1ablpvd/3puINxgWMVBvsieKSMxbcA/d68e403607ea8786de911f7c0bbdd1d3/Frame_628075.png",1390,930,{"items":9324},[],{},"Enterprise browser vs. browser extension solution analysis",{"items":9328},[9329,9914,10697],{"__typename":2059,"sys":9330,"content":9332,"title":9900,"synopsis":9901,"hashTags":59,"publishedDate":9902,"slug":9903,"tagsCollection":9904,"authorsCollection":9910},{"id":9331},"LlTjdYp5ALHM3YIvsCibZ",{"json":9333},{"data":9334,"content":9335,"nodeType":856},{},[9336,9343,9370,9377,9380,9388,9395,9402,9409,9417,9471,9478,9486,9493,9500,9508,9515,9522,9541,9572,9579,9582,9590,9598,9616,9624,9644,9652,9659,9667,9674,9682,9689,9692,9700,9707,9718,9736,9744,9751,9757,9765,9802,9808,9816,9833,9841,9859,9862,9870,9877,9884],{"data":9337,"content":9338,"nodeType":860},{},[9339],{"data":9340,"marks":9341,"value":9342,"nodeType":864},{},[],"Three browser security companies have been acquired by major security platforms in five months. CrowdStrike acquired Seraphic Security in January 2026. Zscaler absorbed SquareX in February. In May, Akamai announced the acquisition of LayerX. Add Palo Alto Networks' earlier acquisition of Talon, and the browser security market has consolidated faster than almost any adjacent security category before it.",{"data":9344,"content":9345,"nodeType":860},{},[9346,9350,9357,9360,9367],{"data":9347,"marks":9348,"value":9349,"nodeType":864},{},[],"These acquisitions recognize that the browser is now where employees work, where AI runs, and where the most damaging attacks on organizations originate. It’s telling that browser security already accounts for ",{"data":9351,"content":9352,"nodeType":883},{"uri":2561},[9353],{"data":9354,"marks":9355,"value":9356,"nodeType":864},{},[],"12.6% of the average security budget",{"data":9358,"marks":9359,"value":2232,"nodeType":864},{},[],{"data":9361,"content":9362,"nodeType":883},{"uri":2561},[9363],{"data":9364,"marks":9365,"value":9366,"nodeType":864},{},[],"85% of organizations expect to increase that spend over the next 12-24 months",{"data":9368,"marks":9369,"value":2924,"nodeType":864},{},[],{"data":9371,"content":9372,"nodeType":860},{},[9373],{"data":9374,"marks":9375,"value":9376,"nodeType":864},{},[],"But for security buyers, consolidation creates a risk as much as an opportunity. The question isn't whether your existing platform vendor now offers browser security — it's whether what they're offering can actually protect you as the threat landscape evolves.",{"data":9378,"content":9379,"nodeType":1005},{},[],{"data":9381,"content":9382,"nodeType":1009},{},[9383],{"data":9384,"marks":9385,"value":9387,"nodeType":864},{},[9386],{"type":899},"Why \"good enough\" isn't good enough in the browser",{"data":9389,"content":9390,"nodeType":860},{},[9391],{"data":9392,"marks":9393,"value":9394,"nodeType":864},{},[],"The consolidation pitch is tempting. If you're already a CrowdStrike, Zscaler, or Palo Alto customer, adding browser security through an existing relationship means fewer vendors, fewer contracts, and a coherent narrative about platform consolidation that plays well internally. ",{"data":9396,"content":9397,"nodeType":860},{},[9398],{"data":9399,"marks":9400,"value":9401,"nodeType":864},{},[],"Security teams make these kinds of tradeoffs all the time — accepting that your SASE vendor's threat intelligence feed may not match a dedicated provider, or that your EDR vendor's vulnerability management module may not match a dedicated scanner — are reasonable decisions where the operational benefit of consolidation outweighs the capability difference.",{"data":9403,"content":9404,"nodeType":860},{},[9405],{"data":9406,"marks":9407,"value":9408,"nodeType":864},{},[],"But browser security is a category where the stakes are too high to accept a \"good enough\" solution. The majority of all reported breaches now originate in the browser and attacker tradecraft in this space is advancing at an unprecedented rate thanks to AI. These risks warrant the strongest form of defense. Here are three reasons that “good enough” solutions don't give you that:",{"data":9410,"content":9411,"nodeType":1312},{},[9412],{"data":9413,"marks":9414,"value":9416,"nodeType":864},{},[9415],{"type":899},"1. Most platform browser solutions were built for the wrong problems",{"data":9418,"content":9419,"nodeType":860},{},[9420,9423,9432,9436,9444,9448,9456,9460,9467],{"data":9421,"marks":9422,"value":21,"nodeType":864},{},[],{"data":9424,"content":9426,"nodeType":883},{"uri":9425},"https://www.crowdstrike.com/en-us/resources/infographics/identity-security-risk-review/",[9427],{"data":9428,"marks":9429,"value":9431,"nodeType":864},{},[9430],{"type":1455},"CrowdStrike's own research",{"data":9433,"marks":9434,"value":9435,"nodeType":864},{},[]," puts identity involvement in 80% of all modern breaches. Identity weaknesses played a material role in ",{"data":9437,"content":9439,"nodeType":883},{"uri":9438},"https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report",[9440],{"data":9441,"marks":9442,"value":9443,"nodeType":864},{},[],"almost 90% of Unit 42 incident response investigations",{"data":9445,"marks":9446,"value":9447,"nodeType":864},{},[],". The breaches making headlines — 2024's ",{"data":9449,"content":9451,"nodeType":883},{"uri":9450},"https://pushsecurity.com/blog/snowflake-retro",[9452],{"data":9453,"marks":9454,"value":9455,"nodeType":864},{},[],"mass Snowflake account compromises",{"data":9457,"marks":9458,"value":9459,"nodeType":864},{},[],", 2025's wave of Salesforce-targeted attacks, and 2026's ",{"data":9461,"content":9462,"nodeType":883},{"uri":4082},[9463],{"data":9464,"marks":9465,"value":9466,"nodeType":864},{},[],"continued spree of data theft and extortion",{"data":9468,"marks":9469,"value":9470,"nodeType":864},{},[]," — all trace back to identity weaknesses exploited through the browser: credentials stuffed into login pages that lacked MFA, session tokens hijacked via AiTM phishing, OAuth consent abused to grant persistent access, and device code flows manipulated to bypass authentication entirely. ",{"data":9472,"content":9473,"nodeType":860},{},[9474],{"data":9475,"marks":9476,"value":9477,"nodeType":864},{},[],"Yet Seraphic was built for browser runtime exploit prevention, SquareX for file-based malware sandboxing, LayerX for access governance and AI usage policy. These are real use cases, but they're not the use cases behind headline breaches. If your browser security solution checks a box for \"phishing protection\" but can't detect the identity attack techniques that are actually being industrialized and deployed at scale, you have a gap — and the danger is that you don't know it's there.",{"data":9479,"content":9480,"nodeType":1312},{},[9481],{"data":9482,"marks":9483,"value":9485,"nodeType":864},{},[9484],{"type":899},"2. Even solutions claiming the right capabilities often deliver them superficially",{"data":9487,"content":9488,"nodeType":860},{},[9489],{"data":9490,"marks":9491,"value":9492,"nodeType":864},{},[],"Every browser security vendor claims phishing detection, ClickFix protection, and session security. What varies enormously is whether those capabilities work against real, live, never-before-seen attacker infrastructure — or only against known-bad indicators that attackers rotate in minutes. 95% of in-browser attacks detected by Push used bot protection to evade blocklists; 89% of phishing domains are active for fewer than two days. ",{"data":9494,"content":9495,"nodeType":860},{},[9496],{"data":9497,"marks":9498,"value":9499,"nodeType":864},{},[],"A solution that appears comprehensive in a demo or PoV may leave significant gaps when tested against adversaries who understand exactly how security tools work and actively engineer around them. ",{"data":9501,"content":9502,"nodeType":1312},{},[9503],{"data":9504,"marks":9505,"value":9507,"nodeType":864},{},[9506],{"type":899},"3. AI is only going to widen the gap between \"good enough\" and what you need",{"data":9509,"content":9510,"nodeType":860},{},[9511],{"data":9512,"marks":9513,"value":9514,"nodeType":864},{},[],"When a browser security product is acquired, engineering effort turns inwards towards integration with the parent platform, not advancing detection capability. ",{"data":9516,"content":9517,"nodeType":860},{},[9518],{"data":9519,"marks":9520,"value":9521,"nodeType":864},{},[],"That dynamic plays out differently for each acquisition, but in Seraphic's case it is expected to be particularly heightened. Seraphic works by injecting an agent into the browser's JavaScript runtime. This is the same approach antivirus vendors have used for years, with well-documented stability consequences. Stability is now a top priority for CrowdStrike, which means the Seraphic integration will proceed cautiously. For buyers, that translates directly into slower capability advancement, not faster.",{"data":9523,"content":9524,"nodeType":860},{},[9525,9529,9537],{"data":9526,"marks":9527,"value":9528,"nodeType":864},{},[],"But this is no time for engineering efforts to turn inward, as the threat landscape continues to evolve at an unprecedented rate. You only need to look at the rise of techniques like device code phishing, which have gone from ",{"data":9530,"content":9531,"nodeType":883},{"uri":3259},[9532],{"data":9533,"marks":9534,"value":9536,"nodeType":864},{},[9535],{"type":1455},"research curiosity to industrialized exploitation",{"data":9538,"marks":9539,"value":9540,"nodeType":864},{},[]," in a matter of months — in large part enabled by AI-powered tools and AI-assisted development. Similarly, AI has compressed the time to generate a convincing phishing campaign from hours to minutes. ",{"data":9542,"content":9543,"nodeType":860},{},[9544,9548,9555,9559,9568],{"data":9545,"marks":9546,"value":9547,"nodeType":864},{},[],"But it's not only external threats: ",{"data":9549,"content":9550,"nodeType":883},{"uri":2561},[9551],{"data":9552,"marks":9553,"value":9554,"nodeType":864},{},[],"92% of organizations allow employees to use public GenAI applications",{"data":9556,"marks":9557,"value":9558,"nodeType":864},{},[]," — every one of them with unsanctioned AI use occurring by design — employees are routinely entering sensitive data into unapproved AI tools, and ",{"data":9560,"content":9562,"nodeType":883},{"uri":9561},"https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025",[9563],{"data":9564,"marks":9565,"value":9567,"nodeType":864},{},[9566],{"type":1455},"Gartner predicts",{"data":9569,"marks":9570,"value":9571,"nodeType":864},{},[]," 40% of enterprise applications will feature AI agents by end of 2026, up from under 5% in 2025. ",{"data":9573,"content":9574,"nodeType":860},{},[9575],{"data":9576,"marks":9577,"value":9578,"nodeType":864},{},[],"The gap between an acquired product focused on integration and vendors whose single-minded focus is on stopping these emerging threats will continue to widen over time.",{"data":9580,"content":9581,"nodeType":1005},{},[],{"data":9583,"content":9584,"nodeType":1009},{},[9585],{"data":9586,"marks":9587,"value":9589,"nodeType":864},{},[9588],{"type":899},"How to identify a genuinely best-of-breed solution",{"data":9591,"content":9592,"nodeType":1312},{},[9593],{"data":9594,"marks":9595,"value":9597,"nodeType":864},{},[9596],{"type":899},"Start from your own requirements",{"data":9599,"content":9600,"nodeType":860},{},[9601,9605,9612],{"data":9602,"marks":9603,"value":9604,"nodeType":864},{},[],"Define the outcomes you need before speaking to any vendor. The ",{"data":9606,"content":9607,"nodeType":883},{"uri":5717},[9608],{"data":9609,"marks":9610,"value":9611,"nodeType":864},{},[],"highest-value browser security use cases",{"data":9613,"marks":9614,"value":9615,"nodeType":864},{},[]," are account takeover prevention, advanced phishing detection, identity posture hardening, browser extension security, and shadow SaaS and OAuth governance.",{"data":9617,"content":9618,"nodeType":1312},{},[9619],{"data":9620,"marks":9621,"value":9623,"nodeType":864},{},[9622],{"type":899},"Understand how it detects, not just what it claims",{"data":9625,"content":9626,"nodeType":860},{},[9627,9631,9640],{"data":9628,"marks":9629,"value":9630,"nodeType":864},{},[],"Most solutions rely on IoCs — matching known-bad domains, URLs, and IPs against feeds that attackers rotate in minutes.  There’s a major shortcoming with this approach, though: attackers rotate infrastructure faster than any blocklist updates and use bot protection to stay off threat intelligence feeds, making every attack feel ",{"data":9632,"content":9634,"nodeType":883},{"uri":9633},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[9635],{"data":9636,"marks":9637,"value":9639,"nodeType":864},{},[9638],{"type":1455},"like a zero-day",{"data":9641,"marks":9642,"value":9643,"nodeType":864},{},[],". The only approach that reliably works is TTP-based behavioral detection. Ask every vendor: are you detecting a known-bad indicator or a behavioral technique?",{"data":9645,"content":9646,"nodeType":1312},{},[9647],{"data":9648,"marks":9649,"value":9651,"nodeType":864},{},[9650],{"type":899},"Test against real attacker behavior",{"data":9653,"content":9654,"nodeType":860},{},[9655],{"data":9656,"marks":9657,"value":9658,"nodeType":864},{},[],"Don't evaluate phishing detection with old phishing URLs. By the time you’re running these tests their IoCs will already be on block-lists (see point above). Instead, deploy realistic testing scenarios and look for demonstrable evidence of stopping real-world phishing kits — Evilginx, Tycoon2FA, Sneaky2FA, and so on. ",{"data":9660,"content":9661,"nodeType":1312},{},[9662],{"data":9663,"marks":9664,"value":9666,"nodeType":864},{},[9665],{"type":899},"Assess innovation velocity",{"data":9668,"content":9669,"nodeType":860},{},[9670],{"data":9671,"marks":9672,"value":9673,"nodeType":864},{},[],"Ask every vendor about their research output and feature release history over the past six months — are they discovering and publishing novel attack techniques, or covering what others already documented? Are new detections shipping continuously, or in quarterly cycles? For acquired products specifically, also ask how the roadmap has changed since acquisition. ",{"data":9675,"content":9676,"nodeType":1312},{},[9677],{"data":9678,"marks":9679,"value":9681,"nodeType":864},{},[9680],{"type":899},"Consider operationalization, vendor focus, and lock-in",{"data":9683,"content":9684,"nodeType":860},{},[9685],{"data":9686,"marks":9687,"value":9688,"nodeType":864},{},[],"Many solutions demo well but create significant overhead at scale. Consider whether you want another agent on endpoints, and whether you have the resources to tune granular policies without drowning in false positives. Your requirements might not carry the same weight with a platform vendor with tens of thousands of customers across multiple product lines, versus a dedicated vendor whose entire roadmap exists to solve your problem. And factor in lock-in: every capability consolidated into an existing platform vendor reduces your ability to change direction later.",{"data":9690,"content":9691,"nodeType":1005},{},[],{"data":9693,"content":9694,"nodeType":1009},{},[9695],{"data":9696,"marks":9697,"value":9699,"nodeType":864},{},[9698],{"type":899},"Why Push is the best-of-breed browser security solution",{"data":9701,"content":9702,"nodeType":860},{},[9703],{"data":9704,"marks":9705,"value":9706,"nodeType":864},{},[],"Think of Push as EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Here’s why customers choose Push as a best-of-breed solution:",{"data":9708,"content":9709,"nodeType":1312},{},[9710,9715],{"data":9711,"marks":9712,"value":9714,"nodeType":864},{},[9713],{"type":899},"Push is built for the security problems that actually cause breaches",{"data":9716,"marks":9717,"value":1171,"nodeType":864},{},[],{"data":9719,"content":9720,"nodeType":860},{},[9721,9725,9732],{"data":9722,"marks":9723,"value":9724,"nodeType":864},{},[],"The highest-value browser security problems — account takeover prevention, advanced phishing detection, identity posture hardening, browser extension security, shadow SaaS and OAuth governance — all require visibility inside the browser session. Push was built from the ground up for exactly that. The same foundational capability that detects AiTM phishing and ClickFix attacks also surfaces the exposure most security teams don't know they have: ",{"data":9726,"content":9727,"nodeType":883},{"uri":5521},[9728],{"data":9729,"marks":9730,"value":9731,"nodeType":864},{},[],"across Push's customer base",{"data":9733,"marks":9734,"value":9735,"nodeType":864},{},[],", 1 in 4 logins use passwords rather than SSO, 2 in 5 are unprotected by MFA, and 46.76% of browser extensions carry permissions sufficient to perform account takeover — none of it visible from the endpoint, network, or email layer.",{"data":9737,"content":9738,"nodeType":1312},{},[9739],{"data":9740,"marks":9741,"value":9743,"nodeType":864},{},[9742],{"type":899},"Push detects high-fidelity attacker TTPs, not low-level IoCs",{"data":9745,"content":9746,"nodeType":860},{},[9747],{"data":9748,"marks":9749,"value":9750,"nodeType":864},{},[],"Push's browser extension operates as a flight recorder inside the session, capturing every page load, credential submission, OAuth consent flow, and user action in real time. That telemetry surfaces attacker behavior — the page structure and script signatures of AiTM kits, the clipboard mechanics of ClickFix, the OAuth flow characteristics of ConsentFix — rather than infrastructure indicators that attackers rotate in minutes. This is how Push intercepts “zero-day” phishing using fresh infrastructure and domains every time, while most solutions are stuck playing known-bad whac-a-mole. ",{"data":9752,"content":9756,"nodeType":996},{"target":9753},{"sys":9754},{"id":9755,"type":1001,"linkType":1002},"4ho5gOHl1loo9Jtv9nPoq1",[],{"data":9758,"content":9759,"nodeType":1312},{},[9760],{"data":9761,"marks":9762,"value":9764,"nodeType":864},{},[9763],{"type":899},"Push’s research and agentic threat hunting keeps you ahead of attacker innovation",{"data":9766,"content":9767,"nodeType":860},{},[9768,9772,9778,9781,9788,9792,9798],{"data":9769,"marks":9770,"value":9771,"nodeType":864},{},[],"Push named ",{"data":9773,"content":9774,"nodeType":883},{"uri":5853},[9775],{"data":9776,"marks":9777,"value":5858,"nodeType":864},{},[],{"data":9779,"marks":9780,"value":902,"nodeType":864},{},[],{"data":9782,"content":9783,"nodeType":883},{"uri":6756},[9784],{"data":9785,"marks":9786,"value":9787,"nodeType":864},{},[],"InstallFix",{"data":9789,"marks":9790,"value":9791,"nodeType":864},{},[]," before any other vendor detected either in production. That research feeds an ",{"data":9793,"content":9794,"nodeType":883},{"uri":5895},[9795],{"data":9796,"marks":9797,"value":5900,"nodeType":864},{},[],{"data":9799,"marks":9800,"value":9801,"nodeType":864},{},[]," built on two learning loops — an inner loop for real-time detection of known techniques, and an outer loop where autonomous agents continuously hunt across 3 million deployed browsers for emerging threats, writing new detections and deploying them to customer environments in minutes. ",{"data":9803,"content":9807,"nodeType":996},{"target":9804},{"sys":9805},{"id":9806,"type":1001,"linkType":1002},"17y3jchoPysKQTf2ra59Bv",[],{"data":9809,"content":9810,"nodeType":1312},{},[9811],{"data":9812,"marks":9813,"value":9815,"nodeType":864},{},[9814],{"type":899},"Push solves more use cases than just stopping advanced attacks",{"data":9817,"content":9818,"nodeType":860},{},[9819,9823,9830],{"data":9820,"marks":9821,"value":9822,"nodeType":864},{},[],"Push uses the same browser-layer visibility to surface every AI tool, agentic browser, extension, and OAuth integration in use across the organization — and enforce policy on what employees can do inside them in real time, including unsanctioned tools no other layer sees. The same technical capabilities provided by Push also harden the identity attack surface, prevent data loss, accelerate insider investigations, and let security teams write custom detections and policies for organization-specific risks. One extension, one deployment, ",{"data":9824,"content":9825,"nodeType":883},{"uri":5717},[9826],{"data":9827,"marks":9828,"value":9829,"nodeType":864},{},[],"multiple high-value use cases",{"data":9831,"marks":9832,"value":2924,"nodeType":864},{},[],{"data":9834,"content":9835,"nodeType":1312},{},[9836],{"data":9837,"marks":9838,"value":9840,"nodeType":864},{},[9839],{"type":899},"Push is built to be operationalized at scale, not just demoed",{"data":9842,"content":9843,"nodeType":860},{},[9844,9848,9855],{"data":9845,"marks":9846,"value":9847,"nodeType":864},{},[],"Push deploys to ",{"data":9849,"content":9850,"nodeType":883},{"uri":5827},[9851],{"data":9852,"marks":9853,"value":9854,"nodeType":864},{},[],"100,000 users in under one hour on a normal workday",{"data":9856,"marks":9857,"value":9858,"nodeType":864},{},[]," — no migration overhead or performance impact. The false positive rate is negligible, meaning no alert noise and no policy tuning overhead. And because Push is independent, it integrates into open ecosystems — feeding browser-layer telemetry into your SIEM, XDR, SOAR, and identity tools alongside the rest of your stack, without adding to your platform lock-in.",{"data":9860,"content":9861,"nodeType":1005},{},[],{"data":9863,"content":9864,"nodeType":1009},{},[9865],{"data":9866,"marks":9867,"value":9869,"nodeType":864},{},[9868],{"type":899},"Final thoughts",{"data":9871,"content":9872,"nodeType":860},{},[9873],{"data":9874,"marks":9875,"value":9876,"nodeType":864},{},[],"Three acquisitions in five months is a strong market signal, but a strong market signal about vendor interest in a category is not the same thing as a strong signal about capability. The attacker techniques and tooling behind breaches in 2026 are evolving faster than any acquired product with split engineering priorities can reasonably track. ",{"data":9878,"content":9879,"nodeType":860},{},[9880],{"data":9881,"marks":9882,"value":9883,"nodeType":864},{},[],"Security buyers who accept a bundled browser solution because it is included in an existing contract are making a procurement decision, not a security decision. The threats in the browser are serious and sophisticated enough to justify the investment in a tool built to stop them. If you agree, Push is worth a serious look.",{"data":9885,"content":9886,"nodeType":860},{},[9887,9890,9897],{"data":9888,"marks":9889,"value":21,"nodeType":864},{},[],{"data":9891,"content":9892,"nodeType":883},{"uri":1700},[9893],{"data":9894,"marks":9895,"value":1703,"nodeType":864},{},[9896],{"type":1455},{"data":9898,"marks":9899,"value":21,"nodeType":864},{},[],"Why \"good enough\" isn’t enough: the case for best-of-breed browser security","Why \"good enough\" isn’t enough when it comes to browser security, and a best-of-breed approach is needed to tackle emerging threats.","2026-05-19T00:00:00.000Z","the-case-for-best-of-breed-browser-security",{"items":9905},[9906,9908],{"sys":9907,"name":297},{"id":2732},{"sys":9909,"name":7555},{"id":7554},{"items":9911},[9912],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":9913},{"url":4881},{"__typename":2059,"sys":9915,"content":9917,"title":10683,"synopsis":10684,"hashTags":59,"publishedDate":10685,"slug":10686,"tagsCollection":10687,"authorsCollection":10693},{"id":9916},"2V130uMePtxAaefYQAKInb",{"json":9918},{"data":9919,"content":9920,"nodeType":856},{},[9921,9927,9934,9941,9948,9951,9959,9966,9978,9990,9996,10003,10006,10014,10021,10027,10034,10041,10149,10156,10159,10167,10174,10237,10253,10259,10266,10269,10277,10284,10292,10299,10306,10337,10344,10352,10359,10366,10373,10381,10388,10395,10402,10405,10413,10425,10432,10439,10447,10454,10461,10469,10476,10539,10555,10573,10581,10588,10596,10603,10610,10617,10623,10631,10638,10645,10650,10657,10664,10671,10677],{"data":9922,"content":9926,"nodeType":996},{"target":9923},{"sys":9924},{"id":9925,"type":1001,"linkType":1002},"5CPZ96xixlhgh6oqQ2rfmO",[],{"data":9928,"content":9929,"nodeType":860},{},[9930],{"data":9931,"marks":9932,"value":9933,"nodeType":864},{},[],"When a security team evaluates browser security solutions, they're usually asking the right question: “How do we protect our users as they work in the browser?”",{"data":9935,"content":9936,"nodeType":860},{},[9937],{"data":9938,"marks":9939,"value":9940,"nodeType":864},{},[],"But the answer they get from many vendors is shaped by a fundamentally different threat model — one that treats the browser as a piece of software to be hardened against exploitation, rather than as the arena where your users’ identities get stolen.",{"data":9942,"content":9943,"nodeType":860},{},[9944],{"data":9945,"marks":9946,"value":9947,"nodeType":864},{},[],"This distinction has enormous consequences for your security posture and the return you can expect from your investment in a new solution.",{"data":9949,"content":9950,"nodeType":1005},{},[],{"data":9952,"content":9953,"nodeType":1009},{},[9954],{"data":9955,"marks":9956,"value":9958,"nodeType":864},{},[9957],{"type":899},"Two different problems, dressed the same",{"data":9960,"content":9961,"nodeType":860},{},[9962],{"data":9963,"marks":9964,"value":9965,"nodeType":864},{},[],"When it comes to protecting users as they work in the browser, security tools typically fall into one of two camps:",{"data":9967,"content":9968,"nodeType":860},{},[9969,9974],{"data":9970,"marks":9971,"value":9973,"nodeType":864},{},[9972],{"type":899},"The first camp:",{"data":9975,"marks":9976,"value":9977,"nodeType":864},{},[]," represented by solutions like Seraphic (now CrowdStrike) — is built around the threat of attacking the browser itself. The architecture is designed to scramble the browser’s JavaScript runtime and prevent exploits from detonating and breaking out of the browser sandbox. This is browser hardening: defending the browser as software against exploitation by attackers who want to compromise the underlying device.",{"data":9979,"content":9980,"nodeType":860},{},[9981,9986],{"data":9982,"marks":9983,"value":9985,"nodeType":864},{},[9984],{"type":899},"The second camp:",{"data":9987,"marks":9988,"value":9989,"nodeType":864},{},[]," and the one Push Security occupies uniquely, focuses on what happens inside the browser when a user is working normally. Phishing pages harvesting credentials. Session tokens being stolen. Malicious OAuth applications being granted access through social engineering. Adversary-in-the-middle proxies intercepting authentication flows. These attacks don't exploit the browser. They exploit the human — and now agents — using it via the browser's legitimate capabilities (think of it as LOTL, browser edition).",{"data":9991,"content":9995,"nodeType":996},{"target":9992},{"sys":9993},{"id":9994,"type":1001,"linkType":1002},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":9997,"content":9998,"nodeType":860},{},[9999],{"data":10000,"marks":10001,"value":10002,"nodeType":864},{},[],"The question for any security team evaluating this space: which of these threat models presents the greatest risks to my organization?",{"data":10004,"content":10005,"nodeType":1005},{},[],{"data":10007,"content":10008,"nodeType":1009},{},[10009],{"data":10010,"marks":10011,"value":10013,"nodeType":864},{},[10012],{"type":899},"How organizations are actually being breached",{"data":10015,"content":10016,"nodeType":860},{},[10017],{"data":10018,"marks":10019,"value":10020,"nodeType":864},{},[],"Let's look at the major breach campaigns of the last three years without the marketing filter and a pattern emerges immediately. Scattered Spider and its successors breached MGM Resorts, Caesars, M&S, JLR, and Salesforce customers — not through browser exploits, but through social engineering, phishing and Adversary-in-the-Middle attacks that stole session tokens and SSO credentials. ",{"data":10022,"content":10026,"nodeType":996},{"target":10023},{"sys":10024},{"id":10025,"type":1001,"linkType":1002},"2qIMTiyyIsQFAyGJ9Ikyej",[],{"data":10028,"content":10029,"nodeType":860},{},[10030],{"data":10031,"marks":10032,"value":10033,"nodeType":864},{},[],"In every case, the attack happened in the browser — using stolen identities to log into legitimate cloud services — not on the browser through exploitation of the browser engine itself.",{"data":10035,"content":10036,"nodeType":860},{},[10037],{"data":10038,"marks":10039,"value":10040,"nodeType":864},{},[],"The data from major threat intelligence sources is unambiguous:",{"data":10042,"content":10043,"nodeType":941},{},[10044,10062,10081,10100,10119,10134],{"data":10045,"content":10046,"nodeType":945},{},[10047],{"data":10048,"content":10049,"nodeType":860},{},[10050,10054,10058],{"data":10051,"marks":10052,"value":10053,"nodeType":864},{},[],"Identity weaknesses played a material role in ",{"data":10055,"marks":10056,"value":9443,"nodeType":864},{},[10057],{"type":899},{"data":10059,"marks":10060,"value":10061,"nodeType":864},{},[]," (Palo Alto Networks Unit 42 IR Report)",{"data":10063,"content":10064,"nodeType":945},{},[10065],{"data":10066,"content":10067,"nodeType":860},{},[10068,10072,10077],{"data":10069,"marks":10070,"value":10071,"nodeType":864},{},[],"Credential abuse and phishing combined accounted for ",{"data":10073,"marks":10074,"value":10076,"nodeType":864},{},[10075],{"type":899},"38% of all breaches",{"data":10078,"marks":10079,"value":10080,"nodeType":864},{},[],", making identity the single largest breach vector (Verizon DBIR 2025)",{"data":10082,"content":10083,"nodeType":945},{},[10084],{"data":10085,"content":10086,"nodeType":860},{},[10087,10091,10096],{"data":10088,"marks":10089,"value":10090,"nodeType":864},{},[],"Cloud-conscious intrusions — attackers using stolen identities to access cloud services — rose ",{"data":10092,"marks":10093,"value":10095,"nodeType":864},{},[10094],{"type":899},"37% in 2025",{"data":10097,"marks":10098,"value":10099,"nodeType":864},{},[],", up 266% among state-nexus actors (CrowdStrike 2026 Global Threat Report)",{"data":10101,"content":10102,"nodeType":945},{},[10103],{"data":10104,"content":10105,"nodeType":860},{},[10106,10110,10115],{"data":10107,"marks":10108,"value":10109,"nodeType":864},{},[],"In cloud-related incidents, identity issues drove initial access in ",{"data":10111,"marks":10112,"value":10114,"nodeType":864},{},[10113],{"type":899},"83% of cases",{"data":10116,"marks":10117,"value":10118,"nodeType":864},{},[]," (Mandiant / Google Cloud Threat Horizons H1 2026)",{"data":10120,"content":10121,"nodeType":945},{},[10122],{"data":10123,"content":10124,"nodeType":860},{},[10125,10130],{"data":10126,"marks":10127,"value":10129,"nodeType":864},{},[10128],{"type":899},"82% of attack detections are now malware-free",{"data":10131,"marks":10132,"value":10133,"nodeType":864},{},[]," — they don't touch the endpoint and abuse legitimate access and functionality (CrowdStrike 2026 Global Threat Report)",{"data":10135,"content":10136,"nodeType":945},{},[10137],{"data":10138,"content":10139,"nodeType":860},{},[10140,10145],{"data":10141,"marks":10142,"value":10144,"nodeType":864},{},[10143],{"type":899},"49% of organizations",{"data":10146,"marks":10147,"value":10148,"nodeType":864},{},[]," suffered a successful browser-based attack in the last 12 months (Omdia 2026)",{"data":10150,"content":10151,"nodeType":860},{},[10152],{"data":10153,"marks":10154,"value":10155,"nodeType":864},{},[],"These aren't edge cases. This is now the primary attack playbook.",{"data":10157,"content":10158,"nodeType":1005},{},[],{"data":10160,"content":10161,"nodeType":1312},{},[10162],{"data":10163,"marks":10164,"value":10166,"nodeType":864},{},[10165],{"type":899},"The economics of attack choice",{"data":10168,"content":10169,"nodeType":860},{},[10170],{"data":10171,"marks":10172,"value":10173,"nodeType":864},{},[],"Attackers are rational actors. They pick the cheapest, most reliable path to their objective. The economics of browser exploitation versus identity theft tell the whole story:",{"data":10175,"content":10176,"nodeType":941},{},[10177,10192,10207,10222],{"data":10178,"content":10179,"nodeType":945},{},[10180],{"data":10181,"content":10182,"nodeType":860},{},[10183,10187],{"data":10184,"marks":10185,"value":10186,"nodeType":864},{},[],"Chrome sandbox RCE exploit (bug bounty value): ",{"data":10188,"marks":10189,"value":10191,"nodeType":864},{},[10190],{"type":899},"$250,000",{"data":10193,"content":10194,"nodeType":945},{},[10195],{"data":10196,"content":10197,"nodeType":860},{},[10198,10202],{"data":10199,"marks":10200,"value":10201,"nodeType":864},{},[],"IAB-provided IdP admin account: ",{"data":10203,"marks":10204,"value":10206,"nodeType":864},{},[10205],{"type":899},"~$3,000",{"data":10208,"content":10209,"nodeType":945},{},[10210],{"data":10211,"content":10212,"nodeType":860},{},[10213,10217],{"data":10214,"marks":10215,"value":10216,"nodeType":864},{},[],"1-year phishing kit rental (PhaaS): ",{"data":10218,"marks":10219,"value":10221,"nodeType":864},{},[10220],{"type":899},"~$1,000",{"data":10223,"content":10224,"nodeType":945},{},[10225],{"data":10226,"content":10227,"nodeType":860},{},[10228,10232],{"data":10229,"marks":10230,"value":10231,"nodeType":864},{},[],"Bulk stolen credential list: ",{"data":10233,"marks":10234,"value":10236,"nodeType":864},{},[10235],{"type":899},"~$15",{"data":10238,"content":10239,"nodeType":860},{},[10240,10244,10249],{"data":10241,"marks":10242,"value":10243,"nodeType":864},{},[],"Browser zero-days accounted for just ",{"data":10245,"marks":10246,"value":10248,"nodeType":864},{},[10247],{"type":899},"9% of all zero-days reported to Google in 2025",{"data":10250,"marks":10251,"value":10252,"nodeType":864},{},[]," — described by Google's own researchers as a \"historic low.\" Chrome's sandbox architecture, site isolation, and hardware-backed security features are the result of years of sustained hardening investment. When a browser vulnerability is discovered, Google typically deploys a patch within days.",{"data":10254,"content":10258,"nodeType":996},{"target":10255},{"sys":10256},{"id":10257,"type":1001,"linkType":1002},"5XWKHTT5J06yWcgZIOL95t",[],{"data":10260,"content":10261,"nodeType":860},{},[10262],{"data":10263,"marks":10264,"value":10265,"nodeType":864},{},[],"The bottom line: browser exploits are extraordinarily expensive to develop, increasingly difficult to execute reliably against a hardened modern browser, and patched rapidly when discovered. In sharp contrast, identity attacks are cheap to run, highly scalable, and have a low technical barrier to adoption — that’s why they’re responsible for the overwhelming majority of enterprise breaches. Attackers have voted with their resources.",{"data":10267,"content":10268,"nodeType":1005},{},[],{"data":10270,"content":10271,"nodeType":1009},{},[10272],{"data":10273,"marks":10274,"value":10276,"nodeType":864},{},[10275],{"type":899},"What you're actually buying with each vendor",{"data":10278,"content":10279,"nodeType":860},{},[10280],{"data":10281,"marks":10282,"value":10283,"nodeType":864},{},[],"Understanding the core architectural choice each vendor has made helps decode what their solution can and cannot protect you from.",{"data":10285,"content":10286,"nodeType":1312},{},[10287],{"data":10288,"marks":10289,"value":10291,"nodeType":864},{},[10290],{"type":899},"Seraphic (CrowdStrike)",{"data":10293,"content":10294,"nodeType":860},{},[10295],{"data":10296,"marks":10297,"value":10298,"nodeType":864},{},[],"Seraphic's architecture is built to inject into the browser's JavaScript runtime at the OS layer, scrambling browser internals to prevent exploits from executing. This is a technically sophisticated approach to a technically interesting problem that is, by every threat intelligence measure, not the problem causing enterprise breaches at scale.",{"data":10300,"content":10301,"nodeType":860},{},[10302],{"data":10303,"marks":10304,"value":10305,"nodeType":864},{},[],"Beyond the threat model mismatch, there are structural concerns with the approach itself. Injecting an agent into the browser's JS runtime is a technique with well-documented stability consequences. This is the same approach antivirus vendors have used for years, often at the cost of system stability. Seraphic now runs alongside the CrowdStrike Falcon sensor on managed devices, combining two heavyweight agents on the same machine. For any organization with CrowdStrike already deployed, the question isn't theoretical: how has that combination been validated in production environments?",{"data":10307,"content":10308,"nodeType":860},{},[10309,10313,10320,10324,10333],{"data":10310,"marks":10311,"value":10312,"nodeType":864},{},[],"There's also the managed-device limitation. Seraphic requires a kernel-level agent, which means it loses meaningful capability on unmanaged devices, BYOD machines, and contractor endpoints. This is not a niche concern: according to ",{"data":10314,"content":10315,"nodeType":883},{"uri":2561},[10316],{"data":10317,"marks":10318,"value":10319,"nodeType":864},{},[],"Omdia's 2026 browser security survey",{"data":10321,"marks":10322,"value":10323,"nodeType":864},{},[],", 32% of users access corporate applications from unmanaged devices at least occasionally. Agent-based solutions are blind to nearly a third of your actual attack surface by design. The Okta breach began on a support engineer's personal device, where ",{"data":10325,"content":10327,"nodeType":883},{"uri":10326},"https://pushsecurity.com/blog/browser-sync-attacks-where-personal-account-hacks-lead-to-corporate-breaches/",[10328],{"data":10329,"marks":10330,"value":10332,"nodeType":864},{},[10331],{"type":1455},"corporate credentials had synced",{"data":10334,"marks":10335,"value":10336,"nodeType":864},{},[]," via Chrome's built-in profile sync. No agent, no visibility.",{"data":10338,"content":10339,"nodeType":860},{},[10340],{"data":10341,"marks":10342,"value":10343,"nodeType":864},{},[],"Teams evaluating Seraphic today are also buying into an integration roadmap, not a shipped capability. The acquisition by CrowdStrike closed in early 2026. The work of wiring browser telemetry into Falcon Fusion and correlating it with endpoint signals is currently a promise, not a production feature.",{"data":10345,"content":10346,"nodeType":1312},{},[10347],{"data":10348,"marks":10349,"value":10351,"nodeType":864},{},[10350],{"type":899},"SquareX (Zscaler)",{"data":10353,"content":10354,"nodeType":860},{},[10355],{"data":10356,"marks":10357,"value":10358,"nodeType":864},{},[],"SquareX's core capability is sandboxing suspicious file downloads inside disposable browser containers before they reach the endpoint. This is a legitimate approach to a real but declining problem. 82% of attack detections are now malware-free (CrowdStrike 2026 Global Threat Report) — attacks don't arrive as files to be sandboxed, they arrive as authenticated sessions. And the delivery channel shift makes the picture even starker: across Push's customer base, 1 in 3 phishing payloads are now delivered outside of email entirely — via social media, ads, and messaging platforms — and 4 in 5 ClickFix payloads arrive through search engines, not email. The threat that SquareX was architecturally designed to address is a shrinking share of the actual attack surface, and it's shrinking fast.",{"data":10360,"content":10361,"nodeType":860},{},[10362],{"data":10363,"marks":10364,"value":10365,"nodeType":864},{},[],"Zscaler already has sandboxing built into ZIA. For an existing Zscaler customer evaluating SquareX, the honest question is: what does this add beyond some extension analysis capability and what you already have? The AiTM phishing campaign that stole your user's credentials and accessed your cloud applications generates no malicious file, triggers no sandbox, and produces no network signal for Zscaler's traffic inspection to catch — because it happened entirely inside a browser session using legitimate authentication flows.",{"data":10367,"content":10368,"nodeType":860},{},[10369],{"data":10370,"marks":10371,"value":10372,"nodeType":864},{},[],"The acquisition also raises product focus questions. Being absorbed into a network-centric platform means SquareX is now optimized for Zscaler's priorities, not for standalone browser detection and response. Teams that care about investigation, threat hunting, and incident response should ask specifically what SquareX adds in those workflows under Zscaler ownership.",{"data":10374,"content":10375,"nodeType":1312},{},[10376],{"data":10377,"marks":10378,"value":10380,"nodeType":864},{},[10379],{"type":899},"LayerX",{"data":10382,"content":10383,"nodeType":860},{},[10384],{"data":10385,"marks":10386,"value":10387,"nodeType":864},{},[],"LayerX is primarily a policy enforcement and risk scoring platform focused on internal governance — controlling which applications employees access, what data moves through the browser, and whether behavior complies with internal rules.",{"data":10389,"content":10390,"nodeType":860},{},[10391],{"data":10392,"marks":10393,"value":10394,"nodeType":864},{},[],"Push Security covers that ground too. Push provides full visibility over AI tool usage, shadow SaaS, unmanaged identities, and data loss vectors — including sensitive data submitted through AI prompts, file uploads to personal cloud destinations, and OAuth grants to third-party applications. The same browser telemetry that detects external attacks also surfaces insider risks and powers DLP controls and compliance audit evidence, all from a single extension.",{"data":10396,"content":10397,"nodeType":860},{},[10398],{"data":10399,"marks":10400,"value":10401,"nodeType":864},{},[],"The critical difference is that Push goes significantly further. Where LayerX scores risk and enforces policy, Push detects active external attack techniques in real time: AiTM phishing kits as they execute, session tokens being stolen, ClickFix lures through behavioral analysis of page structure. These are the attacks causing the most damaging breaches today, and they don't surface on a risk score until after the damage is done. Push addresses both the governance problem and the external threat problem from the same platform. LayerX addresses only the first.",{"data":10403,"content":10404,"nodeType":1005},{},[],{"data":10406,"content":10407,"nodeType":1009},{},[10408],{"data":10409,"marks":10410,"value":10412,"nodeType":864},{},[10411],{"type":899},"Securing the organization via the browser: Push Security",{"data":10414,"content":10415,"nodeType":860},{},[10416,10421],{"data":10417,"marks":10418,"value":10420,"nodeType":864},{},[10419],{"type":899},"Push Security is built on a different architectural premise:",{"data":10422,"marks":10423,"value":10424,"nodeType":864},{},[]," the browser is not primarily a piece of software to harden against exploitation. It is the primary workplace, the primary SaaS access point, and the arena where the majority of modern identity attacks play out. The goal is to secure the organization via the browser — not just to secure the browser itself.",{"data":10426,"content":10427,"nodeType":860},{},[10428],{"data":10429,"marks":10430,"value":10431,"nodeType":864},{},[],"This means Push's detection surface is built around the attacks that are actually causing breaches: adversary-in-the-middle phishing, ClickFix and its many variants, credential stuffing against shadow identities, session token theft and replay, OAuth consent abuse, and the full spectrum of identity-based initial access techniques that dominate the modern threat landscape.",{"data":10433,"content":10434,"nodeType":860},{},[10435],{"data":10436,"marks":10437,"value":10438,"nodeType":864},{},[],"The deployment model reflects the threat model. Push deploys as a lightweight browser extension — no kernel-level agent, no device dependency, no migration to a new browser. It works on managed and unmanaged devices, across every traditional, enterprise and AI browser where employees are doing work and attackers are targeting them. The operational overhead is minimal by design: Push has been deployed to 100,000 users in under one hour during normal business hours.",{"data":10440,"content":10441,"nodeType":1312},{},[10442],{"data":10443,"marks":10444,"value":10446,"nodeType":864},{},[10445],{"type":899},"Detection philosophy: targeting what attackers can't change",{"data":10448,"content":10449,"nodeType":860},{},[10450],{"data":10451,"marks":10452,"value":10453,"nodeType":864},{},[],"Push's detection approach targets attacker TTPs rather than indicators of compromise that attackers can rotate in minutes. 95% of attacks detected by Push used some form of bot protection service — meaning the specific domain and IP were deliberately obscured. If your primary detection relies on blocklists, recent reports tell us that 89% of phishing domains will evade you: because they're active for less than two days, they can be spun up, down, and replaced faster than blocklists can keep up.",{"data":10455,"content":10456,"nodeType":860},{},[10457],{"data":10458,"marks":10459,"value":10460,"nodeType":864},{},[],"Behavioral detection of the attack technique — the AiTM relay structure, the credential entry on a cloned login page, the anomalous session context — remains valid regardless of what domain the attack is hosted on or which PhaaS kit was used to build it.",{"data":10462,"content":10463,"nodeType":1312},{},[10464],{"data":10465,"marks":10466,"value":10468,"nodeType":864},{},[10467],{"type":899},"Measuring the identity attack surface (it's bigger than you realize)",{"data":10470,"content":10471,"nodeType":860},{},[10472],{"data":10473,"marks":10474,"value":10475,"nodeType":864},{},[],"Because Push has visibility into actual login behavior across thousands of organizations, it can quantify the attack surface that identity-based attacks exploit. Of the last million logins observed by Push:",{"data":10477,"content":10478,"nodeType":941},{},[10479,10494,10509,10524],{"data":10480,"content":10481,"nodeType":945},{},[10482],{"data":10483,"content":10484,"nodeType":860},{},[10485,10490],{"data":10486,"marks":10487,"value":10489,"nodeType":864},{},[10488],{"type":899},"15 corporate identities were identified per employee",{"data":10491,"marks":10492,"value":10493,"nodeType":864},{},[]," used to access cloud apps",{"data":10495,"content":10496,"nodeType":945},{},[10497],{"data":10498,"content":10499,"nodeType":860},{},[10500,10505],{"data":10501,"marks":10502,"value":10504,"nodeType":864},{},[10503],{"type":899},"1 in 4",{"data":10506,"marks":10507,"value":10508,"nodeType":864},{},[]," were password logins, not SSO",{"data":10510,"content":10511,"nodeType":945},{},[10512],{"data":10513,"content":10514,"nodeType":860},{},[10515,10520],{"data":10516,"marks":10517,"value":10519,"nodeType":864},{},[10518],{"type":899},"2 in 5",{"data":10521,"marks":10522,"value":10523,"nodeType":864},{},[]," were not protected by MFA",{"data":10525,"content":10526,"nodeType":945},{},[10527],{"data":10528,"content":10529,"nodeType":860},{},[10530,10535],{"data":10531,"marks":10532,"value":10534,"nodeType":864},{},[10533],{"type":899},"1 in 5",{"data":10536,"marks":10537,"value":10538,"nodeType":864},{},[]," used a weak, breached, or reused password",{"data":10540,"content":10541,"nodeType":860},{},[10542,10546,10551],{"data":10543,"marks":10544,"value":10545,"nodeType":864},{},[],"And it's not just login hygiene. Across Push's customer base, ",{"data":10547,"marks":10548,"value":10550,"nodeType":864},{},[10549],{"type":899},"46%+ of browser extensions in corporate environments have the permission combinations required for direct account takeover via session theft if they are malicious or compromised by an attacker",{"data":10552,"marks":10553,"value":10554,"nodeType":864},{},[],". Most organizations have no inventory of what's running in their employees' browsers, let alone visibility into what those extensions can access.",{"data":10556,"content":10557,"nodeType":860},{},[10558,10562,10569],{"data":10559,"marks":10560,"value":10561,"nodeType":864},{},[],"These aren't theoretical vulnerabilities. They're the specific weaknesses that browser-native identity attacks are designed to exploit. ",{"data":10563,"content":10564,"nodeType":883},{"uri":3210},[10565],{"data":10566,"marks":10567,"value":10568,"nodeType":864},{},[],"This visibility turns browser security from a reactive posture into a proactive one",{"data":10570,"marks":10571,"value":10572,"nodeType":864},{},[]," — you can see and remediate the identity weaknesses before an attacker exploits them, not just detect the attack while it's in progress.",{"data":10574,"content":10575,"nodeType":1312},{},[10576],{"data":10577,"marks":10578,"value":10580,"nodeType":864},{},[10579],{"type":899},"The ROI case",{"data":10582,"content":10583,"nodeType":860},{},[10584],{"data":10585,"marks":10586,"value":10587,"nodeType":864},{},[],"The ROI question for any security investment is: what quantum of real risk does this tool address, at what cost in money and operational friction?",{"data":10589,"content":10590,"nodeType":860},{},[10591],{"data":10592,"marks":10593,"value":10595,"nodeType":864},{},[10594],{"type":899},"That calculation looks very different depending on your threat model.",{"data":10597,"content":10598,"nodeType":860},{},[10599],{"data":10600,"marks":10601,"value":10602,"nodeType":864},{},[],"A solution focused on browser engine exploits and sandbox escapes is defending against an attack category that represents a tiny fraction of actual enterprise breaches, requires extraordinary attacker resources to execute, and is increasingly mitigated by browser vendors themselves through hardening and rapid patching. Chrome's automatic update cycle means that even when a browser vulnerability is discovered and disclosed, it is typically in front of users as a patch within days. The defenders here are Google, Mozilla, and Microsoft — with multi-billion dollar security teams and full access to the browser internals.",{"data":10604,"content":10605,"nodeType":860},{},[10606],{"data":10607,"marks":10608,"value":10609,"nodeType":864},{},[],"A solution focused on identity attacks via the browser — phishing, credential theft, session hijacking, OAuth abuse, malicious browser extensions — is defending against the primary cause of enterprise breaches, one that is accelerating (cloud-conscious intrusions up 37% in 2025, browser-based attacks increasing at 68% of organizations over the past two years per Omdia) and increasingly automated through PhaaS infrastructure that gives low-skill attackers enterprise-grade capability for $1,000 a year.",{"data":10611,"content":10612,"nodeType":860},{},[10613],{"data":10614,"marks":10615,"value":10616,"nodeType":864},{},[],"There's also a forward-looking dimension. The threat landscape isn't moving toward more browser exploitation. It's moving further into identity abuse. AI-powered phishing lowers the social engineering barrier. Agentic browsers will automate credential stuffing and account takeover at a scale that wasn't previously possible. And attackers are already adapting to authentication improvements: device code phishing has increased 37x since the start of 2026, a technique specifically designed to circumvent passkeys by bypassing the authentication flow entirely — the attacker never encounters a login page. The investment in identity-centric browser detection compounds over time as the attack surface evolves in the same direction.",{"data":10618,"content":10622,"nodeType":996},{"target":10619},{"sys":10620},{"id":10621,"type":1001,"linkType":1002},"cQ6WPV2NMYvDMZXifqzK1",[],{"data":10624,"content":10625,"nodeType":1312},{},[10626],{"data":10627,"marks":10628,"value":10630,"nodeType":864},{},[10629],{"type":899},"The verdict",{"data":10632,"content":10633,"nodeType":860},{},[10634],{"data":10635,"marks":10636,"value":10637,"nodeType":864},{},[],"Browser security is a real and growing priority — according to Omdia Research, it is now a top-five priority for 88% of security leaders and the top priority for 26% of them. 85% expect their browser security spending to increase over the next 12–24 months. The question isn't whether to invest. It's what to invest in.",{"data":10639,"content":10640,"nodeType":860},{},[10641],{"data":10642,"marks":10643,"value":10644,"nodeType":864},{},[],"The browser is where your users work, where attackers target them, and where the identity attacks causing the majority of enterprise breaches play out. But not all browser security investments address the same problem.",{"data":10646,"content":10649,"nodeType":996},{"target":10647},{"sys":10648},{"id":6621,"type":1001,"linkType":1002},[],{"data":10651,"content":10652,"nodeType":860},{},[10653],{"data":10654,"marks":10655,"value":10656,"nodeType":864},{},[],"Solutions like Seraphic are built to defend against a browser being exploited by an attacker trying to break out of the sandbox — an attack that represents a historic low as a share of enterprise incidents, and one that Google's own hardening and rapid patching increasingly mitigates automatically. SquareX is built around malware sandboxing — a legitimate but declining share of the initial access landscape, and a capability Zscaler's existing customers already partially have. LayerX focuses on internal governance rather than external threats.",{"data":10658,"content":10659,"nodeType":860},{},[10660],{"data":10661,"marks":10662,"value":10663,"nodeType":864},{},[],"Push Security is built to defend against the attacks that are behind the major breaches hitting the headlines: identity theft, credential abuse, session hijacking, and the full identity attack kill chain that plays out inside the browser every time an attacker logs in as your user. Every major threat intelligence report points to these as the primary breach vectors. The economics of attack choice guarantee they'll remain so.",{"data":10665,"content":10666,"nodeType":860},{},[10667],{"data":10668,"marks":10669,"value":10670,"nodeType":864},{},[],"The security team that deploys Push gets the greatest coverage of the highest-impact threats, on managed and unmanaged devices, with the lightest operational footprint. That is the browser security investment that moves the needle on real organizational risk — not the browser security investment that defends the software nobody's actually attacking.",{"data":10672,"content":10676,"nodeType":996},{"target":10673},{"sys":10674},{"id":10675,"type":1001,"linkType":1002},"3a2sEWgWKZulGLCFfODwk0",[],{"data":10678,"content":10679,"nodeType":860},{},[10680],{"data":10681,"marks":10682,"value":21,"nodeType":864},{},[],"How to avoid the browser security buyer's trap","Securing the browser vs. securing the organization via the browser — what's the difference?","2026-05-13T00:00:00.000Z","how-to-avoid-the-browser-security-buyers-trap",{"items":10688},[10689,10691],{"sys":10690,"name":297},{"id":2732},{"sys":10692,"name":2729},{"id":2728},{"items":10694},[10695],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":10696},{"url":4881},{"__typename":2059,"sys":10698,"content":10699,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":11768,"authorsCollection":11774},{"id":3628},{"json":10700},{"data":10701,"content":10702,"nodeType":856},{},[10703,10716,10721,10727,10733,10738,10741,10748,10755,10770,10808,10813,10826,10829,10836,10843,10865,10897,10903,10906,10913,10920,10926,10931,10937,10940,10947,10954,10988,11018,11024,11027,11034,11041,11061,11067,11106,11112,11115,11122,11129,11165,11171,11176,11179,11186,11193,11219,11225,11230,11236,11239,11246,11253,11276,11282,11288,11294,11297,11304,11311,11317,11322,11328,11349,11372,11375,11382,11389,11395,11401,11404,11411,11466,11469,11476,11482,11750,11753],{"data":10704,"content":10705,"nodeType":860},{},[10706,10709,10713],{"data":10707,"marks":10708,"value":3639,"nodeType":864},{},[],{"data":10710,"marks":10711,"value":3644,"nodeType":864},{},[10712],{"type":899},{"data":10714,"marks":10715,"value":3648,"nodeType":864},{},[],{"data":10717,"content":10720,"nodeType":996},{"target":10718},{"sys":10719},{"id":3653,"type":1001,"linkType":1002},[],{"data":10722,"content":10723,"nodeType":860},{},[10724],{"data":10725,"marks":10726,"value":3661,"nodeType":864},{},[],{"data":10728,"content":10729,"nodeType":860},{},[10730],{"data":10731,"marks":10732,"value":3668,"nodeType":864},{},[],{"data":10734,"content":10737,"nodeType":996},{"target":10735},{"sys":10736},{"id":3673,"type":1001,"linkType":1002},[],{"data":10739,"content":10740,"nodeType":1005},{},[],{"data":10742,"content":10743,"nodeType":1009},{},[10744],{"data":10745,"marks":10746,"value":3685,"nodeType":864},{},[10747],{"type":899},{"data":10749,"content":10750,"nodeType":860},{},[10751],{"data":10752,"marks":10753,"value":3693,"nodeType":864},{},[10754],{"type":899},{"data":10756,"content":10757,"nodeType":860},{},[10758,10761,10767],{"data":10759,"marks":10760,"value":3700,"nodeType":864},{},[],{"data":10762,"content":10763,"nodeType":883},{"uri":3703},[10764],{"data":10765,"marks":10766,"value":3708,"nodeType":864},{},[],{"data":10768,"marks":10769,"value":3712,"nodeType":864},{},[],{"data":10771,"content":10772,"nodeType":860},{},[10773,10776,10782,10785,10789,10792,10796,10799,10805],{"data":10774,"marks":10775,"value":3719,"nodeType":864},{},[],{"data":10777,"content":10778,"nodeType":883},{"uri":3722},[10779],{"data":10780,"marks":10781,"value":3727,"nodeType":864},{},[],{"data":10783,"marks":10784,"value":3731,"nodeType":864},{},[],{"data":10786,"marks":10787,"value":3736,"nodeType":864},{},[10788],{"type":899},{"data":10790,"marks":10791,"value":2232,"nodeType":864},{},[],{"data":10793,"marks":10794,"value":3744,"nodeType":864},{},[10795],{"type":899},{"data":10797,"marks":10798,"value":3748,"nodeType":864},{},[],{"data":10800,"content":10801,"nodeType":883},{"uri":3751},[10802],{"data":10803,"marks":10804,"value":3756,"nodeType":864},{},[],{"data":10806,"marks":10807,"value":3760,"nodeType":864},{},[],{"data":10809,"content":10812,"nodeType":996},{"target":10810},{"sys":10811},{"id":3765,"type":1001,"linkType":1002},[],{"data":10814,"content":10815,"nodeType":860},{},[10816,10819,10823],{"data":10817,"marks":10818,"value":3773,"nodeType":864},{},[],{"data":10820,"marks":10821,"value":3778,"nodeType":864},{},[10822],{"type":899},{"data":10824,"marks":10825,"value":2924,"nodeType":864},{},[],{"data":10827,"content":10828,"nodeType":1005},{},[],{"data":10830,"content":10831,"nodeType":1009},{},[10832],{"data":10833,"marks":10834,"value":3792,"nodeType":864},{},[10835],{"type":899},{"data":10837,"content":10838,"nodeType":860},{},[10839],{"data":10840,"marks":10841,"value":3693,"nodeType":864},{},[10842],{"type":899},{"data":10844,"content":10845,"nodeType":860},{},[10846,10849,10855,10858,10862],{"data":10847,"marks":10848,"value":3806,"nodeType":864},{},[],{"data":10850,"content":10851,"nodeType":883},{"uri":3809},[10852],{"data":10853,"marks":10854,"value":3814,"nodeType":864},{},[],{"data":10856,"marks":10857,"value":3818,"nodeType":864},{},[],{"data":10859,"marks":10860,"value":3823,"nodeType":864},{},[10861],{"type":899},{"data":10863,"marks":10864,"value":3827,"nodeType":864},{},[],{"data":10866,"content":10867,"nodeType":860},{},[10868,10871,10877,10880,10884,10887,10894],{"data":10869,"marks":10870,"value":3834,"nodeType":864},{},[],{"data":10872,"content":10873,"nodeType":883},{"uri":3837},[10874],{"data":10875,"marks":10876,"value":3842,"nodeType":864},{},[],{"data":10878,"marks":10879,"value":3846,"nodeType":864},{},[],{"data":10881,"marks":10882,"value":3851,"nodeType":864},{},[10883],{"type":899},{"data":10885,"marks":10886,"value":3855,"nodeType":864},{},[],{"data":10888,"content":10889,"nodeType":883},{"uri":3858},[10890],{"data":10891,"marks":10892,"value":3864,"nodeType":864},{},[10893],{"type":899},{"data":10895,"marks":10896,"value":3868,"nodeType":864},{},[],{"data":10898,"content":10899,"nodeType":860},{},[10900],{"data":10901,"marks":10902,"value":3875,"nodeType":864},{},[],{"data":10904,"content":10905,"nodeType":1005},{},[],{"data":10907,"content":10908,"nodeType":1009},{},[10909],{"data":10910,"marks":10911,"value":3886,"nodeType":864},{},[10912],{"type":899},{"data":10914,"content":10915,"nodeType":860},{},[10916],{"data":10917,"marks":10918,"value":3894,"nodeType":864},{},[10919],{"type":899},{"data":10921,"content":10922,"nodeType":860},{},[10923],{"data":10924,"marks":10925,"value":3901,"nodeType":864},{},[],{"data":10927,"content":10930,"nodeType":996},{"target":10928},{"sys":10929},{"id":3906,"type":1001,"linkType":1002},[],{"data":10932,"content":10933,"nodeType":860},{},[10934],{"data":10935,"marks":10936,"value":3914,"nodeType":864},{},[],{"data":10938,"content":10939,"nodeType":1005},{},[],{"data":10941,"content":10942,"nodeType":1009},{},[10943],{"data":10944,"marks":10945,"value":3925,"nodeType":864},{},[10946],{"type":899},{"data":10948,"content":10949,"nodeType":860},{},[10950],{"data":10951,"marks":10952,"value":3894,"nodeType":864},{},[10953],{"type":899},{"data":10955,"content":10956,"nodeType":860},{},[10957,10960,10967,10970,10976,10979,10985],{"data":10958,"marks":10959,"value":3939,"nodeType":864},{},[],{"data":10961,"content":10962,"nodeType":883},{"uri":3942},[10963],{"data":10964,"marks":10965,"value":3948,"nodeType":864},{},[10966],{"type":1455},{"data":10968,"marks":10969,"value":3731,"nodeType":864},{},[],{"data":10971,"content":10972,"nodeType":883},{"uri":3954},[10973],{"data":10974,"marks":10975,"value":3959,"nodeType":864},{},[],{"data":10977,"marks":10978,"value":3731,"nodeType":864},{},[],{"data":10980,"content":10981,"nodeType":883},{"uri":3965},[10982],{"data":10983,"marks":10984,"value":3970,"nodeType":864},{},[],{"data":10986,"marks":10987,"value":3974,"nodeType":864},{},[],{"data":10989,"content":10990,"nodeType":860},{},[10991,10994,11001,11004,11008,11011,11015],{"data":10992,"marks":10993,"value":21,"nodeType":864},{},[],{"data":10995,"content":10996,"nodeType":883},{"uri":2411},[10997],{"data":10998,"marks":10999,"value":3988,"nodeType":864},{},[11000],{"type":1455},{"data":11002,"marks":11003,"value":3992,"nodeType":864},{},[],{"data":11005,"marks":11006,"value":3997,"nodeType":864},{},[11007],{"type":899},{"data":11009,"marks":11010,"value":4001,"nodeType":864},{},[],{"data":11012,"marks":11013,"value":4006,"nodeType":864},{},[11014],{"type":2246},{"data":11016,"marks":11017,"value":4010,"nodeType":864},{},[],{"data":11019,"content":11020,"nodeType":860},{},[11021],{"data":11022,"marks":11023,"value":4017,"nodeType":864},{},[],{"data":11025,"content":11026,"nodeType":1005},{},[],{"data":11028,"content":11029,"nodeType":1009},{},[11030],{"data":11031,"marks":11032,"value":4028,"nodeType":864},{},[11033],{"type":899},{"data":11035,"content":11036,"nodeType":860},{},[11037],{"data":11038,"marks":11039,"value":3894,"nodeType":864},{},[11040],{"type":899},{"data":11042,"content":11043,"nodeType":860},{},[11044,11047,11051,11054,11058],{"data":11045,"marks":11046,"value":4042,"nodeType":864},{},[],{"data":11048,"marks":11049,"value":4047,"nodeType":864},{},[11050],{"type":2246},{"data":11052,"marks":11053,"value":4051,"nodeType":864},{},[],{"data":11055,"marks":11056,"value":4056,"nodeType":864},{},[11057],{"type":2246},{"data":11059,"marks":11060,"value":4060,"nodeType":864},{},[],{"data":11062,"content":11063,"nodeType":860},{},[11064],{"data":11065,"marks":11066,"value":4067,"nodeType":864},{},[],{"data":11068,"content":11069,"nodeType":941},{},[11070,11088],{"data":11071,"content":11072,"nodeType":945},{},[11073],{"data":11074,"content":11075,"nodeType":860},{},[11076,11079,11085],{"data":11077,"marks":11078,"value":2761,"nodeType":864},{},[],{"data":11080,"content":11081,"nodeType":883},{"uri":4082},[11082],{"data":11083,"marks":11084,"value":4087,"nodeType":864},{},[],{"data":11086,"marks":11087,"value":4091,"nodeType":864},{},[],{"data":11089,"content":11090,"nodeType":945},{},[11091],{"data":11092,"content":11093,"nodeType":860},{},[11094,11097,11103],{"data":11095,"marks":11096,"value":2761,"nodeType":864},{},[],{"data":11098,"content":11099,"nodeType":883},{"uri":4103},[11100],{"data":11101,"marks":11102,"value":4108,"nodeType":864},{},[],{"data":11104,"marks":11105,"value":4112,"nodeType":864},{},[],{"data":11107,"content":11108,"nodeType":860},{},[11109],{"data":11110,"marks":11111,"value":4119,"nodeType":864},{},[],{"data":11113,"content":11114,"nodeType":1005},{},[],{"data":11116,"content":11117,"nodeType":1009},{},[11118],{"data":11119,"marks":11120,"value":4130,"nodeType":864},{},[11121],{"type":899},{"data":11123,"content":11124,"nodeType":860},{},[11125],{"data":11126,"marks":11127,"value":4138,"nodeType":864},{},[11128],{"type":899},{"data":11130,"content":11131,"nodeType":860},{},[11132,11135,11139,11142,11148,11151,11155,11158,11162],{"data":11133,"marks":11134,"value":4145,"nodeType":864},{},[],{"data":11136,"marks":11137,"value":4150,"nodeType":864},{},[11138],{"type":899},{"data":11140,"marks":11141,"value":4154,"nodeType":864},{},[],{"data":11143,"content":11144,"nodeType":883},{"uri":3237},[11145],{"data":11146,"marks":11147,"value":4161,"nodeType":864},{},[],{"data":11149,"marks":11150,"value":4165,"nodeType":864},{},[],{"data":11152,"marks":11153,"value":4170,"nodeType":864},{},[11154],{"type":899},{"data":11156,"marks":11157,"value":4174,"nodeType":864},{},[],{"data":11159,"marks":11160,"value":4179,"nodeType":864},{},[11161],{"type":899},{"data":11163,"marks":11164,"value":4183,"nodeType":864},{},[],{"data":11166,"content":11167,"nodeType":860},{},[11168],{"data":11169,"marks":11170,"value":4190,"nodeType":864},{},[],{"data":11172,"content":11175,"nodeType":996},{"target":11173},{"sys":11174},{"id":4195,"type":1001,"linkType":1002},[],{"data":11177,"content":11178,"nodeType":1005},{},[],{"data":11180,"content":11181,"nodeType":1009},{},[11182],{"data":11183,"marks":11184,"value":4207,"nodeType":864},{},[11185],{"type":899},{"data":11187,"content":11188,"nodeType":860},{},[11189],{"data":11190,"marks":11191,"value":4215,"nodeType":864},{},[11192],{"type":899},{"data":11194,"content":11195,"nodeType":860},{},[11196,11199,11206,11209,11216],{"data":11197,"marks":11198,"value":4222,"nodeType":864},{},[],{"data":11200,"content":11201,"nodeType":883},{"uri":2561},[11202],{"data":11203,"marks":11204,"value":4230,"nodeType":864},{},[11205],{"type":899},{"data":11207,"marks":11208,"value":4234,"nodeType":864},{},[],{"data":11210,"content":11211,"nodeType":883},{"uri":4237},[11212],{"data":11213,"marks":11214,"value":4243,"nodeType":864},{},[11215],{"type":899},{"data":11217,"marks":11218,"value":4247,"nodeType":864},{},[],{"data":11220,"content":11221,"nodeType":860},{},[11222],{"data":11223,"marks":11224,"value":4254,"nodeType":864},{},[],{"data":11226,"content":11229,"nodeType":996},{"target":11227},{"sys":11228},{"id":4259,"type":1001,"linkType":1002},[],{"data":11231,"content":11232,"nodeType":860},{},[11233],{"data":11234,"marks":11235,"value":4267,"nodeType":864},{},[],{"data":11237,"content":11238,"nodeType":1005},{},[],{"data":11240,"content":11241,"nodeType":1009},{},[11242],{"data":11243,"marks":11244,"value":4278,"nodeType":864},{},[11245],{"type":899},{"data":11247,"content":11248,"nodeType":860},{},[11249],{"data":11250,"marks":11251,"value":4286,"nodeType":864},{},[11252],{"type":899},{"data":11254,"content":11255,"nodeType":860},{},[11256,11259,11263,11266,11273],{"data":11257,"marks":11258,"value":4293,"nodeType":864},{},[],{"data":11260,"marks":11261,"value":4298,"nodeType":864},{},[11262],{"type":2246},{"data":11264,"marks":11265,"value":4302,"nodeType":864},{},[],{"data":11267,"content":11268,"nodeType":883},{"uri":4305},[11269],{"data":11270,"marks":11271,"value":4311,"nodeType":864},{},[11272],{"type":899},{"data":11274,"marks":11275,"value":4315,"nodeType":864},{},[],{"data":11277,"content":11278,"nodeType":860},{},[11279],{"data":11280,"marks":11281,"value":4322,"nodeType":864},{},[],{"data":11283,"content":11284,"nodeType":860},{},[11285],{"data":11286,"marks":11287,"value":4329,"nodeType":864},{},[],{"data":11289,"content":11290,"nodeType":860},{},[11291],{"data":11292,"marks":11293,"value":4336,"nodeType":864},{},[],{"data":11295,"content":11296,"nodeType":1005},{},[],{"data":11298,"content":11299,"nodeType":1009},{},[11300],{"data":11301,"marks":11302,"value":4347,"nodeType":864},{},[11303],{"type":899},{"data":11305,"content":11306,"nodeType":860},{},[11307],{"data":11308,"marks":11309,"value":4355,"nodeType":864},{},[11310],{"type":899},{"data":11312,"content":11313,"nodeType":860},{},[11314],{"data":11315,"marks":11316,"value":4362,"nodeType":864},{},[],{"data":11318,"content":11321,"nodeType":996},{"target":11319},{"sys":11320},{"id":4367,"type":1001,"linkType":1002},[],{"data":11323,"content":11324,"nodeType":860},{},[11325],{"data":11326,"marks":11327,"value":4375,"nodeType":864},{},[],{"data":11329,"content":11330,"nodeType":941},{},[11331,11340],{"data":11332,"content":11333,"nodeType":945},{},[11334],{"data":11335,"content":11336,"nodeType":860},{},[11337],{"data":11338,"marks":11339,"value":4388,"nodeType":864},{},[],{"data":11341,"content":11342,"nodeType":945},{},[11343],{"data":11344,"content":11345,"nodeType":860},{},[11346],{"data":11347,"marks":11348,"value":4398,"nodeType":864},{},[],{"data":11350,"content":11351,"nodeType":860},{},[11352,11355,11362,11365,11369],{"data":11353,"marks":11354,"value":4405,"nodeType":864},{},[],{"data":11356,"content":11357,"nodeType":883},{"uri":4408},[11358],{"data":11359,"marks":11360,"value":4414,"nodeType":864},{},[11361],{"type":899},{"data":11363,"marks":11364,"value":4418,"nodeType":864},{},[],{"data":11366,"marks":11367,"value":4423,"nodeType":864},{},[11368],{"type":2246},{"data":11370,"marks":11371,"value":4427,"nodeType":864},{},[],{"data":11373,"content":11374,"nodeType":1005},{},[],{"data":11376,"content":11377,"nodeType":1009},{},[11378],{"data":11379,"marks":11380,"value":4438,"nodeType":864},{},[11381],{"type":899},{"data":11383,"content":11384,"nodeType":860},{},[11385],{"data":11386,"marks":11387,"value":4446,"nodeType":864},{},[11388],{"type":899},{"data":11390,"content":11391,"nodeType":860},{},[11392],{"data":11393,"marks":11394,"value":4453,"nodeType":864},{},[],{"data":11396,"content":11397,"nodeType":860},{},[11398],{"data":11399,"marks":11400,"value":4460,"nodeType":864},{},[],{"data":11402,"content":11403,"nodeType":1005},{},[],{"data":11405,"content":11406,"nodeType":1009},{},[11407],{"data":11408,"marks":11409,"value":4471,"nodeType":864},{},[11410],{"type":899},{"data":11412,"content":11413,"nodeType":941},{},[11414,11427,11440,11453],{"data":11415,"content":11416,"nodeType":945},{},[11417],{"data":11418,"content":11419,"nodeType":860},{},[11420,11424],{"data":11421,"marks":11422,"value":4485,"nodeType":864},{},[11423],{"type":899},{"data":11425,"marks":11426,"value":4489,"nodeType":864},{},[],{"data":11428,"content":11429,"nodeType":945},{},[11430],{"data":11431,"content":11432,"nodeType":860},{},[11433,11437],{"data":11434,"marks":11435,"value":4500,"nodeType":864},{},[11436],{"type":899},{"data":11438,"marks":11439,"value":4504,"nodeType":864},{},[],{"data":11441,"content":11442,"nodeType":945},{},[11443],{"data":11444,"content":11445,"nodeType":860},{},[11446,11450],{"data":11447,"marks":11448,"value":4515,"nodeType":864},{},[11449],{"type":899},{"data":11451,"marks":11452,"value":4519,"nodeType":864},{},[],{"data":11454,"content":11455,"nodeType":945},{},[11456],{"data":11457,"content":11458,"nodeType":860},{},[11459,11463],{"data":11460,"marks":11461,"value":781,"nodeType":864},{},[11462],{"type":899},{"data":11464,"marks":11465,"value":4533,"nodeType":864},{},[],{"data":11467,"content":11468,"nodeType":1005},{},[],{"data":11470,"content":11471,"nodeType":1009},{},[11472],{"data":11473,"marks":11474,"value":4544,"nodeType":864},{},[11475],{"type":899},{"data":11477,"content":11478,"nodeType":860},{},[11479],{"data":11480,"marks":11481,"value":4551,"nodeType":864},{},[],{"data":11483,"content":11484,"nodeType":4845},{},[11485,11508,11530,11552,11574,11596,11618,11640,11662,11684,11706,11728],{"data":11486,"content":11487,"nodeType":4581},{},[11488,11498],{"data":11489,"content":11490,"nodeType":4569},{},[11491],{"data":11492,"content":11493,"nodeType":860},{},[11494],{"data":11495,"marks":11496,"value":4568,"nodeType":864},{},[11497],{"type":899},{"data":11499,"content":11500,"nodeType":4569},{},[11501],{"data":11502,"content":11503,"nodeType":860},{},[11504],{"data":11505,"marks":11506,"value":4580,"nodeType":864},{},[11507],{"type":899},{"data":11509,"content":11510,"nodeType":4581},{},[11511,11521],{"data":11512,"content":11513,"nodeType":4569},{},[11514],{"data":11515,"content":11516,"nodeType":860},{},[11517],{"data":11518,"marks":11519,"value":4595,"nodeType":864},{},[11520],{"type":899},{"data":11522,"content":11523,"nodeType":4569},{},[11524],{"data":11525,"content":11526,"nodeType":860},{},[11527],{"data":11528,"marks":11529,"value":4605,"nodeType":864},{},[],{"data":11531,"content":11532,"nodeType":4581},{},[11533,11543],{"data":11534,"content":11535,"nodeType":4569},{},[11536],{"data":11537,"content":11538,"nodeType":860},{},[11539],{"data":11540,"marks":11541,"value":4619,"nodeType":864},{},[11542],{"type":899},{"data":11544,"content":11545,"nodeType":4569},{},[11546],{"data":11547,"content":11548,"nodeType":860},{},[11549],{"data":11550,"marks":11551,"value":4629,"nodeType":864},{},[],{"data":11553,"content":11554,"nodeType":4581},{},[11555,11565],{"data":11556,"content":11557,"nodeType":4569},{},[11558],{"data":11559,"content":11560,"nodeType":860},{},[11561],{"data":11562,"marks":11563,"value":4643,"nodeType":864},{},[11564],{"type":899},{"data":11566,"content":11567,"nodeType":4569},{},[11568],{"data":11569,"content":11570,"nodeType":860},{},[11571],{"data":11572,"marks":11573,"value":4653,"nodeType":864},{},[],{"data":11575,"content":11576,"nodeType":4581},{},[11577,11587],{"data":11578,"content":11579,"nodeType":4569},{},[11580],{"data":11581,"content":11582,"nodeType":860},{},[11583],{"data":11584,"marks":11585,"value":4667,"nodeType":864},{},[11586],{"type":899},{"data":11588,"content":11589,"nodeType":4569},{},[11590],{"data":11591,"content":11592,"nodeType":860},{},[11593],{"data":11594,"marks":11595,"value":4677,"nodeType":864},{},[],{"data":11597,"content":11598,"nodeType":4581},{},[11599,11609],{"data":11600,"content":11601,"nodeType":4569},{},[11602],{"data":11603,"content":11604,"nodeType":860},{},[11605],{"data":11606,"marks":11607,"value":4691,"nodeType":864},{},[11608],{"type":899},{"data":11610,"content":11611,"nodeType":4569},{},[11612],{"data":11613,"content":11614,"nodeType":860},{},[11615],{"data":11616,"marks":11617,"value":4701,"nodeType":864},{},[],{"data":11619,"content":11620,"nodeType":4581},{},[11621,11631],{"data":11622,"content":11623,"nodeType":4569},{},[11624],{"data":11625,"content":11626,"nodeType":860},{},[11627],{"data":11628,"marks":11629,"value":4715,"nodeType":864},{},[11630],{"type":899},{"data":11632,"content":11633,"nodeType":4569},{},[11634],{"data":11635,"content":11636,"nodeType":860},{},[11637],{"data":11638,"marks":11639,"value":4725,"nodeType":864},{},[],{"data":11641,"content":11642,"nodeType":4581},{},[11643,11653],{"data":11644,"content":11645,"nodeType":4569},{},[11646],{"data":11647,"content":11648,"nodeType":860},{},[11649],{"data":11650,"marks":11651,"value":4739,"nodeType":864},{},[11652],{"type":899},{"data":11654,"content":11655,"nodeType":4569},{},[11656],{"data":11657,"content":11658,"nodeType":860},{},[11659],{"data":11660,"marks":11661,"value":4749,"nodeType":864},{},[],{"data":11663,"content":11664,"nodeType":4581},{},[11665,11675],{"data":11666,"content":11667,"nodeType":4569},{},[11668],{"data":11669,"content":11670,"nodeType":860},{},[11671],{"data":11672,"marks":11673,"value":4763,"nodeType":864},{},[11674],{"type":899},{"data":11676,"content":11677,"nodeType":4569},{},[11678],{"data":11679,"content":11680,"nodeType":860},{},[11681],{"data":11682,"marks":11683,"value":4773,"nodeType":864},{},[],{"data":11685,"content":11686,"nodeType":4581},{},[11687,11697],{"data":11688,"content":11689,"nodeType":4569},{},[11690],{"data":11691,"content":11692,"nodeType":860},{},[11693],{"data":11694,"marks":11695,"value":4787,"nodeType":864},{},[11696],{"type":899},{"data":11698,"content":11699,"nodeType":4569},{},[11700],{"data":11701,"content":11702,"nodeType":860},{},[11703],{"data":11704,"marks":11705,"value":4797,"nodeType":864},{},[],{"data":11707,"content":11708,"nodeType":4581},{},[11709,11719],{"data":11710,"content":11711,"nodeType":4569},{},[11712],{"data":11713,"content":11714,"nodeType":860},{},[11715],{"data":11716,"marks":11717,"value":4811,"nodeType":864},{},[11718],{"type":899},{"data":11720,"content":11721,"nodeType":4569},{},[11722],{"data":11723,"content":11724,"nodeType":860},{},[11725],{"data":11726,"marks":11727,"value":4821,"nodeType":864},{},[],{"data":11729,"content":11730,"nodeType":4581},{},[11731,11741],{"data":11732,"content":11733,"nodeType":4569},{},[11734],{"data":11735,"content":11736,"nodeType":860},{},[11737],{"data":11738,"marks":11739,"value":4500,"nodeType":864},{},[11740],{"type":899},{"data":11742,"content":11743,"nodeType":4569},{},[11744],{"data":11745,"content":11746,"nodeType":860},{},[11747],{"data":11748,"marks":11749,"value":4844,"nodeType":864},{},[],{"data":11751,"content":11752,"nodeType":1005},{},[],{"data":11754,"content":11755,"nodeType":860},{},[11756,11759,11765],{"data":11757,"marks":11758,"value":4855,"nodeType":864},{},[],{"data":11760,"content":11761,"nodeType":883},{"uri":1700},[11762],{"data":11763,"marks":11764,"value":1703,"nodeType":864},{},[],{"data":11766,"marks":11767,"value":21,"nodeType":864},{},[],{"items":11769},[11770,11772],{"sys":11771,"name":297},{"id":2732},{"sys":11773,"name":2729},{"id":2728},{"items":11775},[11776],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":11777},{"url":4881},"blog/enterprise-browser-vs-browser-extension-which-should-your-security-team-choose",{"json":11780},{"data":11781,"content":11782,"nodeType":856},{},[11783],{"data":11784,"content":11785,"nodeType":860},{},[11786],{"data":11787,"marks":11788,"value":11789,"nodeType":864},{},[],"If you're building a shortlist of browser security vendors, one of the first decisions you hit is an architectural one: full-stack enterprise browser, or browser security extension? ",{"id":6310,"publishedAt":11791},"2026-08-12T11:52:48.566Z",{"items":11793},[11794,11796],{"sys":11795,"name":297},{"id":2732},{"sys":11797,"name":2729},{"id":2728},{"items":11799},[11800,11802,11804,11806,11808,11810,11812,11814,11816,11818,11820,11822],{"sys":11801,"name":297,"slug":298,"tier":31},{"id":294},{"sys":11803,"name":279,"slug":280,"tier":31},{"id":276},{"sys":11805,"name":413,"slug":414,"tier":31},{"id":410},{"sys":11807,"name":386,"slug":387,"tier":45},{"id":383},{"sys":11809,"name":377,"slug":378,"tier":45},{"id":374},{"sys":11811,"name":261,"slug":262,"tier":45},{"id":258},{"sys":11813,"name":315,"slug":316,"tier":45},{"id":312},{"sys":11815,"name":484,"slug":485,"tier":45},{"id":481},{"sys":11817,"name":288,"slug":289,"tier":45},{"id":285},{"sys":11819,"name":624,"slug":625,"tier":45},{"id":621},{"sys":11821,"name":306,"slug":307,"tier":45},{"id":303},{"sys":11823,"name":589,"slug":590,"tier":45},{"id":586},"UhLNLgojmxTmt5rogpt-WncHPs8GJpCJ3gCXZJLR1EE",{"id":11826,"title":11827,"authorsCollection":11828,"content":11835,"extension":228,"faqItemsCollection":12356,"faqTitle":59,"featured":6,"hashTags":59,"meta":12358,"metaTitle":12359,"ogImage":59,"postType":6304,"publishedDate":12360,"relatedBlogPostsCollection":12361,"slug":13149,"stem":13150,"subtitle":59,"summary":13151,"synopsis":13162,"sys":13163,"tagsCollection":13166,"topicsCollection":13172,"__hash__":13190},"blog/blog/push-plus-network-security.json","Push + Network Security: The gap between seeing the packet and securing the session",{"items":11829},[11830],{"fullName":11831,"firstName":11832,"jobTitle":851,"socialLinks":59,"profilePicture":11833},"Peyton Padfield","Peyton",{"url":11834},"https://images.ctfassets.net/y1cdw1ablpvd/1GU01HXElmc07nwi89qP3b/3188050420106c62e9df2ed4e4893b7f/1677005177901__1_.jpeg",{"json":11836,"links":12335},{"data":11837,"content":11838,"nodeType":856},{},[11839,11847,11854,11861,11873,11881,11888,11895,11902,11910,11913,11921,11928,11935,11942,11961,11967,11974,11992,12000,12119,12122,12130,12137,12149,12156,12162,12169,12176,12184,12191,12199,12206,12213,12220,12268,12280,12323,12329],{"data":11840,"content":11841,"nodeType":1009},{},[11842],{"data":11843,"marks":11844,"value":11846,"nodeType":864},{},[11845],{"type":899},"Defense used to start at the network perimeter",{"data":11848,"content":11849,"nodeType":860},{},[11850],{"data":11851,"marks":11852,"value":11853,"nodeType":864},{},[],"If you've been working in security for any length of time, you know where defense starts: the network. Long before cloud-first or SaaS-first became default, the perimeter was where defenders had leverage: visibility, enforcement, and control over traffic moving in and out of the organization.",{"data":11855,"content":11856,"nodeType":860},{},[11857],{"data":11858,"marks":11859,"value":11860,"nodeType":864},{},[],"That mental model hasn’t disappeared. Secure Web Gateways, Cloud Access Security Brokers, and the converged Security Service Edge architecture exist because the problem they solve is still real. Organizations generate an enormous volume of web traffic, and someone has to monitor it, filter it, and enforce policy at scale. These tools sit inline, log metadata, apply categorization, and block what’s already known to be dangerous. Without them, the environment quickly becomes unmanageable and extremely difficult to secure.",{"data":11862,"content":11863,"nodeType":860},{},[11864,11868],{"data":11865,"marks":11866,"value":11867,"nodeType":864},{},[],"They are very good at what they were designed to do: securing the wire. ",{"data":11869,"marks":11870,"value":11872,"nodeType":864},{},[11871],{"type":899},"But what happens over the wire is not the full picture. ",{"data":11874,"content":11875,"nodeType":1312},{},[11876],{"data":11877,"marks":11878,"value":11880,"nodeType":864},{},[11879],{"type":899},"Traffic isn't the whole picture anymore",{"data":11882,"content":11883,"nodeType":860},{},[11884],{"data":11885,"marks":11886,"value":11887,"nodeType":864},{},[],"A significant amount of activity happens locally, inside the browser, beyond the visibility of network controls. Modern webpages are effectively complicated web apps that are rendered client-side via JavaScript — and not everything that happens on the page is traffic-generating. ",{"data":11889,"content":11890,"nodeType":860},{},[11891],{"data":11892,"marks":11893,"value":11894,"nodeType":864},{},[],"That distinction matters more than it used to. Authentication, data access, administrative actions, almost all of it now happens inside a browser tab. As a result, the browser has become a central point of both productivity and risk.",{"data":11896,"content":11897,"nodeType":860},{},[11898],{"data":11899,"marks":11900,"value":11901,"nodeType":864},{},[],"Network tools still see the pipeline of traffic moving back and forth. But attackers have adapted to operate within that pipeline rather than around it. They don’t need to break the connection or trigger obvious anomalies. They target the content rendered inside the browser and the user interacting with it.",{"data":11903,"content":11904,"nodeType":860},{},[11905],{"data":11906,"marks":11907,"value":11909,"nodeType":864},{},[11908],{"type":899},"That leaves security teams with noisy traffic visibility and very little insight into the actual attack unfolding inside the browser session.",{"data":11911,"content":11912,"nodeType":1005},{},[],{"data":11914,"content":11915,"nodeType":1009},{},[11916],{"data":11917,"marks":11918,"value":11920,"nodeType":864},{},[11919],{"type":899},"Traffic visibility vs. in-browser context",{"data":11922,"content":11923,"nodeType":860},{},[11924],{"data":11925,"marks":11926,"value":11927,"nodeType":864},{},[],"The modern attacker's playbook is built on a simple idea: stay inside the network’s line of sight without triggering detections or enforcement. Containing operations to the browser layer provides attackers with an easy bypass of many traditional network controls without ever needing to break or evade them outright.",{"data":11929,"content":11930,"nodeType":860},{},[11931],{"data":11932,"marks":11933,"value":11934,"nodeType":864},{},[],"They do this by staying ahead of known-bad detection models, constantly rotating domains and URLs, using anti-analysis techniques, and delivering phishing lures through channels that bypass traditional network ingress points like the email gateway (like social media or SMS). In many cases, the link is never evaluated by perimeter controls at all.",{"data":11936,"content":11937,"nodeType":860},{},[11938],{"data":11939,"marks":11940,"value":11941,"nodeType":864},{},[],"This creates a fundamental visibility gap. Network security tools can see a request going to a legitimate-looking destination, but they can’t observe what happens once the page executes client-side in the browser. Malicious scripts and phishing elements often don’t appear until after the page loads and a user interacts with it, leaving nothing obviously known-bad for network controls to detect.",{"data":11943,"content":11944,"nodeType":860},{},[11945,11949,11957],{"data":11946,"marks":11947,"value":11948,"nodeType":864},{},[],"Blocklists don’t help much here either. Domains rotate constantly, and the window between a phishing site going live and being categorized as malicious is more than enough time for an attacker to succeed. Until that happens, the traffic appears benign and the user is free to interact with the page. And to make matters worse, attackers are leveraging ",{"data":11950,"content":11952,"nodeType":883},{"uri":11951},"https://pushsecurity.com/blog/phishing-detection-evasion-launch/",[11953],{"data":11954,"marks":11955,"value":11956,"nodeType":864},{},[],"detection evasion techniques",{"data":11958,"marks":11959,"value":11960,"nodeType":864},{},[]," designed to frustrate these detections — meaning most bad pages aren't spotted until it's way too late. ",{"data":11962,"content":11966,"nodeType":996},{"target":11963},{"sys":11964},{"id":11965,"type":1001,"linkType":1002},"38X1De97xJ8B6GNXTHW6Y5",[],{"data":11968,"content":11969,"nodeType":860},{},[11970],{"data":11971,"marks":11972,"value":11973,"nodeType":864},{},[],"Consider attacker-in-the-middle phishing. From the proxy’s perspective, everything looks clean: user → reputable domain → “standard” web traffic. The phishing infrastructure is often hidden behind redirects or conditional logic designed to screen out proxies and scanners. Inside the browser session, however, credentials are intercepted, session tokens are harvested, and MFA is bypassed in real time.",{"data":11975,"content":11976,"nodeType":860},{},[11977,11981,11988],{"data":11978,"marks":11979,"value":11980,"nodeType":864},{},[],"For ",{"data":11982,"content":11983,"nodeType":883},{"uri":5100},[11984],{"data":11985,"marks":11986,"value":11987,"nodeType":864},{},[],"modern threat groups",{"data":11989,"marks":11990,"value":11991,"nodeType":864},{},[],", these obscured attack vectors lead directly to initial access and account takeover. The network is no longer the control point where the most consequential attacks can be reliably stopped.",{"data":11993,"content":11994,"nodeType":860},{},[11995],{"data":11996,"marks":11997,"value":11999,"nodeType":864},{},[11998],{"type":2246},"Browser telemetry is key to detecting and blocking malicious content in real-time, rather than relying on blocklists using known-bad indicators like domains and IPs that go out of date as quickly as new entries appear.",{"data":12001,"content":12002,"nodeType":4845},{},[12003,12027,12050,12073,12096],{"data":12004,"content":12005,"nodeType":4581},{},[12006,12017],{"data":12007,"content":12008,"nodeType":12016},{},[12009],{"data":12010,"content":12011,"nodeType":860},{},[12012],{"data":12013,"marks":12014,"value":12015,"nodeType":864},{},[],"What you see with traffic analysis","table-header-cell",{"data":12018,"content":12019,"nodeType":12016},{},[12020],{"data":12021,"content":12022,"nodeType":860},{},[12023],{"data":12024,"marks":12025,"value":12026,"nodeType":864},{},[],"What you can see with browser telemetry",{"data":12028,"content":12029,"nodeType":4581},{},[12030,12040],{"data":12031,"content":12032,"nodeType":4569},{},[12033],{"data":12034,"content":12035,"nodeType":860},{},[12036],{"data":12037,"marks":12038,"value":12039,"nodeType":864},{},[],"HTTP request/response bodies ",{"data":12041,"content":12042,"nodeType":4569},{},[12043],{"data":12044,"content":12045,"nodeType":860},{},[12046],{"data":12047,"marks":12048,"value":12049,"nodeType":864},{},[],"DOM structure fingerprints",{"data":12051,"content":12052,"nodeType":4581},{},[12053,12063],{"data":12054,"content":12055,"nodeType":4569},{},[12056],{"data":12057,"content":12058,"nodeType":860},{},[12059],{"data":12060,"marks":12061,"value":12062,"nodeType":864},{},[],"URLs and headers",{"data":12064,"content":12065,"nodeType":4569},{},[12066],{"data":12067,"content":12068,"nodeType":860},{},[12069],{"data":12070,"marks":12071,"value":12072,"nodeType":864},{},[],"User interaction metadata ",{"data":12074,"content":12075,"nodeType":4581},{},[12076,12086],{"data":12077,"content":12078,"nodeType":4569},{},[12079],{"data":12080,"content":12081,"nodeType":860},{},[12082],{"data":12083,"marks":12084,"value":12085,"nodeType":864},{},[],"Cookie values in transit",{"data":12087,"content":12088,"nodeType":4569},{},[12089],{"data":12090,"content":12091,"nodeType":860},{},[12092],{"data":12093,"marks":12094,"value":12095,"nodeType":864},{},[],"Cookie names and attributes",{"data":12097,"content":12098,"nodeType":4581},{},[12099,12109],{"data":12100,"content":12101,"nodeType":4569},{},[12102],{"data":12103,"content":12104,"nodeType":860},{},[12105],{"data":12106,"marks":12107,"value":12108,"nodeType":864},{},[],"Static JS code",{"data":12110,"content":12111,"nodeType":4569},{},[12112],{"data":12113,"content":12114,"nodeType":860},{},[12115],{"data":12116,"marks":12117,"value":12118,"nodeType":864},{},[],"Script execution patterns and dynamic JS analysis",{"data":12120,"content":12121,"nodeType":1005},{},[],{"data":12123,"content":12124,"nodeType":1009},{},[12125],{"data":12126,"marks":12127,"value":12129,"nodeType":864},{},[12128],{"type":899},"Securing the browser session is key to stopping modern threats",{"data":12131,"content":12132,"nodeType":860},{},[12133],{"data":12134,"marks":12135,"value":12136,"nodeType":864},{},[],"If the browser is where users actually work, and where attackers actually operate, then that’s the layer that defenders need to understand and control.",{"data":12138,"content":12139,"nodeType":860},{},[12140,12144],{"data":12141,"marks":12142,"value":12143,"nodeType":864},{},[],"Modern web-based attacks don’t succeed because traffic goes uninspected. They succeed because network inspection can’t follow the interaction far enough. Traffic shows where data went, not what the user actually saw or did, ",{"data":12145,"marks":12146,"value":12148,"nodeType":864},{},[12147],{"type":899},"and in today’s attacks, that distinction matters.",{"data":12150,"content":12151,"nodeType":860},{},[12152],{"data":12153,"marks":12154,"value":12155,"nodeType":864},{},[],"To stop these threats, you have to see what the user is actually interacting with. Things like what scripts are loading, how the DOM is being manipulated, or whether the login form a user is using is legitimate or being proxied. Those are page-level signals, and they only exist inside the browser tab.",{"data":12157,"content":12161,"nodeType":996},{"target":12158},{"sys":12159},{"id":12160,"type":1001,"linkType":1002},"6qMaivxhJ3xT9DkwXGcCSJ",[],{"data":12163,"content":12164,"nodeType":860},{},[12165],{"data":12166,"marks":12167,"value":12168,"nodeType":864},{},[],"That same shift applies to control. Destination-based blocking breaks down when the destination itself appears legitimate. Effective intervention requires decisions based on behavior as it unfolds so teams can stop risky or malicious activity that would compromise an account.",{"data":12170,"content":12171,"nodeType":860},{},[12172],{"data":12173,"marks":12174,"value":12175,"nodeType":864},{},[],"And visibility can’t stop at centrally managed applications. Shadow SaaS breaks any assumption that access patterns are uniform or fully governed by the IdP. Local accounts, duplicate identities, and password-only logins don’t show up clearly in network telemetry, but they materially expand the attack surface. Seeing every login, across every app, directly from the browser is the only way to build an accurate picture of who has access to what.",{"data":12177,"content":12178,"nodeType":1312},{},[12179],{"data":12180,"marks":12181,"value":12183,"nodeType":864},{},[12182],{"type":899},"Push provides the missing context for network security",{"data":12185,"content":12186,"nodeType":860},{},[12187],{"data":12188,"marks":12189,"value":12190,"nodeType":864},{},[],"At this point, the gap should be clear. Network security gives you strong control over traffic, but very little insight into what actually happens once that traffic lands in a user’s browser.",{"data":12192,"content":12193,"nodeType":860},{},[12194],{"data":12195,"marks":12196,"value":12198,"nodeType":864},{},[12197],{"type":899},"This is where Push can help.",{"data":12200,"content":12201,"nodeType":860},{},[12202],{"data":12203,"marks":12204,"value":12205,"nodeType":864},{},[],"The Push browser agent extends monitoring into the browser itself, providing the visibility and control that perimeter-based tools can’t deliver. It doesn’t replace SSE, SWG, or CASB. Those tools remain the right way to manage traffic and enforce policy at the edge. Push complements them by operating in the one place they can’t: inside the live browser session.",{"data":12207,"content":12208,"nodeType":860},{},[12209],{"data":12210,"marks":12211,"value":12212,"nodeType":864},{},[],"Push does this by deploying a browser-native agent, similar in spirit to how EDR works at the host level. That agent gives defenders direct insight into what the network can’t see like the page being rendered, how the user is interacting with it, and the attack techniques that play out entirely within the tab.",{"data":12214,"content":12215,"nodeType":860},{},[12216],{"data":12217,"marks":12218,"value":12219,"nodeType":864},{},[],"With Push deployed, teams gain:",{"data":12221,"content":12222,"nodeType":941},{},[12223,12238,12253],{"data":12224,"content":12225,"nodeType":945},{},[12226],{"data":12227,"content":12228,"nodeType":860},{},[12229,12234],{"data":12230,"marks":12231,"value":12233,"nodeType":864},{},[12232],{"type":899},"Real-time, in-browser threat detection:",{"data":12235,"marks":12236,"value":12237,"nodeType":864},{},[]," Detect and stop attacks like AiTM phishing and session hijacking based on what’s actually happening in the browser. Instead of relying on blocklists or downstream signals, Push identifies attacker behavior as it unfolds and can intervene before credentials or session tokens are stolen.",{"data":12239,"content":12240,"nodeType":945},{},[12241],{"data":12242,"content":12243,"nodeType":860},{},[12244,12249],{"data":12245,"marks":12246,"value":12248,"nodeType":864},{},[12247],{"type":899},"Complete visibility into SaaS access: ",{"data":12250,"marks":12251,"value":12252,"nodeType":864},{},[],"Build a true inventory of user identities and authentication methods across every application in use, including shadow SaaS. Push fills the gaps left by network and IdP logs, giving teams a real picture of where access exists and how it’s being granted.",{"data":12254,"content":12255,"nodeType":945},{},[12256],{"data":12257,"content":12258,"nodeType":860},{},[12259,12264],{"data":12260,"marks":12261,"value":12263,"nodeType":864},{},[12262],{"type":899},"Streamlined hardening at the point of access:",{"data":12265,"marks":12266,"value":12267,"nodeType":864},{},[]," Use the browser as a control point to enforce secure login behavior everywhere it matters. Mandate MFA, steer users toward SSO, and block risky credentials on unmanaged apps, shifting from reactive cleanup to continuous, preventative hardening.",{"data":12269,"content":12270,"nodeType":860},{},[12271,12275],{"data":12272,"marks":12273,"value":12274,"nodeType":864},{},[],"The result is a unified model and real defense in depth. ",{"data":12276,"marks":12277,"value":12279,"nodeType":864},{},[12278],{"type":899},"Network tools secure the pipeline, and Push secures the user moving through it.",{"data":12281,"content":12282,"nodeType":1116},{},[12283],{"data":12284,"content":12285,"nodeType":860},{},[12286,12290,12298,12301,12309,12313,12320],{"data":12287,"marks":12288,"value":12289,"nodeType":864},{},[],"Want to learn more about Push? ",{"data":12291,"content":12293,"nodeType":883},{"uri":12292},"https://pushsecurity.com/resources/product-brochure",[12294],{"data":12295,"marks":12296,"value":12297,"nodeType":864},{},[],"Check out our latest product overview",{"data":12299,"marks":12300,"value":3731,"nodeType":864},{},[],{"data":12302,"content":12304,"nodeType":883},{"uri":12303},"https://pushsecurity.com/product-demo/",[12305],{"data":12306,"marks":12307,"value":12308,"nodeType":864},{},[],"visit our demo library",{"data":12310,"marks":12311,"value":12312,"nodeType":864},{},[],", or ",{"data":12314,"content":12315,"nodeType":883},{"uri":1700},[12316],{"data":12317,"marks":12318,"value":12319,"nodeType":864},{},[],"book some time with one of our team for a live demo",{"data":12321,"marks":12322,"value":2924,"nodeType":864},{},[],{"data":12324,"content":12328,"nodeType":996},{"target":12325},{"sys":12326},{"id":12327,"type":1001,"linkType":1002},"1doMkOu2ZuGqMp2VJgV5pb",[],{"data":12330,"content":12331,"nodeType":860},{},[12332],{"data":12333,"marks":12334,"value":21,"nodeType":864},{},[],{"entries":12336},{"hyperlink":12337,"inline":12338,"block":12339},[],[],[12340,12346,12352],{"sys":12341,"__typename":1724,"title":12342,"caption":59,"layoutMode":59,"file":12343},{"id":11965},"Why known-bad detections are failing. ",{"url":12344,"width":12345,"height":1729},"https://images.ctfassets.net/y1cdw1ablpvd/6b63OwWsBBv4z7HAiaOKL8/defc65b40e27f1b14ad64cbf09d8c1d4/Screenshot_2026-01-30_at_16.57.54.png",3372,{"sys":12347,"__typename":1724,"title":12348,"caption":12348,"layoutMode":59,"file":12349},{"id":12160},"The browser sees the \"missing middle\" that is key to stopping modern attacks.",{"url":12350,"width":12345,"height":12351},"https://images.ctfassets.net/y1cdw1ablpvd/62kkmEzar8I24kELigqdoq/8e4c0476ba9bec03c418977bed5f40e6/Screenshot_2026-01-30_at_16.42.19.png",1560,{"sys":12353,"__typename":1717,"type":1718,"ctaText":12354,"buttonLabel":12355,"buttonColour":1721,"buttonUrl":6151},{"id":12327},"Stop browser-based attacks in real time. Book a demo today. ","Book a Demo",{"items":12357},[],{},"Push + Network Security: Seeing packets vs securing sessions","2026-01-30T00:00:00.000Z",{"items":12362},[12363,12761],{"__typename":2059,"sys":12364,"content":12366,"title":12747,"synopsis":12748,"hashTags":59,"publishedDate":12360,"slug":12749,"tagsCollection":12750,"authorsCollection":12757},{"id":12365},"6YWYKGESlyUKQxvhKmBzeH",{"json":12367},{"data":12368,"content":12369,"nodeType":856},{},[12370,12378,12385,12392,12404,12416,12424,12431,12438,12445,12451,12454,12462,12469,12476,12488,12495,12502,12510,12517,12565,12581,12588,12596,12603,12630,12637,12645,12693,12700,12736,12741],{"data":12371,"content":12372,"nodeType":1009},{},[12373],{"data":12374,"marks":12375,"value":12377,"nodeType":864},{},[12376],{"type":899},"EDR is still the best tool for attacks that touch the endpoint",{"data":12379,"content":12380,"nodeType":860},{},[12381],{"data":12382,"marks":12383,"value":12384,"nodeType":864},{},[],"Endpoint Detection and Response (EDR) tooling is fundamental to modern security. It earned its place as a foundational control by moving defense away from static, known-bad indicators and toward deep, real-time detection, investigation, and response based on behavior observed in a live environment. ",{"data":12386,"content":12387,"nodeType":860},{},[12388],{"data":12389,"marks":12390,"value":12391,"nodeType":864},{},[],"By running an agent inside the operating system, EDR gave defenders something they never had before: visibility into what was actually happening on the host as it happened, and the ability to act on it.",{"data":12393,"content":12394,"nodeType":860},{},[12395,12399],{"data":12396,"marks":12397,"value":12398,"nodeType":864},{},[],"That agent-level visibility is still incredibly powerful. File system changes, process execution, memory behavior, or registry modifications is the kind of telemetry that enables threat hunting, exposes fileless attacks, and allows teams to contain incidents by isolating a device or killing a malicious process. ",{"data":12400,"marks":12401,"value":12403,"nodeType":864},{},[12402],{"type":899},"For anything that touches the endpoint, EDR remains the right tool.",{"data":12405,"content":12406,"nodeType":860},{},[12407,12411],{"data":12408,"marks":12409,"value":12410,"nodeType":864},{},[],"But that’s the key constraint: ",{"data":12412,"marks":12413,"value":12415,"nodeType":864},{},[12414],{"type":2246},"for anything that touches the endpoint.",{"data":12417,"content":12418,"nodeType":1312},{},[12419],{"data":12420,"marks":12421,"value":12423,"nodeType":864},{},[12422],{"type":899},"But modern attacks have moved beyond the endpoint",{"data":12425,"content":12426,"nodeType":860},{},[12427],{"data":12428,"marks":12429,"value":12430,"nodeType":864},{},[],"The reality of how work gets done has shifted. Most applications are now SaaS-based and accessed entirely through a browser. Employees authenticate, move data, administer systems, and interact with customers inside a browser window. And attackers have followed them there.",{"data":12432,"content":12433,"nodeType":860},{},[12434],{"data":12435,"marks":12436,"value":12437,"nodeType":864},{},[],"When attacks play out in the browser, endpoint-level signals often never appear. From the operating system’s perspective, there’s just a browser process behaving normally. The EDR agent is doing exactly what it was designed to do, but the activity that matters is happening within the browser itself.",{"data":12439,"content":12440,"nodeType":860},{},[12441],{"data":12442,"marks":12443,"value":12444,"nodeType":864},{},[],"That’s the gap teams are running into. EDR protects the integrity of the host, but it has no visibility into the live application session inside the browser. And as attackers consciously avoid the endpoint entirely, that blind spot is becoming harder to ignore.",{"data":12446,"content":12450,"nodeType":996},{"target":12447},{"sys":12448},{"id":12449,"type":1001,"linkType":1002},"7aVTgi4Btxl6PpzQl8kipW",[],{"data":12452,"content":12453,"nodeType":1005},{},[],{"data":12455,"content":12456,"nodeType":1009},{},[12457],{"data":12458,"marks":12459,"value":12461,"nodeType":864},{},[12460],{"type":899},"Attackers are consciously evading EDR",{"data":12463,"content":12464,"nodeType":860},{},[12465],{"data":12466,"marks":12467,"value":12468,"nodeType":864},{},[],"The gap endpoint teams are running into isn’t accidental. It’s the result of attackers adapting to where defenders are strongest (and weakest).",{"data":12470,"content":12471,"nodeType":860},{},[12472],{"data":12473,"marks":12474,"value":12475,"nodeType":864},{},[],"Modern EDR has made compromising the host operating system expensive and noisy. Deep telemetry and constant monitoring mean that even when an attacker manages to execute code on a device, that action is quickly under scrutiny. From there, progress is slow. After all, lateral movement and persistence take time, and all of it carries risk and generates signals defenders are good at catching.",{"data":12477,"content":12478,"nodeType":860},{},[12479,12484],{"data":12480,"marks":12481,"value":12483,"nodeType":864},{},[12482],{"type":899},"So attackers take a different route. ",{"data":12485,"marks":12486,"value":12487,"nodeType":864},{},[],"Instead of targeting the OS, they operate inside the browser session, abusing legitimate access paths to cloud applications directly over the internet. The endpoint just sees a browser session, not the malicious activity that's happening inside it. ",{"data":12489,"content":12490,"nodeType":860},{},[12491],{"data":12492,"marks":12493,"value":12494,"nodeType":864},{},[],"EDR agents are extremely good at protecting the operating system, but their visibility largely stops at the browser boundary. They can see that a browser process is running. They can’t see what a user is actually interacting with inside a specific tab, or what code is executing within the browser.",{"data":12496,"content":12497,"nodeType":860},{},[12498],{"data":12499,"marks":12500,"value":12501,"nodeType":864},{},[],"This is the shift security teams are feeling. Attacks don’t trigger endpoint alerts because they aren’t endpoint attacks. They unfold inside the browser, over standard web sessions, using legitimate accounts. To EDR, the host is unaffected. To the business, the damage is already underway.",{"data":12503,"content":12504,"nodeType":1312},{},[12505],{"data":12506,"marks":12507,"value":12509,"nodeType":864},{},[12508],{"type":899},"How modern attacks circumvent EDR",{"data":12511,"content":12512,"nodeType":860},{},[12513],{"data":12514,"marks":12515,"value":12516,"nodeType":864},{},[],"Examples of modern attacks that are consciously evading EDR by staying off the endpoint include:",{"data":12518,"content":12519,"nodeType":941},{},[12520,12535,12550],{"data":12521,"content":12522,"nodeType":945},{},[12523],{"data":12524,"content":12525,"nodeType":860},{},[12526,12531],{"data":12527,"marks":12528,"value":12530,"nodeType":864},{},[12529],{"type":899},"AiTM phishing: ",{"data":12532,"marks":12533,"value":12534,"nodeType":864},{},[],"Sophisticated attacker-in-the-middle phishing kits render convincing login pages directly in the browser and proxy authentication in real time, stealing credentials or MFA tokens as the user enters them. From the OS perspective, nothing appears unusual; EDR can’t see the page structure or scripts running inside the tab.",{"data":12536,"content":12537,"nodeType":945},{},[12538],{"data":12539,"content":12540,"nodeType":860},{},[12541,12546],{"data":12542,"marks":12543,"value":12545,"nodeType":864},{},[12544],{"type":899},"Session hijacking:",{"data":12547,"marks":12548,"value":12549,"nodeType":864},{},[]," When attackers obtain a valid session token, they gain persistent access to an account without needing a password at all. Once in use, the session typically blends into normal browser activity, generating no endpoint data. ",{"data":12551,"content":12552,"nodeType":945},{},[12553],{"data":12554,"content":12555,"nodeType":860},{},[12556,12561],{"data":12557,"marks":12558,"value":12560,"nodeType":864},{},[12559],{"type":899},"Malicious browser extensions:",{"data":12562,"marks":12563,"value":12564,"nodeType":864},{},[]," Malicious extensions (either made by attackers or hijacked by them) can read page content, intercept credentials, or siphon session tokens. Because extensions operate inside the browser’s execution model, their behavior is largely invisible to endpoint tooling focused on OS-level activity.",{"data":12566,"content":12567,"nodeType":860},{},[12568,12572,12577],{"data":12569,"marks":12570,"value":12571,"nodeType":864},{},[],"Even attacks that nominally involve the endpoint often stay outside EDR’s strongest visibility. ",{"data":12573,"marks":12574,"value":12576,"nodeType":864},{},[12575],{"type":899},"ClickFix-style social engineering",{"data":12578,"marks":12579,"value":12580,"nodeType":864},{},[]," is a good example. Attackers manipulate users into taking risky actions that look legitimate, the most prominent example being executing malicious commands on the host that are deliberately obfuscated or broken into benign-looking steps. While EDR may catch the code execution (and any malware the execution attempts to install), these techniques are designed to stay ambiguous enough to avoid reliable detection.",{"data":12582,"content":12583,"nodeType":860},{},[12584],{"data":12585,"marks":12586,"value":12587,"nodeType":864},{},[],"All of these attacks succeed for the same reason: the activity unfolds inside the browser. And because EDR was never designed to observe or control what happens inside a live browser session, attackers can operate there with far less resistance.",{"data":12589,"content":12590,"nodeType":1312},{},[12591],{"data":12592,"marks":12593,"value":12595,"nodeType":864},{},[12594],{"type":899},"Extending detection and response to the browser",{"data":12597,"content":12598,"nodeType":860},{},[12599],{"data":12600,"marks":12601,"value":12602,"nodeType":864},{},[],"Defenders need to meet attackers where they actually operate. That means establishing real detection and response capabilities inside the browser itself.",{"data":12604,"content":12605,"nodeType":860},{},[12606,12610,12615,12619,12627],{"data":12607,"marks":12608,"value":12609,"nodeType":864},{},[],"When endpoint security evolved, it did so by putting an agent on the host to observe behavior, collect telemetry, and act at the source — ",{"data":12611,"marks":12612,"value":12614,"nodeType":864},{},[12613],{"type":899},"getting inside the data stream",{"data":12616,"marks":12617,"value":12618,"nodeType":864},{},[],". The same logic applies here. If the browser is where credentials are entered, sessions are established, and attacks unfold, then it needs to be treated as a security surface in its own right. ",{"data":12620,"content":12622,"nodeType":883},{"uri":12621},"https://pushsecurity.com/blog/push-plus-network-security",[12623],{"data":12624,"marks":12625,"value":12626,"nodeType":864},{},[],"That doesn't mean just looking at web traffic, but examining client-side browser processes and activity that are the best, earliest indicators of bad activity. ",{"data":12628,"marks":12629,"value":21,"nodeType":864},{},[],{"data":12631,"content":12632,"nodeType":860},{},[12633],{"data":12634,"marks":12635,"value":12636,"nodeType":864},{},[],"This doesn’t replace EDR. EDR secures the host. Identity tools govern authentication. But the browser, the layer that connects users to everything else, is a blind spot. Extending detection and response into that layer fills the gap while complementing the controls that already work.",{"data":12638,"content":12639,"nodeType":1312},{},[12640],{"data":12641,"marks":12642,"value":12644,"nodeType":864},{},[12643],{"type":899},"Your browser detection and response checklist",{"data":12646,"content":12647,"nodeType":941},{},[12648,12663,12678],{"data":12649,"content":12650,"nodeType":945},{},[12651],{"data":12652,"content":12653,"nodeType":860},{},[12654,12659],{"data":12655,"marks":12656,"value":12658,"nodeType":864},{},[12657],{"type":899},"Browser-native protection: ",{"data":12660,"marks":12661,"value":12662,"nodeType":864},{},[],"Running inside the browser is the only way you can see what page a user is interacting with, what scripts are running, and how the session is behaving in real time. It’s also the only place you can reliably distinguish between normal user activity and attacker-driven manipulation.",{"data":12664,"content":12665,"nodeType":945},{},[12666],{"data":12667,"content":12668,"nodeType":860},{},[12669,12674],{"data":12670,"marks":12671,"value":12673,"nodeType":864},{},[12672],{"type":899},"Behavioral detection:",{"data":12675,"marks":12676,"value":12677,"nodeType":864},{},[]," Detection can’t rely on static indicators. It has to be based on behaviors — like how pages render, how credentials are submitted, and how sessions are established and abused. ",{"data":12679,"content":12680,"nodeType":945},{},[12681],{"data":12682,"content":12683,"nodeType":860},{},[12684,12689],{"data":12685,"marks":12686,"value":12688,"nodeType":864},{},[12687],{"type":899},"Real-time interception:",{"data":12690,"marks":12691,"value":12692,"nodeType":864},{},[]," Response has to be immediate. Blocking credential submission, interrupting a malicious action, capturing high-fidelity context, all of that needs to happen at the point of interaction — before an account is compromised.",{"data":12694,"content":12695,"nodeType":860},{},[12696],{"data":12697,"marks":12698,"value":12699,"nodeType":864},{},[],"This is what it means to extend detection and response to the browser: not another tool bolted onto the stack, but a necessary evolution in how modern attacks are actually stopped.",{"data":12701,"content":12702,"nodeType":1116},{},[12703],{"data":12704,"content":12705,"nodeType":860},{},[12706,12709,12715,12718,12724,12727,12733],{"data":12707,"marks":12708,"value":12289,"nodeType":864},{},[],{"data":12710,"content":12711,"nodeType":883},{"uri":12292},[12712],{"data":12713,"marks":12714,"value":12297,"nodeType":864},{},[],{"data":12716,"marks":12717,"value":3731,"nodeType":864},{},[],{"data":12719,"content":12720,"nodeType":883},{"uri":12303},[12721],{"data":12722,"marks":12723,"value":12308,"nodeType":864},{},[],{"data":12725,"marks":12726,"value":12312,"nodeType":864},{},[],{"data":12728,"content":12729,"nodeType":883},{"uri":1700},[12730],{"data":12731,"marks":12732,"value":12319,"nodeType":864},{},[],{"data":12734,"marks":12735,"value":2924,"nodeType":864},{},[],{"data":12737,"content":12740,"nodeType":996},{"target":12738},{"sys":12739},{"id":12327,"type":1001,"linkType":1002},[],{"data":12742,"content":12743,"nodeType":860},{},[12744],{"data":12745,"marks":12746,"value":21,"nodeType":864},{},[],"Push + Endpoint Security: Extending detection and response to the browser","Why extending detection and response into the browser is crucial in the face of modern attacks that consciously evade the network and endpoint. ","push-plus-endpoint-security",{"items":12751},[12752,12754],{"sys":12753,"name":7555},{"id":7554},{"sys":12755,"name":342},{"id":12756},"4ksQNCFeBf8H4QIORqpRLw",{"items":12758},[12759],{"fullName":11831,"firstName":11832,"jobTitle":851,"profilePicture":12760},{"url":11834},{"__typename":2059,"sys":12762,"content":12764,"title":13135,"synopsis":13136,"hashTags":59,"publishedDate":13137,"slug":13138,"tagsCollection":13139,"authorsCollection":13145},{"id":12763},"2k2aDK5dyQKlQBrk66pMXE",{"json":12765},{"data":12766,"content":12767,"nodeType":856},{},[12768,12776,12783,12790,12797,12804,12811,12819,12826,12833,12840,12843,12851,12858,12865,12872,12879,12897,12905,12912,12919,12926,12929,12937,12953,12969,12976,12984,12991,12998,13005,13012,13017,13024,13087,13090,13129],{"data":12769,"content":12770,"nodeType":1009},{},[12771],{"data":12772,"marks":12773,"value":12775,"nodeType":864},{},[12774],{"type":899},"Cloud security tools ensure secure configurations",{"data":12777,"content":12778,"nodeType":860},{},[12779],{"data":12780,"marks":12781,"value":12782,"nodeType":864},{},[],"If you’re a cloud security architect, you probably don’t think in terms of firewalls and perimeters anymore. You think in control planes. Your job isn’t protecting a box or a subnet; it’s governing a sprawling web of IAM roles, service principals, APIs, and permissions that exist mostly as configuration and code. In this world, the boundary isn’t physical or even networked, it’s defined entirely by how your environment is configured.",{"data":12784,"content":12785,"nodeType":860},{},[12786],{"data":12787,"marks":12788,"value":12789,"nodeType":864},{},[],"The way most teams approached that problem was pragmatic. As cloud environments scaled, it became impossible to secure it by inspection or tribal knowledge. Cloud Security Posture Management tools and, later, Cloud Native Application Protection Platforms emerged to solve a very real problem: visibility and control over cloud configuration at scale. They gave teams a way to continuously assess infrastructure, track misconfigurations, and understand risk across accounts, regions, and services without drowning in raw provider logs.",{"data":12791,"content":12792,"nodeType":860},{},[12793],{"data":12794,"marks":12795,"value":12796,"nodeType":864},{},[],"That capability is important. Without it, cloud security simply doesn’t function. ",{"data":12798,"content":12799,"nodeType":860},{},[12800],{"data":12801,"marks":12802,"value":12803,"nodeType":864},{},[],"CSPM and CNAPP answer the question of “is my cloud environment configured securely?”. They tell you whether an IAM role is too permissive, whether a resource is exposed, or whether a policy violates best practice. They tell you when a user or account is trying to do something they shouldn’t. ",{"data":12805,"content":12806,"nodeType":860},{},[12807],{"data":12808,"marks":12809,"value":12810,"nodeType":864},{},[],"What they don’t answer is a different, increasingly important question: “What happens when attacker behavior is indistinguishable from legitimate user behavior?”",{"data":12812,"content":12813,"nodeType":1312},{},[12814],{"data":12815,"marks":12816,"value":12818,"nodeType":864},{},[12817],{"type":899},"But they can’t stop “legitimate” actions",{"data":12820,"content":12821,"nodeType":860},{},[12822],{"data":12823,"marks":12824,"value":12825,"nodeType":864},{},[],"The gap (or lack of) between legitimate user behavior and malicious abuse is becoming more relevant as cloud breaches change shape. ",{"data":12827,"content":12828,"nodeType":860},{},[12829],{"data":12830,"marks":12831,"value":12832,"nodeType":864},{},[],"In many of today’s incidents, attackers aren’t exploiting misconfigurations or abusing the cloud control plane directly. They’re compromising users. Once an authentication has occurred through illegitimate means, whether phishing, session hijacking, or token theft, the attacker operates entirely within an approved session.",{"data":12834,"content":12835,"nodeType":860},{},[12836],{"data":12837,"marks":12838,"value":12839,"nodeType":864},{},[],"From the perspective of cloud security tooling, very little looks wrong. The identity is valid. The access patterns appear expected. The infrastructure remains correctly configured. As long as the attacker operates within the bounds of what looks “normal”, no alarms are triggered. Meanwhile, sensitive actions are carried out through the browser, using the same interfaces and workflows as a real user.",{"data":12841,"content":12842,"nodeType":1005},{},[],{"data":12844,"content":12845,"nodeType":1009},{},[12846],{"data":12847,"marks":12848,"value":12850,"nodeType":864},{},[12849],{"type":899},"The gap between the IdP and the final API call — the “missing middle” in your security stack",{"data":12852,"content":12853,"nodeType":860},{},[12854],{"data":12855,"marks":12856,"value":12857,"nodeType":864},{},[],"The browser session sits outside the telemetry and control model of infrastructure-focused cloud security tools. We call this the \"missing middle.\" It’s the space between the IdP login and the final cloud API call. ",{"data":12859,"content":12860,"nodeType":860},{},[12861],{"data":12862,"marks":12863,"value":12864,"nodeType":864},{},[],"In theory, you could try to close the gap by stitching together logs from every SaaS application in your environment. In practice, anyone who’s attempted this knows how quickly it falls apart. ",{"data":12866,"content":12867,"nodeType":860},{},[12868],{"data":12869,"marks":12870,"value":12871,"nodeType":864},{},[],"Each integration is brittle and expensive to maintain, and many applications don’t expose the level of telemetry you actually need, even if you’re willing to fork out for the top Security++ product tier. When you’re dealing with hundreds of apps per enterprise, each with their own configuration complexity, there’s a good chance that your solution focused on “core” cloud apps doesn’t actually have visibility of the full attack surface.",{"data":12873,"content":12874,"nodeType":860},{},[12875],{"data":12876,"marks":12877,"value":12878,"nodeType":864},{},[],"When logs do exist, they rarely show what you actually need. To a CSPM or CNAPP, it looks like an authorized user doing authorized things. A file was accessed or a setting was changed. What those tools can’t see is that the browser session itself was being manipulated in real time.",{"data":12880,"content":12881,"nodeType":860},{},[12882,12885,12893],{"data":12883,"marks":12884,"value":11980,"nodeType":864},{},[],{"data":12886,"content":12887,"nodeType":883},{"uri":5100},[12888],{"data":12889,"marks":12890,"value":12892,"nodeType":864},{},[12891],{"type":1455},"modern, cloud-native threat groups",{"data":12894,"marks":12895,"value":12896,"nodeType":864},{},[],", this lack of session-level visibility is their greatest advantage. They bypass the strong configuration and identity controls you’ve already implemented by simply stepping into the authorized stream. And by the time infrastructure-level signals suggest something is wrong, the attacker has already accomplished what they came for.",{"data":12898,"content":12899,"nodeType":1312},{},[12900],{"data":12901,"marks":12902,"value":12904,"nodeType":864},{},[12903],{"type":899},"Secure everything, still lose",{"data":12906,"content":12907,"nodeType":860},{},[12908],{"data":12909,"marks":12910,"value":12911,"nodeType":864},{},[],"At some point, this forces a hard realization: you can do everything “right” at the cloud and identity layers and still lose.",{"data":12913,"content":12914,"nodeType":860},{},[12915],{"data":12916,"marks":12917,"value":12918,"nodeType":864},{},[],"You can lock down infrastructure-as-code, tighten IAM policies, enforce conditional access, and pass every posture check you care about. But none of that changes where access actually happens. When users work in cloud services, they do it through a browser. And once a session is established, that browser session becomes the real control plane.",{"data":12920,"content":12921,"nodeType":860},{},[12922],{"data":12923,"marks":12924,"value":12925,"nodeType":864},{},[],"That’s the shift cloud security teams are running into. The problem isn’t that CSPM or CNAPP failed, it’s that they can’t see the full picture. Bridging the missing middle means treating the browser session itself as something you can inspect and defend.",{"data":12927,"content":12928,"nodeType":1005},{},[],{"data":12930,"content":12931,"nodeType":1009},{},[12932],{"data":12933,"marks":12934,"value":12936,"nodeType":864},{},[12935],{"type":899},"Why moving detection and response to the browser is the solution",{"data":12938,"content":12939,"nodeType":860},{},[12940,12944,12949],{"data":12941,"marks":12942,"value":12943,"nodeType":864},{},[],"First, ",{"data":12945,"marks":12946,"value":12948,"nodeType":864},{},[12947],{"type":899},"detection has to move into the browser",{"data":12950,"marks":12951,"value":12952,"nodeType":864},{},[],". Modern cloud attacks don’t announce themselves with known indicators or suspicious IPs; it’s all about behavior. A phishing kit rendering inside a login page. A session token being silently exfiltrated. A user interacting with a page that looks legitimate but isn’t. You only see those signals by inspecting the page, the scripts, and the user’s interaction, in real time, inside the tab, before any cloud API ever gets touched.",{"data":12954,"content":12955,"nodeType":860},{},[12956,12960,12965],{"data":12957,"marks":12958,"value":12959,"nodeType":864},{},[],"Second, ",{"data":12961,"marks":12962,"value":12964,"nodeType":864},{},[12963],{"type":899},"posture can’t stop at the IdP or cloud configuration.",{"data":12966,"marks":12967,"value":12968,"nodeType":864},{},[]," It’s not enough to enforce MFA and SSO at a handful of centrally managed apps and assume the rest of the estate follows suit. Shadow SaaS breaks that assumption immediately. Local accounts, duplicate identities, and MFA gaps undermine cloud access controls, even when your AWS or Azure configuration is otherwise airtight. If a sensitive app allows password-only access, that weakness propagates straight back into your cloud environment.",{"data":12970,"content":12971,"nodeType":860},{},[12972],{"data":12973,"marks":12974,"value":12975,"nodeType":864},{},[],"Finally, when something does go wrong, teams need more than a login timestamp and an IP address. They need to know what the user actually saw and did. Click-by-click browser session data is what allows responders to understand intent, scope impact accurately, and determine whether a session was abused or simply used.",{"data":12977,"content":12978,"nodeType":1312},{},[12979],{"data":12980,"marks":12981,"value":12983,"nodeType":864},{},[12982],{"type":899},"Visibility into the browser session holds the answers",{"data":12985,"content":12986,"nodeType":860},{},[12987],{"data":12988,"marks":12989,"value":12990,"nodeType":864},{},[],"If the browser session is where cloud access actually happens, then treating it as a black box is no longer viable.",{"data":12992,"content":12993,"nodeType":860},{},[12994],{"data":12995,"marks":12996,"value":12997,"nodeType":864},{},[],"This is where Push Security fits. Push is designed to cover the missing middle, not by replacing your existing cloud security stack, but by extending it into the one place it can’t reach on its own: the live browser session.",{"data":12999,"content":13000,"nodeType":860},{},[13001],{"data":13002,"marks":13003,"value":13004,"nodeType":864},{},[],"CSPM and CNAPP remain the right tools for securing cloud configuration and infrastructure. They tell you whether IAM policies are sane, resources are exposed, and guardrails are in place. Push addresses a different problem. It focuses on what happens once access is granted, when identity moves from configuration into motion.",{"data":13006,"content":13007,"nodeType":860},{},[13008],{"data":13009,"marks":13010,"value":13011,"nodeType":864},{},[],"Push does this by deploying a browser-native agent, like EDR operates at the host level. That agent gives defenders direct visibility into the application session itself like the page structure being rendered, the user’s interaction with it, and the behaviors attackers rely on when they hijack sessions in real time.",{"data":13013,"content":13016,"nodeType":996},{"target":13014},{"sys":13015},{"id":12160,"type":1001,"linkType":1002},[],{"data":13018,"content":13019,"nodeType":860},{},[13020],{"data":13021,"marks":13022,"value":13023,"nodeType":864},{},[],"That visibility changes how cloud access can be defended.",{"data":13025,"content":13026,"nodeType":941},{},[13027,13042,13057,13072],{"data":13028,"content":13029,"nodeType":945},{},[13030],{"data":13031,"content":13032,"nodeType":860},{},[13033,13038],{"data":13034,"marks":13035,"value":13037,"nodeType":864},{},[13036],{"type":899},"Real-time detection in the browser:",{"data":13039,"marks":13040,"value":13041,"nodeType":864},{},[]," Detect in-browser attacker techniques as they happen, left of boom. Phishing kits rendering inside login flows, session tokens being intercepted, credential submission into lookalike pages — Push observes these behaviors directly and can block them before any cloud API is touched or a console is reached.",{"data":13043,"content":13044,"nodeType":945},{},[13045],{"data":13046,"content":13047,"nodeType":860},{},[13048,13053],{"data":13049,"marks":13050,"value":13052,"nodeType":864},{},[13051],{"type":899},"Complete visibility into cloud access paths:",{"data":13054,"marks":13055,"value":13056,"nodeType":864},{},[]," Build an accurate inventory of how users are actually accessing cloud services. Push surfaces every application in use, including shadow SaaS, and shows which accounts are local, duplicated, missing MFA, or bypassing SSO — crucial visibility that falls between the cracks of application and identity provider. ",{"data":13058,"content":13059,"nodeType":945},{},[13060],{"data":13061,"content":13062,"nodeType":860},{},[13063,13068],{"data":13064,"marks":13065,"value":13067,"nodeType":864},{},[13066],{"type":899},"Active hardening at the point of access:",{"data":13069,"marks":13070,"value":13071,"nodeType":864},{},[]," Enforce secure login behavior across the entire application surface, not just centrally managed apps. Push can steer users toward using MFA and SSO and block risky credentials on unmanaged tools, closing identity gaps before they’re exploited.",{"data":13073,"content":13074,"nodeType":945},{},[13075],{"data":13076,"content":13077,"nodeType":860},{},[13078,13083],{"data":13079,"marks":13080,"value":13082,"nodeType":864},{},[13081],{"type":899},"Session-level context for rapid response:",{"data":13084,"marks":13085,"value":13086,"nodeType":864},{},[]," When something does go wrong, Push provides the missing ground truth. Instead of stitching together partial logs or relying on brittle app-level integrations, responders can see exactly what the user saw and did in the browser (from context generated directly from the browser session itself) making it possible to understand intent, assess scope accurately, and contain a compromised session quickly.",{"data":13088,"content":13089,"nodeType":1005},{},[],{"data":13091,"content":13092,"nodeType":1116},{},[13093],{"data":13094,"content":13095,"nodeType":860},{},[13096,13099,13106,13109,13116,13119,13126],{"data":13097,"marks":13098,"value":12289,"nodeType":864},{},[],{"data":13100,"content":13101,"nodeType":883},{"uri":12292},[13102],{"data":13103,"marks":13104,"value":12297,"nodeType":864},{},[13105],{"type":1455},{"data":13107,"marks":13108,"value":3731,"nodeType":864},{},[],{"data":13110,"content":13111,"nodeType":883},{"uri":12303},[13112],{"data":13113,"marks":13114,"value":12308,"nodeType":864},{},[13115],{"type":1455},{"data":13117,"marks":13118,"value":12312,"nodeType":864},{},[],{"data":13120,"content":13121,"nodeType":883},{"uri":1700},[13122],{"data":13123,"marks":13124,"value":12319,"nodeType":864},{},[13125],{"type":1455},{"data":13127,"marks":13128,"value":2924,"nodeType":864},{},[],{"data":13130,"content":13131,"nodeType":860},{},[13132],{"data":13133,"marks":13134,"value":21,"nodeType":864},{},[],"Push + Cloud Security: What do you do when bad looks normal?","Why cloud security tools only give you part of the picture when it comes to modern attacks. ","2026-02-06T00:00:00.000Z","push-plus-cloud-security",{"items":13140},[13141,13143],{"sys":13142,"name":7555},{"id":7554},{"sys":13144,"name":342},{"id":12756},{"items":13146},[13147],{"fullName":11831,"firstName":11832,"jobTitle":851,"profilePicture":13148},{"url":11834},"push-plus-network-security","blog/push-plus-network-security",{"json":13152},{"data":13153,"content":13154,"nodeType":856},{},[13155],{"data":13156,"content":13157,"nodeType":860},{},[13158],{"data":13159,"marks":13160,"value":13161,"nodeType":864},{},[],"One key question we get is \"we're already monitoring network and web traffic, so why do we need to be in the browser too?\". Here are the key differences.","Why network and web traffic only gives you part of the picture when it comes to modern browser-based attacks. ",{"id":13164,"publishedAt":13165},"5caCcGCqMMPm5KlwUv0sbz","2026-08-13T09:35:43.143Z",{"items":13167},[13168,13170],{"sys":13169,"name":7555},{"id":7554},{"sys":13171,"name":342},{"id":12756},{"items":13173},[13174,13176,13178,13180,13182,13184,13186,13188],{"sys":13175,"name":297,"slug":298,"tier":31},{"id":294},{"sys":13177,"name":279,"slug":280,"tier":31},{"id":276},{"sys":13179,"name":342,"slug":343,"tier":31},{"id":339},{"sys":13181,"name":624,"slug":625,"tier":45},{"id":621},{"sys":13183,"name":306,"slug":307,"tier":45},{"id":303},{"sys":13185,"name":261,"slug":262,"tier":45},{"id":258},{"sys":13187,"name":571,"slug":572,"tier":45},{"id":568},{"sys":13189,"name":589,"slug":590,"tier":45},{"id":586},"utVTmyush9vQUYa5rOo2h_Mf_xmrYJ7bhUe-9CuVFGA",{"id":13192,"title":13193,"authorsCollection":13194,"content":13200,"extension":228,"faqItemsCollection":14614,"faqTitle":59,"featured":6,"hashTags":59,"meta":14616,"metaTitle":14617,"ogImage":59,"postType":6304,"publishedDate":14618,"relatedBlogPostsCollection":14619,"slug":19241,"stem":19242,"subtitle":59,"summary":19243,"synopsis":19261,"sys":19262,"tagsCollection":19265,"topicsCollection":19271,"__hash__":19317},"blog/blog/5-reasons-why-push-security-shouldnt-exist.json","5 reasons why Push Security shouldn’t exist",{"items":13195},[13196],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":13197,"profilePicture":13199},[13198],"https://www.linkedin.com/in/daniel-g-/",{"url":2740},{"json":13201,"links":14589},{"data":13202,"content":13203,"nodeType":856},{},[13204,13224,13230,13237,13244,13265,13272,13275,13282,13289,13296,13303,13395,13402,13494,13502,13509,13516,13524,13527,13534,13541,13548,13577,13610,13639,13646,13653,13685,13692,13725,13732,13762,13769,13776,13805,13817,13824,13843,13875,13887,13890,13897,13917,13929,13947,13962,13969,13989,14021,14041,14048,14055,14074,14081,14089,14092,14099,14106,14144,14152,14159,14166,14173,14259,14283,14290,14297,14309,14329,14341,14344,14351,14358,14421,14440,14446,14449,14456,14485,14492,14499,14577,14583],{"data":13205,"content":13206,"nodeType":860},{},[13207,13211,13220],{"data":13208,"marks":13209,"value":13210,"nodeType":864},{},[],"If you caught ",{"data":13212,"content":13214,"nodeType":883},{"uri":13213},"https://cisoseries.com/securing-identities-in-the-cloud/",[13215],{"data":13216,"marks":13217,"value":13219,"nodeType":864},{},[13218],{"type":1455},"our CEO Adam’s recent appearance on the Defense in Depth podcast",{"data":13221,"marks":13222,"value":13223,"nodeType":864},{},[]," you’ll have heard some top-tier banter between Geoff and David on the problem of identity security – and how, in Geoff’s words, “way too many people” think they’ve got it covered when it comes to identity attacks.",{"data":13225,"content":13229,"nodeType":996},{"target":13226},{"sys":13227},{"id":13228,"type":1001,"linkType":1002},"UcfFq2lOiMMJKaDfaNBqx",[],{"data":13231,"content":13232,"nodeType":860},{},[13233],{"data":13234,"marks":13235,"value":13236,"nodeType":864},{},[],"At Push, we’re constantly exploring the limits of controls against the latest threats. But naturally, security teams with hundreds of priorities can’t afford to dedicate the same amount of research time to this problem that we can. This means we come across a lot of common misconceptions about how controls like MFA, SSO and EDR perform against current identity attack techniques. ",{"data":13238,"content":13239,"nodeType":860},{},[13240],{"data":13241,"marks":13242,"value":13243,"nodeType":864},{},[],"These common misconceptions are severely impacting the ability of security teams to plan for, and defend against, identity-based attacks – giving attackers the window of opportunity they need to continue exploiting people and businesses. ",{"data":13245,"content":13246,"nodeType":860},{},[13247,13251,13256,13260],{"data":13248,"marks":13249,"value":13250,"nodeType":864},{},[],"So, we hope that this allows you a clearer perspective when building your identity security strategy, with a realistic view of what a particular control will give you – and what it won’t. ",{"data":13252,"marks":13253,"value":13255,"nodeType":864},{},[13254],{"type":899},"That isn’t to say you should discard any of these controls; they all have an important part to play! ",{"data":13257,"marks":13258,"value":13259,"nodeType":864},{},[],"But, it’s important to be aware of their limitations to be able to build a resilient security model, ",{"data":13261,"marks":13262,"value":13264,"nodeType":864},{},[13263],{"type":899},"with strategic defense in depth to compensate for known weaknesses. ",{"data":13266,"content":13267,"nodeType":860},{},[13268],{"data":13269,"marks":13270,"value":13271,"nodeType":864},{},[],"Without further ado, here are the top reasons why Push Security shouldn’t exist. ",{"data":13273,"content":13274,"nodeType":1005},{},[],{"data":13276,"content":13277,"nodeType":1009},{},[13278],{"data":13279,"marks":13280,"value":13281,"nodeType":864},{},[],"Reason 1: “Browser-based attacks aren’t a priority”",{"data":13283,"content":13284,"nodeType":860},{},[13285],{"data":13286,"marks":13287,"value":13288,"nodeType":864},{},[],"Particularly in the current economic climate, with many security teams feeling the squeeze, organizations often haven’t budgeted (mentally or financially) for a new kind of threat to factor into their modelling. ",{"data":13290,"content":13291,"nodeType":860},{},[13292],{"data":13293,"marks":13294,"value":13295,"nodeType":864},{},[],"We get it, now isn’t a great time to be tackling a new problem. Getting the budget to do the same as last year is difficult enough, never mind adding something new. ",{"data":13297,"content":13298,"nodeType":860},{},[13299],{"data":13300,"marks":13301,"value":13302,"nodeType":864},{},[],"But, there’s clear evidence that we're facing something a new kind of security problem. Modern attacks are consciously evading the network and endpoint, and are increasingly playing out entirely over the internet in the form of account takeover. ",{"data":13304,"content":13305,"nodeType":941},{},[13306,13328,13351,13373],{"data":13307,"content":13308,"nodeType":945},{},[13309],{"data":13310,"content":13311,"nodeType":860},{},[13312,13316,13324],{"data":13313,"marks":13314,"value":13315,"nodeType":864},{},[],"Stolen creds are the #1 breach vector in 79% of web app attacks (",{"data":13317,"content":13318,"nodeType":883},{"uri":4408},[13319],{"data":13320,"marks":13321,"value":13323,"nodeType":864},{},[13322],{"type":1455},"Verizon",{"data":13325,"marks":13326,"value":13327,"nodeType":864},{},[],").  ",{"data":13329,"content":13330,"nodeType":945},{},[13331],{"data":13332,"content":13333,"nodeType":860},{},[13334,13338,13347],{"data":13335,"marks":13336,"value":13337,"nodeType":864},{},[],"147,000 token replay attacks in 2023, 111% increase year-over-year (",{"data":13339,"content":13341,"nodeType":883},{"uri":13340},"https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700",[13342],{"data":13343,"marks":13344,"value":13346,"nodeType":864},{},[13345],{"type":1455},"Microsoft",{"data":13348,"marks":13349,"value":13350,"nodeType":864},{},[],"). ",{"data":13352,"content":13353,"nodeType":945},{},[13354],{"data":13355,"content":13356,"nodeType":860},{},[13357,13361,13370],{"data":13358,"marks":13359,"value":13360,"nodeType":864},{},[],"80% of attacks involve identity and compromised credentials (",{"data":13362,"content":13364,"nodeType":883},{"uri":13363},"https://www.crowdstrike.com/blog/relentless-threat-activity-puts-identities-in-the-crosshairs/",[13365],{"data":13366,"marks":13367,"value":13369,"nodeType":864},{},[13368],{"type":1455},"Crowdstrike",{"data":13371,"marks":13372,"value":13327,"nodeType":864},{},[],{"data":13374,"content":13375,"nodeType":945},{},[13376],{"data":13377,"content":13378,"nodeType":860},{},[13379,13383,13391],{"data":13380,"marks":13381,"value":13382,"nodeType":864},{},[],"4,000 password-based attacks per second observed (",{"data":13384,"content":13386,"nodeType":883},{"uri":13385},"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023",[13387],{"data":13388,"marks":13389,"value":13346,"nodeType":864},{},[13390],{"type":1455},{"data":13392,"marks":13393,"value":13394,"nodeType":864},{},[],").",{"data":13396,"content":13397,"nodeType":860},{},[13398],{"data":13399,"marks":13400,"value":13401,"nodeType":864},{},[],"It’s also telling that the cyber crime ecosystem itself seems to be leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":13403,"content":13404,"nodeType":941},{},[13405,13426,13449,13471],{"data":13406,"content":13407,"nodeType":945},{},[13408],{"data":13409,"content":13410,"nodeType":860},{},[13411,13414,13422],{"data":13412,"marks":13413,"value":21,"nodeType":864},{},[],{"data":13415,"content":13416,"nodeType":883},{"uri":4408},[13417],{"data":13418,"marks":13419,"value":13421,"nodeType":864},{},[13420],{"type":1455},"According to the 2024 DBIR",{"data":13423,"marks":13424,"value":13425,"nodeType":864},{},[],", more than 1000 credentials appear on criminal forums and marketplaces every day, with the majority (65%) appearing less than a day after first being discovered. ",{"data":13427,"content":13428,"nodeType":945},{},[13429],{"data":13430,"content":13431,"nodeType":860},{},[13432,13436,13445],{"data":13433,"marks":13434,"value":13435,"nodeType":864},{},[],"In June, ",{"data":13437,"content":13439,"nodeType":883},{"uri":13438},"https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/",[13440],{"data":13441,"marks":13442,"value":13444,"nodeType":864},{},[13443],{"type":1455},"Troy Hunt at Have I Been Pwned (HIBP) wrote about the impact of channels like Telegram",{"data":13446,"marks":13447,"value":13448,"nodeType":864},{},[]," and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":13450,"content":13451,"nodeType":945},{},[13452],{"data":13453,"content":13454,"nodeType":860},{},[13455,13459,13468],{"data":13456,"marks":13457,"value":13458,"nodeType":864},{},[],"In July, ",{"data":13460,"content":13462,"nodeType":883},{"uri":13461},"https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/",[13463],{"data":13464,"marks":13465,"value":13467,"nodeType":864},{},[13466],{"type":1455},"10 billion passwords were leaked in the RockYou2024 compilation",{"data":13469,"marks":13470,"value":6570,"nodeType":864},{},[],{"data":13472,"content":13473,"nodeType":945},{},[13474],{"data":13475,"content":13476,"nodeType":860},{},[13477,13481,13490],{"data":13478,"marks":13479,"value":13480,"nodeType":864},{},[],"And ultimately, ",{"data":13482,"content":13484,"nodeType":883},{"uri":13483},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/",[13485],{"data":13486,"marks":13487,"value":13489,"nodeType":864},{},[13488],{"type":1455},"high-profile breaches",{"data":13491,"marks":13492,"value":13493,"nodeType":864},{},[]," of Snowflake customers, Microsoft, Okta, and others reinforce the threat behind the numbers, all of which are the result of identity attacks. ",{"data":13495,"content":13496,"nodeType":860},{},[13497],{"data":13498,"marks":13499,"value":13501,"nodeType":864},{},[13500],{"type":899},"So, if a business uses any third-party provided web applications or services, then its workforce identities are the lowest-hanging fruit for attackers to pick, and the risk of account takeover should be high up on the risk register. ",{"data":13503,"content":13504,"nodeType":860},{},[13505],{"data":13506,"marks":13507,"value":13508,"nodeType":864},{},[],"Yes, it’s tough to redo budgets on the fly or rip up a five year plan. But, asymmetrical cyber TTPs have always sought to undermine the best laid plans of CISOs – attackers usually look in the places that defenders aren't. ",{"data":13510,"content":13511,"nodeType":860},{},[13512],{"data":13513,"marks":13514,"value":13515,"nodeType":864},{},[],"When looking at the evidence, is securing the identity attack surface really a lower priority than adding a CASB, CSPM, or shiny new AI tool? Even when we look at historical recurring spend on things like EDR or vulnerability management, it’s arguable that the risk of identity attacks has overtaken software-based exploits for many organizations whose traditional networks are shrinking, while their cloud app estate grows. ",{"data":13517,"content":13518,"nodeType":860},{},[13519],{"data":13520,"marks":13521,"value":13523,"nodeType":864},{},[13522],{"type":899},"It’s important to consider what’s right for your business, but the evidence shows us that securing the identity attack surface promises real risk reduction in the face of a genuine threat. ",{"data":13525,"content":13526,"nodeType":1005},{},[],{"data":13528,"content":13529,"nodeType":1009},{},[13530],{"data":13531,"marks":13532,"value":13533,"nodeType":864},{},[],"Reason 2: “Our business apps are all behind SSO”",{"data":13535,"content":13536,"nodeType":860},{},[13537],{"data":13538,"marks":13539,"value":13540,"nodeType":864},{},[],"SSO is often seen as a utopia where each employee has a single, secure digital identity that is used to access all of their work applications. When businesses are using SSO, we usually hear:",{"data":13542,"content":13543,"nodeType":1312},{},[13544],{"data":13545,"marks":13546,"value":13547,"nodeType":864},{},[],"“Everything is behind SSO, there are no apps outside of it.”",{"data":13549,"content":13550,"nodeType":860},{},[13551,13555,13564,13568,13573],{"data":13552,"marks":13553,"value":13554,"nodeType":864},{},[],"Unfortunately, organizations are always using more apps than they realize. The impact of ",{"data":13556,"content":13558,"nodeType":883},{"uri":13557},"https://productled.com/blog/product-led-growth-definition",[13559],{"data":13560,"marks":13561,"value":13563,"nodeType":864},{},[13562],{"type":1455},"product-led growth",{"data":13565,"marks":13566,"value":13567,"nodeType":864},{},[]," on the self adoption of cloud services is well documented, and we see that ",{"data":13569,"marks":13570,"value":13572,"nodeType":864},{},[13571],{"type":899},"even SMEs typically have 100+ apps in their estate",{"data":13574,"marks":13575,"value":13576,"nodeType":864},{},[],", and the number of apps per business continues to grow year on year. ",{"data":13578,"content":13579,"nodeType":860},{},[13580,13584,13589,13593,13597,13601,13606],{"data":13581,"marks":13582,"value":13583,"nodeType":864},{},[],"So, while every ",{"data":13585,"marks":13586,"value":13588,"nodeType":864},{},[13587],{"type":899},"known ",{"data":13590,"marks":13591,"value":13592,"nodeType":864},{},[],"app",{"data":13594,"marks":13595,"value":1171,"nodeType":864},{},[13596],{"type":899},{"data":13598,"marks":13599,"value":13600,"nodeType":864},{},[],"might be behind SSO, this still leaves tens or hundreds of ",{"data":13602,"marks":13603,"value":13605,"nodeType":864},{},[13604],{"type":899},"unknown",{"data":13607,"marks":13608,"value":13609,"nodeType":864},{},[]," apps, with thousands of associated identities. ",{"data":13611,"content":13612,"nodeType":860},{},[13613,13617,13622,13626,13635],{"data":13614,"marks":13615,"value":13616,"nodeType":864},{},[],"But even if you did know about every app, the fact of the matter is ",{"data":13618,"marks":13619,"value":13621,"nodeType":864},{},[13620],{"type":899},"that fewer than 1 in 3 apps actually support SAML SSO",{"data":13623,"marks":13624,"value":13625,"nodeType":864},{},[],", and many of those ",{"data":13627,"content":13629,"nodeType":883},{"uri":13628},"https://sso.tax/",[13630],{"data":13631,"marks":13632,"value":13634,"nodeType":864},{},[13633],{"type":1455},"only at the premium tier",{"data":13636,"marks":13637,"value":13638,"nodeType":864},{},[],". Our data shows that the proportion of apps actually behind SSO is even lower, at 1 in 5. So getting everything behind SSO just isn’t a realistic goal for any organization. ",{"data":13640,"content":13641,"nodeType":1312},{},[13642],{"data":13643,"marks":13644,"value":13645,"nodeType":864},{},[],"“Everything important is behind SSO, and the apps that aren’t don’t pose a risk.” ",{"data":13647,"content":13648,"nodeType":860},{},[13649],{"data":13650,"marks":13651,"value":13652,"nodeType":864},{},[],"There’s often a view that if it wasn’t centrally procured, IT wasn’t involved, and it’s not behind SSO, then it’s just not a concern. But apps can have complex integrations and permissions that increase the potential blast radius of an app compromise. ",{"data":13654,"content":13655,"nodeType":860},{},[13656,13660,13669,13673,13681],{"data":13657,"marks":13658,"value":13659,"nodeType":864},{},[],"We’ve published ",{"data":13661,"content":13663,"nodeType":883},{"uri":13662},"https://github.com/pushsecurity/saas-attacks",[13664],{"data":13665,"marks":13666,"value":13668,"nodeType":864},{},[13667],{"type":1455},"extensive research on SaaS-native attack techniques",{"data":13670,"marks":13671,"value":13672,"nodeType":864},{},[]," and documented many of the scenarios in which attackers can expand from hijacking a single SaaS app with a small number of users into a larger-scale compromise, for example through ",{"data":13674,"content":13675,"nodeType":883},{"uri":5876},[13676],{"data":13677,"marks":13678,"value":13680,"nodeType":864},{},[13679],{"type":1455},"SAMLjacking",{"data":13682,"marks":13683,"value":13684,"nodeType":864},{},[],": Modifying SAML for a compromised app to redirect users to a malicious domain during the authentication process that proxies a legitimate authentication service (e.g. Google, Okta or Microsoft) – effectively acting as a watering hole for further credential harvesting. ",{"data":13686,"content":13687,"nodeType":860},{},[13688],{"data":13689,"marks":13690,"value":13691,"nodeType":864},{},[],"Also, the value of an app is not necessarily tied to the number of users it has in the business. A sales and marketing app can contain huge amounts of sensitive data, as can developer apps – just look at Snowflake! It only takes a single account to be created, a single integration to be set up, to result in a major data breach down the line. ",{"data":13693,"content":13694,"nodeType":860},{},[13695,13699,13708,13712,13721],{"data":13696,"marks":13697,"value":13698,"nodeType":864},{},[],"You can check out our ",{"data":13700,"content":13702,"nodeType":883},{"uri":13701},"https://pushsecurity.com/blog/",[13703],{"data":13704,"marks":13705,"value":13707,"nodeType":864},{},[13706],{"type":1455},"blog page",{"data":13709,"marks":13710,"value":13711,"nodeType":864},{},[]," or ",{"data":13713,"content":13715,"nodeType":883},{"uri":13714},"https://www.youtube.com/watch?v=xZIQd_0v9sE&t=12s",[13716],{"data":13717,"marks":13718,"value":13720,"nodeType":864},{},[13719],{"type":1455},"watch one of our videos",{"data":13722,"marks":13723,"value":13724,"nodeType":864},{},[]," for more information.   ",{"data":13726,"content":13727,"nodeType":1312},{},[13728],{"data":13729,"marks":13730,"value":13731,"nodeType":864},{},[],"Ghost logins: A nightmare for SSO, dreamy for attackers",{"data":13733,"content":13734,"nodeType":860},{},[13735,13739,13744,13748,13758],{"data":13736,"marks":13737,"value":13738,"nodeType":864},{},[],"You might already be feeling a bit deflated that SSO isn’t going to give you everything you wanted, and we’re sorry to be the bearer of bad news. Unfortunately, ",{"data":13740,"marks":13741,"value":13743,"nodeType":864},{},[13742],{"type":899},"even if you are using SSO, additional login methods can still exist alongside SSO",{"data":13745,"marks":13746,"value":13747,"nodeType":864},{},[],". We call these ",{"data":13749,"content":13751,"nodeType":883},{"uri":13750},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[13752],{"data":13753,"marks":13754,"value":13757,"nodeType":864},{},[13755,13756],{"type":1455},{"type":899},"ghost logins",{"data":13759,"marks":13760,"value":6570,"nodeType":864},{},[13761],{"type":899},{"data":13763,"content":13764,"nodeType":860},{},[13765],{"data":13766,"marks":13767,"value":13768,"nodeType":864},{},[],"Ghost logins are effectively any alternative login method. In addition to SSO, you could have a local password, a social login (e.g., login with Google, Facebook, etc.), backup emails, or API-based login methods. ",{"data":13770,"content":13771,"nodeType":860},{},[13772],{"data":13773,"marks":13774,"value":13775,"nodeType":864},{},[],"Multiple methods are often enabled by default and need to be explicitly disabled at the app level. Further, migrating an existing app to SSO doesn’t automatically remove local accounts, but effectively adds an SSO layer on top. ",{"data":13777,"content":13778,"nodeType":860},{},[13779,13783,13788,13792,13801],{"data":13780,"marks":13781,"value":13782,"nodeType":864},{},[],"The final problem here is that because MFA is applied separately at the app level and SSO level, ",{"data":13784,"marks":13785,"value":13787,"nodeType":864},{},[13786],{"type":899},"you can have local logins without MFA, at the same time as SSO logins with MFA — that can be used concurrently.",{"data":13789,"marks":13790,"value":13791,"nodeType":864},{},[]," This was acutely felt during the recent Snowflake breaches, ",{"data":13793,"content":13795,"nodeType":883},{"uri":13794},"https://pushsecurity.com/resources/video/demonstrating-ghost-logins-in-snowflake-and-how-to-remediate-them/",[13796],{"data":13797,"marks":13798,"value":13800,"nodeType":864},{},[13799],{"type":1455},"where in-app identification and disabling of non-SSO logins proved to be particularly error-prone",{"data":13802,"marks":13803,"value":13804,"nodeType":864},{},[],".  ",{"data":13806,"content":13807,"nodeType":860},{},[13808,13812],{"data":13809,"marks":13810,"value":13811,"nodeType":864},{},[],"The result here is that credential stuffing attacks can still prove successful against your SSO-joined apps if local logins exist, and MFA hasn’t been specifically set at the app level. ",{"data":13813,"marks":13814,"value":13816,"nodeType":864},{},[13815],{"type":899},"And unless you’ve specifically disabled them and unset every non-SSO login for every app, they probably do. ",{"data":13818,"content":13819,"nodeType":1312},{},[13820],{"data":13821,"marks":13822,"value":13823,"nodeType":864},{},[],"The verdict: SSO is great, but it's no silver bullet",{"data":13825,"content":13826,"nodeType":860},{},[13827,13831,13839],{"data":13828,"marks":13829,"value":13830,"nodeType":864},{},[],"While SSO is invariably a beneficial security control, ",{"data":13832,"content":13834,"nodeType":883},{"uri":13833},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/#id-how-can-ghost-logins-be-abused-by-attackers_id-ghost-logins-for-persistence-and-defense-evasion",[13835],{"data":13836,"marks":13837,"value":13838,"nodeType":864},{},[],"attackers can also naturally exploit it to gain access to a large number of downstream applications",{"data":13840,"marks":13841,"value":13842,"nodeType":864},{},[],". If you compromise an IdP account like Okta, you can then access any connected app, often without requiring any further authentication.",{"data":13844,"content":13845,"nodeType":860},{},[13846,13850,13859,13863,13872],{"data":13847,"marks":13848,"value":13849,"nodeType":864},{},[],"We’ve seen this recently, with an ",{"data":13851,"content":13853,"nodeType":883},{"uri":13852},"https://www.bleepingcomputer.com/news/security/okta-warns-of-unprecedented-credential-stuffing-attacks-on-customers/",[13854],{"data":13855,"marks":13856,"value":13858,"nodeType":864},{},[13857],{"type":1455},"unprecedented spike in credential stuffing attacks reported by Okta",{"data":13860,"marks":13861,"value":13862,"nodeType":864},{},[],", as well as ",{"data":13864,"content":13866,"nodeType":883},{"uri":13865},"https://www.bleepingcomputer.com/news/security/okta-warns-of-credential-stuffing-attacks-targeting-its-cors-feature/",[13867],{"data":13868,"marks":13869,"value":13871,"nodeType":864},{},[13870],{"type":1455},"attacks looking to exploit Okta’s CORS feature",{"data":13873,"marks":13874,"value":6570,"nodeType":864},{},[],{"data":13876,"content":13877,"nodeType":860},{},[13878,13883],{"data":13879,"marks":13880,"value":13882,"nodeType":864},{},[13881],{"type":899},"Ultimately, the promised land of a 1:1 employee to identity ratio just isn’t realistic. ",{"data":13884,"marks":13885,"value":13886,"nodeType":864},{},[],"So while SSO is a big part of the solution to identity attacks, it’s not a silver bullet.   ",{"data":13888,"content":13889,"nodeType":1005},{},[],{"data":13891,"content":13892,"nodeType":1009},{},[13893],{"data":13894,"marks":13895,"value":13896,"nodeType":864},{},[],"Reason 3: “We’ve got MFA deployed everywhere”",{"data":13898,"content":13899,"nodeType":860},{},[13900,13904,13913],{"data":13901,"marks":13902,"value":13903,"nodeType":864},{},[],"Microsoft famously stated that ",{"data":13905,"content":13907,"nodeType":883},{"uri":13906},"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023#:~:text=Outlier%20attacks%20make%20up%20just,of%20compromise%20by%2099.2%20percent.",[13908],{"data":13909,"marks":13910,"value":13912,"nodeType":864},{},[13911],{"type":1455},"MFA reduces the risk of compromise by 99.2%",{"data":13914,"marks":13915,"value":13916,"nodeType":864},{},[],". But this doesn’t mean that it stops 99% of attacks. Or, that it should make up 99% of your defense. ",{"data":13918,"content":13919,"nodeType":860},{},[13920,13924],{"data":13921,"marks":13922,"value":13923,"nodeType":864},{},[],"MFA unarguably raises the bar for attackers, even if that bar is still pretty low. Naturally, accounts without MFA are an easier target. ",{"data":13925,"marks":13926,"value":13928,"nodeType":864},{},[13927],{"type":899},"But the problem is that MFA isn’t an enterprise-wide castle wall. It’s more like a row of hurdles with gaps in-between. ",{"data":13930,"content":13931,"nodeType":860},{},[13932,13936,13944],{"data":13933,"marks":13934,"value":13935,"nodeType":864},{},[],"MFA is usually handled separately at the SSO level and app level. For apps that are self-adopted by end users, they can't be relied on to add in a security control that will introduce friction to their user experience. Building on the aforementioned ghost logins, even if MFA is adopted at the SSO level, local logins can exist without MFA unless also applied at the app level. ",{"data":13937,"content":13938,"nodeType":883},{"uri":13794},[13939],{"data":13940,"marks":13941,"value":13943,"nodeType":864},{},[13942],{"type":1455},"The recent Snowflake breach is a perfect example of this problem",{"data":13945,"marks":13946,"value":6570,"nodeType":864},{},[],{"data":13948,"content":13949,"nodeType":860},{},[13950,13954,13959],{"data":13951,"marks":13952,"value":13953,"nodeType":864},{},[],"Because of this, ",{"data":13955,"marks":13956,"value":13958,"nodeType":864},{},[13957],{"type":899},"we find that only around 1 in 3 identities actually have MFA enabled",{"data":13960,"marks":13961,"value":6570,"nodeType":864},{},[],{"data":13963,"content":13964,"nodeType":1312},{},[13965],{"data":13966,"marks":13967,"value":13968,"nodeType":864},{},[],"\"MFA protects us against phishing attacks\"",{"data":13970,"content":13971,"nodeType":860},{},[13972,13976,13985],{"data":13973,"marks":13974,"value":13975,"nodeType":864},{},[],"Even where MFA is deployed, most MFA methods are proven to be phishable or otherwise bypassable. SMS and push-based MFA are susceptible to well known bypasses including SIM swapping and ",{"data":13977,"content":13979,"nodeType":883},{"uri":13978},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_fatigue/description.md",[13980],{"data":13981,"marks":13982,"value":13984,"nodeType":864},{},[13983],{"type":1455},"MFA fatigue",{"data":13986,"marks":13987,"value":13988,"nodeType":864},{},[]," attacks. TOTP is a little better, but still vulnerable. ",{"data":13990,"content":13991,"nodeType":860},{},[13992,13996,14005,14009,14018],{"data":13993,"marks":13994,"value":13995,"nodeType":864},{},[],"Many attacks are simply cutting out the middleman and focusing on ",{"data":13997,"content":13999,"nodeType":883},{"uri":13998},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/session_cookie_theft/description.md",[14000],{"data":14001,"marks":14002,"value":14004,"nodeType":864},{},[14003],{"type":1455},"using stolen session tokens",{"data":14006,"marks":14007,"value":14008,"nodeType":864},{},[]," to bypass MFA. The most common method for this is via infostealers, which typically scrape all credentials (e.g. usernames, passwords, login pages, session tokens) as well as other information stored in the browser of an infected device. ",{"data":14010,"content":14012,"nodeType":883},{"uri":14011},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[14013],{"data":14014,"marks":14015,"value":14017,"nodeType":864},{},[14016],{"type":1455},"Infostealers played a major role in the recent Snowflake breach",{"data":14019,"marks":14020,"value":6570,"nodeType":864},{},[],{"data":14022,"content":14023,"nodeType":860},{},[14024,14028,14037],{"data":14025,"marks":14026,"value":14027,"nodeType":864},{},[],"Additionally, ",{"data":14029,"content":14031,"nodeType":883},{"uri":14030},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[14032],{"data":14033,"marks":14034,"value":14036,"nodeType":864},{},[14035],{"type":1455},"modern phishing techniques like adversary-in-the-middle (AitM) and browser-in-the-middle (BitM)",{"data":14038,"marks":14039,"value":14040,"nodeType":864},{},[]," see the attacker steal the live session and associated tokens from the victim, with the victim prompted to complete the MFA process as part of the attack. ",{"data":14042,"content":14043,"nodeType":1312},{},[14044],{"data":14045,"marks":14046,"value":14047,"nodeType":864},{},[],"“We’re using passkeys”",{"data":14049,"content":14050,"nodeType":860},{},[14051],{"data":14052,"marks":14053,"value":14054,"nodeType":864},{},[],"Great! Passkey users are in a better position than 99% of other businesses. Passkeys are widely accepted to be phishing resistant – at least for now, although as more businesses use them, new ways of getting around them will no doubt be discovered by attackers. ",{"data":14056,"content":14057,"nodeType":860},{},[14058,14062,14071],{"data":14059,"marks":14060,"value":14061,"nodeType":864},{},[],"But, MFA downgrade attacks are possible. There are often backup MFA methods set that can be selected by canceling the authentication prompt and selecting a different method. Even when these aren’t selectable, ",{"data":14063,"content":14065,"nodeType":883},{"uri":14064},"https://pushsecurity.com/blog/mfa-downgrade-attacks/",[14066],{"data":14067,"marks":14068,"value":14070,"nodeType":864},{},[14069],{"type":1455},"researchers have demonstrated ways of downgrading authentication to use a phishable method",{"data":14072,"marks":14073,"value":6570,"nodeType":864},{},[],{"data":14075,"content":14076,"nodeType":860},{},[14077],{"data":14078,"marks":14079,"value":14080,"nodeType":864},{},[],"Most apps are designed primarily for user flexibility, not security. And backup methods have a legitimate use-case – what if the authenticator device is lost or stops working? If passkeys are the only authentication method, you just got locked out of all of your accounts. But at least no hackers can access them either, right?",{"data":14082,"content":14083,"nodeType":860},{},[14084],{"data":14085,"marks":14086,"value":14088,"nodeType":864},{},[14087],{"type":899},"Like SSO, unless backup MFA methods are disabled for all identities and apps, and all users have enabled MFA across all their accounts and login methods, this isn’t a silver bullet either.  ",{"data":14090,"content":14091,"nodeType":1005},{},[],{"data":14093,"content":14094,"nodeType":1009},{},[14095],{"data":14096,"marks":14097,"value":14098,"nodeType":864},{},[],"Reason 4: “We’ve got anti-phishing controls already”",{"data":14100,"content":14101,"nodeType":860},{},[14102],{"data":14103,"marks":14104,"value":14105,"nodeType":864},{},[],"Identity attacks have evolved significantly in recent years, as have the environments being targeted by attackers with the shift to cloud services and decentralized business IT. Unfortunately, traditional anti-phishing controls weren’t designed for this reality. ",{"data":14107,"content":14108,"nodeType":941},{},[14109,14129],{"data":14110,"content":14111,"nodeType":945},{},[14112],{"data":14113,"content":14114,"nodeType":860},{},[14115,14120,14125],{"data":14116,"marks":14117,"value":14119,"nodeType":864},{},[14118],{"type":899},"A",{"data":14121,"marks":14122,"value":14124,"nodeType":864},{},[14123],{"type":899},"ttacks used to be focused on a single VPN/webmail endpoint ",{"data":14126,"marks":14127,"value":14128,"nodeType":864},{},[],"that was naturally easier to protect than 100+ SaaS apps (especially if the security team isn’t even aware of them). Attackers now have 1000s of sprawled identities to target per enterprise, increasing the chance that weak or reused passwords will be found. ",{"data":14130,"content":14131,"nodeType":945},{},[14132],{"data":14133,"content":14134,"nodeType":860},{},[14135,14140],{"data":14136,"marks":14137,"value":14139,"nodeType":864},{},[14138],{"type":899},"Likewise, security teams only needed to care about a small set of credentials ",{"data":14141,"marks":14142,"value":14143,"nodeType":864},{},[],"relating to user directory accounts and VPN/remote access tooling used to tunnel into the corporate network. Now, business functions and data are dispersed across cloud apps rather than being neatly contained in on-prem apps and databases.",{"data":14145,"content":14146,"nodeType":860},{},[14147],{"data":14148,"marks":14149,"value":14151,"nodeType":864},{},[14150],{"type":899},"Now, attackers have more platforms on which to phish your users, more credentials to choose from, and more apps to spray them across, while security teams have a much larger surface to defend.",{"data":14153,"content":14154,"nodeType":1312},{},[14155],{"data":14156,"marks":14157,"value":14158,"nodeType":864},{},[],"“Our email and content filtering controls stop phishing attacks”",{"data":14160,"content":14161,"nodeType":860},{},[14162],{"data":14163,"marks":14164,"value":14165,"nodeType":864},{},[],"Existing phishing prevention solutions have tried to solve the problem by protecting the inbox, a common (but not the only) attack vector, or by blocking lists of known-bad domains. ",{"data":14167,"content":14168,"nodeType":860},{},[14169],{"data":14170,"marks":14171,"value":14172,"nodeType":864},{},[],"But, these approaches have major shortcomings:",{"data":14174,"content":14175,"nodeType":941},{},[14176,14216,14231],{"data":14177,"content":14178,"nodeType":945},{},[14179],{"data":14180,"content":14181,"nodeType":860},{},[14182,14187,14191,14200,14203,14212],{"data":14183,"marks":14184,"value":14186,"nodeType":864},{},[14185],{"type":899},"Incomplete coverage: ",{"data":14188,"marks":14189,"value":14190,"nodeType":864},{},[],"Email-based phishing prevention tools can catch general spray-and-pray email phishing campaigns, but it only takes a small amount of tailoring to fly under their radar. The use of LLM tools to tailor phishing emails for their intended victims already makes this possible at scale. Email-based tools also fail to cover phishing attacks beyond the inbox, such as ",{"data":14192,"content":14194,"nodeType":883},{"uri":14193},"https://pushsecurity.com/blog/slack-phishing-for-initial-access/",[14195],{"data":14196,"marks":14197,"value":14199,"nodeType":864},{},[14198],{"type":1455},"Slack",{"data":14201,"marks":14202,"value":902,"nodeType":864},{},[],{"data":14204,"content":14206,"nodeType":883},{"uri":14205},"https://pushsecurity.com/blog/phishing-microsoft-teams-for-initial-access/",[14207],{"data":14208,"marks":14209,"value":14211,"nodeType":864},{},[14210],{"type":1455},"Teams",{"data":14213,"marks":14214,"value":14215,"nodeType":864},{},[]," phishing.",{"data":14217,"content":14218,"nodeType":945},{},[14219],{"data":14220,"content":14221,"nodeType":860},{},[14222,14227],{"data":14223,"marks":14224,"value":14226,"nodeType":864},{},[14225],{"type":899},"Expired intel: ",{"data":14228,"marks":14229,"value":14230,"nodeType":864},{},[],"Tools that rely on known-bad domains always have an incomplete picture because a domain must be reported as malicious in order to get added to a blocklist. Meanwhile, attackers can spin up new sites or host phishing pages on existing sites by exploiting vulnerabilities in them, bypassing rules around preventing visits to newly registered domains. It’s like trying to hit a moving target.",{"data":14232,"content":14233,"nodeType":945},{},[14234],{"data":14235,"content":14236,"nodeType":860},{},[14237,14242,14246,14255],{"data":14238,"marks":14239,"value":14241,"nodeType":864},{},[14240],{"type":899},"Web-based obfuscation: ",{"data":14243,"marks":14244,"value":14245,"nodeType":864},{},[],"Attacker tools and malicious implants running on webpages are constantly evolving to evade fingerprinting, and attackers are using techniques like ",{"data":14247,"content":14249,"nodeType":883},{"uri":14248},"https://www.cyfirma.com/research/html-smuggling-a-stealthier-approach-to-deliver-malware/",[14250],{"data":14251,"marks":14252,"value":14254,"nodeType":864},{},[14253],{"type":1455},"HTML smuggling",{"data":14256,"marks":14257,"value":14258,"nodeType":864},{},[]," to get around web-based controls put in place by developers. ",{"data":14260,"content":14261,"nodeType":860},{},[14262,14266,14271,14275,14280],{"data":14263,"marks":14264,"value":14265,"nodeType":864},{},[],"Even if these controls are sometimes successful, attackers have reliably demonstrated ways to get around them, ",{"data":14267,"marks":14268,"value":14270,"nodeType":864},{},[14269],{"type":899},"it really is a cat-and-mouse game at this point",{"data":14272,"marks":14273,"value":14274,"nodeType":864},{},[],". There usually needs to be a compromise before the attacker's infrastructure or tooling can be tagged and blocked, but ",{"data":14276,"marks":14277,"value":14279,"nodeType":864},{},[14278],{"type":899},"they evolve so rapidly that defenders are always one step behind",{"data":14281,"marks":14282,"value":6570,"nodeType":864},{},[],{"data":14284,"content":14285,"nodeType":1312},{},[14286],{"data":14287,"marks":14288,"value":14289,"nodeType":864},{},[],"“All our employees use a password manager”",{"data":14291,"content":14292,"nodeType":860},{},[14293],{"data":14294,"marks":14295,"value":14296,"nodeType":864},{},[],"Password managers are increasingly necessary due to the large number of credentials that users now have to juggle. Since the majority of apps don’t support SAML SSO, the need for separate credentials per app isn’t going away any time soon. ",{"data":14298,"content":14299,"nodeType":860},{},[14300,14304],{"data":14301,"marks":14302,"value":14303,"nodeType":864},{},[],"We often find 2 or more password managers in use per organization (not exactly optimal), but despite increased password manager adoption we see consistently high levels of password reuse, ",{"data":14305,"marks":14306,"value":14308,"nodeType":864},{},[14307],{"type":899},"with 1 in 3 users reusing passwords – including their sensitive IdP credentials. ",{"data":14310,"content":14311,"nodeType":860},{},[14312,14316,14325],{"data":14313,"marks":14314,"value":14315,"nodeType":864},{},[],"High levels of password reuse shows us that password managers don’t automatically result in secure employee behaviors, while widespread credential reuse significantly increases exposure to ",{"data":14317,"content":14319,"nodeType":883},{"uri":14318},"https://pushsecurity.com/blog/what-is-credential-stuffing/",[14320],{"data":14321,"marks":14322,"value":14324,"nodeType":864},{},[14323],{"type":1455},"credential stuffing attacks",{"data":14326,"marks":14327,"value":14328,"nodeType":864},{},[]," where attackers spray known username and password combinations across a range of app login pages.  ",{"data":14330,"content":14331,"nodeType":860},{},[14332,14337],{"data":14333,"marks":14334,"value":14336,"nodeType":864},{},[14335],{"type":899},"Generally, businesses have very limited visibility into employee password data",{"data":14338,"marks":14339,"value":14340,"nodeType":864},{},[]," to be able to enforce good practice or accurately respond to data breaches involving credential dumps, even if employees are using a password manager (or several, as the case may be).  ",{"data":14342,"content":14343,"nodeType":1005},{},[],{"data":14345,"content":14346,"nodeType":1009},{},[14347],{"data":14348,"marks":14349,"value":14350,"nodeType":864},{},[],"Reason 5: “We’ve got all the security data we need”",{"data":14352,"content":14353,"nodeType":860},{},[14354],{"data":14355,"marks":14356,"value":14357,"nodeType":864},{},[],"Organizations looking to protect themselves from modern identity attacks suffer from a pretty substantial telemetry gap. ",{"data":14359,"content":14360,"nodeType":941},{},[14361,14376,14391,14406],{"data":14362,"content":14363,"nodeType":945},{},[14364],{"data":14365,"content":14366,"nodeType":860},{},[14367,14372],{"data":14368,"marks":14369,"value":14371,"nodeType":864},{},[14370],{"type":899},"Endpoint logs ",{"data":14373,"marks":14374,"value":14375,"nodeType":864},{},[],"won’t show anything meaningful because most identity attacks don’t need to target the endpoint – no malware is deployed, everything happens in the browser, over the internet. ",{"data":14377,"content":14378,"nodeType":945},{},[14379],{"data":14380,"content":14381,"nodeType":860},{},[14382,14387],{"data":14383,"marks":14384,"value":14386,"nodeType":864},{},[14385],{"type":899},"Application logs",{"data":14388,"marks":14389,"value":14390,"nodeType":864},{},[]," are limited in availability, scope, and ease of ingestion, with most app vendors providing substandard logging, and requiring complex custom integrations to get what little data is available. ",{"data":14392,"content":14393,"nodeType":945},{},[14394],{"data":14395,"content":14396,"nodeType":860},{},[14397,14402],{"data":14398,"marks":14399,"value":14401,"nodeType":864},{},[14400],{"type":899},"Network logs",{"data":14403,"marks":14404,"value":14405,"nodeType":864},{},[]," (such as via web proxy) struggle to gather and piece together identity data points at-scale, across different apps, due to the sheer volume and broken format of the data post-TLS-termination. ",{"data":14407,"content":14408,"nodeType":945},{},[14409],{"data":14410,"content":14411,"nodeType":860},{},[14412,14417],{"data":14413,"marks":14414,"value":14416,"nodeType":864},{},[14415],{"type":899},"Identity provider logs",{"data":14418,"marks":14419,"value":14420,"nodeType":864},{},[]," naturally only cover SSO integrated apps (and therefore don’t cover ⅔ of your business apps) and look exclusively at authentication, and so are blind to client side attacks like phishing. ",{"data":14422,"content":14423,"nodeType":860},{},[14424,14428,14437],{"data":14425,"marks":14426,"value":14427,"nodeType":864},{},[],"Unless you’re ingesting data from a browser-based solution like Push, it’s unlikely you have a full monitoring visibility of your identity attack surface. ",{"data":14429,"content":14431,"nodeType":883},{"uri":14430},"https://pushsecurity.com/blog/the-web-proxy-is-dead-long-live-the-browser-extension/",[14432],{"data":14433,"marks":14434,"value":14436,"nodeType":864},{},[14435],{"type":1455},"Read more on the value of browser telemetry here. ",{"data":14438,"marks":14439,"value":21,"nodeType":864},{},[],{"data":14441,"content":14445,"nodeType":996},{"target":14442},{"sys":14443},{"id":14444,"type":1001,"linkType":1002},"5jPCGPO1tnIkoI7MKW4oUi",[],{"data":14447,"content":14448,"nodeType":1005},{},[],{"data":14450,"content":14451,"nodeType":1009},{},[14452],{"data":14453,"marks":14454,"value":14455,"nodeType":864},{},[],"Maybe there’s a reason for Push to exist after all!",{"data":14457,"content":14458,"nodeType":860},{},[14459,14464,14468,14473,14476,14481],{"data":14460,"marks":14461,"value":14463,"nodeType":864},{},[14462],{"type":899},"The key takeaway here is that there are no quick fixes or silver bullets. ",{"data":14465,"marks":14466,"value":14467,"nodeType":864},{},[],"Things like SSO, MFA, and password managers are all part of the solution, ",{"data":14469,"marks":14470,"value":14472,"nodeType":864},{},[14471],{"type":899},"but",{"data":14474,"marks":14475,"value":1171,"nodeType":864},{},[],{"data":14477,"marks":14478,"value":14480,"nodeType":864},{},[14479],{"type":899},"aren’t set-and-forget controls",{"data":14482,"marks":14483,"value":14484,"nodeType":864},{},[],". They need to be continually monitored and maintained to ensure they remain effective.",{"data":14486,"content":14487,"nodeType":860},{},[14488],{"data":14489,"marks":14490,"value":14491,"nodeType":864},{},[],"Push stops identity attacks by continually finding and fixing identity vulnerabilities, providing deep context to manage the identity attack surface without looking through blinkers at the IdP or individual apps. ",{"data":14493,"content":14494,"nodeType":860},{},[14495],{"data":14496,"marks":14497,"value":14498,"nodeType":864},{},[],"Push helps businesses to get the most out of their identity controls (and bridge the gaps they leave) by:",{"data":14500,"content":14501,"nodeType":941},{},[14502,14517,14532,14547,14562],{"data":14503,"content":14504,"nodeType":945},{},[14505],{"data":14506,"content":14507,"nodeType":860},{},[14508,14513],{"data":14509,"marks":14510,"value":14512,"nodeType":864},{},[14511],{"type":899},"Locating all business apps",{"data":14514,"marks":14515,"value":14516,"nodeType":864},{},[],", not just those plugged into your IdP, so they can be put behind SSO (where possible) or at least securely managed and configured.",{"data":14518,"content":14519,"nodeType":945},{},[14520],{"data":14521,"content":14522,"nodeType":860},{},[14523,14528],{"data":14524,"marks":14525,"value":14527,"nodeType":864},{},[14526],{"type":899},"Identifying all workforce identities, associated login types, and MFA methods",{"data":14529,"marks":14530,"value":14531,"nodeType":864},{},[]," to more clearly pinpoint gaps, harden identities, and remediate vulnerabilities like ghost logins.",{"data":14533,"content":14534,"nodeType":945},{},[14535],{"data":14536,"content":14537,"nodeType":860},{},[14538,14543],{"data":14539,"marks":14540,"value":14542,"nodeType":864},{},[14541],{"type":899},"Stopping account takeover attempts",{"data":14544,"marks":14545,"value":14546,"nodeType":864},{},[]," by detecting and blocking AitM and BitM phishing toolkits running on webpages, blocking sensitive credential reuse to prevent credential phishing, and identifying stolen sessions running in attacker browsers. ",{"data":14548,"content":14549,"nodeType":945},{},[14550],{"data":14551,"content":14552,"nodeType":860},{},[14553,14558],{"data":14554,"marks":14555,"value":14557,"nodeType":864},{},[14556],{"type":899},"Preventing password-based attacks",{"data":14559,"marks":14560,"value":14561,"nodeType":864},{},[]," by detecting the use of weak, reused, and breached passwords across the app estate.  ",{"data":14563,"content":14564,"nodeType":945},{},[14565],{"data":14566,"content":14567,"nodeType":860},{},[14568,14573],{"data":14569,"marks":14570,"value":14572,"nodeType":864},{},[14571],{"type":899},"Providing unique telemetry in the browser",{"data":14574,"marks":14575,"value":14576,"nodeType":864},{},[]," to build both proactive and reactive security operations workflows, or add missing context to other data sources, such as IdP, application, or endpoint logs.",{"data":14578,"content":14582,"nodeType":996},{"target":14579},{"sys":14580},{"id":14581,"type":1001,"linkType":1002},"11p9wnGrZHqp3XPpThHFk3",[],{"data":14584,"content":14585,"nodeType":860},{},[14586],{"data":14587,"marks":14588,"value":21,"nodeType":864},{},[],{"entries":14590},{"hyperlink":14591,"inline":14592,"block":14593},[],[],[14594,14601,14609],{"sys":14595,"__typename":1724,"title":14596,"caption":14597,"layoutMode":59,"file":14598},{"id":13228},"Nobody has any identity problems, right?","Push Security’s cheekiest advisor, Geoff Belknap.",{"url":14599,"width":14600,"height":14600},"https://images.ctfassets.net/y1cdw1ablpvd/28qcLq225o8kusjQQQUnCC/98b10fe4f9e6916eb7657f60ab869062/Geoff_Ad__1_.png",1210,{"sys":14602,"__typename":1724,"title":14603,"caption":14604,"layoutMode":59,"file":14605},{"id":14444},"Telemetry comparison table","The browser presents a significant advantage over other sources of identity attack data.",{"url":14606,"width":14607,"height":14608},"https://images.ctfassets.net/y1cdw1ablpvd/4feAEpfP6tetyTjcLIopwG/5bec8c8c10e6e328ebe258bc59bc3cb6/Frame_627570__7_.png",2444,894,{"sys":14610,"__typename":1717,"type":14611,"ctaText":14612,"buttonLabel":14613,"buttonColour":1721,"buttonUrl":59},{"id":14581},"Demo","Book a demo to see how Push stops account takeover","Book demo",{"items":14615},[],{},"Tackling common browser & identity security misconceptions","2024-07-11T00:00:00.000Z",{"items":14620},[14621,17593,18401],{"__typename":2059,"sys":14622,"content":14624,"title":17579,"synopsis":17580,"hashTags":59,"publishedDate":17581,"slug":17582,"tagsCollection":17583,"authorsCollection":17589},{"id":14623},"6XIts2UEnrsJDki8gKDXyI",{"json":14625},{"data":14626,"content":14627,"nodeType":856},{},[14628,14635,14667,14674,14680,14687,14707,14730,14737,14744,14768,14784,14791,14803,14810,14813,14820,14827,14843,14855,14866,14896,14899,14906,14925,14932,14940,15035,15042,15181,15188,15306,15313,15320,15492,15499,15506,15589,15592,15599,15606,15613,15676,15683,15716,15723,15766,15772,15778,16015,16021,16029,16036,16039,16046,16053,16060,16113,16120,16163,16170,16203,16209,16215,16381,16387,16395,16402,16410,16417,16425,16432,16435,16442,16449,16456,16519,16526,16559,16566,16599,16605,16611,16718,16721,16728,16735,16742,16805,16812,16845,16852,16885,16891,16897,17072,17075,17082,17089,17096,17169,17176,17209,17216,17249,17255,17261,17493,17496,17503,17510,17517,17524,17527,17534,17541,17548,17551,17558,17565,17572],{"data":14629,"content":14630,"nodeType":1009},{},[14631],{"data":14632,"marks":14633,"value":14634,"nodeType":864},{},[],"Browser-based Identity attacks on the rise?",{"data":14636,"content":14637,"nodeType":860},{},[14638,14642,14651,14655,14664],{"data":14639,"marks":14640,"value":14641,"nodeType":864},{},[],"Identity has been recorded as the #1 cyber attack vector since forever. You don’t have to look particularly hard to find statistics to support this. In 2023, one source reports that ",{"data":14643,"content":14645,"nodeType":883},{"uri":14644},"https://www.csoonline.com/article/648894/identity-based-security-threats-are-growing-rapidly-report.html",[14646],{"data":14647,"marks":14648,"value":14650,"nodeType":864},{},[14649],{"type":1455},"4/5 breaches involved identity and compromised credentials",{"data":14652,"marks":14653,"value":14654,"nodeType":864},{},[],", while another suggests that ",{"data":14656,"content":14658,"nodeType":883},{"uri":14657},"https://rakgarg.substack.com/p/identity-crisis-the-biggest-prize",[14659],{"data":14660,"marks":14661,"value":14663,"nodeType":864},{},[14662],{"type":1455},"75% of breaches are caused by mismanaged identity, access, or privileges",{"data":14665,"marks":14666,"value":2924,"nodeType":864},{},[],{"data":14668,"content":14669,"nodeType":860},{},[14670],{"data":14671,"marks":14672,"value":14673,"nodeType":864},{},[],"Phishing, social engineering, credential stuffing, and business email compromise have morphed into a homogenous understanding of identity threats that are generally tackled through a combination of email security tooling, content access controls, and user awareness. ",{"data":14675,"content":14679,"nodeType":996},{"target":14676},{"sys":14677},{"id":14678,"type":1001,"linkType":1002},"5NRWvCl0xsoWcpgHbcQIkf",[],{"data":14681,"content":14682,"nodeType":860},{},[14683],{"data":14684,"marks":14685,"value":14686,"nodeType":864},{},[],"The fact that such attacks have been reported as the top security threat for so long probably means that people pay less attention to identity threats. Ransomware grabs the headlines, and rightly so in many cases, but phishing feels like a “known known” that we have a plan for (even if the plan often fails). ",{"data":14688,"content":14689,"nodeType":860},{},[14690,14694,14703],{"data":14691,"marks":14692,"value":14693,"nodeType":864},{},[],"In fact, there’s a problem with messaging generally. The ",{"data":14695,"content":14697,"nodeType":883},{"uri":14696},"https://www.verizon.com/business/resources/T78/reports/data-breach-investigation-report_2015.pdf",[14698],{"data":14699,"marks":14700,"value":14702,"nodeType":864},{},[14701],{"type":1455},"2015 Verizon DBIR",{"data":14704,"marks":14705,"value":14706,"nodeType":864},{},[]," contains plenty of stats that still ring largely true today. For example:",{"data":14708,"content":14709,"nodeType":941},{},[14710,14720],{"data":14711,"content":14712,"nodeType":945},{},[14713],{"data":14714,"content":14715,"nodeType":860},{},[14716],{"data":14717,"marks":14718,"value":14719,"nodeType":864},{},[],"In the 2013 DBIR, phishing was associated with over 95% of incidents attributed to state sponsored actors, and for two years running, more than two-thirds of incidents have featured phishing",{"data":14721,"content":14722,"nodeType":945},{},[14723],{"data":14724,"content":14725,"nodeType":860},{},[14726],{"data":14727,"marks":14728,"value":14729,"nodeType":864},{},[],"In 60% of cases, attackers are able to compromise an organization within minutes",{"data":14731,"content":14732,"nodeType":860},{},[14733],{"data":14734,"marks":14735,"value":14736,"nodeType":864},{},[],"Remove the dates and a lot of the report still stands up. ",{"data":14738,"content":14739,"nodeType":1312},{},[14740],{"data":14741,"marks":14742,"value":14743,"nodeType":864},{},[],"Bad then, worse now",{"data":14745,"content":14746,"nodeType":860},{},[14747,14751,14756,14760,14765],{"data":14748,"marks":14749,"value":14750,"nodeType":864},{},[],"But browser-based identity attacks ",{"data":14752,"marks":14753,"value":14755,"nodeType":864},{},[14754],{"type":899},"are",{"data":14757,"marks":14758,"value":14759,"nodeType":864},{},[]," worse than they used to be. Yes, credential stuffing, phishing, and SIM swapping may not be the most sophisticated attacks, but they remain as effective as ever. ",{"data":14761,"marks":14762,"value":14764,"nodeType":864},{},[14763],{"type":2246},"As the saying goes, if it ain’t broke — don’t fix it.",{"data":14766,"marks":14767,"value":6408,"nodeType":864},{},[],{"data":14769,"content":14770,"nodeType":860},{},[14771,14775,14780],{"data":14772,"marks":14773,"value":14774,"nodeType":864},{},[],"Recent attacks have moved toward a broader targeting of the ",{"data":14776,"marks":14777,"value":14779,"nodeType":864},{},[14778],{"type":899},"identity infrastructure",{"data":14781,"marks":14782,"value":14783,"nodeType":864},{},[],". While phishing and social engineering was once primarily a delivery mechanism for malicious payloads to be executed on endpoint, it is now used to harvest credentials and secrets for identity-based attacks against cloud apps and services. ",{"data":14785,"content":14786,"nodeType":860},{},[14787],{"data":14788,"marks":14789,"value":14790,"nodeType":864},{},[],"And because businesses have migrated to more cloud-based services and infrastructure, the compromise of an identity now has different consequences.",{"data":14792,"content":14793,"nodeType":860},{},[14794,14798],{"data":14795,"marks":14796,"value":14797,"nodeType":864},{},[],"The data and functionality that attackers seek has moved off endpoints and internal networks and onto cloud systems and SaaS applications, which organizations are using in large numbers (tens to hundreds). The modern way of working means that applications are more often than not directly exposed to the internet — and the only thing needed to access these apps are identities. ",{"data":14799,"marks":14800,"value":14802,"nodeType":864},{},[14801],{"type":899},"Naturally, it's much harder to stop credential stuffing attacks against 100 SaaS apps than the single centralized external VPN/webmail endpoint of yesteryear. ",{"data":14804,"content":14805,"nodeType":860},{},[14806],{"data":14807,"marks":14808,"value":14809,"nodeType":864},{},[],"It’s clear that stats alone don’t adequately capture the identity threat. So we have to look beyond the numbers to find out why. ",{"data":14811,"content":14812,"nodeType":1005},{},[],{"data":14814,"content":14815,"nodeType":1009},{},[14816],{"data":14817,"marks":14818,"value":14819,"nodeType":864},{},[],"Using this resource",{"data":14821,"content":14822,"nodeType":860},{},[14823],{"data":14824,"marks":14825,"value":14826,"nodeType":864},{},[],"To cut through some of the noise, we’ve compiled this list of reported attacks and explored what they mean for the identity threat landscape. ",{"data":14828,"content":14829,"nodeType":860},{},[14830,14834,14839],{"data":14831,"marks":14832,"value":14833,"nodeType":864},{},[],"This is not intended to be an exhaustive list of all attacks involving the compromise of digital identities (the list would be endless!). Nor is it something you should read all in one go (unless you ",{"data":14835,"marks":14836,"value":14838,"nodeType":864},{},[14837],{"type":2246},"really",{"data":14840,"marks":14841,"value":14842,"nodeType":864},{},[]," want to, we won’t stop you). We want it to be a resource that you can refer back to, that we will continue to update as new attacks are recorded. ",{"data":14844,"content":14845,"nodeType":860},{},[14846,14850],{"data":14847,"marks":14848,"value":14849,"nodeType":864},{},[],"In this context we define identity attacks as ",{"data":14851,"marks":14852,"value":14854,"nodeType":864},{},[14853],{"type":899},"attacks targeting cloud identities and their associated identity management systems, protocols, applications, and infrastructure. ",{"data":14856,"content":14857,"nodeType":860},{},[14858,14862],{"data":14859,"marks":14860,"value":14861,"nodeType":864},{},[],"The attacks recorded below are high profile examples of browser-based identity attacks",{"data":14863,"marks":14864,"value":14865,"nodeType":864},{},[]," that demonstrate how threat actors are leveraging the cloud identity plane to evade established cyber defenses and traverse new attack paths to achieve their goals. We’ve focused on attacks targeting identity infrastructure itself that are notable for their bypassing of traditional environments and established controls (e.g. Networkless or SaaS-to-SaaS attack paths). ",{"data":14867,"content":14868,"nodeType":860},{},[14869,14873,14880,14884,14893],{"data":14870,"marks":14871,"value":14872,"nodeType":864},{},[],"As with all publicly disclosed breaches, the level of detail and transparency we see varies. Where possible, we've mapped the threat actor Tactics, Techniques and Procedures to our ",{"data":14874,"content":14875,"nodeType":883},{"uri":6586},[14876],{"data":14877,"marks":14878,"value":6772,"nodeType":864},{},[14879],{"type":1455},{"data":14881,"marks":14882,"value":14883,"nodeType":864},{},[]," (previously the SaaS Attack Matrix). To learn more about SaaS attack techniques ",{"data":14885,"content":14887,"nodeType":883},{"uri":14886},"https://pushsecurity.com/blog/saas-attack-techniques/#id-problems-with-observing-saas-attacks",[14888],{"data":14889,"marks":14890,"value":14892,"nodeType":864},{},[14891],{"type":1455},"read the blog",{"data":14894,"marks":14895,"value":1774,"nodeType":864},{},[],{"data":14897,"content":14898,"nodeType":1005},{},[],{"data":14900,"content":14901,"nodeType":1009},{},[14902],{"data":14903,"marks":14904,"value":14905,"nodeType":864},{},[],"Snowflake – June 2024",{"data":14907,"content":14908,"nodeType":860},{},[14909,14913,14922],{"data":14910,"marks":14911,"value":14912,"nodeType":864},{},[],"The threat group known as ShinyHunters (also tracked as UNC5537) has claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. The breach stems from the historical compromise of credentials used to access customer-specific Snowflake tenants, via infostealer infections. These credentials were used as part of a targeted campaign against Snowflake customers, which was exacerbated by the widespread absence of MFA due to the lack of MFA enforcement by default. At the time of writing, approximately 165 customers have been impacted globally ",{"data":14914,"content":14916,"nodeType":883},{"uri":14915},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[14917],{"data":14918,"marks":14919,"value":14921,"nodeType":864},{},[14920],{"type":1455},"according to a report by Mandiant",{"data":14923,"marks":14924,"value":6570,"nodeType":864},{},[],{"data":14926,"content":14927,"nodeType":1312},{},[14928],{"data":14929,"marks":14930,"value":14931,"nodeType":864},{},[],"How did Snowflake get breached?",{"data":14933,"content":14934,"nodeType":860},{},[14935],{"data":14936,"marks":14937,"value":14939,"nodeType":864},{},[14938],{"type":2246},"It’s worth noting that customers/users of Snowflake were breached via their Snowflake tenants, and no central breach of Snowflake's own systems occurred.",{"data":14941,"content":14942,"nodeType":941},{},[14943,14953,14975,14985,14995,15005,15015,15025],{"data":14944,"content":14945,"nodeType":945},{},[14946],{"data":14947,"content":14948,"nodeType":860},{},[14949],{"data":14950,"marks":14951,"value":14952,"nodeType":864},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period. The threat actor used Snowflake customer credentials that were previously exposed via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":14954,"content":14955,"nodeType":945},{},[14956],{"data":14957,"content":14958,"nodeType":860},{},[14959,14963,14971],{"data":14960,"marks":14961,"value":14962,"nodeType":864},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and ",{"data":14964,"content":14965,"nodeType":883},{"uri":13438},[14966],{"data":14967,"marks":14968,"value":14970,"nodeType":864},{},[14969],{"type":1455},"Telegram channels",{"data":14972,"marks":14973,"value":14974,"nodeType":864},{},[]," as combolists (username, password, and login portal combinations). ",{"data":14976,"content":14977,"nodeType":945},{},[14978],{"data":14979,"content":14980,"nodeType":860},{},[14981],{"data":14982,"marks":14983,"value":14984,"nodeType":864},{},[],"Criminal groups (either ShinyHunters or another organization) saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":14986,"content":14987,"nodeType":945},{},[14988],{"data":14989,"content":14990,"nodeType":860},{},[14991],{"data":14992,"marks":14993,"value":14994,"nodeType":864},{},[],"ShinyHunters embarked on a large-scale campaign targeting Snowflake customer accounts using previously breached credentials. ",{"data":14996,"content":14997,"nodeType":945},{},[14998],{"data":14999,"content":15000,"nodeType":860},{},[15001],{"data":15002,"marks":15003,"value":15004,"nodeType":864},{},[],"ShinyHunters accessed user accounts that lacked MFA, belonging to approximately 165 Snowflake customers. ",{"data":15006,"content":15007,"nodeType":945},{},[15008],{"data":15009,"content":15010,"nodeType":860},{},[15011],{"data":15012,"marks":15013,"value":15014,"nodeType":864},{},[],"ShinyHunters used SQL-based reconnaissance, staging, and data exfiltration techniques, expedited by custom hacker tooling developed specifically for Snowflake, to conduct attacks at scale.",{"data":15016,"content":15017,"nodeType":945},{},[15018],{"data":15019,"content":15020,"nodeType":860},{},[15021],{"data":15022,"marks":15023,"value":15024,"nodeType":864},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. The most sensitive data declared so far pertains to end-customers of each victim, for example PII, bank account and card information, etc.  ",{"data":15026,"content":15027,"nodeType":945},{},[15028],{"data":15029,"content":15030,"nodeType":860},{},[15031],{"data":15032,"marks":15033,"value":15034,"nodeType":864},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired. ",{"data":15036,"content":15037,"nodeType":1312},{},[15038],{"data":15039,"marks":15040,"value":15041,"nodeType":864},{},[],"What was the impact of the Snowflake breach?",{"data":15043,"content":15044,"nodeType":941},{},[15045,15064,15096,15124,15143,15162],{"data":15046,"content":15047,"nodeType":945},{},[15048],{"data":15049,"content":15050,"nodeType":860},{},[15051,15055,15060],{"data":15052,"marks":15053,"value":15054,"nodeType":864},{},[],"Approximately ",{"data":15056,"marks":15057,"value":15059,"nodeType":864},{},[15058],{"type":899},"165 victims were identified by Mandiant",{"data":15061,"marks":15062,"value":15063,"nodeType":864},{},[],". Organizations are gradually coming forward to declare the breach and release customer communications accordingly, but not all victims have been named.",{"data":15065,"content":15066,"nodeType":945},{},[15067],{"data":15068,"content":15069,"nodeType":860},{},[15070,15074,15079,15083,15092],{"data":15071,"marks":15072,"value":15073,"nodeType":864},{},[],"Based on the figures being suggested so far, the impact upon end-customers is huge, with the data of ",{"data":15075,"marks":15076,"value":15078,"nodeType":864},{},[15077],{"type":899},"hundreds of millions of people exposed",{"data":15080,"marks":15081,"value":15082,"nodeType":864},{},[],", and has been touted by some news outlets as ‘",{"data":15084,"content":15086,"nodeType":883},{"uri":15085},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[15087],{"data":15088,"marks":15089,"value":15091,"nodeType":864},{},[15090],{"type":1455},"one of the biggest breaches ever",{"data":15093,"marks":15094,"value":15095,"nodeType":864},{},[],"’.  ",{"data":15097,"content":15098,"nodeType":945},{},[15099],{"data":15100,"content":15101,"nodeType":860},{},[15102,15106,15111,15115,15120],{"data":15103,"marks":15104,"value":15105,"nodeType":864},{},[],"The impact on the affected businesses is largely unknown at this stage. It’s clear that the victims will suffer ",{"data":15107,"marks":15108,"value":15110,"nodeType":864},{},[15109],{"type":899},"reputational damage",{"data":15112,"marks":15113,"value":15114,"nodeType":864},{},[]," based on the extent of their individual breaches, and possibly face other ",{"data":15116,"marks":15117,"value":15119,"nodeType":864},{},[15118],{"type":899},"penalties and sanctions",{"data":15121,"marks":15122,"value":15123,"nodeType":864},{},[]," if they are found to be at fault by their respective regulators and/or national information security authorities. ",{"data":15125,"content":15126,"nodeType":945},{},[15127],{"data":15128,"content":15129,"nodeType":860},{},[15130,15134,15139],{"data":15131,"marks":15132,"value":15133,"nodeType":864},{},[],"The impact upon individuals will be significant, with high potential for further targeting in terms of ",{"data":15135,"marks":15136,"value":15138,"nodeType":864},{},[15137],{"type":899},"identity theft, blackmail, financial crime",{"data":15140,"marks":15141,"value":15142,"nodeType":864},{},[],", etc.  ",{"data":15144,"content":15145,"nodeType":945},{},[15146],{"data":15147,"content":15148,"nodeType":860},{},[15149,15153,15158],{"data":15150,"marks":15151,"value":15152,"nodeType":864},{},[],"It is unclear what data has been exposed in addition to personal data affecting end-customers. If other sensitive commercial or business data pertaining to ",{"data":15154,"marks":15155,"value":15157,"nodeType":864},{},[15156],{"type":899},"Intellectual Property",{"data":15159,"marks":15160,"value":15161,"nodeType":864},{},[]," has been exposed then this data may also be sold on via other nefarious channels, with a potential future impact.",{"data":15163,"content":15164,"nodeType":945},{},[15165],{"data":15166,"content":15167,"nodeType":860},{},[15168,15172,15177],{"data":15169,"marks":15170,"value":15171,"nodeType":864},{},[],"Given the lack of MFA for the compromised accounts, there has been a general criticism of the ‘opt-in’ nature of MFA for SaaS services, with many security professionals suggesting that ",{"data":15173,"marks":15174,"value":15176,"nodeType":864},{},[15175],{"type":899},"Snowflake should enforce MFA by default",{"data":15178,"marks":15179,"value":15180,"nodeType":864},{},[]," given the critical nature of the service. ",{"data":15182,"content":15183,"nodeType":1312},{},[15184],{"data":15185,"marks":15186,"value":15187,"nodeType":864},{},[],"What stands out in the Snowflake breach?",{"data":15189,"content":15190,"nodeType":941},{},[15191,15210,15251,15278],{"data":15192,"content":15193,"nodeType":945},{},[15194],{"data":15195,"content":15196,"nodeType":860},{},[15197,15201,15206],{"data":15198,"marks":15199,"value":15200,"nodeType":864},{},[],"The breach ",{"data":15202,"marks":15203,"value":15205,"nodeType":864},{},[15204],{"type":899},"was achieved by using stolen credentials dating back as far as 2020",{"data":15207,"marks":15208,"value":15209,"nodeType":864},{},[],", that had not been rotated or changed. This indicates that many of the credentials used were not necessarily the result of any recent data sharing. This highlights the potential risk of breached credentials already in the public domain; particularly in the case of cloud services that may not be subject to the same levels of credential hygiene as other traditional network logins. ",{"data":15211,"content":15212,"nodeType":945},{},[15213],{"data":15214,"content":15215,"nodeType":860},{},[15216,15220,15228,15231,15236,15240,15248],{"data":15217,"marks":15218,"value":15219,"nodeType":864},{},[],"Much of the industry response has focused on ensuring that accounts are using SSO (and therefore are protected by MFA at the IdP level). However, due to the existence of ",{"data":15221,"content":15223,"nodeType":883},{"uri":15222},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/ghost-logins",[15224],{"data":15225,"marks":15226,"value":13757,"nodeType":864},{},[15227],{"type":1455},{"data":15229,"marks":15230,"value":3731,"nodeType":864},{},[],{"data":15232,"marks":15233,"value":15235,"nodeType":864},{},[15234],{"type":899},"local logins without MFA can exist simultaneously with the SSO login unless expressly disabled",{"data":15237,"marks":15238,"value":15239,"nodeType":864},{},[],". Organizations using Snowflake that are looking to lock down their accounts can ",{"data":15241,"content":15242,"nodeType":883},{"uri":13794},[15243],{"data":15244,"marks":15245,"value":15247,"nodeType":864},{},[15246],{"type":1455},"watch our recent demo of how to effectively remediate this vulnerability in Snowflake",{"data":15249,"marks":15250,"value":13804,"nodeType":864},{},[],{"data":15252,"content":15253,"nodeType":945},{},[15254],{"data":15255,"content":15256,"nodeType":860},{},[15257,15262,15266,15274],{"data":15258,"marks":15259,"value":15261,"nodeType":864},{},[15260],{"type":899},"80% of the credentials were gathered through infostealer malware",{"data":15263,"marks":15264,"value":15265,"nodeType":864},{},[],". Typically, this occurs when unmanaged devices are used to access company resources, or personal browser profiles are synchronized on both work and personal devices. Malware deployed to an insecure personal device can then access and steal credentials for company resources. This situation usually occurs when working with third-party contractors on a BYOD basis; ",{"data":15267,"content":15268,"nodeType":883},{"uri":14011},[15269],{"data":15270,"marks":15271,"value":15273,"nodeType":864},{},[15272],{"type":1455},"a recent article indicates that Ukraine-based EPAM Systems",{"data":15275,"marks":15276,"value":15277,"nodeType":864},{},[],", an engineering and digital service provider and “Elite Tier Partner” of Snowflake, was one such organization breached in this way. Organizations consuming Snowflake-related services from EPAM were then subsequently affected, as the compromise of EPAM users granted access to a large number of Snowflake credentials for various company tenants.  ",{"data":15279,"content":15280,"nodeType":945},{},[15281],{"data":15282,"content":15283,"nodeType":860},{},[15284,15288,15293,15297,15302],{"data":15285,"marks":15286,"value":15287,"nodeType":864},{},[],"While attacker activity has focused on Snowflake to date, the success of this attack will signal the potential for further credential based attacks against similar apps. ",{"data":15289,"marks":15290,"value":15292,"nodeType":864},{},[15291],{"type":899},"There may already be a 'Snowflake 2.0' among the credentials already available online",{"data":15294,"marks":15295,"value":15296,"nodeType":864},{},[],". Further, credentials can be used against a wide range of apps to capitalize on potential ",{"data":15298,"marks":15299,"value":15301,"nodeType":864},{},[15300],{"type":899},"password reuse (which we see for 1 in 3 employees)",{"data":15303,"marks":15304,"value":15305,"nodeType":864},{},[],", so the exact creds for a particular app don’t have to be explicitly breached, so long as the domain for the login portal can be guessed or has been exposed elsewhere.   ",{"data":15307,"content":15308,"nodeType":1312},{},[15309],{"data":15310,"marks":15311,"value":15312,"nodeType":864},{},[],"Browser & Identity Attacks Matrix mapping",{"data":15314,"content":15315,"nodeType":860},{},[15316],{"data":15317,"marks":15318,"value":15319,"nodeType":864},{},[],"For more information on each TTP please navigate to the entries linked in the table below. ",{"data":15321,"content":15322,"nodeType":4845},{},[15323,15366,15428],{"data":15324,"content":15325,"nodeType":4581},{},[15326,15336,15346,15356],{"data":15327,"content":15328,"nodeType":12016},{},[15329],{"data":15330,"content":15331,"nodeType":860},{},[15332],{"data":15333,"marks":15334,"value":15335,"nodeType":864},{},[],"ID",{"data":15337,"content":15338,"nodeType":12016},{},[15339],{"data":15340,"content":15341,"nodeType":860},{},[15342],{"data":15343,"marks":15344,"value":15345,"nodeType":864},{},[],"Name",{"data":15347,"content":15348,"nodeType":12016},{},[15349],{"data":15350,"content":15351,"nodeType":860},{},[15352],{"data":15353,"marks":15354,"value":15355,"nodeType":864},{},[],"Stage",{"data":15357,"content":15358,"nodeType":12016},{},[15359],{"data":15360,"content":15361,"nodeType":860},{},[15362],{"data":15363,"marks":15364,"value":15365,"nodeType":864},{},[],"Description",{"data":15367,"content":15368,"nodeType":4581},{},[15369,15389,15408,15418],{"data":15370,"content":15371,"nodeType":4569},{},[15372],{"data":15373,"content":15374,"nodeType":860},{},[15375,15378,15386],{"data":15376,"marks":15377,"value":21,"nodeType":864},{},[],{"data":15379,"content":15380,"nodeType":883},{"uri":13750},[15381],{"data":15382,"marks":15383,"value":15385,"nodeType":864},{},[15384],{"type":1455},"SAT1017",{"data":15387,"marks":15388,"value":21,"nodeType":864},{},[],{"data":15390,"content":15391,"nodeType":4569},{},[15392],{"data":15393,"content":15394,"nodeType":860},{},[15395,15398,15405],{"data":15396,"marks":15397,"value":21,"nodeType":864},{},[],{"data":15399,"content":15400,"nodeType":883},{"uri":15222},[15401],{"data":15402,"marks":15403,"value":395,"nodeType":864},{},[15404],{"type":1455},{"data":15406,"marks":15407,"value":21,"nodeType":864},{},[],{"data":15409,"content":15410,"nodeType":4569},{},[15411],{"data":15412,"content":15413,"nodeType":860},{},[15414],{"data":15415,"marks":15416,"value":15417,"nodeType":864},{},[],"Initial Access; Persistence; Defense Evasion",{"data":15419,"content":15420,"nodeType":4569},{},[15421],{"data":15422,"content":15423,"nodeType":860},{},[15424],{"data":15425,"marks":15426,"value":15427,"nodeType":864},{},[],"Abusing non-SSO additional login methods such as password-based authentication (local to the SaaS app), social logins, API access, etc. ",{"data":15429,"content":15430,"nodeType":4581},{},[15431,15451,15472,15482],{"data":15432,"content":15433,"nodeType":4569},{},[15434],{"data":15435,"content":15436,"nodeType":860},{},[15437,15440,15448],{"data":15438,"marks":15439,"value":21,"nodeType":864},{},[],{"data":15441,"content":15442,"nodeType":883},{"uri":13998},[15443],{"data":15444,"marks":15445,"value":15447,"nodeType":864},{},[15446],{"type":1455},"SAT1044",{"data":15449,"marks":15450,"value":21,"nodeType":864},{},[],{"data":15452,"content":15453,"nodeType":4569},{},[15454],{"data":15455,"content":15456,"nodeType":860},{},[15457,15460,15469],{"data":15458,"marks":15459,"value":21,"nodeType":864},{},[],{"data":15461,"content":15463,"nodeType":883},{"uri":15462},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/session-cookie-theft",[15464],{"data":15465,"marks":15466,"value":15468,"nodeType":864},{},[15467],{"type":1455},"Session cookie theft",{"data":15470,"marks":15471,"value":21,"nodeType":864},{},[],{"data":15473,"content":15474,"nodeType":4569},{},[15475],{"data":15476,"content":15477,"nodeType":860},{},[15478],{"data":15479,"marks":15480,"value":15481,"nodeType":864},{},[],"Lateral Movement; Defense Evasion",{"data":15483,"content":15484,"nodeType":4569},{},[15485],{"data":15486,"content":15487,"nodeType":860},{},[15488],{"data":15489,"marks":15490,"value":15491,"nodeType":864},{},[],"Session cookies are used to pivot from an endpoint compromise and laterally move to downstream SaaS applications.",{"data":15493,"content":15494,"nodeType":1312},{},[15495],{"data":15496,"marks":15497,"value":15498,"nodeType":864},{},[],"Related breaches",{"data":15500,"content":15501,"nodeType":860},{},[15502],{"data":15503,"marks":15504,"value":15505,"nodeType":864},{},[],"Named victims are listed below:",{"data":15507,"content":15508,"nodeType":941},{},[15509,15519,15529,15539,15549,15559,15569,15579],{"data":15510,"content":15511,"nodeType":945},{},[15512],{"data":15513,"content":15514,"nodeType":860},{},[15515],{"data":15516,"marks":15517,"value":15518,"nodeType":864},{},[],"Ticketmaster",{"data":15520,"content":15521,"nodeType":945},{},[15522],{"data":15523,"content":15524,"nodeType":860},{},[15525],{"data":15526,"marks":15527,"value":15528,"nodeType":864},{},[],"Santander",{"data":15530,"content":15531,"nodeType":945},{},[15532],{"data":15533,"content":15534,"nodeType":860},{},[15535],{"data":15536,"marks":15537,"value":15538,"nodeType":864},{},[],"Neiman Marcus",{"data":15540,"content":15541,"nodeType":945},{},[15542],{"data":15543,"content":15544,"nodeType":860},{},[15545],{"data":15546,"marks":15547,"value":15548,"nodeType":864},{},[],"Los Angeles Unified",{"data":15550,"content":15551,"nodeType":945},{},[15552],{"data":15553,"content":15554,"nodeType":860},{},[15555],{"data":15556,"marks":15557,"value":15558,"nodeType":864},{},[],"Pure Storage",{"data":15560,"content":15561,"nodeType":945},{},[15562],{"data":15563,"content":15564,"nodeType":860},{},[15565],{"data":15566,"marks":15567,"value":15568,"nodeType":864},{},[],"Advance Auto Parts",{"data":15570,"content":15571,"nodeType":945},{},[15572],{"data":15573,"content":15574,"nodeType":860},{},[15575],{"data":15576,"marks":15577,"value":15578,"nodeType":864},{},[],"Truist Bank",{"data":15580,"content":15581,"nodeType":945},{},[15582],{"data":15583,"content":15584,"nodeType":860},{},[15585],{"data":15586,"marks":15587,"value":15588,"nodeType":864},{},[],"Lending Tree",{"data":15590,"content":15591,"nodeType":1005},{},[],{"data":15593,"content":15594,"nodeType":1009},{},[15595],{"data":15596,"marks":15597,"value":15598,"nodeType":864},{},[],"Microsoft — January 2024",{"data":15600,"content":15601,"nodeType":860},{},[15602],{"data":15603,"marks":15604,"value":15605,"nodeType":864},{},[],"The threat group known as APT29 (also known as “The Dukes”, “Cozy Bear”, and labeled “Midnight Blizzard” by Microsoft) executed a cleverly executed password-guessing attack to compromise test cloud identities that were also lacking MFA. Attackers then leveraged this access to compromise some OAuth applications that allowed lateral movement to Microsoft’s corporate environment and the creation of other malicious OAuth applications to achieve persistence.",{"data":15607,"content":15608,"nodeType":1312},{},[15609],{"data":15610,"marks":15611,"value":15612,"nodeType":864},{},[],"How did Microsoft get breached?",{"data":15614,"content":15615,"nodeType":941},{},[15616,15626,15636,15646,15656,15666],{"data":15617,"content":15618,"nodeType":945},{},[15619],{"data":15620,"content":15621,"nodeType":860},{},[15622],{"data":15623,"marks":15624,"value":15625,"nodeType":864},{},[],"APT29 utilized password spraying / credential stuffing attacks to compromise test cloud identities that were also lacking MFA, attached to a non-production test tenant.",{"data":15627,"content":15628,"nodeType":945},{},[15629],{"data":15630,"content":15631,"nodeType":860},{},[15632],{"data":15633,"marks":15634,"value":15635,"nodeType":864},{},[],"APT29 leveraged their initial access to the test tenant to identify and compromise a test OAuth application that had access to the Microsoft corporate environment by leveraging permissive Entra ID roles in the test tenant.",{"data":15637,"content":15638,"nodeType":945},{},[15639],{"data":15640,"content":15641,"nodeType":860},{},[15642],{"data":15643,"marks":15644,"value":15645,"nodeType":864},{},[],"APT29 used the existing configurations to access the Microsoft corporate Entra ID tenant whereupon the app registration from the test tenant was installed as a service principal in the corporate tenant, granting the equivalent of global admin rights.",{"data":15647,"content":15648,"nodeType":945},{},[15649],{"data":15650,"content":15651,"nodeType":860},{},[15652],{"data":15653,"marks":15654,"value":15655,"nodeType":864},{},[],"Using these new permissions, APT29 registered additional malicious OAuth applications in the Microsoft corporate environment, and created a new user in the Microsoft corporate tenant to grant consent to the new malicious OAuth apps, thereby achieving persistent access to the environment.",{"data":15657,"content":15658,"nodeType":945},{},[15659],{"data":15660,"content":15661,"nodeType":860},{},[15662],{"data":15663,"marks":15664,"value":15665,"nodeType":864},{},[],"APT29 leveraged the elevated (maximum) privileges assigned to the ‘test’ app service principal to grant app roles to other newly created app service principals, granting them the Office 365 Exchange Online full_access_as_app role in the corporate tenant, which allows access to mailboxes.",{"data":15667,"content":15668,"nodeType":945},{},[15669],{"data":15670,"content":15671,"nodeType":860},{},[15672],{"data":15673,"marks":15674,"value":15675,"nodeType":864},{},[],"APT29 leveraged these malicious OAuth applications to authenticate to Microsoft Exchange Online and target Microsoft corporate email accounts.",{"data":15677,"content":15678,"nodeType":1312},{},[15679],{"data":15680,"marks":15681,"value":15682,"nodeType":864},{},[],"What was the impact of the Microsoft breach?",{"data":15684,"content":15685,"nodeType":941},{},[15686,15696,15706],{"data":15687,"content":15688,"nodeType":945},{},[15689],{"data":15690,"content":15691,"nodeType":860},{},[15692],{"data":15693,"marks":15694,"value":15695,"nodeType":864},{},[],"APT29 had access to Microsoft corporate email accounts, including members of the senior leadership team and employees in the cybersecurity, legal, and other functions, resulting in sensitive data leakage.",{"data":15697,"content":15698,"nodeType":945},{},[15699],{"data":15700,"content":15701,"nodeType":860},{},[15702],{"data":15703,"marks":15704,"value":15705,"nodeType":864},{},[],"Microsoft has not disclosed any further impacts at this time, but it is likely that the adversary had complete, unmitigated control of the Microsoft corporate tenant for a period of time, with global administrator level access.",{"data":15707,"content":15708,"nodeType":945},{},[15709],{"data":15710,"content":15711,"nodeType":860},{},[15712],{"data":15713,"marks":15714,"value":15715,"nodeType":864},{},[],"Since the initial attack there has been evidence of continued targeting, with password spraying attacks reportedly increasing tenfold, likely informed by stolen information.",{"data":15717,"content":15718,"nodeType":1312},{},[15719],{"data":15720,"marks":15721,"value":15722,"nodeType":864},{},[],"What stands out in the Microsoft breach?",{"data":15724,"content":15725,"nodeType":941},{},[15726,15736,15746,15756],{"data":15727,"content":15728,"nodeType":945},{},[15729],{"data":15730,"content":15731,"nodeType":860},{},[15732],{"data":15733,"marks":15734,"value":15735,"nodeType":864},{},[],"The attack was covert and targeted, with APT29 tailoring the attack to a limited number of accounts and using a low number of attempts to evade detection and avoid account blocks based on the volume of failures.",{"data":15737,"content":15738,"nodeType":945},{},[15739],{"data":15740,"content":15741,"nodeType":860},{},[15742],{"data":15743,"marks":15744,"value":15745,"nodeType":864},{},[],"APT29 used residential proxy networks when interacting with the compromised tenant and, subsequently, with Exchange Online to obfuscate the source of their attack and avoid impossible travel detections. ",{"data":15747,"content":15748,"nodeType":945},{},[15749],{"data":15750,"content":15751,"nodeType":860},{},[15752],{"data":15753,"marks":15754,"value":15755,"nodeType":864},{},[],"APT29 demonstrated mature and in-depth understanding of cloud infrastructure, protocols, and workflows, particularly in terms of privilege escalation and lateral movement.",{"data":15757,"content":15758,"nodeType":945},{},[15759],{"data":15760,"content":15761,"nodeType":860},{},[15762],{"data":15763,"marks":15764,"value":15765,"nodeType":864},{},[],"If even Microsoft (an organization with pretty much unrivaled security resources) can’t ensure that all their accounts are protected by MFA and that there are no weak links between test/dev and prod systems, this should be a wake-up call for any company that thinks their MFA implementation is flawless. ",{"data":15767,"content":15768,"nodeType":1312},{},[15769],{"data":15770,"marks":15771,"value":15312,"nodeType":864},{},[],{"data":15773,"content":15774,"nodeType":860},{},[15775],{"data":15776,"marks":15777,"value":15319,"nodeType":864},{},[],{"data":15779,"content":15780,"nodeType":4845},{},[15781,15821,15885,15950],{"data":15782,"content":15783,"nodeType":4581},{},[15784,15793,15803,15812],{"data":15785,"content":15786,"nodeType":12016},{},[15787],{"data":15788,"content":15789,"nodeType":860},{},[15790],{"data":15791,"marks":15792,"value":15335,"nodeType":864},{},[],{"data":15794,"content":15795,"nodeType":12016},{},[15796],{"data":15797,"content":15798,"nodeType":860},{},[15799],{"data":15800,"marks":15801,"value":15802,"nodeType":864},{},[],"Technique",{"data":15804,"content":15805,"nodeType":12016},{},[15806],{"data":15807,"content":15808,"nodeType":860},{},[15809],{"data":15810,"marks":15811,"value":15355,"nodeType":864},{},[],{"data":15813,"content":15814,"nodeType":12016},{},[15815],{"data":15816,"content":15817,"nodeType":860},{},[15818],{"data":15819,"marks":15820,"value":15365,"nodeType":864},{},[],{"data":15822,"content":15823,"nodeType":4581},{},[15824,15845,15865,15875],{"data":15825,"content":15826,"nodeType":4569},{},[15827],{"data":15828,"content":15829,"nodeType":860},{},[15830,15833,15842],{"data":15831,"marks":15832,"value":21,"nodeType":864},{},[],{"data":15834,"content":15836,"nodeType":883},{"uri":15835},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[15837],{"data":15838,"marks":15839,"value":15841,"nodeType":864},{},[15840],{"type":1455},"SAT1011",{"data":15843,"marks":15844,"value":21,"nodeType":864},{},[],{"data":15846,"content":15847,"nodeType":4569},{},[15848],{"data":15849,"content":15850,"nodeType":860},{},[15851,15854,15862],{"data":15852,"marks":15853,"value":21,"nodeType":864},{},[],{"data":15855,"content":15857,"nodeType":883},{"uri":15856},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/credential-stuffing",[15858],{"data":15859,"marks":15860,"value":333,"nodeType":864},{},[15861],{"type":1455},{"data":15863,"marks":15864,"value":21,"nodeType":864},{},[],{"data":15866,"content":15867,"nodeType":4569},{},[15868],{"data":15869,"content":15870,"nodeType":860},{},[15871],{"data":15872,"marks":15873,"value":15874,"nodeType":864},{},[],"Initial Access",{"data":15876,"content":15877,"nodeType":4569},{},[15878],{"data":15879,"content":15880,"nodeType":860},{},[15881],{"data":15882,"marks":15883,"value":15884,"nodeType":864},{},[],"Attempt to authenticate to a SaaS account by guessing a large number of passwords ",{"data":15886,"content":15887,"nodeType":4581},{},[15888,15909,15930,15940],{"data":15889,"content":15890,"nodeType":4569},{},[15891],{"data":15892,"content":15893,"nodeType":860},{},[15894,15897,15906],{"data":15895,"marks":15896,"value":21,"nodeType":864},{},[],{"data":15898,"content":15900,"nodeType":883},{"uri":15899},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_tokens/description.md",[15901],{"data":15902,"marks":15903,"value":15905,"nodeType":864},{},[15904],{"type":1455},"SAT1027",{"data":15907,"marks":15908,"value":21,"nodeType":864},{},[],{"data":15910,"content":15911,"nodeType":4569},{},[15912],{"data":15913,"content":15914,"nodeType":860},{},[15915,15918,15927],{"data":15916,"marks":15917,"value":21,"nodeType":864},{},[],{"data":15919,"content":15921,"nodeType":883},{"uri":15920},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/oauth-tokens",[15922],{"data":15923,"marks":15924,"value":15926,"nodeType":864},{},[15925],{"type":1455},"OAuth tokens",{"data":15928,"marks":15929,"value":21,"nodeType":864},{},[],{"data":15931,"content":15932,"nodeType":4569},{},[15933],{"data":15934,"content":15935,"nodeType":860},{},[15936],{"data":15937,"marks":15938,"value":15939,"nodeType":864},{},[],"Execution; Persistence; Defense Evasion",{"data":15941,"content":15942,"nodeType":4569},{},[15943],{"data":15944,"content":15945,"nodeType":860},{},[15946],{"data":15947,"marks":15948,"value":15949,"nodeType":864},{},[],"Use a malicious OAuth app to create an OAuth token, using arbitrary permissions to maintain long-term programmatic access to a compromised user account.",{"data":15951,"content":15952,"nodeType":4581},{},[15953,15974,15995,16005],{"data":15954,"content":15955,"nodeType":4569},{},[15956],{"data":15957,"content":15958,"nodeType":860},{},[15959,15962,15971],{"data":15960,"marks":15961,"value":21,"nodeType":864},{},[],{"data":15963,"content":15965,"nodeType":883},{"uri":15964},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/abuse_existing_oauth_integrations/description.md",[15966],{"data":15967,"marks":15968,"value":15970,"nodeType":864},{},[15969],{"type":1455},"SAT1001",{"data":15972,"marks":15973,"value":21,"nodeType":864},{},[],{"data":15975,"content":15976,"nodeType":4569},{},[15977],{"data":15978,"content":15979,"nodeType":860},{},[15980,15983,15992],{"data":15981,"marks":15982,"value":21,"nodeType":864},{},[],{"data":15984,"content":15986,"nodeType":883},{"uri":15985},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/abuse-existing-oauth-integrations",[15987],{"data":15988,"marks":15989,"value":15991,"nodeType":864},{},[15990],{"type":1455},"Abuse existing OAuth integrations",{"data":15993,"marks":15994,"value":21,"nodeType":864},{},[],{"data":15996,"content":15997,"nodeType":4569},{},[15998],{"data":15999,"content":16000,"nodeType":860},{},[16001],{"data":16002,"marks":16003,"value":16004,"nodeType":864},{},[],"Privilege Escalation;\nLateral Movement",{"data":16006,"content":16007,"nodeType":4569},{},[16008],{"data":16009,"content":16010,"nodeType":860},{},[16011],{"data":16012,"marks":16013,"value":16014,"nodeType":864},{},[],"If an adversary compromises a SaaS account integrated with other apps, they can escalate privileges and move laterally to other apps.",{"data":16016,"content":16017,"nodeType":1312},{},[16018],{"data":16019,"marks":16020,"value":15498,"nodeType":864},{},[],{"data":16022,"content":16023,"nodeType":860},{},[16024],{"data":16025,"marks":16026,"value":16028,"nodeType":864},{},[16027],{"type":899},"Hewlett Packard Enterprise (HPE) — May 2023",{"data":16030,"content":16031,"nodeType":860},{},[16032],{"data":16033,"marks":16034,"value":16035,"nodeType":864},{},[],"At the time of the Microsoft breach becoming public knowledge, HPE disclosed that they had become aware of a historical incident in Dec 2023, involving unauthorized access to and exfiltration of a limited number of SharePoint files as early as May 2023. Hackers accessed and exfiltrated data from HPE mailboxes belonging to individuals in the cybersecurity, go-to-market, business segments, and other functions. No further information is available on the techniques used or impact of the breach. ",{"data":16037,"content":16038,"nodeType":1005},{},[],{"data":16040,"content":16041,"nodeType":1009},{},[16042],{"data":16043,"marks":16044,"value":16045,"nodeType":864},{},[],"Okta — October 2023",{"data":16047,"content":16048,"nodeType":860},{},[16049],{"data":16050,"marks":16051,"value":16052,"nodeType":864},{},[],"An unknown threat group compromised an Okta employee's personal Google account that was being used on a company-managed device, granting the threat actor access to a service account for Okta’s customer support system, that included session tokens for 134 customers. This was then used to hijack the legitimate Okta sessions of five customers. ",{"data":16054,"content":16055,"nodeType":1312},{},[16056],{"data":16057,"marks":16058,"value":16059,"nodeType":864},{},[],"How did Okta get breached?",{"data":16061,"content":16062,"nodeType":941},{},[16063,16073,16083,16093,16103],{"data":16064,"content":16065,"nodeType":945},{},[16066],{"data":16067,"content":16068,"nodeType":860},{},[16069],{"data":16070,"marks":16071,"value":16072,"nodeType":864},{},[],"The threat actor compromised a personal Google account that the user had accessed from their Okta-managed work device by signing into their personal profile from the Chrome browser.",{"data":16074,"content":16075,"nodeType":945},{},[16076],{"data":16077,"content":16078,"nodeType":860},{},[16079],{"data":16080,"marks":16081,"value":16082,"nodeType":864},{},[],"The personal account credentials are likely to have been compromised in a historical data breach and did not have MFA enabled.",{"data":16084,"content":16085,"nodeType":945},{},[16086],{"data":16087,"content":16088,"nodeType":860},{},[16089],{"data":16090,"marks":16091,"value":16092,"nodeType":864},{},[],"The username and password of a service account for Okta’s customer support system had been saved into the employee’s personal Google account and was therefore compromised.",{"data":16094,"content":16095,"nodeType":945},{},[16096],{"data":16097,"content":16098,"nodeType":860},{},[16099],{"data":16100,"marks":16101,"value":16102,"nodeType":864},{},[],"The threat actor was able to access the service account by logging in using the stolen credentials, which again likely did not have MFA deployed as a service account.",{"data":16104,"content":16105,"nodeType":945},{},[16106],{"data":16107,"content":16108,"nodeType":860},{},[16109],{"data":16110,"marks":16111,"value":16112,"nodeType":864},{},[],"The threat actor was able to use session tokens in the HAR files to impersonate staff and hijack the legitimate Okta sessions of five customers, including 1Password, BeyondTrust, and Cloudflare.",{"data":16114,"content":16115,"nodeType":1312},{},[16116],{"data":16117,"marks":16118,"value":16119,"nodeType":864},{},[],"What was the impact of the Okta breach?",{"data":16121,"content":16122,"nodeType":941},{},[16123,16133,16143,16153],{"data":16124,"content":16125,"nodeType":945},{},[16126],{"data":16127,"content":16128,"nodeType":860},{},[16129],{"data":16130,"marks":16131,"value":16132,"nodeType":864},{},[],"The threat actor gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers.",{"data":16134,"content":16135,"nodeType":945},{},[16136],{"data":16137,"content":16138,"nodeType":860},{},[16139],{"data":16140,"marks":16141,"value":16142,"nodeType":864},{},[],"The threat actor was able to use these session tokens to hijack the legitimate Okta sessions of 5 (publicly disclosed) customers.",{"data":16144,"content":16145,"nodeType":945},{},[16146],{"data":16147,"content":16148,"nodeType":860},{},[16149],{"data":16150,"marks":16151,"value":16152,"nodeType":864},{},[],"Okta originally claimed the breach had impacted only 1% of customers, but later found that a report run and downloaded by the threat actor contained the names and email addresses of all 18,400 Okta customer support users, as well as some Okta employee information, meaning 100% of customer support users were impacted.",{"data":16154,"content":16155,"nodeType":945},{},[16156],{"data":16157,"content":16158,"nodeType":860},{},[16159],{"data":16160,"marks":16161,"value":16162,"nodeType":864},{},[],"Okta users are at higher risk of phishing and credential stuffing attacks based on the data stolen by the threat actor, increasing the importance of robust MFA implementation.",{"data":16164,"content":16165,"nodeType":1312},{},[16166],{"data":16167,"marks":16168,"value":16169,"nodeType":864},{},[],"What stands out in the Okta breach?",{"data":16171,"content":16172,"nodeType":941},{},[16173,16183,16193],{"data":16174,"content":16175,"nodeType":945},{},[16176],{"data":16177,"content":16178,"nodeType":860},{},[16179],{"data":16180,"marks":16181,"value":16182,"nodeType":864},{},[],"This attack demonstrates the risk associated with cloud Identity Providers and the potential goldmine that they are to attackers. Much in the same way that the manufacturers of physical and virtual network appliances are continuously probed for software vulnerabilities, cloud IdPs like Okta present a huge potential opportunity, both in terms of targeting specific organizational instances as well as the Okta organization. This attack showcases the possibility of third-party supply chain attacks to target downstream organizations using IdP services. ",{"data":16184,"content":16185,"nodeType":945},{},[16186],{"data":16187,"content":16188,"nodeType":860},{},[16189],{"data":16190,"marks":16191,"value":16192,"nodeType":864},{},[],"Similar to the Microsoft breach, gaps were discovered and exploited in Okta’s MFA coverage and implementation, highlighting that there are gaps in even the most mature organizations. ",{"data":16194,"content":16195,"nodeType":945},{},[16196],{"data":16197,"content":16198,"nodeType":860},{},[16199],{"data":16200,"marks":16201,"value":16202,"nodeType":864},{},[],"The subsequent attack on Cloudflare (see below) and the scale of the recovery effort demonstrates the significant operational overhead in responding to and recovering from a breach of identity infrastructure, with a similar or greater scale than a traditional Active Directory compromise. While addressing the incident, Cloudflare's staff rotated all production credentials (over 5,000 unique ones), physically segmented test and staging systems, performed forensic triage on 4,893 systems, reimaged and rebooted all systems on the company's global network, including all Atlassian servers (Jira, Confluence, and Bitbucket) and machines accessed by the threat actor. All equipment in Cloudflare's Brazil data center, which was unsuccessfully targeted by the threat actor, was later returned to the manufacturers to ensure that the data center was secure.",{"data":16204,"content":16205,"nodeType":1312},{},[16206],{"data":16207,"marks":16208,"value":15312,"nodeType":864},{},[],{"data":16210,"content":16211,"nodeType":860},{},[16212],{"data":16213,"marks":16214,"value":15319,"nodeType":864},{},[],{"data":16216,"content":16217,"nodeType":4845},{},[16218,16257,16316],{"data":16219,"content":16220,"nodeType":4581},{},[16221,16230,16239,16248],{"data":16222,"content":16223,"nodeType":12016},{},[16224],{"data":16225,"content":16226,"nodeType":860},{},[16227],{"data":16228,"marks":16229,"value":15335,"nodeType":864},{},[],{"data":16231,"content":16232,"nodeType":12016},{},[16233],{"data":16234,"content":16235,"nodeType":860},{},[16236],{"data":16237,"marks":16238,"value":15802,"nodeType":864},{},[],{"data":16240,"content":16241,"nodeType":12016},{},[16242],{"data":16243,"content":16244,"nodeType":860},{},[16245],{"data":16246,"marks":16247,"value":15355,"nodeType":864},{},[],{"data":16249,"content":16250,"nodeType":12016},{},[16251],{"data":16252,"content":16253,"nodeType":860},{},[16254],{"data":16255,"marks":16256,"value":15365,"nodeType":864},{},[],{"data":16258,"content":16259,"nodeType":4581},{},[16260,16279,16298,16307],{"data":16261,"content":16262,"nodeType":4569},{},[16263],{"data":16264,"content":16265,"nodeType":860},{},[16266,16269,16276],{"data":16267,"marks":16268,"value":21,"nodeType":864},{},[],{"data":16270,"content":16271,"nodeType":883},{"uri":15835},[16272],{"data":16273,"marks":16274,"value":15841,"nodeType":864},{},[16275],{"type":1455},{"data":16277,"marks":16278,"value":21,"nodeType":864},{},[],{"data":16280,"content":16281,"nodeType":4569},{},[16282],{"data":16283,"content":16284,"nodeType":860},{},[16285,16288,16295],{"data":16286,"marks":16287,"value":21,"nodeType":864},{},[],{"data":16289,"content":16290,"nodeType":883},{"uri":15856},[16291],{"data":16292,"marks":16293,"value":333,"nodeType":864},{},[16294],{"type":1455},{"data":16296,"marks":16297,"value":21,"nodeType":864},{},[],{"data":16299,"content":16300,"nodeType":4569},{},[16301],{"data":16302,"content":16303,"nodeType":860},{},[16304],{"data":16305,"marks":16306,"value":15874,"nodeType":864},{},[],{"data":16308,"content":16309,"nodeType":4569},{},[16310],{"data":16311,"content":16312,"nodeType":860},{},[16313],{"data":16314,"marks":16315,"value":15884,"nodeType":864},{},[],{"data":16317,"content":16318,"nodeType":4581},{},[16319,16340,16361,16371],{"data":16320,"content":16321,"nodeType":4569},{},[16322],{"data":16323,"content":16324,"nodeType":860},{},[16325,16328,16337],{"data":16326,"marks":16327,"value":21,"nodeType":864},{},[],{"data":16329,"content":16331,"nodeType":883},{"uri":16330},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/password_scraping/description.md",[16332],{"data":16333,"marks":16334,"value":16336,"nodeType":864},{},[16335],{"type":1455},"SAT1028",{"data":16338,"marks":16339,"value":21,"nodeType":864},{},[],{"data":16341,"content":16342,"nodeType":4569},{},[16343],{"data":16344,"content":16345,"nodeType":860},{},[16346,16349,16358],{"data":16347,"marks":16348,"value":21,"nodeType":864},{},[],{"data":16350,"content":16352,"nodeType":883},{"uri":16351},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/password-scraping",[16353],{"data":16354,"marks":16355,"value":16357,"nodeType":864},{},[16356],{"type":1455},"Password Scraping",{"data":16359,"marks":16360,"value":21,"nodeType":864},{},[],{"data":16362,"content":16363,"nodeType":4569},{},[16364],{"data":16365,"content":16366,"nodeType":860},{},[16367],{"data":16368,"marks":16369,"value":16370,"nodeType":864},{},[],"Credential Access",{"data":16372,"content":16373,"nodeType":4569},{},[16374],{"data":16375,"content":16376,"nodeType":860},{},[16377],{"data":16378,"marks":16379,"value":16380,"nodeType":864},{},[],"Collection of credentials and secrets from repositories e.g. password managers, SaaS file stores, etc.",{"data":16382,"content":16383,"nodeType":1312},{},[16384],{"data":16385,"marks":16386,"value":15498,"nodeType":864},{},[],{"data":16388,"content":16389,"nodeType":860},{},[16390],{"data":16391,"marks":16392,"value":16394,"nodeType":864},{},[16393],{"type":899},"Cloudflare — November 2023",{"data":16396,"content":16397,"nodeType":860},{},[16398],{"data":16399,"marks":16400,"value":16401,"nodeType":864},{},[],"The threat actor used tokens and credentials that had not been rotated to breach Cloudflare’s internal Atlassian server and access its Confluence wiki, Jira bug database, and Bitbucket source code management system. The threat actor first gained access to Cloudflare's self-hosted Atlassian server and then accessed the company's Confluence and Jira systems following a reconnaissance stage. Cloudflare says that this breach did not impact customer data or systems or the provision of services.",{"data":16403,"content":16404,"nodeType":860},{},[16405],{"data":16406,"marks":16407,"value":16409,"nodeType":864},{},[16408],{"type":899},"1Password — October 2023",{"data":16411,"content":16412,"nodeType":860},{},[16413],{"data":16414,"marks":16415,"value":16416,"nodeType":864},{},[],"1Password reported unsolicited activity in their Okta environment which was traced to a suspicious IP address. Later it was confirmed that an threat actor had accessed 1Password’s Okta environment using administrative privileges. They attempted to access the IT team member’s user dashboard, but that attempt was blocked by Okta. They also requested a report of administrative users, which was identified as suspicious and triggered an investigation. 1Password says it terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.",{"data":16418,"content":16419,"nodeType":860},{},[16420],{"data":16421,"marks":16422,"value":16424,"nodeType":864},{},[16423],{"type":899},"BeyondTrust - October 2023",{"data":16426,"content":16427,"nodeType":860},{},[16428],{"data":16429,"marks":16430,"value":16431,"nodeType":864},{},[],"BeyondTrust security teams detected an identity-centric attack on an in-house Okta administrator account. BeyondTrust blocked all access to the threat actor, and verified that they did not gain access to any systems. BeyondTrust has confirmed that there was no additional exposure to our internal systems or BeyondTrust’s customers.",{"data":16433,"content":16434,"nodeType":1005},{},[],{"data":16436,"content":16437,"nodeType":1009},{},[16438],{"data":16439,"marks":16440,"value":16441,"nodeType":864},{},[],"MGM Resorts — September 2023",{"data":16443,"content":16444,"nodeType":860},{},[16445],{"data":16446,"marks":16447,"value":16448,"nodeType":864},{},[],"The threat group known as Scattered Spider socially engineered MGM help desk personnel to grant ‘super admin’ access to the Okta tenant, which was then used to steal data and deploy ransomware, resulting in significant business disruption. ",{"data":16450,"content":16451,"nodeType":1312},{},[16452],{"data":16453,"marks":16454,"value":16455,"nodeType":864},{},[],"How did MGM get breached?",{"data":16457,"content":16458,"nodeType":941},{},[16459,16469,16479,16489,16499,16509],{"data":16460,"content":16461,"nodeType":945},{},[16462],{"data":16463,"content":16464,"nodeType":860},{},[16465],{"data":16466,"marks":16467,"value":16468,"nodeType":864},{},[],"Scattered Spider researched MGM employees on LinkedIn to identify individuals likely to have privileged Okta access, specifically Super Administrator privileges. ",{"data":16470,"content":16471,"nodeType":945},{},[16472],{"data":16473,"content":16474,"nodeType":860},{},[16475],{"data":16476,"marks":16477,"value":16478,"nodeType":864},{},[],"Scattered Spider contacted the IT help desk impersonating an employee with a privileged account asking for an authentication reset (password and MFA).",{"data":16480,"content":16481,"nodeType":945},{},[16482],{"data":16483,"content":16484,"nodeType":860},{},[16485],{"data":16486,"marks":16487,"value":16488,"nodeType":864},{},[],"With privileged access, the compromised Super Administrator accounts were used to assign higher privileges to other accounts, circumventing MFA by removing enrolled authenticators and/or removing MFA from authentication policies.",{"data":16490,"content":16491,"nodeType":945},{},[16492],{"data":16493,"content":16494,"nodeType":860},{},[16495],{"data":16496,"marks":16497,"value":16498,"nodeType":864},{},[],"Scattered Spider registered a second, attacker-controlled IdP via Org2Org using inbound federation, granting the ability to impersonate users and access applications on their behalf. By matching the username of target accounts in the second IdP to the original, the attacker was able to SSO into target applications. ",{"data":16500,"content":16501,"nodeType":945},{},[16502],{"data":16503,"content":16504,"nodeType":860},{},[16505],{"data":16506,"marks":16507,"value":16508,"nodeType":864},{},[],"Through inbound federation, Scattered Spider obtained global admin rights in Azure, effectively granting full control over connected systems and granting domain admin privileges in target environments.",{"data":16510,"content":16511,"nodeType":945},{},[16512],{"data":16513,"content":16514,"nodeType":860},{},[16515],{"data":16516,"marks":16517,"value":16518,"nodeType":864},{},[],"Scattered Spider deployed encryption software to around 100 ESXi servers and exfiltrated data, disrupting core business operations.",{"data":16520,"content":16521,"nodeType":1312},{},[16522],{"data":16523,"marks":16524,"value":16525,"nodeType":864},{},[],"What was the impact of the MGM breach?",{"data":16527,"content":16528,"nodeType":941},{},[16529,16539,16549],{"data":16530,"content":16531,"nodeType":945},{},[16532],{"data":16533,"content":16534,"nodeType":860},{},[16535],{"data":16536,"marks":16537,"value":16538,"nodeType":864},{},[],"Led to a 36-hour outage of multiple MGM IT systems and affected a number of its casinos on the Las Vegas strip, including the Bellagio, Excalibur, Luxor, Mandalay Bay and New York New York.",{"data":16540,"content":16541,"nodeType":945},{},[16542],{"data":16543,"content":16544,"nodeType":860},{},[16545],{"data":16546,"marks":16547,"value":16548,"nodeType":864},{},[],"Personal data compromise of an unspecified number of customers including various contact information, dates of births, genders, driver’s license numbers, social security numbers, and passport information. ",{"data":16550,"content":16551,"nodeType":945},{},[16552],{"data":16553,"content":16554,"nodeType":860},{},[16555],{"data":16556,"marks":16557,"value":16558,"nodeType":864},{},[],"MGM reported that the attack would cause a $100 million hit to its third-quarter results, including $10 million in one-time cyber security consulting fees. ",{"data":16560,"content":16561,"nodeType":1312},{},[16562],{"data":16563,"marks":16564,"value":16565,"nodeType":864},{},[],"What stands out in the MGM breach?",{"data":16567,"content":16568,"nodeType":941},{},[16569,16579,16589],{"data":16570,"content":16571,"nodeType":945},{},[16572],{"data":16573,"content":16574,"nodeType":860},{},[16575],{"data":16576,"marks":16577,"value":16578,"nodeType":864},{},[],"The MGM breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":16580,"content":16581,"nodeType":945},{},[16582],{"data":16583,"content":16584,"nodeType":860},{},[16585],{"data":16586,"marks":16587,"value":16588,"nodeType":864},{},[],"The MGM breach is notable for being a hybrid attack that ended in what has become a typical “actions on objective” for ransomware operators and their affiliates - the propagation of malware and encryption of core business servers. In this way attackers are leveraging the newer functionality that cloud services provide them to target non-cloud/on-premise resources. This potentially indicates that attackers see cloud applications and services as the path of least resistance to achieving their goals, exploiting more limited security team visibility and understanding of these services compared to more traditional (now well protected) targets. ",{"data":16590,"content":16591,"nodeType":945},{},[16592],{"data":16593,"content":16594,"nodeType":860},{},[16595],{"data":16596,"marks":16597,"value":16598,"nodeType":864},{},[],"While attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (vishing) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":16600,"content":16601,"nodeType":1312},{},[16602],{"data":16603,"marks":16604,"value":15312,"nodeType":864},{},[],{"data":16606,"content":16607,"nodeType":860},{},[16608],{"data":16609,"marks":16610,"value":15319,"nodeType":864},{},[],{"data":16612,"content":16613,"nodeType":4845},{},[16614,16653],{"data":16615,"content":16616,"nodeType":4581},{},[16617,16626,16635,16644],{"data":16618,"content":16619,"nodeType":12016},{},[16620],{"data":16621,"content":16622,"nodeType":860},{},[16623],{"data":16624,"marks":16625,"value":15335,"nodeType":864},{},[],{"data":16627,"content":16628,"nodeType":12016},{},[16629],{"data":16630,"content":16631,"nodeType":860},{},[16632],{"data":16633,"marks":16634,"value":15802,"nodeType":864},{},[],{"data":16636,"content":16637,"nodeType":12016},{},[16638],{"data":16639,"content":16640,"nodeType":860},{},[16641],{"data":16642,"marks":16643,"value":15355,"nodeType":864},{},[],{"data":16645,"content":16646,"nodeType":12016},{},[16647],{"data":16648,"content":16649,"nodeType":860},{},[16650],{"data":16651,"marks":16652,"value":15365,"nodeType":864},{},[],{"data":16654,"content":16655,"nodeType":4581},{},[16656,16677,16698,16708],{"data":16657,"content":16658,"nodeType":4569},{},[16659],{"data":16660,"content":16661,"nodeType":860},{},[16662,16665,16674],{"data":16663,"marks":16664,"value":21,"nodeType":864},{},[],{"data":16666,"content":16668,"nodeType":883},{"uri":16667},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[16669],{"data":16670,"marks":16671,"value":16673,"nodeType":864},{},[16672],{"type":1455},"SAT1041",{"data":16675,"marks":16676,"value":21,"nodeType":864},{},[],{"data":16678,"content":16679,"nodeType":4569},{},[16680],{"data":16681,"content":16682,"nodeType":860},{},[16683,16686,16695],{"data":16684,"marks":16685,"value":21,"nodeType":864},{},[],{"data":16687,"content":16689,"nodeType":883},{"uri":16688},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/inbound-federation",[16690],{"data":16691,"marks":16692,"value":16694,"nodeType":864},{},[16693],{"type":1455},"Inbound Federation",{"data":16696,"marks":16697,"value":21,"nodeType":864},{},[],{"data":16699,"content":16700,"nodeType":4569},{},[16701],{"data":16702,"content":16703,"nodeType":860},{},[16704],{"data":16705,"marks":16706,"value":16707,"nodeType":864},{},[],"Persistence; Lateral Movement",{"data":16709,"content":16710,"nodeType":4569},{},[16711],{"data":16712,"content":16713,"nodeType":860},{},[16714],{"data":16715,"marks":16716,"value":16717,"nodeType":864},{},[],"Inbound federation allows users to login to a target identity provider by authenticating with a source identity provider",{"data":16719,"content":16720,"nodeType":1005},{},[],{"data":16722,"content":16723,"nodeType":1009},{},[16724],{"data":16725,"marks":16726,"value":16727,"nodeType":864},{},[],"Retool — August 2023",{"data":16729,"content":16730,"nodeType":860},{},[16731],{"data":16732,"marks":16733,"value":16734,"nodeType":864},{},[],"Software development company Retool disclosed that the accounts of 27 of its cloud customers were compromised following a targeted SMS-based social engineering attack, which was enabled by Google Authenticator’s default synchronization of MFA tokens with the associated Google account.  ",{"data":16736,"content":16737,"nodeType":1312},{},[16738],{"data":16739,"marks":16740,"value":16741,"nodeType":864},{},[],"How did Retool get breached?",{"data":16743,"content":16744,"nodeType":941},{},[16745,16755,16765,16775,16785,16795],{"data":16746,"content":16747,"nodeType":945},{},[16748],{"data":16749,"content":16750,"nodeType":860},{},[16751],{"data":16752,"marks":16753,"value":16754,"nodeType":864},{},[],"The threat actor launched a targeted SMS-based phishing campaign against Retool employees with a custom lure relating to their workplace healthcare coverage.",{"data":16756,"content":16757,"nodeType":945},{},[16758],{"data":16759,"content":16760,"nodeType":860},{},[16761],{"data":16762,"marks":16763,"value":16764,"nodeType":864},{},[],"The timing coincided with a recently announced migration of logins to Okta, and the message contained a url disguised to look like their internal identity portal.",{"data":16766,"content":16767,"nodeType":945},{},[16768],{"data":16769,"content":16770,"nodeType":860},{},[16771],{"data":16772,"marks":16773,"value":16774,"nodeType":864},{},[],"After logging into the fake portal – which included an MFA form – the threat actor called the employee impersonating an IT team member, deepfaking the IT employee’s real voice and using real information about the company to build trust.",{"data":16776,"content":16777,"nodeType":945},{},[16778],{"data":16779,"content":16780,"nodeType":860},{},[16781],{"data":16782,"marks":16783,"value":16784,"nodeType":864},{},[],"The phished employee shared an MFA OTP token which allowed the threat actor to add their own personal device to the employee’s Okta account and enabled their own Okta MFA from that point forward.",{"data":16786,"content":16787,"nodeType":945},{},[16788],{"data":16789,"content":16790,"nodeType":860},{},[16791],{"data":16792,"marks":16793,"value":16794,"nodeType":864},{},[],"Due to the Google Authenticator synchronization feature that syncs MFA codes to the cloud by default, meaning that access to a Google account immediately gave access to all MFA tokens held within that account.",{"data":16796,"content":16797,"nodeType":945},{},[16798],{"data":16799,"content":16800,"nodeType":860},{},[16801],{"data":16802,"marks":16803,"value":16804,"nodeType":864},{},[],"This enabled the threat actor to take over a number of identities associated with a range of target apps and change the credentials.",{"data":16806,"content":16807,"nodeType":1312},{},[16808],{"data":16809,"marks":16810,"value":16811,"nodeType":864},{},[],"What was the impact of the Retool breach?",{"data":16813,"content":16814,"nodeType":941},{},[16815,16825,16835],{"data":16816,"content":16817,"nodeType":945},{},[16818],{"data":16819,"content":16820,"nodeType":860},{},[16821],{"data":16822,"marks":16823,"value":16824,"nodeType":864},{},[],"A total of 27 customers were impacted, with the threat actor specifically targeting customers in the Crypto industry.",{"data":16826,"content":16827,"nodeType":945},{},[16828],{"data":16829,"content":16830,"nodeType":860},{},[16831],{"data":16832,"marks":16833,"value":16834,"nodeType":864},{},[],"After taking over the accounts, the threat actor was observed gathering information and exploring the Retool apps.",{"data":16836,"content":16837,"nodeType":945},{},[16838],{"data":16839,"content":16840,"nodeType":860},{},[16841],{"data":16842,"marks":16843,"value":16844,"nodeType":864},{},[],"After learning of the attack, Retool revoked all internal authenticated sessions (Okta, GSuite, etc.) for employees, locked down access to the affected accounts, notified the affected customers, and restored their accounts to their original state.",{"data":16846,"content":16847,"nodeType":1312},{},[16848],{"data":16849,"marks":16850,"value":16851,"nodeType":864},{},[],"What stands out in the Retool breach?",{"data":16853,"content":16854,"nodeType":941},{},[16855,16865,16875],{"data":16856,"content":16857,"nodeType":945},{},[16858],{"data":16859,"content":16860,"nodeType":860},{},[16861],{"data":16862,"marks":16863,"value":16864,"nodeType":864},{},[],"Like the MGM breach, the Retool breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":16866,"content":16867,"nodeType":945},{},[16868],{"data":16869,"content":16870,"nodeType":860},{},[16871],{"data":16872,"marks":16873,"value":16874,"nodeType":864},{},[],"A further similarity with the MGM breach, while attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (SMS phishing in this case) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":16876,"content":16877,"nodeType":945},{},[16878],{"data":16879,"content":16880,"nodeType":860},{},[16881],{"data":16882,"marks":16883,"value":16884,"nodeType":864},{},[],"In this case, the attacker abused inherent weaknesses in Google Authenticator, which came under fire following the breach for its default synchronization of MFA codes to the cloud when connected to an account, in order to move laterally and compromise other target apps. ",{"data":16886,"content":16887,"nodeType":1312},{},[16888],{"data":16889,"marks":16890,"value":15312,"nodeType":864},{},[],{"data":16892,"content":16893,"nodeType":860},{},[16894],{"data":16895,"marks":16896,"value":15319,"nodeType":864},{},[],{"data":16898,"content":16899,"nodeType":4845},{},[16900,16939,17005],{"data":16901,"content":16902,"nodeType":4581},{},[16903,16912,16921,16930],{"data":16904,"content":16905,"nodeType":12016},{},[16906],{"data":16907,"content":16908,"nodeType":860},{},[16909],{"data":16910,"marks":16911,"value":15335,"nodeType":864},{},[],{"data":16913,"content":16914,"nodeType":12016},{},[16915],{"data":16916,"content":16917,"nodeType":860},{},[16918],{"data":16919,"marks":16920,"value":15802,"nodeType":864},{},[],{"data":16922,"content":16923,"nodeType":12016},{},[16924],{"data":16925,"content":16926,"nodeType":860},{},[16927],{"data":16928,"marks":16929,"value":15355,"nodeType":864},{},[],{"data":16931,"content":16932,"nodeType":12016},{},[16933],{"data":16934,"content":16935,"nodeType":860},{},[16936],{"data":16937,"marks":16938,"value":15365,"nodeType":864},{},[],{"data":16940,"content":16941,"nodeType":4581},{},[16942,16964,16986,16995],{"data":16943,"content":16944,"nodeType":4569},{},[16945],{"data":16946,"content":16947,"nodeType":860},{},[16948,16952,16961],{"data":16949,"marks":16950,"value":21,"nodeType":864},{},[16951],{"type":1455},{"data":16953,"content":16955,"nodeType":883},{"uri":16954},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/aitm_phishing/description.md",[16956],{"data":16957,"marks":16958,"value":16960,"nodeType":864},{},[16959],{"type":1455},"SAT1042",{"data":16962,"marks":16963,"value":21,"nodeType":864},{},[],{"data":16965,"content":16966,"nodeType":4569},{},[16967],{"data":16968,"content":16969,"nodeType":860},{},[16970,16974,16983],{"data":16971,"marks":16972,"value":21,"nodeType":864},{},[16973],{"type":1455},{"data":16975,"content":16977,"nodeType":883},{"uri":16976},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/aitm-phishing",[16978],{"data":16979,"marks":16980,"value":16982,"nodeType":864},{},[16981],{"type":1455},"AiTM Phishing",{"data":16984,"marks":16985,"value":21,"nodeType":864},{},[],{"data":16987,"content":16988,"nodeType":4569},{},[16989],{"data":16990,"content":16991,"nodeType":860},{},[16992],{"data":16993,"marks":16994,"value":15874,"nodeType":864},{},[],{"data":16996,"content":16997,"nodeType":4569},{},[16998],{"data":16999,"content":17000,"nodeType":860},{},[17001],{"data":17002,"marks":17003,"value":17004,"nodeType":864},{},[],"Attacker-in-the-Middle (AiTM) phishing uses dedicated tooling to act as a web proxy between the victim and a legitimate login portal for an application the victim has access to, principally to make it easier to defeat MFA protection.",{"data":17006,"content":17007,"nodeType":4581},{},[17008,17029,17052,17062],{"data":17009,"content":17010,"nodeType":4569},{},[17011],{"data":17012,"content":17013,"nodeType":860},{},[17014,17017,17026],{"data":17015,"marks":17016,"value":21,"nodeType":864},{},[],{"data":17018,"content":17020,"nodeType":883},{"uri":17019},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_enrollment/description.md",[17021],{"data":17022,"marks":17023,"value":17025,"nodeType":864},{},[17024],{"type":1455},"SAT1043",{"data":17027,"marks":17028,"value":21,"nodeType":864},{},[],{"data":17030,"content":17031,"nodeType":4569},{},[17032],{"data":17033,"content":17034,"nodeType":860},{},[17035,17039,17048],{"data":17036,"marks":17037,"value":21,"nodeType":864},{},[17038],{"type":1455},{"data":17040,"content":17042,"nodeType":883},{"uri":17041},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/device-enrollment",[17043],{"data":17044,"marks":17045,"value":17047,"nodeType":864},{},[17046],{"type":1455},"Device Enrollment",{"data":17049,"marks":17050,"value":21,"nodeType":864},{},[17051],{"type":1455},{"data":17053,"content":17054,"nodeType":4569},{},[17055],{"data":17056,"content":17057,"nodeType":860},{},[17058],{"data":17059,"marks":17060,"value":17061,"nodeType":864},{},[],"Initial Access; Persistence",{"data":17063,"content":17064,"nodeType":4569},{},[17065],{"data":17066,"content":17067,"nodeType":860},{},[17068],{"data":17069,"marks":17070,"value":17071,"nodeType":864},{},[],"Enrollment of a new MFA device in order to allow an adversary to complete MFA challenges for future authentication. ",{"data":17073,"content":17074,"nodeType":1005},{},[],{"data":17076,"content":17077,"nodeType":1009},{},[17078],{"data":17079,"marks":17080,"value":17081,"nodeType":864},{},[],"GitHub / Heroku / Travis-CI / npm — April 2022",{"data":17083,"content":17084,"nodeType":860},{},[17085],{"data":17086,"marks":17087,"value":17088,"nodeType":864},{},[],"An unknown threat actor used stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories. The threat actor then compromised an internal Heroku customer database as well as accessed and stole data from dozens of downstream organizations using Heroku and Travis-CI-maintained OAuth apps.",{"data":17090,"content":17091,"nodeType":1312},{},[17092],{"data":17093,"marks":17094,"value":17095,"nodeType":864},{},[],"How did they get breached?",{"data":17097,"content":17098,"nodeType":941},{},[17099,17109,17119,17129,17139,17149,17159],{"data":17100,"content":17101,"nodeType":945},{},[17102],{"data":17103,"content":17104,"nodeType":860},{},[17105],{"data":17106,"marks":17107,"value":17108,"nodeType":864},{},[],"The threat actor obtained access to two third-party OAuth integrators, Heroku and Travis-CI, accessing databases and downloading stored customer GitHub integration OAuth tokens. These tokens had earlier been used by Travis-CI and Heroku OAuth applications to integrate with GitHub to deploy applications.",{"data":17110,"content":17111,"nodeType":945},{},[17112],{"data":17113,"content":17114,"nodeType":860},{},[17115],{"data":17116,"marks":17117,"value":17118,"nodeType":864},{},[],"Access to the environment was gained by leveraging a compromised token for a Heroku machine account, but it is not disclosed how the threat actor achieved this. ",{"data":17120,"content":17121,"nodeType":945},{},[17122],{"data":17123,"content":17124,"nodeType":860},{},[17125],{"data":17126,"marks":17127,"value":17128,"nodeType":864},{},[],"The threat actor authenticated to the GitHub API using the stolen OAuth tokens issued to Heroku and Travis CI.",{"data":17130,"content":17131,"nodeType":945},{},[17132],{"data":17133,"content":17134,"nodeType":860},{},[17135],{"data":17136,"marks":17137,"value":17138,"nodeType":864},{},[],"For users who had the affected Heroku or Travis CI OAuth apps authorized in their GitHub accounts, the threat actor listed all the user's organizations.",{"data":17140,"content":17141,"nodeType":945},{},[17142],{"data":17143,"content":17144,"nodeType":860},{},[17145],{"data":17146,"marks":17147,"value":17148,"nodeType":864},{},[],"The threat actor then selected targets based on the listed organizations.",{"data":17150,"content":17151,"nodeType":945},{},[17152],{"data":17153,"content":17154,"nodeType":860},{},[17155],{"data":17156,"marks":17157,"value":17158,"nodeType":864},{},[],"The threat actor listed the private repositories for user accounts of interest and proceeded to clone private repositories of interest.",{"data":17160,"content":17161,"nodeType":945},{},[17162],{"data":17163,"content":17164,"nodeType":860},{},[17165],{"data":17166,"marks":17167,"value":17168,"nodeType":864},{},[],"GitHub identified unauthorized access to their npm production infrastructure using a compromised AWS API key, obtained by the threat actor when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications.",{"data":17170,"content":17171,"nodeType":1312},{},[17172],{"data":17173,"marks":17174,"value":17175,"nodeType":864},{},[],"What was the impact?",{"data":17177,"content":17178,"nodeType":941},{},[17179,17189,17199],{"data":17180,"content":17181,"nodeType":945},{},[17182],{"data":17183,"content":17184,"nodeType":860},{},[17185],{"data":17186,"marks":17187,"value":17188,"nodeType":864},{},[],"By stealing these OAuth tokens, the threat actor could access and download data from GitHub repositories belonging to those who authorized the compromised Heroku or Travis CI OAuth apps with their accounts. ",{"data":17190,"content":17191,"nodeType":945},{},[17192],{"data":17193,"content":17194,"nodeType":860},{},[17195],{"data":17196,"marks":17197,"value":17198,"nodeType":864},{},[],"The threat actor was able to mine the downloaded private repositories for secrets that could be used to pivot to other infrastructure, stealing data from dozens of organizations. ",{"data":17200,"content":17201,"nodeType":945},{},[17202],{"data":17203,"content":17204,"nodeType":860},{},[17205],{"data":17206,"marks":17207,"value":17208,"nodeType":864},{},[],"In addition to user repo’s downstream, the compromised token for a Heroku machine account obtained by threat actors also allowed unauthorized access into Heroku's internal database of customer accounts, enabling the threat actor to extract the hashed and salted passwords. ",{"data":17210,"content":17211,"nodeType":1312},{},[17212],{"data":17213,"marks":17214,"value":17215,"nodeType":864},{},[],"What stands out in the Github breach?",{"data":17217,"content":17218,"nodeType":941},{},[17219,17229,17239],{"data":17220,"content":17221,"nodeType":945},{},[17222],{"data":17223,"content":17224,"nodeType":860},{},[17225],{"data":17226,"marks":17227,"value":17228,"nodeType":864},{},[],"Similar to the Okta breach, this attack showcases the possibility of third-party supply chain attacks to target downstream organizations using cloud SaaS services. In this case, targeting OAuth integrators as opposed to IdP providers, but with a similar goal and impact of compromising the real target organizations downstream. ",{"data":17230,"content":17231,"nodeType":945},{},[17232],{"data":17233,"content":17234,"nodeType":860},{},[17235],{"data":17236,"marks":17237,"value":17238,"nodeType":864},{},[],"Applications like Github are an obvious target for attackers due to their widespread adoption. There have been numerous attacks leveraging Github as the vehicle for attacks by compromising repo’s to insert malicious code, or registering malicious copycat repo’s to dupe users into using them. ",{"data":17240,"content":17241,"nodeType":945},{},[17242],{"data":17243,"content":17244,"nodeType":860},{},[17245],{"data":17246,"marks":17247,"value":17248,"nodeType":864},{},[],"Unlike the attacks abusing the functionality of Github (repo poisoning) which target the legitimate developer processes when using the app, this attack could have been prevented at the identity layer before the attacker was able to breach the Heroku/Travis-CI accounts. ",{"data":17250,"content":17251,"nodeType":1312},{},[17252],{"data":17253,"marks":17254,"value":15312,"nodeType":864},{},[],{"data":17256,"content":17257,"nodeType":860},{},[17258],{"data":17259,"marks":17260,"value":15319,"nodeType":864},{},[],{"data":17262,"content":17263,"nodeType":4845},{},[17264,17303,17363,17428],{"data":17265,"content":17266,"nodeType":4581},{},[17267,17276,17285,17294],{"data":17268,"content":17269,"nodeType":12016},{},[17270],{"data":17271,"content":17272,"nodeType":860},{},[17273],{"data":17274,"marks":17275,"value":15335,"nodeType":864},{},[],{"data":17277,"content":17278,"nodeType":12016},{},[17279],{"data":17280,"content":17281,"nodeType":860},{},[17282],{"data":17283,"marks":17284,"value":15802,"nodeType":864},{},[],{"data":17286,"content":17287,"nodeType":12016},{},[17288],{"data":17289,"content":17290,"nodeType":860},{},[17291],{"data":17292,"marks":17293,"value":15355,"nodeType":864},{},[],{"data":17295,"content":17296,"nodeType":12016},{},[17297],{"data":17298,"content":17299,"nodeType":860},{},[17300],{"data":17301,"marks":17302,"value":15365,"nodeType":864},{},[],{"data":17304,"content":17305,"nodeType":4581},{},[17306,17325,17344,17354],{"data":17307,"content":17308,"nodeType":4569},{},[17309],{"data":17310,"content":17311,"nodeType":860},{},[17312,17315,17322],{"data":17313,"marks":17314,"value":21,"nodeType":864},{},[],{"data":17316,"content":17317,"nodeType":883},{"uri":15964},[17318],{"data":17319,"marks":17320,"value":15970,"nodeType":864},{},[17321],{"type":1455},{"data":17323,"marks":17324,"value":21,"nodeType":864},{},[],{"data":17326,"content":17327,"nodeType":4569},{},[17328],{"data":17329,"content":17330,"nodeType":860},{},[17331,17334,17341],{"data":17332,"marks":17333,"value":21,"nodeType":864},{},[],{"data":17335,"content":17336,"nodeType":883},{"uri":15985},[17337],{"data":17338,"marks":17339,"value":15991,"nodeType":864},{},[17340],{"type":1455},{"data":17342,"marks":17343,"value":21,"nodeType":864},{},[],{"data":17345,"content":17346,"nodeType":4569},{},[17347],{"data":17348,"content":17349,"nodeType":860},{},[17350],{"data":17351,"marks":17352,"value":17353,"nodeType":864},{},[],"Privilege Escalation; Lateral Movement",{"data":17355,"content":17356,"nodeType":4569},{},[17357],{"data":17358,"content":17359,"nodeType":860},{},[17360],{"data":17361,"marks":17362,"value":16014,"nodeType":864},{},[],{"data":17364,"content":17365,"nodeType":4581},{},[17366,17387,17408,17418],{"data":17367,"content":17368,"nodeType":4569},{},[17369],{"data":17370,"content":17371,"nodeType":860},{},[17372,17375,17384],{"data":17373,"marks":17374,"value":21,"nodeType":864},{},[],{"data":17376,"content":17378,"nodeType":883},{"uri":17377},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_keys/description.md",[17379],{"data":17380,"marks":17381,"value":17383,"nodeType":864},{},[17382],{"type":1455},"SAT1004",{"data":17385,"marks":17386,"value":21,"nodeType":864},{},[],{"data":17388,"content":17389,"nodeType":4569},{},[17390],{"data":17391,"content":17392,"nodeType":860},{},[17393,17396,17405],{"data":17394,"marks":17395,"value":21,"nodeType":864},{},[],{"data":17397,"content":17399,"nodeType":883},{"uri":17398},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/api-keys",[17400],{"data":17401,"marks":17402,"value":17404,"nodeType":864},{},[17403],{"type":1455},"API keys",{"data":17406,"marks":17407,"value":21,"nodeType":864},{},[],{"data":17409,"content":17410,"nodeType":4569},{},[17411],{"data":17412,"content":17413,"nodeType":860},{},[17414],{"data":17415,"marks":17416,"value":17417,"nodeType":864},{},[],"Persistence; Defense Evasion",{"data":17419,"content":17420,"nodeType":4569},{},[17421],{"data":17422,"content":17423,"nodeType":860},{},[17424],{"data":17425,"marks":17426,"value":17427,"nodeType":864},{},[],"An adversary that has compromised an account could then read existing API keys from the app settings, if the app allows this, or create a new API key.",{"data":17429,"content":17430,"nodeType":4581},{},[17431,17452,17473,17483],{"data":17432,"content":17433,"nodeType":4569},{},[17434],{"data":17435,"content":17436,"nodeType":860},{},[17437,17440,17449],{"data":17438,"marks":17439,"value":21,"nodeType":864},{},[],{"data":17441,"content":17443,"nodeType":883},{"uri":17442},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_directory_lookup/description.md#app-directory-lookup",[17444],{"data":17445,"marks":17446,"value":17448,"nodeType":864},{},[17447],{"type":1455},"SAT1006",{"data":17450,"marks":17451,"value":21,"nodeType":864},{},[],{"data":17453,"content":17454,"nodeType":4569},{},[17455],{"data":17456,"content":17457,"nodeType":860},{},[17458,17461,17470],{"data":17459,"marks":17460,"value":21,"nodeType":864},{},[],{"data":17462,"content":17464,"nodeType":883},{"uri":17463},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/app-directory-lookup",[17465],{"data":17466,"marks":17467,"value":17469,"nodeType":864},{},[17468],{"type":1455},"App directory lookup",{"data":17471,"marks":17472,"value":21,"nodeType":864},{},[],{"data":17474,"content":17475,"nodeType":4569},{},[17476],{"data":17477,"content":17478,"nodeType":860},{},[17479],{"data":17480,"marks":17481,"value":17482,"nodeType":864},{},[],"Discovery",{"data":17484,"content":17485,"nodeType":4569},{},[17486],{"data":17487,"content":17488,"nodeType":860},{},[17489],{"data":17490,"marks":17491,"value":17492,"nodeType":864},{},[],"An adversary who has gained a foothold via a SaaS app could download the list of users accessible to them in order to better target attacks against other users.",{"data":17494,"content":17495,"nodeType":1005},{},[],{"data":17497,"content":17498,"nodeType":1009},{},[17499],{"data":17500,"marks":17501,"value":17502,"nodeType":864},{},[],"Other notable attacks",{"data":17504,"content":17505,"nodeType":1312},{},[17506],{"data":17507,"marks":17508,"value":17509,"nodeType":864},{},[],"SEC X hack — January 2024",{"data":17511,"content":17512,"nodeType":860},{},[17513],{"data":17514,"marks":17515,"value":17516,"nodeType":864},{},[],"The X account for the U.S. Securities and Exchange Commission was victim to a SIM swapping attack, whereupon the attacker used the social media platform to issue a fake announcement on the approval of Bitcoin ETFs on security exchanges.",{"data":17518,"content":17519,"nodeType":860},{},[17520],{"data":17521,"marks":17522,"value":17523,"nodeType":864},{},[],"Once the threat actors controlled the number, they reset the password for the @SECGov account, and created the fake announcement. The SEC also confirmed that multi-factor authentication was not enabled on the account, as they had asked X support to disable it when they encountered problems logging into the account.",{"data":17525,"content":17526,"nodeType":1005},{},[],{"data":17528,"content":17529,"nodeType":1312},{},[17530],{"data":17531,"marks":17532,"value":17533,"nodeType":864},{},[],"Mandiant X hack — January 2024",{"data":17535,"content":17536,"nodeType":860},{},[17537],{"data":17538,"marks":17539,"value":17540,"nodeType":864},{},[],"The X account for Mandiant was hacked by a Drainer-as-a-Service (DaaS) gang in a brute force attack. MFA was not enabled on the account. The threat actor used the social media account to share links redirecting to a phishing page to steal cryptocurrency. ",{"data":17542,"content":17543,"nodeType":860},{},[17544],{"data":17545,"marks":17546,"value":17547,"nodeType":864},{},[],"The attacker used a wallet drainer dubbed CLINKSINK. This same drainer has been used since December to steal funds and tokens from users of Solana cryptocurrency as part of a large-scale campaign involving at least 35 affiliate IDs linked to a shared DaaS.",{"data":17549,"content":17550,"nodeType":1005},{},[],{"data":17552,"content":17553,"nodeType":1312},{},[17554],{"data":17555,"marks":17556,"value":17557,"nodeType":864},{},[],"23andMe data breach — April 2023",{"data":17559,"content":17560,"nodeType":860},{},[17561],{"data":17562,"marks":17563,"value":17564,"nodeType":864},{},[],"Genetic testing provider 23andMe confirmed that hackers downloaded the data of 6.9 million people of the existing 14 million customers after breaching around 14,000 user accounts. ",{"data":17566,"content":17567,"nodeType":860},{},[17568],{"data":17569,"marks":17570,"value":17571,"nodeType":864},{},[],"The attacker stole health reports and raw genotype data of customers affected by a credential stuffing attack that went unnoticed for five months, from April 29 to September 27. ",{"data":17573,"content":17574,"nodeType":860},{},[17575],{"data":17576,"marks":17577,"value":17578,"nodeType":864},{},[],"The credentials used by the attackers to breach the customers' accounts were stolen in other data breaches or used on previously compromised online platforms, and targeted accounts without MFA. ","Tracking identity-based attacks in the wild","To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.","2024-03-21T00:00:00.000Z","identity-attacks-in-the-wild",{"items":17584},[17585,17587],{"sys":17586,"name":7555},{"id":7554},{"sys":17588,"name":342},{"id":12756},{"items":17590},[17591],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":17592},{"url":2740},{"__typename":2059,"sys":17594,"content":17596,"title":18385,"synopsis":18386,"hashTags":59,"publishedDate":18387,"slug":18388,"tagsCollection":18389,"authorsCollection":18397},{"id":17595},"20FcoPvHu7zXkTQyv9MmK0",{"json":17597},{"data":17598,"content":17599,"nodeType":856},{},[17600,17606,17613,17665,17672,17679,17694,17701,17708,17793,17800,17806,17813,17820,17835,17842,17849,17872,17894,17900,17920,17927,17934,17964,17971,17978,17984,18002,18009,18016,18023,18030,18036,18054,18061,18068,18075,18082,18088,18107,18113,18120,18126,18145,18152,18159,18166,18214,18221,18292,18307,18313,18320,18327,18334,18341,18359,18366],{"data":17601,"content":17605,"nodeType":996},{"target":17602},{"sys":17603},{"id":17604,"type":1001,"linkType":1002},"7rud2H1hcTAOhxh9zHzxP6",[],{"data":17607,"content":17608,"nodeType":860},{},[17609],{"data":17610,"marks":17611,"value":17612,"nodeType":864},{},[],"If someone asked you where you work, you probably wouldn’t answer, “My browser.” But that would be the truth.",{"data":17614,"content":17615,"nodeType":860},{},[17616,17620,17628,17631,17639,17642,17650,17653,17661],{"data":17617,"marks":17618,"value":17619,"nodeType":864},{},[],"(Threat actors already know where you work, of course, and they’ve been capitalizing on the massive shift to cloud-based workforces. Just look at any of the ",{"data":17621,"content":17623,"nodeType":883},{"uri":17622},"https://www.crowdstrike.com/global-threat-report/",[17624],{"data":17625,"marks":17626,"value":17627,"nodeType":864},{},[],"latest",{"data":17629,"marks":17630,"value":1171,"nodeType":864},{},[],{"data":17632,"content":17634,"nodeType":883},{"uri":17633},"https://redcanary.com/threat-detection-report/techniques/cloud-accounts/",[17635],{"data":17636,"marks":17637,"value":17638,"nodeType":864},{},[],"threat",{"data":17640,"marks":17641,"value":1171,"nodeType":864},{},[],{"data":17643,"content":17645,"nodeType":883},{"uri":17644},"https://www.verizon.com/business/resources/reports/dbir/",[17646],{"data":17647,"marks":17648,"value":17649,"nodeType":864},{},[],"research",{"data":17651,"marks":17652,"value":1171,"nodeType":864},{},[],{"data":17654,"content":17656,"nodeType":883},{"uri":17655},"https://www.lab539.com/blog/6-months-tracking-aitm-campaigns",[17657],{"data":17658,"marks":17659,"value":17660,"nodeType":864},{},[],"reports",{"data":17662,"marks":17663,"value":17664,"nodeType":864},{},[]," on identity-based attacks to see how good a job they’ve been doing.)",{"data":17666,"content":17667,"nodeType":860},{},[17668],{"data":17669,"marks":17670,"value":17671,"nodeType":864},{},[],"To get visibility of your infrastructure in order to build a strong detection and response program, the equation used to look something like:",{"data":17673,"content":17674,"nodeType":860},{},[17675],{"data":17676,"marks":17677,"value":17678,"nodeType":864},{},[],"Network traffic + Logs + Endpoints = Profit!",{"data":17680,"content":17681,"nodeType":860},{},[17682,17686,17691],{"data":17683,"marks":17684,"value":17685,"nodeType":864},{},[],"But now there’s a missing piece, as identity infrastructure sprawls across IdPs, core apps, shadow SaaS and third-party integrations: ",{"data":17687,"marks":17688,"value":17690,"nodeType":864},{},[17689],{"type":899},"Browser telemetry",{"data":17692,"marks":17693,"value":2924,"nodeType":864},{},[],{"data":17695,"content":17696,"nodeType":860},{},[17697],{"data":17698,"marks":17699,"value":17700,"nodeType":864},{},[],"As a browser agent, Push is uniquely positioned to provide telemetry you can’t easily get anywhere else. We believe that this missing piece is the key to stopping identity attacks by providing the context both for first-class detections and security controls, as well as key correlations for events you observe in traditional log sources.",{"data":17702,"content":17703,"nodeType":860},{},[17704],{"data":17705,"marks":17706,"value":17707,"nodeType":864},{},[],"Now we have a better way to bring Push’s data to life to solve meaningful security challenges:",{"data":17709,"content":17710,"nodeType":941},{},[17711,17742],{"data":17712,"content":17713,"nodeType":945},{},[17714],{"data":17715,"content":17716,"nodeType":860},{},[17717,17722,17726,17738],{"data":17718,"marks":17719,"value":17721,"nodeType":864},{},[17720],{"type":899},"Plug-and-play security controls",{"data":17723,"marks":17724,"value":17725,"nodeType":864},{},[],", accessible from the new ",{"data":17727,"content":17731,"nodeType":17737},{"target":17728},{"sys":17729},{"id":17730,"type":1001,"linkType":1002},"BtDLgVZRWQ3Ov4WgDQX1W",[17732],{"data":17733,"marks":17734,"value":17736,"nodeType":864},{},[17735],{"type":899},"Controls","entry-hyperlink",{"data":17739,"marks":17740,"value":17741,"nodeType":864},{},[]," page in the Push platform",{"data":17743,"content":17744,"nodeType":945},{},[17745],{"data":17746,"content":17747,"nodeType":860},{},[17748,17753,17757,17765,17768,17776,17780,17789],{"data":17749,"marks":17750,"value":17752,"nodeType":864},{},[17751],{"type":899},"Choose-your-own-adventure tooling",{"data":17754,"marks":17755,"value":17756,"nodeType":864},{},[],", including a ",{"data":17758,"content":17760,"nodeType":883},{"uri":17759},"https://pushsecurity.redoc.ly/rest-v1/",[17761],{"data":17762,"marks":17763,"value":17764,"nodeType":864},{},[],"REST API",{"data":17766,"marks":17767,"value":3731,"nodeType":864},{},[],{"data":17769,"content":17771,"nodeType":883},{"uri":17770},"https://pushsecurity.redoc.ly/webhooks-v1/",[17772],{"data":17773,"marks":17774,"value":17775,"nodeType":864},{},[],"webhooks",{"data":17777,"marks":17778,"value":17779,"nodeType":864},{},[],", and a new ",{"data":17781,"content":17783,"nodeType":883},{"uri":17782},"/help/audience/administrators/docs/connect-to-siem-or-soar/#using-the-events-page",[17784],{"data":17785,"marks":17786,"value":17788,"nodeType":864},{},[17787],{"type":899},"Events",{"data":17790,"marks":17791,"value":17792,"nodeType":864},{},[]," page to help you visualize and build custom detections and automations.",{"data":17794,"content":17795,"nodeType":860},{},[17796],{"data":17797,"marks":17798,"value":17799,"nodeType":864},{},[],"Let’s take a closer look.",{"data":17801,"content":17805,"nodeType":996},{"target":17802},{"sys":17803},{"id":17804,"type":1001,"linkType":1002},"6iKFd9Qys2SSuNqKVQB7ka",[],{"data":17807,"content":17808,"nodeType":1009},{},[17809],{"data":17810,"marks":17811,"value":17812,"nodeType":864},{},[],"Plug-and-play controls",{"data":17814,"content":17815,"nodeType":860},{},[17816],{"data":17817,"marks":17818,"value":17819,"nodeType":864},{},[],"Security visibility without security control is a recipe for a stress headache, so we’re big believers in providing meaningful interventions that are easy to use.",{"data":17821,"content":17822,"nodeType":860},{},[17823,17827,17831],{"data":17824,"marks":17825,"value":17826,"nodeType":864},{},[],"With the new ",{"data":17828,"marks":17829,"value":17736,"nodeType":864},{},[17830],{"type":899},{"data":17832,"marks":17833,"value":17834,"nodeType":864},{},[]," page in the Push admin console, you can now find these preconfigured detections and interventions in one place. They cover use cases that any organization can benefit from, and take a unique browser-based approach to solving some thorny issues.",{"data":17836,"content":17837,"nodeType":860},{},[17838],{"data":17839,"marks":17840,"value":17841,"nodeType":864},{},[],"These controls include:",{"data":17843,"content":17844,"nodeType":1312},{},[17845],{"data":17846,"marks":17847,"value":17848,"nodeType":864},{},[],"Phishing tool detection",{"data":17850,"content":17851,"nodeType":860},{},[17852,17856,17861,17864,17869],{"data":17853,"marks":17854,"value":17855,"nodeType":864},{},[],"Detect and block when employees visit webpages that use advanced phishing tools such as Evilginx or EvilNoVNC, among others. These adversary-in-the-middle (AitM) toolkits can mimic legitimate login screens, such as an Okta login page, to steal ",{"data":17857,"marks":17858,"value":17860,"nodeType":864},{},[17859],{"type":899},"credentials",{"data":17862,"marks":17863,"value":902,"nodeType":864},{},[],{"data":17865,"marks":17866,"value":17868,"nodeType":864},{},[17867],{"type":899},"MFA codes",{"data":17870,"marks":17871,"value":2924,"nodeType":864},{},[],{"data":17873,"content":17874,"nodeType":860},{},[17875,17879,17883,17886,17890],{"data":17876,"marks":17877,"value":17878,"nodeType":864},{},[],"Push emits a webhook event when the browser agent detects attributes of these malware. You can also set Push to ",{"data":17880,"marks":17881,"value":1503,"nodeType":864},{},[17882],{"type":899},{"data":17884,"marks":17885,"value":13711,"nodeType":864},{},[],{"data":17887,"marks":17888,"value":1397,"nodeType":864},{},[17889],{"type":899},{"data":17891,"marks":17892,"value":17893,"nodeType":864},{},[]," mode to display a customizable message to end-users when they encounter a phishing site.",{"data":17895,"content":17899,"nodeType":996},{"target":17896},{"sys":17897},{"id":17898,"type":1001,"linkType":1002},"2ylIkR0JXHkFStGuCFRjlN",[],{"data":17901,"content":17902,"nodeType":860},{},[17903,17907,17917],{"data":17904,"marks":17905,"value":17906,"nodeType":864},{},[],"More about ",{"data":17908,"content":17912,"nodeType":17737},{"target":17909},{"sys":17910},{"id":17911,"type":1001,"linkType":1002},"7KRnTSnJAbbiho69gNyN0B",[17913],{"data":17914,"marks":17915,"value":17916,"nodeType":864},{},[],"phishing tool detection",{"data":17918,"marks":17919,"value":21,"nodeType":864},{},[],{"data":17921,"content":17922,"nodeType":1312},{},[17923],{"data":17924,"marks":17925,"value":17926,"nodeType":864},{},[],"SSO password protection",{"data":17928,"content":17929,"nodeType":860},{},[17930],{"data":17931,"marks":17932,"value":17933,"nodeType":864},{},[],"Prevent employees from reusing their corporate SSO password on any page that doesn’t belong to the identity provider, including phishing sites. This means that even if that employee was the first person to get phished using a new attacker site, Push still detects it and blocks it.",{"data":17935,"content":17936,"nodeType":860},{},[17937,17941,17945,17948,17952,17956,17960],{"data":17938,"marks":17939,"value":17940,"nodeType":864},{},[],"Customize the message that end-users see in ",{"data":17942,"marks":17943,"value":1503,"nodeType":864},{},[17944],{"type":899},{"data":17946,"marks":17947,"value":13711,"nodeType":864},{},[],{"data":17949,"marks":17950,"value":1397,"nodeType":864},{},[17951],{"type":899},{"data":17953,"marks":17954,"value":17955,"nodeType":864},{},[]," mode, or start out in ",{"data":17957,"marks":17958,"value":1334,"nodeType":864},{},[17959],{"type":899},{"data":17961,"marks":17962,"value":17963,"nodeType":864},{},[]," mode to catch any false positives before you enforce the control.",{"data":17965,"content":17966,"nodeType":860},{},[17967],{"data":17968,"marks":17969,"value":17970,"nodeType":864},{},[],"This feature supports the following identity providers: Okta, Microsoft 365, Google Workspace, JumpCloud, Duo, and Ping Identity.",{"data":17972,"content":17973,"nodeType":860},{},[17974],{"data":17975,"marks":17976,"value":17977,"nodeType":864},{},[],"Push will also emit a webhook event when an SSO password is used, and if an employee clicks through the warning screen.",{"data":17979,"content":17983,"nodeType":996},{"target":17980},{"sys":17981},{"id":17982,"type":1001,"linkType":1002},"25c8M2gWYFST7yYxGEji2s",[],{"data":17985,"content":17986,"nodeType":860},{},[17987,17990,17999],{"data":17988,"marks":17989,"value":17906,"nodeType":864},{},[],{"data":17991,"content":17995,"nodeType":17737},{"target":17992},{"sys":17993},{"id":17994,"type":1001,"linkType":1002},"6FYHbkcRUrtznPo7RarRsz",[17996],{"data":17997,"marks":17998,"value":17926,"nodeType":864},{},[],{"data":18000,"marks":18001,"value":21,"nodeType":864},{},[],{"data":18003,"content":18004,"nodeType":1312},{},[18005],{"data":18006,"marks":18007,"value":18008,"nodeType":864},{},[],"URL blocking",{"data":18010,"content":18011,"nodeType":860},{},[18012],{"data":18013,"marks":18014,"value":18015,"nodeType":864},{},[],"When you find malicious sites you want to block, such as when responding to a phishing incident, add them to a blocklist and prevent other employees from accessing those sites. ",{"data":18017,"content":18018,"nodeType":860},{},[18019],{"data":18020,"marks":18021,"value":18022,"nodeType":864},{},[],"URL blocking can be used in tandem with Push’s anti-phishing controls, so that as you discover malicious sites, you can block them from a central blocklist. This offers a kind of herd immunity where you can block other users from visiting a malicious site as soon as you have a single incident.",{"data":18024,"content":18025,"nodeType":860},{},[18026],{"data":18027,"marks":18028,"value":18029,"nodeType":864},{},[],"You can programmatically manage the blocklist using the Push REST API or sync to other threat intelligence sources you consume.",{"data":18031,"content":18035,"nodeType":996},{"target":18032},{"sys":18033},{"id":18034,"type":1001,"linkType":1002},"3m00cFiUDAnddsOBOpkeiZ",[],{"data":18037,"content":18038,"nodeType":860},{},[18039,18042,18051],{"data":18040,"marks":18041,"value":17906,"nodeType":864},{},[],{"data":18043,"content":18047,"nodeType":17737},{"target":18044},{"sys":18045},{"id":18046,"type":1001,"linkType":1002},"P0coHgQAdRL0YTu4Rwd4z",[18048],{"data":18049,"marks":18050,"value":18008,"nodeType":864},{},[],{"data":18052,"marks":18053,"value":21,"nodeType":864},{},[],{"data":18055,"content":18056,"nodeType":1312},{},[18057],{"data":18058,"marks":18059,"value":18060,"nodeType":864},{},[],"Session token theft detection",{"data":18062,"content":18063,"nodeType":860},{},[18064],{"data":18065,"marks":18066,"value":18067,"nodeType":864},{},[],"Inject a unique marker provided by the Push browser agent into the User Agent string of sessions that occur in browsers enrolled in Push. ",{"data":18069,"content":18070,"nodeType":860},{},[18071],{"data":18072,"marks":18073,"value":18074,"nodeType":864},{},[],"By analyzing logs from your IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":18076,"content":18077,"nodeType":860},{},[18078],{"data":18079,"marks":18080,"value":18081,"nodeType":864},{},[],"This is a high-fidelity signal that a session token has been stolen and is being used.",{"data":18083,"content":18087,"nodeType":996},{"target":18084},{"sys":18085},{"id":18086,"type":1001,"linkType":1002},"43rk3TCqN269Vr2YWT4llP",[],{"data":18089,"content":18090,"nodeType":860},{},[18091,18094,18104],{"data":18092,"marks":18093,"value":17906,"nodeType":864},{},[],{"data":18095,"content":18099,"nodeType":17737},{"target":18096},{"sys":18097},{"id":18098,"type":1001,"linkType":1002},"1UMZdjyNQt4Y7NBb2wuK4L",[18100],{"data":18101,"marks":18102,"value":18103,"nodeType":864},{},[],"session token theft detection",{"data":18105,"marks":18106,"value":21,"nodeType":864},{},[],{"data":18108,"content":18109,"nodeType":1312},{},[18110],{"data":18111,"marks":18112,"value":1366,"nodeType":864},{},[],{"data":18114,"content":18115,"nodeType":860},{},[18116],{"data":18117,"marks":18118,"value":18119,"nodeType":864},{},[],"Add guardrails to employees’ use of SaaS apps with in-browser app banner messages you customize with your own text. You can require users to acknowledge having read a message before they can access an app, or even require them to submit a reason for using an app before they can log in.",{"data":18121,"content":18125,"nodeType":996},{"target":18122},{"sys":18123},{"id":18124,"type":1001,"linkType":1002},"5nEKTBz6mauHI5mg8jB4ea",[],{"data":18127,"content":18128,"nodeType":860},{},[18129,18132,18142],{"data":18130,"marks":18131,"value":17906,"nodeType":864},{},[],{"data":18133,"content":18137,"nodeType":17737},{"target":18134},{"sys":18135},{"id":18136,"type":1001,"linkType":1002},"2ZpKnuljaUH0jzVaae4SMN",[18138],{"data":18139,"marks":18140,"value":18141,"nodeType":864},{},[],"app banners",{"data":18143,"marks":18144,"value":21,"nodeType":864},{},[],{"data":18146,"content":18147,"nodeType":1009},{},[18148],{"data":18149,"marks":18150,"value":18151,"nodeType":864},{},[],"Choose your own adventure",{"data":18153,"content":18154,"nodeType":860},{},[18155],{"data":18156,"marks":18157,"value":18158,"nodeType":864},{},[],"Want to do something creative? We've got you covered. Push provides a wealth of raw telemetry via the Push REST API and webhook events. Use this data to build both proactive and reactive security operations workflows, or add missing context to other sources, such as your IdP, application, or endpoint logs.",{"data":18160,"content":18161,"nodeType":860},{},[18162],{"data":18163,"marks":18164,"value":18165,"nodeType":864},{},[],"You can use this browser telemetry to:",{"data":18167,"content":18168,"nodeType":941},{},[18169,18184,18199],{"data":18170,"content":18171,"nodeType":945},{},[18172],{"data":18173,"content":18174,"nodeType":860},{},[18175,18180],{"data":18176,"marks":18177,"value":18179,"nodeType":864},{},[18178],{"type":899},"Harden identities and reduce account compromise",{"data":18181,"marks":18182,"value":18183,"nodeType":864},{},[],", such as alerting you when passwords are identified in public data breaches or when employees are using an unapproved app or when an SSO app is accessed via local account.",{"data":18185,"content":18186,"nodeType":945},{},[18187],{"data":18188,"content":18189,"nodeType":860},{},[18190,18195],{"data":18191,"marks":18192,"value":18194,"nodeType":864},{},[18193],{"type":899},"Monitor for suspicious activity or high-risk changes",{"data":18196,"marks":18197,"value":18198,"nodeType":864},{},[],", such as checking for MFA method changes, or flagging when employees reuse corporate SSO passwords or visit sites running phishing malware.",{"data":18200,"content":18201,"nodeType":945},{},[18202],{"data":18203,"content":18204,"nodeType":860},{},[18205,18210],{"data":18206,"marks":18207,"value":18209,"nodeType":864},{},[18208],{"type":899},"Investigate indicators of compromise",{"data":18211,"marks":18212,"value":18213,"nodeType":864},{},[],", such as correlating login events with platform logs, searching for recent signups to risky apps, or identifying post-compromise lateral movement opportunities.",{"data":18215,"content":18216,"nodeType":860},{},[18217],{"data":18218,"marks":18219,"value":18220,"nodeType":864},{},[],"In the “make my life easier” category, you can also use Push telemetry to:",{"data":18222,"content":18223,"nodeType":941},{},[18224,18243,18262,18277],{"data":18225,"content":18226,"nodeType":945},{},[18227],{"data":18228,"content":18229,"nodeType":860},{},[18230,18234,18239],{"data":18231,"marks":18232,"value":18233,"nodeType":864},{},[],"Automate a workflow ",{"data":18235,"marks":18236,"value":18238,"nodeType":864},{},[18237],{"type":899},"showing you all the accounts and apps used by an offboarded employee",{"data":18240,"marks":18241,"value":18242,"nodeType":864},{},[],", and their account login methods.",{"data":18244,"content":18245,"nodeType":945},{},[18246],{"data":18247,"content":18248,"nodeType":860},{},[18249,18253,18258],{"data":18250,"marks":18251,"value":18252,"nodeType":864},{},[],"Automate a workflow to",{"data":18254,"marks":18255,"value":18257,"nodeType":864},{},[18256],{"type":899}," revoke licenses on SaaS after a period of inactivity",{"data":18259,"marks":18260,"value":18261,"nodeType":864},{},[],", saving money.",{"data":18263,"content":18264,"nodeType":945},{},[18265],{"data":18266,"content":18267,"nodeType":860},{},[18268,18273],{"data":18269,"marks":18270,"value":18272,"nodeType":864},{},[18271],{"type":899},"Build an approved apps list in your company wiki",{"data":18274,"marks":18275,"value":18276,"nodeType":864},{},[],", synced from Push’s source of truth.",{"data":18278,"content":18279,"nodeType":945},{},[18280],{"data":18281,"content":18282,"nodeType":860},{},[18283,18288],{"data":18284,"marks":18285,"value":18287,"nodeType":864},{},[18286],{"type":899},"Force-reset an IdP password if Push finds a compromised password",{"data":18289,"marks":18290,"value":18291,"nodeType":864},{},[]," on an employee account.",{"data":18293,"content":18294,"nodeType":860},{},[18295,18299,18303],{"data":18296,"marks":18297,"value":18298,"nodeType":864},{},[],"To help you visualize and plan how you will use this telemetry, Push also provides an ",{"data":18300,"marks":18301,"value":17788,"nodeType":864},{},[18302],{"type":899},{"data":18304,"marks":18305,"value":18306,"nodeType":864},{},[]," page in the admin console with a rolling 7-day snapshot of all the events in your environment.",{"data":18308,"content":18312,"nodeType":996},{"target":18309},{"sys":18310},{"id":18311,"type":1001,"linkType":1002},"2a3bJ5sN8dJ0c1kQtZiag7",[],{"data":18314,"content":18315,"nodeType":860},{},[18316],{"data":18317,"marks":18318,"value":18319,"nodeType":864},{},[],"The Events page can help you see real-world examples, understand the attributes of each event, and gauge event volume before you ingest data into a SIEM or other platform.",{"data":18321,"content":18322,"nodeType":1009},{},[18323],{"data":18324,"marks":18325,"value":18326,"nodeType":864},{},[],"What if you don’t have a SIEM?",{"data":18328,"content":18329,"nodeType":860},{},[18330],{"data":18331,"marks":18332,"value":18333,"nodeType":864},{},[],"While you’d need a SIEM for writing detections and performing log correlations, you can still get a lot of value out of Push telemetry if you don’t have one.",{"data":18335,"content":18336,"nodeType":860},{},[18337],{"data":18338,"marks":18339,"value":18340,"nodeType":864},{},[],"Use Push’s webhook events to send alerts directly to your Slack, Teams, or other chat platform, or build workflows that hook into your ticketing system or SOAR platform.",{"data":18342,"content":18343,"nodeType":860},{},[18344,18348,18355],{"data":18345,"marks":18346,"value":18347,"nodeType":864},{},[],"Review our ",{"data":18349,"content":18350,"nodeType":883},{"uri":17770},[18351],{"data":18352,"marks":18353,"value":18354,"nodeType":864},{},[],"webhooks documentation",{"data":18356,"marks":18357,"value":18358,"nodeType":864},{},[]," for a list of events.",{"data":18360,"content":18361,"nodeType":1009},{},[18362],{"data":18363,"marks":18364,"value":18365,"nodeType":864},{},[],"Find out more",{"data":18367,"content":18368,"nodeType":860},{},[18369,18373,18381],{"data":18370,"marks":18371,"value":18372,"nodeType":864},{},[],"If you want to see Push in action, ",{"data":18374,"content":18376,"nodeType":883},{"uri":18375},"/demo/",[18377],{"data":18378,"marks":18379,"value":18380,"nodeType":864},{},[],"book a demo",{"data":18382,"marks":18383,"value":18384,"nodeType":864},{},[],". We’ll be happy to show you these features, along with how we discover all the apps your employees are using — even the ones not behind SSO.","Introducing set-and-forget controls that stop real-world identity attacks","Enable detections and interventions in the browser using Push’s new security controls.","2024-07-02T00:00:00.000Z","introducing-set-and-forget-controls-that-stop-real-world-identity-attacks",{"items":18390},[18391,18395],{"sys":18392,"name":18394},{"id":18393},"5jk0kqjSdSK2L0YiistQjY","Release notes",{"sys":18396,"name":342},{"id":12756},{"items":18398},[18399],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":18400},{"url":853},{"__typename":2059,"sys":18402,"content":18404,"title":19227,"synopsis":19228,"hashTags":59,"publishedDate":19229,"slug":19230,"tagsCollection":19231,"authorsCollection":19237},{"id":18403},"174u87EYeKMKHzYYxBLlHO",{"json":18405},{"data":18406,"content":18407,"nodeType":856},{},[18408,18415,18422,18429,18458,18465,18472,18489,18496,18503,18521,18528,18535,18542,18548,18555,18598,18605,18612,18619,18642,18649,18656,18663,18711,18718,18725,18732,18739,18751,18758,18766,18773,18806,18813,18820,18827,18834,18900,18908,18915,18922,18956,18963,18971,18978,18985,18997,19013,19043,19061,19068,19086,19093,19100,19117,19124,19131,19138,19171,19178,19197,19215,19221],{"data":18409,"content":18410,"nodeType":860},{},[18411],{"data":18412,"marks":18413,"value":18414,"nodeType":864},{},[],"Identity attacks like phishing, credential stuffing, and session hijacking are now the leading cause of cyber security breaches, as attackers shift their attention to the sprawl of third-party applications and services that has become the backbone of business IT. ",{"data":18416,"content":18417,"nodeType":860},{},[18418],{"data":18419,"marks":18420,"value":18421,"nodeType":864},{},[],"The attacker’s goal in these attacks is account takeover: logging into a user account to access your company app tenant. From there, the attacker can usually achieve all of their objectives from inside the compromised app, usually involving dumping sensitive data with which to hold the company to ransom, or selling the data on underground criminal marketplaces. ",{"data":18423,"content":18424,"nodeType":860},{},[18425],{"data":18426,"marks":18427,"value":18428,"nodeType":864},{},[],"These attack techniques have been commonplace for over a decade — but the shift in attack context away from attacking endpoints (user devices and servers) to cloud services is seeing something of an identity attack renaissance. ",{"data":18430,"content":18431,"nodeType":860},{},[18432,18435,18442,18446,18454],{"data":18433,"marks":18434,"value":21,"nodeType":864},{},[],{"data":18436,"content":18437,"nodeType":883},{"uri":13750},[18438],{"data":18439,"marks":18440,"value":395,"nodeType":864},{},[18441],{"type":1455},{"data":18443,"marks":18444,"value":18445,"nodeType":864},{},[]," are one of the leading factors in successful ",{"data":18447,"content":18448,"nodeType":883},{"uri":15835},[18449],{"data":18450,"marks":18451,"value":18453,"nodeType":864},{},[18452],{"type":1455},"credential stuffing",{"data":18455,"marks":18456,"value":18457,"nodeType":864},{},[]," attacks driving account takeover.",{"data":18459,"content":18460,"nodeType":1009},{},[18461],{"data":18462,"marks":18463,"value":18464,"nodeType":864},{},[],"Ghost logins 101",{"data":18466,"content":18467,"nodeType":860},{},[18468],{"data":18469,"marks":18470,"value":18471,"nodeType":864},{},[],"Simply put, ghost logins are often-forgotten alternative login methods that are tricky for security teams to manage and secure — because they don’t know about them. Because of this, they’re likely to possess weak configurations that make them susceptible to account takeover attacks. ",{"data":18473,"content":18474,"nodeType":860},{},[18475,18479,18486],{"data":18476,"marks":18477,"value":18478,"nodeType":864},{},[],"We found that ",{"data":18480,"content":18481,"nodeType":883},{"uri":5521},[18482],{"data":18483,"marks":18484,"value":18485,"nodeType":864},{},[],"ghost logins are present in ~10% of the accounts per organization",{"data":18487,"marks":18488,"value":1774,"nodeType":864},{},[],{"data":18490,"content":18491,"nodeType":1312},{},[18492],{"data":18493,"marks":18494,"value":18495,"nodeType":864},{},[],"Why do ghost logins exist?",{"data":18497,"content":18498,"nodeType":860},{},[18499],{"data":18500,"marks":18501,"value":18502,"nodeType":864},{},[],"Identity management used to be something that was centrally contained and managed using an enterprise identity service like Active Directory. Most users probably only had one or two identities that you really cared about: the one they used to log into their company laptop and domain, and maybe also to log into a VPN. ",{"data":18504,"content":18505,"nodeType":860},{},[18506,18510,18517],{"data":18507,"marks":18508,"value":18509,"nodeType":864},{},[],"Now, there are ",{"data":18511,"content":18512,"nodeType":883},{"uri":5521},[18513],{"data":18514,"marks":18515,"value":18516,"nodeType":864},{},[],"200+ business apps in use per company, creating 1000s of sprawled identities",{"data":18518,"marks":18519,"value":18520,"nodeType":864},{},[]," across an ecosystem of business apps and services accessed over the internet.",{"data":18522,"content":18523,"nodeType":860},{},[18524],{"data":18525,"marks":18526,"value":18527,"nodeType":864},{},[],"Most businesses have tried to solve this problem with single sign on (SSO). The logic being that if you can use a single set of credentials (and therefore, a single identity) to access all of your business apps, and then secure those credentials with MFA, then this problem goes away. However…",{"data":18529,"content":18530,"nodeType":1312},{},[18531],{"data":18532,"marks":18533,"value":18534,"nodeType":864},{},[],"SSO expectations versus reality",{"data":18536,"content":18537,"nodeType":860},{},[18538],{"data":18539,"marks":18540,"value":18541,"nodeType":864},{},[],"Unfortunately, the reality of SSO implementation is flawed. Most apps accept multiple login methods that can be configured — and used — simultaneously (yes, most apps don’t have proper session controls).  ",{"data":18543,"content":18547,"nodeType":996},{"target":18544},{"sys":18545},{"id":18546,"type":1001,"linkType":1002},"3sOz3HkiyJpY9nFtGCWEOV",[],{"data":18549,"content":18550,"nodeType":860},{},[18551],{"data":18552,"marks":18553,"value":18554,"nodeType":864},{},[],"This is made worse by the fact that:",{"data":18556,"content":18557,"nodeType":941},{},[18558,18568,18578,18588],{"data":18559,"content":18560,"nodeType":945},{},[18561],{"data":18562,"content":18563,"nodeType":860},{},[18564],{"data":18565,"marks":18566,"value":18567,"nodeType":864},{},[],"Most apps can't be locked down to restrict which login methods are accepted.",{"data":18569,"content":18570,"nodeType":945},{},[18571],{"data":18572,"content":18573,"nodeType":860},{},[18574],{"data":18575,"marks":18576,"value":18577,"nodeType":864},{},[],"Users often self-adopt apps, and default to a username and password (and typically miss out MFA). ",{"data":18579,"content":18580,"nodeType":945},{},[18581],{"data":18582,"content":18583,"nodeType":860},{},[18584],{"data":18585,"marks":18586,"value":18587,"nodeType":864},{},[],"SSO isn’t always possible if you aren’t using a supported IdP — and only one in three apps support SAML, the preferred enterprise-grade protocol.",{"data":18589,"content":18590,"nodeType":945},{},[18591],{"data":18592,"content":18593,"nodeType":860},{},[18594],{"data":18595,"marks":18596,"value":18597,"nodeType":864},{},[],"Even where SSO is possible, configuring an app for SSO doesn't automatically delete any legacy local logins.",{"data":18599,"content":18600,"nodeType":860},{},[18601],{"data":18602,"marks":18603,"value":18604,"nodeType":864},{},[],"Inevitably, this means that there are many situations in which users will create local accounts — typically with a username and password, and without MFA. This is how ghost logins are born.",{"data":18606,"content":18607,"nodeType":1312},{},[18608],{"data":18609,"marks":18610,"value":18611,"nodeType":864},{},[],"How are ghost logins created? ",{"data":18613,"content":18614,"nodeType":860},{},[18615],{"data":18616,"marks":18617,"value":18618,"nodeType":864},{},[],"Ghost logins can be created in the following ways:",{"data":18620,"content":18621,"nodeType":941},{},[18622,18632],{"data":18623,"content":18624,"nodeType":945},{},[18625],{"data":18626,"content":18627,"nodeType":860},{},[18628],{"data":18629,"marks":18630,"value":18631,"nodeType":864},{},[],"A user self-adopts an app, setting up an account with a local username and password. The app is later adopted companywide and brought under SSO. This creates an additional SSO login method, likely as the default, but the local login will continue to exist unless explicitly disabled or deleted. ",{"data":18633,"content":18634,"nodeType":945},{},[18635],{"data":18636,"content":18637,"nodeType":860},{},[18638],{"data":18639,"marks":18640,"value":18641,"nodeType":864},{},[],"Secondary/backup login methods can often be added later in the app settings after logging in. This includes things like setting up a secondary email to send a login link to, or setting up API access to remove the need to authenticate altogether. ",{"data":18643,"content":18644,"nodeType":860},{},[18645],{"data":18646,"marks":18647,"value":18648,"nodeType":864},{},[],"So, ghost logins are very easily introduced through the normal course of app adoption and use by employees. ",{"data":18650,"content":18651,"nodeType":1312},{},[18652],{"data":18653,"marks":18654,"value":18655,"nodeType":864},{},[],"Why do ghost logins pose a risk? ",{"data":18657,"content":18658,"nodeType":860},{},[18659],{"data":18660,"marks":18661,"value":18662,"nodeType":864},{},[],"Ghost logins pose a risk for a number of reasons, as they: ",{"data":18664,"content":18665,"nodeType":941},{},[18666,18681,18696],{"data":18667,"content":18668,"nodeType":945},{},[18669],{"data":18670,"content":18671,"nodeType":860},{},[18672,18677],{"data":18673,"marks":18674,"value":18676,"nodeType":864},{},[18675],{"type":899},"Typically have less secure configurations ",{"data":18678,"marks":18679,"value":18680,"nodeType":864},{},[],"than your preferred login method – and may be missing key controls like MFA.  ",{"data":18682,"content":18683,"nodeType":945},{},[18684],{"data":18685,"content":18686,"nodeType":860},{},[18687,18692],{"data":18688,"marks":18689,"value":18691,"nodeType":864},{},[18690],{"type":899},"Are effectively shadow logins",{"data":18693,"marks":18694,"value":18695,"nodeType":864},{},[]," – IT/security don’t know about them, and if using an IdP as your primary identity security interface, they won’t necessarily be visible without taking a deeper look at individual apps. ",{"data":18697,"content":18698,"nodeType":945},{},[18699],{"data":18700,"content":18701,"nodeType":860},{},[18702,18707],{"data":18703,"marks":18704,"value":18706,"nodeType":864},{},[18705],{"type":899},"Can be used simultaneously with SSO",{"data":18708,"marks":18709,"value":18710,"nodeType":864},{},[]," – so you can have an unrestricted number of concurrent sessions with SSO and non SSO logins active at the same time, without the user being kicked out of the previous session.",{"data":18712,"content":18713,"nodeType":860},{},[18714],{"data":18715,"marks":18716,"value":18717,"nodeType":864},{},[],"Ghost logins provide opportunities for attackers to bypass security controls for initial access and persistence in an application (which we’ll come onto in more detail later). They also provide an opportunity for malicious insiders, e.g. a disgruntled employee, to access systems even after SSO access is revoked. If the security team relies on IdP logs to audit app logins, these accounts can go undetected.",{"data":18719,"content":18720,"nodeType":860},{},[18721],{"data":18722,"marks":18723,"value":18724,"nodeType":864},{},[],"To be able to identify them, you’d need to log into the app admin dashboard. But depending on how the app was adopted, you (as a security admin) may not even be an app-level admin — it’s not unusual for individual teams to administer their own apps. And even if you do have access, it’s not always easy (or possible) to gather this level of information about user account configuration. ",{"data":18726,"content":18727,"nodeType":860},{},[18728],{"data":18729,"marks":18730,"value":18731,"nodeType":864},{},[],"It’s very easy to see how these vulnerable login methods can be overlooked by security teams – let’s look at how they can be identified and exploited by attackers. ",{"data":18733,"content":18734,"nodeType":1009},{},[18735],{"data":18736,"marks":18737,"value":18738,"nodeType":864},{},[],"How can ghost logins be exploited by attackers?",{"data":18740,"content":18741,"nodeType":860},{},[18742,18747],{"data":18743,"marks":18744,"value":18746,"nodeType":864},{},[18745],{"type":899},"Let’s take an example scenario:",{"data":18748,"marks":18749,"value":18750,"nodeType":864},{},[]," You’re using an IdP solution like Okta or Microsoft/Entra with SAML SSO as the default login method for your core business apps. Via your IdP you require MFA when authenticating to your IdP apps page, and also potentially when signing into an individual connected app. ",{"data":18752,"content":18753,"nodeType":860},{},[18754],{"data":18755,"marks":18756,"value":18757,"nodeType":864},{},[],"However, you only recently introduced your IdP solution, and your users previously accessed this app with a local username and password. Although you asked your users to configure MFA in the app itself, not all of them did. And when you deployed your IdP solution, you didn’t manually unset all the local password-based logins for the apps you connected to it. ",{"data":18759,"content":18760,"nodeType":860},{},[18761],{"data":18762,"marks":18763,"value":18765,"nodeType":864},{},[18764],{"type":899},"Unknown to you, there are now hundreds of local accounts for core business apps which lack MFA. ",{"data":18767,"content":18768,"nodeType":860},{},[18769],{"data":18770,"marks":18771,"value":18772,"nodeType":864},{},[],"There are two main scenarios in which ghost logins can be utilized by an attacker:",{"data":18774,"content":18775,"nodeType":941},{},[18776,18791],{"data":18777,"content":18778,"nodeType":945},{},[18779],{"data":18780,"content":18781,"nodeType":860},{},[18782,18787],{"data":18783,"marks":18784,"value":18786,"nodeType":864},{},[18785],{"type":899},"To bypass robustly configured login methods",{"data":18788,"marks":18789,"value":18790,"nodeType":864},{},[]," such as SSO to compromise an app identity during the initial access phase of an attack. ",{"data":18792,"content":18793,"nodeType":945},{},[18794],{"data":18795,"content":18796,"nodeType":860},{},[18797,18802],{"data":18798,"marks":18799,"value":18801,"nodeType":864},{},[18800],{"type":899},"To create additional login methods for an already compromised account to ensure persistent access",{"data":18803,"marks":18804,"value":18805,"nodeType":864},{},[]," – even if the original compromised login method is revoked or disabled. This could be either the result of compromising an identity belonging to a specific app, or having previously compromised an IdP account (e.g. Okta).",{"data":18807,"content":18808,"nodeType":860},{},[18809],{"data":18810,"marks":18811,"value":18812,"nodeType":864},{},[],"Let's look at these use cases in more detail. ",{"data":18814,"content":18815,"nodeType":1312},{},[18816],{"data":18817,"marks":18818,"value":18819,"nodeType":864},{},[],"Ghost logins for initial access",{"data":18821,"content":18822,"nodeType":860},{},[18823],{"data":18824,"marks":18825,"value":18826,"nodeType":864},{},[],"Arguably the most dangerous use case for ghost logins is to conduct credential attacks against accounts using a username and password. Logins with a weak or guessable password, or a reused password that has appeared in a public data breach dump, are primed for account takeover. ",{"data":18828,"content":18829,"nodeType":860},{},[18830],{"data":18831,"marks":18832,"value":18833,"nodeType":864},{},[],"The cyber crime ecosystem is leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":18835,"content":18836,"nodeType":941},{},[18837,18858,18878],{"data":18838,"content":18839,"nodeType":945},{},[18840],{"data":18841,"content":18842,"nodeType":860},{},[18843,18847,18855],{"data":18844,"marks":18845,"value":18846,"nodeType":864},{},[],"There are 600 million identity attacks per day, with 99% involving passwords (",{"data":18848,"content":18850,"nodeType":883},{"uri":18849},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf",[18851],{"data":18852,"marks":18853,"value":13346,"nodeType":864},{},[18854],{"type":1455},{"data":18856,"marks":18857,"value":13394,"nodeType":864},{},[],{"data":18859,"content":18860,"nodeType":945},{},[18861],{"data":18862,"content":18863,"nodeType":860},{},[18864,18868,18875],{"data":18865,"marks":18866,"value":18867,"nodeType":864},{},[],"Over 1000 credentials are posted online per day, per marketplace with an average sale price of $10, and 65% posted less than one day after being collected (",{"data":18869,"content":18870,"nodeType":883},{"uri":4408},[18871],{"data":18872,"marks":18873,"value":13323,"nodeType":864},{},[18874],{"type":1455},{"data":18876,"marks":18877,"value":13394,"nodeType":864},{},[],{"data":18879,"content":18880,"nodeType":945},{},[18881],{"data":18882,"content":18883,"nodeType":860},{},[18884,18888,18897],{"data":18885,"marks":18886,"value":18887,"nodeType":864},{},[],"One million new stealer logs are distributed every month, with an estimated 3-5% containing credentials and session cookies to corporate IT environments (",{"data":18889,"content":18891,"nodeType":883},{"uri":18890},"https://www.bleepingcomputer.com/news/security/single-sign-on-and-the-cybercrime-ecosystem/",[18892],{"data":18893,"marks":18894,"value":18896,"nodeType":864},{},[18895],{"type":1455},"Flare",{"data":18898,"marks":18899,"value":13394,"nodeType":864},{},[],{"data":18901,"content":18902,"nodeType":860},{},[18903],{"data":18904,"marks":18905,"value":18907,"nodeType":864},{},[18906],{"type":899},"So, it’s easier than ever for attackers to gather breached credentials and weaponize them at scale. ",{"data":18909,"content":18910,"nodeType":860},{},[18911],{"data":18912,"marks":18913,"value":18914,"nodeType":864},{},[],"Realistically, any username and password combination for addresses belonging to a specific organization/domain can be attempted on any app. Breached credential data will often provide a strong indicator of other apps also in use for that organization. And for apps with a custom tenant URL (that cannot be easily guessed) data dumps often helpfully include the URLs for those login pages, too.  ",{"data":18916,"content":18917,"nodeType":860},{},[18918],{"data":18919,"marks":18920,"value":18921,"nodeType":864},{},[],"The risk posed by the massive amounts of leaked credentials available is heightened because: ",{"data":18923,"content":18924,"nodeType":941},{},[18925,18946],{"data":18926,"content":18927,"nodeType":945},{},[18928],{"data":18929,"content":18930,"nodeType":860},{},[18931,18935,18942],{"data":18932,"marks":18933,"value":18934,"nodeType":864},{},[],"Many employees reuse passwords, with ",{"data":18936,"content":18937,"nodeType":883},{"uri":5521},[18938],{"data":18939,"marks":18940,"value":18941,"nodeType":864},{},[],"~9% of all accounts using a breached, weak, or reused password",{"data":18943,"marks":18944,"value":18945,"nodeType":864},{},[],". This isn’t just for low-risk apps either, and includes the reuse of highly sensitive IdP creds. ",{"data":18947,"content":18948,"nodeType":945},{},[18949],{"data":18950,"content":18951,"nodeType":860},{},[18952],{"data":18953,"marks":18954,"value":18955,"nodeType":864},{},[],"Organizations don’t typically rotate or enforce changes to SaaS app passwords in the same way they might for company account/device login connected to Active Directory.  ",{"data":18957,"content":18958,"nodeType":860},{},[18959],{"data":18960,"marks":18961,"value":18962,"nodeType":864},{},[],"Ghost logins aren’t limited to just username and password either. For example, a breached social account such as Facebook or Google can result in a broader compromise if those accounts have been connected to any corporate apps.   ",{"data":18964,"content":18965,"nodeType":860},{},[18966],{"data":18967,"marks":18968,"value":18970,"nodeType":864},{},[18969],{"type":899},"So, exploiting ghost logins can be a highly effective method for attackers to gain initial access to a user account from which to launch further attacks.  ",{"data":18972,"content":18973,"nodeType":1312},{},[18974],{"data":18975,"marks":18976,"value":18977,"nodeType":864},{},[],"Ghost logins for persistence and defense evasion",{"data":18979,"content":18980,"nodeType":860},{},[18981],{"data":18982,"marks":18983,"value":18984,"nodeType":864},{},[],"Now, we’ll take a look at how attackers can leverage ghost logins as part of the later stages of an attack, having already established an initial foothold via account compromise. ",{"data":18986,"content":18987,"nodeType":860},{},[18988,18992],{"data":18989,"marks":18990,"value":18991,"nodeType":864},{},[],"If an organization has a reasonable level of security monitoring in-place (depending on log availability from the particular app vendor), or a victim receives a notification about an unusual login (e.g. from a new device or unusual IP) then access to an account can be short-lived. ",{"data":18993,"marks":18994,"value":18996,"nodeType":864},{},[18995],{"type":899},"However, ghost logins can provide attackers with the tools to maintain persistent access to a compromised account, even if the initial compromised login method is disabled or revoked. ",{"data":18998,"content":18999,"nodeType":860},{},[19000,19004,19009],{"data":19001,"marks":19002,"value":19003,"nodeType":864},{},[],"For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. This allows the adversary to maintain persistent access to the user account ",{"data":19005,"marks":19006,"value":19008,"nodeType":864},{},[19007],{"type":899},"even in the event of password changes or MFA changes",{"data":19010,"marks":19011,"value":19012,"nodeType":864},{},[],". The attack will go unnoticed if the victim organization relies on SSO logs for auditing access to SaaS applications because the attack bypasses SSO, as the login remains local to the SaaS app or, in the case of an OIDC SSO login, the adversary’s own social account.",{"data":19014,"content":19015,"nodeType":860},{},[19016,19020,19028,19032,19040],{"data":19017,"marks":19018,"value":19019,"nodeType":864},{},[],"Another quirk is that it’s common for ordinary users to become app-level admins when an app is self-adopted by an individual or team. If an attacker is able to gain control of such an account, it can then be used to target other users without needing to deliver phishing links by hijacking SAML-based authentication. In this scenario, users attempting to sign in using SAML SSO are directed it to an attacker-controlled tenant in a watering hole attack (also known as ",{"data":19021,"content":19023,"nodeType":883},{"uri":19022},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[19024],{"data":19025,"marks":19026,"value":13680,"nodeType":864},{},[19027],{"type":1455},{"data":19029,"marks":19030,"value":19031,"nodeType":864},{},[],", which you can ",{"data":19033,"content":19034,"nodeType":883},{"uri":5876},[19035],{"data":19036,"marks":19037,"value":19039,"nodeType":864},{},[19038],{"type":1455},"read more about in another blog post",{"data":19041,"marks":19042,"value":13350,"nodeType":864},{},[],{"data":19044,"content":19045,"nodeType":860},{},[19046,19050,19058],{"data":19047,"marks":19048,"value":19049,"nodeType":864},{},[],"If you're curious as to how an attacker might be able to compromise an IdP account such as Okta, ",{"data":19051,"content":19052,"nodeType":883},{"uri":14030},[19053],{"data":19054,"marks":19055,"value":19057,"nodeType":864},{},[19056],{"type":1455},"you should check out our blog post on AitM and BitM phishing techniques",{"data":19059,"marks":19060,"value":13804,"nodeType":864},{},[],{"data":19062,"content":19063,"nodeType":1009},{},[19064],{"data":19065,"marks":19066,"value":19067,"nodeType":864},{},[],"Case study: Snowflake",{"data":19069,"content":19070,"nodeType":860},{},[19071,19074,19082],{"data":19072,"marks":19073,"value":2761,"nodeType":864},{},[],{"data":19075,"content":19077,"nodeType":883},{"uri":19076},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[19078],{"data":19079,"marks":19080,"value":19081,"nodeType":864},{},[],"recent attacks on 165 Snowflake customers",{"data":19083,"marks":19084,"value":19085,"nodeType":864},{},[],", resulting in hundreds of millions of breached customer records, were the product of a credential stuffing campaign using stolen credentials from infostealer infections dating back to 2020. ",{"data":19087,"content":19088,"nodeType":860},{},[19089],{"data":19090,"marks":19091,"value":19092,"nodeType":864},{},[],"The industry response to Snowflake was typical: check whether Snowflake has been set up for SSO, and if so, job done — we’re protected by MFA.",{"data":19094,"content":19095,"nodeType":860},{},[19096],{"data":19097,"marks":19098,"value":19099,"nodeType":864},{},[],"The reality was that MFA was not — and could not — be centrally enforced for username and password accounts. Even if MFA was applied at the IdP level for SSO logins, it was not enforced for local username and password logins. It needed to be opted-into by the user. ",{"data":19101,"content":19102,"nodeType":860},{},[19103,19107,19114],{"data":19104,"marks":19105,"value":19106,"nodeType":864},{},[],"This meant the most logical thing to do was to disable local accounts. But because Snowflake is essentially a cloud-hosted SQL database, there was no easy-to-use GUI to access local account config data. Once you’d managed to get an admin account with the right permissions, you needed to run various commands to find and unset the accounts. ",{"data":19108,"content":19109,"nodeType":883},{"uri":13794},[19110],{"data":19111,"marks":19112,"value":19113,"nodeType":864},{},[],"But if you didn’t have the exact type of admin account, misleading results would be returned — and even after you had fixed the vulnerability it took hours to update the database. ",{"data":19115,"marks":19116,"value":21,"nodeType":864},{},[],{"data":19118,"content":19119,"nodeType":860},{},[19120],{"data":19121,"marks":19122,"value":19123,"nodeType":864},{},[],"This meant that organizations were exposed to these attacks for a prolonged period, and were left uncertain as to whether they had addressed the vulnerabilities or not. ",{"data":19125,"content":19126,"nodeType":1009},{},[19127],{"data":19128,"marks":19129,"value":19130,"nodeType":864},{},[],"Using Push to find and fix ghost logins across your app inventory",{"data":19132,"content":19133,"nodeType":860},{},[19134],{"data":19135,"marks":19136,"value":19137,"nodeType":864},{},[],"Finding and fixing ghost logins is a challenge for most organizations. Since you can’t rely on the view provided by your IdP, you need to:",{"data":19139,"content":19140,"nodeType":941},{},[19141,19151,19161],{"data":19142,"content":19143,"nodeType":945},{},[19144],{"data":19145,"content":19146,"nodeType":860},{},[19147],{"data":19148,"marks":19149,"value":19150,"nodeType":864},{},[],"Discover the apps in use across your organization",{"data":19152,"content":19153,"nodeType":945},{},[19154],{"data":19155,"content":19156,"nodeType":860},{},[19157],{"data":19158,"marks":19159,"value":19160,"nodeType":864},{},[],"Get admin rights, audit each app, and unset any local credentials (enforcing MFA at the app-level too if you can, for good measure)",{"data":19162,"content":19163,"nodeType":945},{},[19164],{"data":19165,"content":19166,"nodeType":860},{},[19167],{"data":19168,"marks":19169,"value":19170,"nodeType":864},{},[],"Configure the app to prevent local accounts being created (again, if possible)",{"data":19172,"content":19173,"nodeType":860},{},[19174],{"data":19175,"marks":19176,"value":19177,"nodeType":864},{},[],"Not only is this a sisyphean task with continually moving goalposts, but depending on which apps you use, and how they’ve been designed, it may not be possible to remediate every instance of ghost logins. For that reason, it’s important to also invest in your identity threat detection and response capabilities — for when, not if, an account takeover attempt occurs. ",{"data":19179,"content":19180,"nodeType":860},{},[19181,19185,19194],{"data":19182,"marks":19183,"value":19184,"nodeType":864},{},[],"Push helps organizations to defend against ghost logins and other identity threats with a defense-in-depth approach: Using a browser-based agent to generate visibility of all logins (not just via IdP logs) while also detecting, intercepting, and shutting down account takeover attempts via phishing, credential stuffing, and session hijacking. ",{"data":19186,"content":19188,"nodeType":883},{"uri":19187},"https://pushsecurity.com/",[19189],{"data":19190,"marks":19191,"value":19193,"nodeType":864},{},[19192],{"type":1455},"Learn more here.",{"data":19195,"marks":19196,"value":21,"nodeType":864},{},[],{"data":19198,"content":19199,"nodeType":860},{},[19200,19204,19212],{"data":19201,"marks":19202,"value":19203,"nodeType":864},{},[],"And if you'd like to learn more about ghost logins and other identity attack techniques, ",{"data":19205,"content":19207,"nodeType":883},{"uri":19206},"https://github.com/pushsecurity/saas-attacks?tab=readme-ov-file",[19208],{"data":19209,"marks":19210,"value":19211,"nodeType":864},{},[],"check out the SaaS attack matrix on GitHub",{"data":19213,"marks":19214,"value":1774,"nodeType":864},{},[],{"data":19216,"content":19220,"nodeType":996},{"target":19217},{"sys":19218},{"id":19219,"type":1001,"linkType":1002},"1VMpMgZvx9hgps2OoxCTmF",[],{"data":19222,"content":19223,"nodeType":860},{},[19224],{"data":19225,"marks":19226,"value":21,"nodeType":864},{},[],"Ghost logins: When forgotten identities come back to haunt you","How ghost logins can be used by cyber attackers for account takeover and persistence.","2024-07-10T00:00:00.000Z","ghost-logins-when-forgotten-identities-come-back-to-haunt-you",{"items":19232},[19233,19235],{"sys":19234,"name":7555},{"id":7554},{"sys":19236,"name":342},{"id":12756},{"items":19238},[19239],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":19240},{"url":2740},"5-reasons-why-push-security-shouldnt-exist","blog/5-reasons-why-push-security-shouldnt-exist",{"json":19244},{"data":19245,"content":19246,"nodeType":856},{},[19247,19254],{"data":19248,"content":19249,"nodeType":860},{},[19250],{"data":19251,"marks":19252,"value":19253,"nodeType":864},{},[],"If current security controls worked perfectly, Push wouldn't need to exist – unfortunately, they don't, so here we are!",{"data":19255,"content":19256,"nodeType":860},{},[19257],{"data":19258,"marks":19259,"value":19260,"nodeType":864},{},[],"In this article, we break down common misconceptions about identity controls like MFA, SSO, passkeys, and password managers, exploring some of the gaps they leave and how to fill them to achieve defense in depth.","Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.",{"id":19263,"publishedAt":19264},"1fp5aOCIcGHDbdQ0amCYOf","2026-08-12T11:55:11.772Z",{"items":19266},[19267,19269],{"sys":19268,"name":342},{"id":12756},{"sys":19270,"name":297},{"id":2732},{"items":19272},[19273,19275,19277,19279,19281,19283,19285,19287,19289,19291,19293,19295,19297,19299,19301,19303,19305,19307,19309,19311,19313,19315],{"sys":19274,"name":413,"slug":414,"tier":31},{"id":410},{"sys":19276,"name":297,"slug":298,"tier":31},{"id":294},{"sys":19278,"name":279,"slug":280,"tier":31},{"id":276},{"sys":19280,"name":519,"slug":520,"tier":31},{"id":516},{"sys":19282,"name":545,"slug":546,"tier":31},{"id":542},{"sys":19284,"name":342,"slug":343,"tier":31},{"id":339},{"sys":19286,"name":395,"slug":396,"tier":45},{"id":392},{"sys":19288,"name":457,"slug":458,"tier":45},{"id":454},{"sys":19290,"name":466,"slug":467,"tier":45},{"id":463},{"sys":19292,"name":333,"slug":334,"tier":45},{"id":330},{"sys":19294,"name":589,"slug":590,"tier":45},{"id":586},{"sys":19296,"name":261,"slug":262,"tier":45},{"id":258},{"sys":19298,"name":571,"slug":572,"tier":45},{"id":568},{"sys":19300,"name":422,"slug":423,"tier":45},{"id":419},{"sys":19302,"name":502,"slug":503,"tier":45},{"id":499},{"sys":19304,"name":493,"slug":494,"tier":45},{"id":490},{"sys":19306,"name":404,"slug":405,"tier":45},{"id":401},{"sys":19308,"name":377,"slug":378,"tier":45},{"id":374},{"sys":19310,"name":624,"slug":625,"tier":45},{"id":621},{"sys":19312,"name":306,"slug":307,"tier":45},{"id":303},{"sys":19314,"name":598,"slug":599,"tier":45},{"id":595},{"sys":19316,"name":475,"slug":476,"tier":45},{"id":472},"7ekz7o6jH_LJs1GGrGDh2SvoDhuQmK1UIytQMiVACOw",{"id":19319,"title":19320,"authorsCollection":19321,"content":19326,"extension":228,"faqItemsCollection":19819,"faqTitle":59,"featured":6,"hashTags":59,"meta":19821,"metaTitle":19822,"ogImage":59,"postType":6304,"publishedDate":19823,"relatedBlogPostsCollection":19824,"slug":21910,"stem":21911,"subtitle":59,"summary":21912,"synopsis":21922,"sys":21923,"tagsCollection":21926,"topicsCollection":21932,"__hash__":21946},"blog/blog/the-web-proxy-is-dead-long-live-the-browser-extension.json","The web proxy is dead… long live the browser extension!",{"items":19322},[19323],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":19324,"profilePicture":19325},[13198],{"url":2740},{"json":19327,"links":19803},{"data":19328,"content":19329,"nodeType":856},{},[19330,19337,19344,19351,19358,19365,19372,19379,19386,19393,19411,19429,19436,19443,19462,19469,19481,19524,19531,19550,19558,19565,19572,19579,19586,19593,19660,19667,19673,19680,19687,19694,19701,19721,19728,19735,19742,19749,19756,19763,19770,19777,19784,19789,19796],{"data":19331,"content":19332,"nodeType":860},{},[19333],{"data":19334,"marks":19335,"value":19336,"nodeType":864},{},[],"User web activity can be a rich source of attack detection data. To this end, most organizations today ingest some form of network traffic data for security monitoring purposes. ",{"data":19338,"content":19339,"nodeType":860},{},[19340],{"data":19341,"marks":19342,"value":19343,"nodeType":864},{},[],"Typically, network traffic data is gathered by analyzing web proxy and/or DNS logs. But, we regularly speak to organizations that are frustrated with the challenge of piecing together web traffic data, without understanding the opportunity presented by the alternatives.",{"data":19345,"content":19346,"nodeType":860},{},[19347],{"data":19348,"marks":19349,"value":19350,"nodeType":864},{},[],"Even with proxies that can terminate TLS-encrypted datastreams, it’s difficult for even expert security teams to collect and analyze any meaningful data from web proxy logs. While the kind of data needed might be technically possible to extract, the process of reconstructing proxy data to analyze the specific data points that you really need, at scale, is prohibitively complicated.",{"data":19352,"content":19353,"nodeType":860},{},[19354],{"data":19355,"marks":19356,"value":19357,"nodeType":864},{},[],"The old “needle in a haystack” adage is very apt here! Rather than trying to piece together half-broken data – overlaying noisy proxy logs with other sources such as app and IdP telemetry – we think that the browser presents a much simpler way of analyzing relevant data points, particularly when it comes to identity attacks. ",{"data":19359,"content":19360,"nodeType":860},{},[19361],{"data":19362,"marks":19363,"value":19364,"nodeType":864},{},[],"Before we get on to detection opportunities in the browser, let’s take a deeper look at the web proxy situation.",{"data":19366,"content":19367,"nodeType":1009},{},[19368],{"data":19369,"marks":19370,"value":19371,"nodeType":864},{},[],"Detection based on web proxy – how does it work and what are the limitations?",{"data":19373,"content":19374,"nodeType":860},{},[19375],{"data":19376,"marks":19377,"value":19378,"nodeType":864},{},[],"Web proxies generate common data points that can be used for threat detection, particularly when looking for indicators of an endpoint compromise. They work by inspecting network traffic to and from the endpoint, which includes web activity in the browser. ",{"data":19380,"content":19381,"nodeType":860},{},[19382],{"data":19383,"marks":19384,"value":19385,"nodeType":864},{},[],"The classic use case would be inspecting traffic from an endpoint to networked servers and devices, either on the local network or over the internet (e.g. via VPN), to detect signs of suspicious/malicious behavior from the device (indicating a potential compromise). Data is then shipped to a central proxy server where it can be analyzed for indicators of malicious activity. ",{"data":19387,"content":19388,"nodeType":860},{},[19389],{"data":19390,"marks":19391,"value":19392,"nodeType":864},{},[],"The traditional proxy setup has a number of limitations: ",{"data":19394,"content":19395,"nodeType":941},{},[19396],{"data":19397,"content":19398,"nodeType":945},{},[19399],{"data":19400,"content":19401,"nodeType":860},{},[19402,19407],{"data":19403,"marks":19404,"value":19406,"nodeType":864},{},[19405],{"type":899},"The proxy needs to be in a position to intercept traffic.",{"data":19408,"marks":19409,"value":19410,"nodeType":864},{},[]," It may only be active when a user is in the office, on a VPN and/or for external web traffic only. It might not work if a user is on their home or other other Wi-Fi – e.g. when working from Starbucks, or visiting a customer site, which isn’t an ideal setup in the era of remote working.  ",{"data":19412,"content":19413,"nodeType":941},{},[19414],{"data":19415,"content":19416,"nodeType":945},{},[19417],{"data":19418,"content":19419,"nodeType":860},{},[19420,19425],{"data":19421,"marks":19422,"value":19424,"nodeType":864},{},[19423],{"type":899},"Most web traffic is protected by TLS – so a proxy has to decrypt this to inspect what’s inside.",{"data":19426,"marks":19427,"value":19428,"nodeType":864},{},[]," At the very least you’re going to need to deploy a CA cert to every endpoint. But, some websites use things like certificate pinning or other SSL-enforcement controls to straight up prevent this. Unless you’re doing TLS-termination at scale with a COTS solution, then the ability to do proxy-based monitoring is seriously limited. ",{"data":19430,"content":19431,"nodeType":1312},{},[19432],{"data":19433,"marks":19434,"value":19435,"nodeType":864},{},[],"Proxies under the hood",{"data":19437,"content":19438,"nodeType":860},{},[19439],{"data":19440,"marks":19441,"value":19442,"nodeType":864},{},[],"Let’s pop the hood and take a look at the data you can collect using a web proxy that is useful for threat detection. ",{"data":19444,"content":19445,"nodeType":860},{},[19446,19450,19458],{"data":19447,"marks":19448,"value":19449,"nodeType":864},{},[],"Typically, you’re looking at data points such as domain names or IP addresses. If the proxy is terminating TLS, you might also have web URLs, the type of web content accessed, and other HTTP-level metadata. Higher level data like file uploads/downloads can sometimes be reconstructed when using very vanilla methods. More advanced proxies might run or open downloaded files in a sandbox for dynamic analysis to identify potentially malicious properties, which has ",{"data":19451,"content":19452,"nodeType":883},{"uri":14248},[19453],{"data":19454,"marks":19455,"value":19457,"nodeType":864},{},[19456],{"type":1455},"given rise to techniques like HTML smuggling",{"data":19459,"marks":19460,"value":19461,"nodeType":864},{},[]," to hide these file downloads from advanced proxies. ",{"data":19463,"content":19464,"nodeType":860},{},[19465],{"data":19466,"marks":19467,"value":19468,"nodeType":864},{},[],"In practice this means that you might see that an endpoint at IP address X accessed google.com. If it’s an authenticated proxy, you might see the user of the endpoint as well. Using this data, it’s possible to see which endpoint’s owner accessed the web domain, but not the identity/account they used, or whether they actually logged in at all. So for the majority of in-house proxy setups not doing TLS-termination… that’s it. Even then, without decrypting TLS you can’t be sure you’re seeing the actual/final domain because of technologies like domain fronting that are commonly implemented in modern CDNs. ",{"data":19470,"content":19471,"nodeType":860},{},[19472,19476],{"data":19473,"marks":19474,"value":19475,"nodeType":864},{},[],"With TLS termination, it’s possible to see a lot more by inspecting/unpacking the HTTP data. At this point there are two possible approaches: Manual analysis after the fact, or automated analysis on the fly. ",{"data":19477,"marks":19478,"value":19480,"nodeType":864},{},[19479],{"type":899},"Unfortunately, there are problems with both options. ",{"data":19482,"content":19483,"nodeType":941},{},[19484,19504],{"data":19485,"content":19486,"nodeType":945},{},[19487],{"data":19488,"content":19489,"nodeType":860},{},[19490,19495,19499],{"data":19491,"marks":19492,"value":19494,"nodeType":864},{},[19493],{"type":899},"There is too much HTTP data to store and manually analyze everything:",{"data":19496,"marks":19497,"value":19498,"nodeType":864},{},[]," Usually, organizations limit the data being stored to specific metadata as opposed to trying to store everything (terabytes of data per day), which would be impossibly expensive to store (and also to build the server infrastructure required to index and search it – effectively a mini-datacenter). ",{"data":19500,"marks":19501,"value":19503,"nodeType":864},{},[19502],{"type":2246},"Not to mention that storing detailed HTTP body data presents a significant security risk, as it includes valid session tokens/cookies for all your identities…  ",{"data":19505,"content":19506,"nodeType":945},{},[19507],{"data":19508,"content":19509,"nodeType":860},{},[19510,19515,19519],{"data":19511,"marks":19512,"value":19514,"nodeType":864},{},[19513],{"type":899},"Each web app is custom, making automated analysis (virtually) impossible:",{"data":19516,"marks":19517,"value":19518,"nodeType":864},{},[]," Proxy-based solutions have to reconstruct the data after TLS encryption. HTTP data is usually stored in large application JSON/XML objects or even in totally custom encoding – per each app. This means that complex, custom code is required per each app to be able to perform automated analysis. When businesses today are using hundreds of apps on average, ",{"data":19520,"marks":19521,"value":19523,"nodeType":864},{},[19522],{"type":899},"automating this process is not feasible as it requires constant reverse engineering of every web app. ",{"data":19525,"content":19526,"nodeType":860},{},[19527],{"data":19528,"marks":19529,"value":19530,"nodeType":864},{},[],"So what does this mean? Well, even organizations with a TLS-terminating proxy are limited to manual analysis of select metadata after-the-fact, which massively reduces its utility. You could sink a day or more’s analysis into gathering a small amount of useful data, for example whether a URL was accessed, but not necessarily which device/user, or what account/creds were used to log in). This means you’re probably going to use proxy data to aid in the investigation of a known incident rather than anything proactive. ",{"data":19532,"content":19533,"nodeType":860},{},[19534,19539,19545],{"data":19535,"marks":19536,"value":19538,"nodeType":864},{},[19537],{"type":899},"It might be ",{"data":19540,"marks":19541,"value":19544,"nodeType":864},{},[19542,19543],{"type":2246},{"type":899},"theoretically",{"data":19546,"marks":19547,"value":19549,"nodeType":864},{},[19548],{"type":899}," possible to sift through decrypted HTTP data to identify and correlate identities and actions, effectively reconstructing web pages from the network traffic automatically and on the fly (in the same way that it’s theoretically possible to remove my head and transplant it onto your body), but is it practical or reasonable for most organizations to do this? No. ",{"data":19551,"content":19552,"nodeType":1009},{},[19553],{"data":19554,"marks":19555,"value":19557,"nodeType":864},{},[19556],{"type":899},"Browser data: a better alternative?",{"data":19559,"content":19560,"nodeType":860},{},[19561],{"data":19562,"marks":19563,"value":19564,"nodeType":864},{},[],"One way of overcoming some of the limitations of the classic web proxy setup is to use a browser-based solution. It’s much easier to collect data at the browser level before it’s encrypted. ",{"data":19566,"content":19567,"nodeType":860},{},[19568],{"data":19569,"marks":19570,"value":19571,"nodeType":864},{},[],"A browser agent isn’t just a proxy for pre-TLS HTML data, though. In the browser, you’re able to dynamically interact with the DOM or the rendered web application, including its JS code. This makes it easy to find, for example, input fields for usernames and passwords. You can see what information the user is inputting and where, without needing to figure out how the data is encoded and sent back to the app. These are fairly generic fields that can be identified across your suite of apps without needing complex custom code. To put it in perspective, approximately 10 login cases cover the entirety of the SaaS apps we support (~1000). Using a proxy-based solution, each of these would require custom development.   ",{"data":19573,"content":19574,"nodeType":860},{},[19575],{"data":19576,"marks":19577,"value":19578,"nodeType":864},{},[],"While it's technically possible to keep track of multiple sessions for thousands of users across hundreds of apps via proxy, it’s no mean feat – made much easier when each extension is tracking one user, in one browser, and even knows the browser tab it’s running in. You also get additional context at the identity layer such as the email address, authentication protocol, and credentials used, neatly mapped to that specific user and browser profile – no more trying to link the owner of an IP address to log events!",{"data":19580,"content":19581,"nodeType":860},{},[19582],{"data":19583,"marks":19584,"value":19585,"nodeType":864},{},[],"The browser also has the added benefit of being a natural enforcement point. You can collect and analyze data dynamically, and produce an immediate response – rather than taking info away, analyzing it, and coming back with a detection minutes or hours later (and potentially prompting a manual response). ",{"data":19587,"content":19588,"nodeType":860},{},[19589],{"data":19590,"marks":19591,"value":19592,"nodeType":864},{},[],"Let’s look at a couple of examples based on how we’re using our browser agent to detect and block identity attacks. ",{"data":19594,"content":19595,"nodeType":941},{},[19596,19618,19639],{"data":19597,"content":19598,"nodeType":945},{},[19599],{"data":19600,"content":19601,"nodeType":860},{},[19602,19605,19614],{"data":19603,"marks":19604,"value":21,"nodeType":864},{},[],{"data":19606,"content":19608,"nodeType":883},{"uri":19607},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[19609],{"data":19610,"marks":19611,"value":19613,"nodeType":864},{},[19612],{"type":1455},"Pinning passwords to the legitimate site they are linked with",{"data":19615,"marks":19616,"value":19617,"nodeType":864},{},[],". This is made possible by interacting with the DOM to observe passwords being entered – enabling the Push agent to intercept and block before an HTTP network request can even be made. ",{"data":19619,"content":19620,"nodeType":945},{},[19621],{"data":19622,"content":19623,"nodeType":860},{},[19624,19627,19635],{"data":19625,"marks":19626,"value":21,"nodeType":864},{},[],{"data":19628,"content":19630,"nodeType":883},{"uri":19629},"https://pushsecurity.com/blog/introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser/",[19631],{"data":19632,"marks":19633,"value":19634,"nodeType":864},{},[],"Detecting and blocking malicious phishing tools",{"data":19636,"marks":19637,"value":19638,"nodeType":864},{},[]," running on websites by observing behavioral attributes in the browser, such as Javascript calls being made or data structures saved to local storage.",{"data":19640,"content":19641,"nodeType":945},{},[19642],{"data":19643,"content":19644,"nodeType":860},{},[19645,19648,19656],{"data":19646,"marks":19647,"value":21,"nodeType":864},{},[],{"data":19649,"content":19651,"nodeType":883},{"uri":19650},"https://pushsecurity.com/blog/manage-third-party-data-access/",[19652],{"data":19653,"marks":19654,"value":19655,"nodeType":864},{},[],"Observing users signing up to and using risky apps",{"data":19657,"marks":19658,"value":19659,"nodeType":864},{},[],", or changing or removing authentication methods, MFA methods, and configuration methods, which could indicate account takeover. ",{"data":19661,"content":19662,"nodeType":860},{},[19663],{"data":19664,"marks":19665,"value":19666,"nodeType":864},{},[],"It’s always useful to refer back to the concept of the Pyramid of Pain in these situations. The opportunities to detect and block in the browser tend to align with indicators at the apex of the pyramid, meaning they are a significant obstruction for attackers – and difficult to circumvent. This contrasts the indicators aligned with proxy-based solutions, which are much easier to bypass through, for example, IP masking using residential proxy networks, or changing the domains and URLs used for phishing campaigns.  ",{"data":19668,"content":19672,"nodeType":996},{"target":19669},{"sys":19670},{"id":19671,"type":1001,"linkType":1002},"HrK2xQak6KfjInDbeSgv8",[],{"data":19674,"content":19675,"nodeType":860},{},[19676],{"data":19677,"marks":19678,"value":19679,"nodeType":864},{},[],"In summary: Browser data provides high-fidelity indicators of malicious activity, without the complications of proxy-based approaches. The scope for response in the browser is significant and immediate, meaning it’s a great enforcement point for security controls to be able to disrupt attacks. ",{"data":19681,"content":19682,"nodeType":1009},{},[19683],{"data":19684,"marks":19685,"value":19686,"nodeType":864},{},[],"Won’t my app and IdP logs cover this?",{"data":19688,"content":19689,"nodeType":860},{},[19690],{"data":19691,"marks":19692,"value":19693,"nodeType":864},{},[],"App and IdP logs are useful (when you can get them), but neither give you the full picture. ",{"data":19695,"content":19696,"nodeType":1312},{},[19697],{"data":19698,"marks":19699,"value":19700,"nodeType":864},{},[],"App logs are limited in availability, scope, and ease of ingestion ",{"data":19702,"content":19703,"nodeType":860},{},[19704,19708,19717],{"data":19705,"marks":19706,"value":19707,"nodeType":864},{},[],"When relying on app logs, you’re naturally constrained by the app provider. Many smaller apps provide no security logging, while others ",{"data":19709,"content":19711,"nodeType":883},{"uri":19710},"https://audit-logs.tax/",[19712],{"data":19713,"marks":19714,"value":19716,"nodeType":864},{},[19715],{"type":1455},"lock security logging behind the premium tier subscription",{"data":19718,"marks":19719,"value":19720,"nodeType":864},{},[],". When logs are available, you’re limited to the events that the third-party deems suitable to log. ",{"data":19722,"content":19723,"nodeType":860},{},[19724],{"data":19725,"marks":19726,"value":19727,"nodeType":864},{},[],"Out of the 100 most popular apps we see across our customers, and perhaps the few dozen or so that are security critical, only a small handful provide any useful logging. This means, naturally, that the majority of apps do not. ",{"data":19729,"content":19730,"nodeType":860},{},[19731],{"data":19732,"marks":19733,"value":19734,"nodeType":864},{},[],"To top it all off, the process of extracting these logs and feeding them into your SIEM (or equivalent) is also not straightforward. The lack of out-of-the-box connectors for many apps means that complex custom architectures are required for collecting data. Some vendors place constraints on the format and mechanism for extracting logs which can make ingestion difficult to feed reliable detections – even before any meaningful analysis of the data can take place. ",{"data":19736,"content":19737,"nodeType":860},{},[19738],{"data":19739,"marks":19740,"value":19741,"nodeType":864},{},[],"Until application security logs are made widely available (and at no additional cost) it’s unlikely you’re going to be able to get the visibility you need from app logs, for every app your employees use (though of course there are exceptions – and we hope to see more vendors in future treating security as a minimum requirement, not a chargeable addon). ",{"data":19743,"content":19744,"nodeType":1312},{},[19745],{"data":19746,"marks":19747,"value":19748,"nodeType":864},{},[],"IdP logs cover only SSO integrated apps and are limited in scope",{"data":19750,"content":19751,"nodeType":860},{},[19752],{"data":19753,"marks":19754,"value":19755,"nodeType":864},{},[],"You might think, “but all of our business apps are behind SSO, right?” In reality, only about 1 in 3 apps support SSO (and even fewer at the ‘free’ tier). And in practice, our data shows us that only 1 in 5 apps on average are actually behind SSO per organization. The theoretical security benefit of IdP logs is that they provide context, a foundation for the user’s activity across (and between) a suite of apps. But because of the lack of coverage, this isn’t the case. ",{"data":19757,"content":19758,"nodeType":860},{},[19759],{"data":19760,"marks":19761,"value":19762,"nodeType":864},{},[],"IdP logs are naturally focused on authentication, and so don’t compensate for any gaps in app logging. Naturally, they are only able to observe what happens on the IdP side – and so are blind to client side attacks like phishing (which we’ve already shown the browser provides superior visibility of compared to typical alternatives like proxy logs).   ",{"data":19764,"content":19765,"nodeType":1312},{},[19766],{"data":19767,"marks":19768,"value":19769,"nodeType":864},{},[],"Browser is best for stopping identity attacks",{"data":19771,"content":19772,"nodeType":860},{},[19773],{"data":19774,"marks":19775,"value":19776,"nodeType":864},{},[],"This is where the browser comes in. Think of your browser as your source of truth, a broad data baseline for user activity where the browser provides complete context of the browser profile, employee, accounts, credentials, auth methods, and MFA types – as well as employee interaction with web sites.",{"data":19778,"content":19779,"nodeType":860},{},[19780],{"data":19781,"marks":19782,"value":19783,"nodeType":864},{},[],"The TL;DR is that your visibility in the browser is theoretically limitless. Every page loaded (and its source, javascript state, local storage), every user interaction can be observed. And best of all, this analysis is done securely in the browser and only the results of detections are reported back, rather than decrypting the entire raw traffic stream including all session data in an additional centralized system. ",{"data":19785,"content":19788,"nodeType":996},{"target":19786},{"sys":19787},{"id":14444,"type":1001,"linkType":1002},[],{"data":19790,"content":19791,"nodeType":1009},{},[19792],{"data":19793,"marks":19794,"value":19795,"nodeType":864},{},[],"Conclusion",{"data":19797,"content":19798,"nodeType":860},{},[19799],{"data":19800,"marks":19801,"value":19802,"nodeType":864},{},[],"As an industry, we need to start looking at browser-based detection and response as the next logical evolution to stop identity attacks. There are clear parallels with the emergence of EDR – which came about because existing endpoint log sources were not sufficient. Today, we wouldn’t dream of trying to detect and respond to endpoint-based attacks without EDR – it’s time we started thinking about cloud identity attacks and the browser in the same way.  ",{"entries":19804},{"hyperlink":19805,"inline":19806,"block":19807},[],[],[19808,19816],{"sys":19809,"__typename":1724,"title":19810,"caption":19811,"layoutMode":59,"file":19812},{"id":19671},"Pyramid of pain: Identity attacks edition","Applying the Pyramid of Pain concept to identity attacks.",{"url":19813,"width":19814,"height":19815},"https://images.ctfassets.net/y1cdw1ablpvd/30YWVepOBUQeSVGynF251a/3821d6b78bf8cc2edac6770f587e1ed8/Frame_627569__10_.png",2815,1087,{"sys":19817,"__typename":1724,"title":14603,"caption":14604,"layoutMode":59,"file":19818},{"id":14444},{"url":14606,"width":14607,"height":14608},{"items":19820},[],{},"Why browser data is best for identity threat detection.","2024-06-11T00:00:00.000Z",{"items":19825},[19826,20253,21101],{"__typename":2059,"sys":19827,"content":19829,"title":20239,"synopsis":20240,"hashTags":59,"publishedDate":20241,"slug":20242,"tagsCollection":20243,"authorsCollection":20249},{"id":19828},"4EfGLsD4qOkE4AoTUoL83m",{"json":19830},{"data":19831,"content":19832,"nodeType":856},{},[19833,19839,19860,19880,19898,19918,19941,19948,19968,19989,19996,20002,20009,20016,20023,20030,20037,20044,20051,20058,20065,20085,20092,20098,20120,20127,20145,20151,20170,20177,20184,20191,20198,20216,20222],{"data":19834,"content":19838,"nodeType":996},{"target":19835},{"sys":19836},{"id":19837,"type":1001,"linkType":1002},"B8i0EK90Dn7FLrJXR4ANh",[],{"data":19840,"content":19841,"nodeType":860},{},[19842,19846,19856],{"data":19843,"marks":19844,"value":19845,"nodeType":864},{},[],"Is the golden era of MFA protection over? Watch a demo of an ",{"data":19847,"content":19851,"nodeType":17737},{"target":19848},{"sys":19849},{"id":19850,"type":1001,"linkType":1002},"7DJnckJxP4CXyXhPJJpby5",[19852],{"data":19853,"marks":19854,"value":19855,"nodeType":864},{},[],"EvilNoVNC phishing attack",{"data":19857,"marks":19858,"value":19859,"nodeType":864},{},[]," and you may be left sweating a little and whispering “FIDO2” like a protection spell.",{"data":19861,"content":19862,"nodeType":860},{},[19863,19867,19876],{"data":19864,"marks":19865,"value":19866,"nodeType":864},{},[],"With the widespread adoption of MFA, attackers are ",{"data":19868,"content":19871,"nodeType":17737},{"target":19869},{"sys":19870},{"id":14623,"type":1001,"linkType":1002},[19872],{"data":19873,"marks":19874,"value":19875,"nodeType":864},{},[],"increasingly turning",{"data":19877,"marks":19878,"value":19879,"nodeType":864},{},[]," to more sophisticated methods of credential theft as their initial point of entry. ",{"data":19881,"content":19882,"nodeType":860},{},[19883,19887,19894],{"data":19884,"marks":19885,"value":19886,"nodeType":864},{},[],"Newer phishing approaches include reverse proxies as well as tools that mimic legitimate login pages by rendering the webpages and then displaying those renders to the unsuspecting end-user. While these tools are not always common knowledge among blue teams, their use is ",{"data":19888,"content":19889,"nodeType":883},{"uri":17655},[19890],{"data":19891,"marks":19892,"value":19893,"nodeType":864},{},[],"on the rise",{"data":19895,"marks":19896,"value":19897,"nodeType":864},{},[],", an unsurprising response to the broad use of multi-factor authentication in many organizations.",{"data":19899,"content":19900,"nodeType":860},{},[19901,19905,19914],{"data":19902,"marks":19903,"value":19904,"nodeType":864},{},[],"What sets this generation of ",{"data":19906,"content":19909,"nodeType":17737},{"target":19907},{"sys":19908},{"id":19850,"type":1001,"linkType":1002},[19910],{"data":19911,"marks":19912,"value":19913,"nodeType":864},{},[],"Adversary-in-the-Middle (AitM) phishing tools",{"data":19915,"marks":19916,"value":19917,"nodeType":864},{},[]," apart? ",{"data":19919,"content":19920,"nodeType":941},{},[19921,19931],{"data":19922,"content":19923,"nodeType":945},{},[19924],{"data":19925,"content":19926,"nodeType":860},{},[19927],{"data":19928,"marks":19929,"value":19930,"nodeType":864},{},[],"They act as a proxy between the user and a legitimate web login page, allowing the attacker to bypass MFA and harvest credentials and session tokens.",{"data":19932,"content":19933,"nodeType":945},{},[19934],{"data":19935,"content":19936,"nodeType":860},{},[19937],{"data":19938,"marks":19939,"value":19940,"nodeType":864},{},[],"They give off little scent to end-users, because the end-user is logging into the legitimate site, just by taking a detour via the attacker’s device.",{"data":19942,"content":19943,"nodeType":860},{},[19944],{"data":19945,"marks":19946,"value":19947,"nodeType":864},{},[],"These AitM tools are also difficult to detect — unless you have eyes in the browser.",{"data":19949,"content":19950,"nodeType":860},{},[19951,19955,19964],{"data":19952,"marks":19953,"value":19954,"nodeType":864},{},[],"Powered by the Push browser agent, Push now offers a ",{"data":19956,"content":19959,"nodeType":17737},{"target":19957},{"sys":19958},{"id":17911,"type":1001,"linkType":1002},[19960],{"data":19961,"marks":19962,"value":19963,"nodeType":864},{},[],"preconfigured set of detections",{"data":19965,"marks":19966,"value":19967,"nodeType":864},{},[]," for phishing tools like Evilginx and others, informed by our threat detection team’s research into their behavior. This phishing tool detection feature will automatically prevent users from accessing a site that’s running one of these malicious tools, and display a custom warning message to your end-users.",{"data":19969,"content":19970,"nodeType":860},{},[19971,19975,19985],{"data":19972,"marks":19973,"value":19974,"nodeType":864},{},[],"While Push already provides strong phishing protection by ",{"data":19976,"content":19980,"nodeType":17737},{"target":19977},{"sys":19978},{"id":19979,"type":1001,"linkType":1002},"4UtRVoFElDduWJBx9Sa4Cw",[19981],{"data":19982,"marks":19983,"value":19984,"nodeType":864},{},[],"preventing SSO password use",{"data":19986,"marks":19987,"value":19988,"nodeType":864},{},[]," on non-IdP webpages (in other words, it stops you from using your Okta password on any page that isn’t an Okta login page), this new feature allows us to sharpen our anti-phishing capabilities by detecting malware on a site before a user even interacts with the page. ",{"data":19990,"content":19991,"nodeType":860},{},[19992],{"data":19993,"marks":19994,"value":19995,"nodeType":864},{},[],"In this article, we’ll describe our approach to detecting these newer phishing tools, including how we’re borrowing techniques from the world of EDR, and how you can combine phishing tool detection with other Push controls for a defense-in-depth strategy that covers both the user and the application sides of the equation.",{"data":19997,"content":20001,"nodeType":996},{"target":19998},{"sys":19999},{"id":20000,"type":1001,"linkType":1002},"59q6klX2j7ClgUvmix93sG",[],{"data":20003,"content":20004,"nodeType":1009},{},[20005],{"data":20006,"marks":20007,"value":20008,"nodeType":864},{},[],"Taking a page from EDR",{"data":20010,"content":20011,"nodeType":860},{},[20012],{"data":20013,"marks":20014,"value":20015,"nodeType":864},{},[],"Most phishing prevention solutions rely on lists of known-bad sites as the source of intelligence. These are always going to be a step behind reality because they rely on ever-shifting secondary attributes such as domain names (though we won’t be disabling Chrome Safe Browsing anytime soon, and we’re not trying to replace it).",{"data":20017,"content":20018,"nodeType":860},{},[20019],{"data":20020,"marks":20021,"value":20022,"nodeType":864},{},[],"As veterans of the EDR world, we’re drawn to think in analogous terms. With detecting AitM phishing tools, that means expanding on the concept of dynamic analysis on the endpoint. EDR allows you to dynamically analyze the behavior of malware live and at scale, rather than focusing on easy-to-change indicators like file hashes or domain names.",{"data":20024,"content":20025,"nodeType":860},{},[20026],{"data":20027,"marks":20028,"value":20029,"nodeType":864},{},[],"Applying this idea to malware that runs in the browser requires a solution that is in the browser, like the Push browser agent.",{"data":20031,"content":20032,"nodeType":860},{},[20033],{"data":20034,"marks":20035,"value":20036,"nodeType":864},{},[],"So we’re expanding the attributes that are traditionally analyzed to spot indicators of compromise (IoCs) beyond domains, file names, file hashes, IP addresses, etc., to also include behavioral attributes of malware that are much harder to change, such as Javascript calls being made or data structures saved to local storage.",{"data":20038,"content":20039,"nodeType":860},{},[20040],{"data":20041,"marks":20042,"value":20043,"nodeType":864},{},[],"By performing behavioral analysis on AitM automated proxy tools, we can directly analyze the application for a precise and immediate identification. ",{"data":20045,"content":20046,"nodeType":860},{},[20047],{"data":20048,"marks":20049,"value":20050,"nodeType":864},{},[],"Push researchers are regularly identifying and adding detections for new toolkits — think of this like Push’s database of threat research in action.",{"data":20052,"content":20053,"nodeType":1009},{},[20054],{"data":20055,"marks":20056,"value":20057,"nodeType":864},{},[],"How it works",{"data":20059,"content":20060,"nodeType":860},{},[20061],{"data":20062,"marks":20063,"value":20064,"nodeType":864},{},[],"If you’re new to Push, a bit of context may be useful. Push uses a browser agent deployed to employee browsers (we support all major browsers) to prevent, detect, and block identity attacks. ",{"data":20066,"content":20067,"nodeType":860},{},[20068,20072,20081],{"data":20069,"marks":20070,"value":20071,"nodeType":864},{},[],"By directly observing user behavior at the login event, Push provides broad and actionable context across all the apps your employees are using, how they are accessing them, their MFA methods, and where they’re using insecure and reused passwords. With this context as the foundation, Push enforces your desired ",{"data":20073,"content":20076,"nodeType":17737},{"target":20074},{"sys":20075},{"id":17730,"type":1001,"linkType":1002},[20077],{"data":20078,"marks":20079,"value":20080,"nodeType":864},{},[],"security controls",{"data":20082,"marks":20083,"value":20084,"nodeType":864},{},[],", including preventing SSO password reuse, blocking malicious websites, or steering employees to approved apps only.",{"data":20086,"content":20087,"nodeType":860},{},[20088],{"data":20089,"marks":20090,"value":20091,"nodeType":864},{},[],"Once configured by an administrator, phishing tool detection will immediately check for the fingerprints of these toolkits as end-users visit websites and then display your custom warn or block message. ",{"data":20093,"content":20097,"nodeType":996},{"target":20094},{"sys":20095},{"id":20096,"type":1001,"linkType":1002},"1LdHJjTDlOiie5mctbAVvZ",[],{"data":20099,"content":20100,"nodeType":860},{},[20101,20104,20108,20112,20116],{"data":20102,"marks":20103,"value":1499,"nodeType":864},{},[],{"data":20105,"marks":20106,"value":1397,"nodeType":864},{},[20107],{"type":899},{"data":20109,"marks":20110,"value":20111,"nodeType":864},{},[]," mode, users cannot proceed to the site where malicious software has been detected. In ",{"data":20113,"marks":20114,"value":1503,"nodeType":864},{},[20115],{"type":899},{"data":20117,"marks":20118,"value":20119,"nodeType":864},{},[]," mode, users can choose to proceed if they are sure it’s not a phishing site.",{"data":20121,"content":20122,"nodeType":860},{},[20123],{"data":20124,"marks":20125,"value":20126,"nodeType":864},{},[],"In both cases, users do not need to interact with a page (by typing, clicking, etc.) for Push to trigger the custom message. ",{"data":20128,"content":20129,"nodeType":860},{},[20130,20134,20141],{"data":20131,"marks":20132,"value":20133,"nodeType":864},{},[],"Administrators can also consume phishing tool detection events via the ",{"data":20135,"content":20136,"nodeType":883},{"uri":17759},[20137],{"data":20138,"marks":20139,"value":20140,"nodeType":864},{},[],"Push REST API",{"data":20142,"marks":20143,"value":20144,"nodeType":864},{},[]," into their SIEM or use Push’s webhooks to alert when a warn or block event has occurred.",{"data":20146,"content":20150,"nodeType":996},{"target":20147},{"sys":20148},{"id":20149,"type":1001,"linkType":1002},"6oAhxLBPVxN3Rcw2kFeVtG",[],{"data":20152,"content":20153,"nodeType":860},{},[20154,20158,20166],{"data":20155,"marks":20156,"value":20157,"nodeType":864},{},[],"Pairing this phishing detection capability with Push’s ",{"data":20159,"content":20162,"nodeType":17737},{"target":20160},{"sys":20161},{"id":17994,"type":1001,"linkType":1002},[20163],{"data":20164,"marks":20165,"value":17926,"nodeType":864},{},[],{"data":20167,"marks":20168,"value":20169,"nodeType":864},{},[]," feature provides a strong defense-in-depth strategy for stopping credential theft.",{"data":20171,"content":20172,"nodeType":860},{},[20173],{"data":20174,"marks":20175,"value":20176,"nodeType":864},{},[],"SSO password protection works by analyzing user behavior — namely, is a user entering their SSO password onto a page that does not belong to the legitimate identity provider.",{"data":20178,"content":20179,"nodeType":860},{},[20180],{"data":20181,"marks":20182,"value":20183,"nodeType":864},{},[],"Phishing tool detection adds in the application-level behavioral analysis. In addition, when Push identifies a new, previously unknown phishing tool in the wild via blocked SSO credential theft, we add its fingerprints to the browser agent’s detective capabilities.  ",{"data":20185,"content":20186,"nodeType":1009},{},[20187],{"data":20188,"marks":20189,"value":20190,"nodeType":864},{},[],"Looking ahead",{"data":20192,"content":20193,"nodeType":860},{},[20194],{"data":20195,"marks":20196,"value":20197,"nodeType":864},{},[],"We’re just scratching the surface on this approach and are exploring how Push can identify and block other web-delivered malware and Javascript-based attack types beyond AitM tools. Think HTML smuggling, tabnabbing, and the like.",{"data":20199,"content":20200,"nodeType":860},{},[20201,20205,20213],{"data":20202,"marks":20203,"value":20204,"nodeType":864},{},[],"Got feedback? We’d ",{"data":20206,"content":20208,"nodeType":883},{"uri":20207},"/contact/",[20209],{"data":20210,"marks":20211,"value":20212,"nodeType":864},{},[],"love to talk",{"data":20214,"marks":20215,"value":2924,"nodeType":864},{},[],{"data":20217,"content":20218,"nodeType":1009},{},[20219],{"data":20220,"marks":20221,"value":18365,"nodeType":864},{},[],{"data":20223,"content":20224,"nodeType":860},{},[20225,20229,20235],{"data":20226,"marks":20227,"value":20228,"nodeType":864},{},[],"To see Push in action, ",{"data":20230,"content":20231,"nodeType":883},{"uri":6151},[20232],{"data":20233,"marks":20234,"value":18380,"nodeType":864},{},[],{"data":20236,"marks":20237,"value":20238,"nodeType":864},{},[],". We’ll be happy to show you this feature, along with how we discover all the apps your employees are using, even the ones not behind SSO, and how we detect vulnerable identities and stop identity attacks with browser-based controls.","Introducing AitM phishing toolkit detection, powered by the Push browser agent","Push analyzes behavioral attributes of malware to identify phishing tools like Evilginx and NakedPages and immediately block end-users from visiting them.","2024-06-06T00:00:00.000Z","introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser",{"items":20244},[20245,20247],{"sys":20246,"name":18394},{"id":18393},{"sys":20248,"name":342},{"id":12756},{"items":20250},[20251],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":20252},{"url":853},{"__typename":2059,"sys":20254,"content":20255,"title":21083,"synopsis":21084,"hashTags":59,"publishedDate":21085,"slug":21086,"tagsCollection":21087,"authorsCollection":21093},{"id":19850},{"json":20256},{"data":20257,"content":20258,"nodeType":856},{},[20259,20266,20273,20280,20287,20294,20301,20308,20315,20322,20328,20335,20342,20349,20406,20413,20420,20439,20446,20453,20460,20493,20509,20516,20523,20530,20537,20544,20551,20571,20590,20695,20702,20720,20727,20734,20741,20747,20754,20761,20768,20800,20807,20814,20847,20854,20861,20957,20974,20980,20987,20994,21001,21055,21062,21065,21072,21077],{"data":20260,"content":20261,"nodeType":860},{},[20262],{"data":20263,"marks":20264,"value":20265,"nodeType":864},{},[],"Phishing attacks have always been a go-to technique for both red teamers and real-world threat actors alike. Whether focused on harvesting creds or running malicious payloads, phishing has continued to be adapted to circumvent defenses and has remained highly effective due to this.",{"data":20267,"content":20268,"nodeType":860},{},[20269],{"data":20270,"marks":20271,"value":20272,"nodeType":864},{},[],"As MFA has become more common, classic password harvesting focused phishing attacks have become less effective. Typically, for a full account compromise, an MFA push notification or a one-time passcode (OTP) needs to be entered at the time of login. This means harvesting passwords and using them later is no longer effective alone, because an MFA factor is still required each time a valid login is performed.",{"data":20274,"content":20275,"nodeType":860},{},[20276],{"data":20277,"marks":20278,"value":20279,"nodeType":864},{},[],"Adversary-in-the-Middle (AitM) phishing is a newer variant of phishing that allows attackers to circumvent MFA protection. In this article, we’re going to look at what AitM phishing is, how it works, and what you can do about it.",{"data":20281,"content":20282,"nodeType":1009},{},[20283],{"data":20284,"marks":20285,"value":20286,"nodeType":864},{},[],"What is AitM phishing?",{"data":20288,"content":20289,"nodeType":860},{},[20290],{"data":20291,"marks":20292,"value":20293,"nodeType":864},{},[],"AitM phishing is a technique that uses dedicated tooling to act as a proxy between the target and a legitimate login portal for an application, principally to make it easier to defeat MFA protection. ",{"data":20295,"content":20296,"nodeType":860},{},[20297],{"data":20298,"marks":20299,"value":20300,"nodeType":864},{},[],"While any login portal can be a target, attackers typically look for SSO login portals such as Microsoft Entra, Okta, or Google Workspace. This allows the target to log in successfully with a legitimate service they use and even continue to interact with it, while providing additional access to connected SSO apps if the attack is successful. ",{"data":20302,"content":20303,"nodeType":860},{},[20304],{"data":20305,"marks":20306,"value":20307,"nodeType":864},{},[],"As it’s a proxy to the real application, the page will appear exactly as the user expects, because they are logging into the legitimate site – just taking a detour via the attacker’s device. For example, if accessing their webmail, the user will see all their real emails; if accessing their cloud file store then all their real files will be present, etc. This gives the method an increased sense of authenticity and makes the compromise less obvious to the user. However, because the attacker is sitting in the middle of this connection, they are able to observe all interactions and also take control of the authenticated session to gain control of the user account. ",{"data":20309,"content":20310,"nodeType":860},{},[20311],{"data":20312,"marks":20313,"value":20314,"nodeType":864},{},[],"While this access is technically temporary, since the attacker is unable to re-authenticate in future without additional MFA prompts, in practice authenticated sessions can often last as long as 30 days or more if kept active. Additionally, there are a wide range of persistence techniques that allow an attacker to maintain some level of access to the user account and/or targeted application indefinitely. ",{"data":20316,"content":20317,"nodeType":860},{},[20318],{"data":20319,"marks":20320,"value":20321,"nodeType":864},{},[],"We’ll revisit this point later, but for now let’s consider the two main techniques that are used to implement AitM phishing: Reverse web proxies and Browser-in-the-Middle techniques.",{"data":20323,"content":20327,"nodeType":996},{"target":20324},{"sys":20325},{"id":20326,"type":1001,"linkType":1002},"6WEolDcviadCgAW4dCgTPW",[],{"data":20329,"content":20330,"nodeType":1312},{},[20331],{"data":20332,"marks":20333,"value":20334,"nodeType":864},{},[],"Reverse web proxy techniques",{"data":20336,"content":20337,"nodeType":860},{},[20338],{"data":20339,"marks":20340,"value":20341,"nodeType":864},{},[],"One common AitM phishing approach is to use tooling that acts as a reverse web proxy. For example, let’s say a victim is tricked into visiting a malicious domain. Under the hood, HTTP requests are passed between the victim’s browser and the real site via the malicious site. When the malicious site receives an HTTP request, it forwards this request on to the legitimate site it is impersonating, receives the response, and then forwards that on to the victim. ",{"data":20343,"content":20344,"nodeType":860},{},[20345],{"data":20346,"marks":20347,"value":20348,"nodeType":864},{},[],"In practice, there are many technical challenges, such as rewriting all links and references to the impersonated site to ensure everything continues to be sent to the attacker. However, at a high level, it really is just acting as a reverse web proxy.",{"data":20350,"content":20351,"nodeType":860},{},[20352,20356,20365,20368,20377,20381,20390,20394,20403],{"data":20353,"marks":20354,"value":20355,"nodeType":864},{},[],"This is arguably the most scalable and reliable approach from an attacker’s point of view. Open-source tools that demonstrate this method include ",{"data":20357,"content":20359,"nodeType":883},{"uri":20358},"https://github.com/drk1wi/Modlishka",[20360],{"data":20361,"marks":20362,"value":20364,"nodeType":864},{},[20363],{"type":1455},"Modlishka",{"data":20366,"marks":20367,"value":3731,"nodeType":864},{},[],{"data":20369,"content":20371,"nodeType":883},{"uri":20370},"https://github.com/muraenateam/muraena",[20372],{"data":20373,"marks":20374,"value":20376,"nodeType":864},{},[20375],{"type":1455},"Muraena",{"data":20378,"marks":20379,"value":20380,"nodeType":864},{},[],", and the ever popular ",{"data":20382,"content":20384,"nodeType":883},{"uri":20383},"https://github.com/kgretzky/evilginx2",[20385],{"data":20386,"marks":20387,"value":20389,"nodeType":864},{},[20388],{"type":1455},"Evilginx",{"data":20391,"marks":20392,"value":20393,"nodeType":864},{},[],". In the criminal world, there are also similar private toolsets available that have been used in many breaches in the past. A good example of this would be ",{"data":20395,"content":20397,"nodeType":883},{"uri":20396},"https://www.bleepingcomputer.com/news/security/evilproxy-uses-indeedcom-open-redirect-for-microsoft-365-phishing/",[20398],{"data":20399,"marks":20400,"value":20402,"nodeType":864},{},[20401],{"type":1455},"Evilproxy",{"data":20404,"marks":20405,"value":2924,"nodeType":864},{},[],{"data":20407,"content":20408,"nodeType":860},{},[20409],{"data":20410,"marks":20411,"value":20412,"nodeType":864},{},[],"One downside to this approach is that there are controls that can be put in place to block it. For example, application developers can hide obfuscated JavaScript code that will fail if the correct value is not produced, checking that the origin matches the expected (legitimate) domains or contains encrypted tokens including this material sent as part of the login process. ",{"data":20414,"content":20415,"nodeType":860},{},[20416],{"data":20417,"marks":20418,"value":20419,"nodeType":864},{},[],"While your average small website is not going to be implementing such checks, major identity providers have a strong vested interest in evolving their defenses to block these techniques. At this point, it’s a cat-and-mouse game. ",{"data":20421,"content":20422,"nodeType":860},{},[20423,20427,20436],{"data":20424,"marks":20425,"value":20426,"nodeType":864},{},[],"If you want to know more about this space, then definitely check out ",{"data":20428,"content":20430,"nodeType":883},{"uri":20429},"https://www.youtube.com/watch?v=C-Fh4sIdY8c",[20431],{"data":20432,"marks":20433,"value":20435,"nodeType":864},{},[20434],{"type":1455},"Kuba Gretzky’s talk on this at x33fcon",{"data":20437,"marks":20438,"value":13804,"nodeType":864},{},[],{"data":20440,"content":20441,"nodeType":1312},{},[20442],{"data":20443,"marks":20444,"value":20445,"nodeType":864},{},[],"Browser-in-the-Middle (BitM) techniques ",{"data":20447,"content":20448,"nodeType":860},{},[20449],{"data":20450,"marks":20451,"value":20452,"nodeType":864},{},[],"Another common approach is known as Browser-in-the-Middle (BitM). Rather than act as a reverse web proxy, this technique tricks a target into directly controlling the attacker’s own browser remotely using desktop screen sharing and control approaches, much like VNC and RDP. This enables the attacker to harvest not just the username and password, but all other associated secrets and tokens that go along with the login. ",{"data":20454,"content":20455,"nodeType":860},{},[20456],{"data":20457,"marks":20458,"value":20459,"nodeType":864},{},[],"In this case, the victim isn’t interacting with a fake website clone or proxy. They are literally remotely controlling the attacker’s browser to log in to the legitimate application without realizing. This is the virtual equivalent of an attacker handing their laptop to their victim, asking them to login to Okta for them, and then taking their laptop back afterwards. Thanks very much!",{"data":20461,"content":20462,"nodeType":860},{},[20463,20467,20476,20480,20489],{"data":20464,"marks":20465,"value":20466,"nodeType":864},{},[],"Practically speaking, the most common approach for implementing this technique is using the open-source project noVNC, which is a JavaScript-based VNC client that allows VNC to be used in the browser. Probably the most well-known example of an offensive tool implementing this is ",{"data":20468,"content":20470,"nodeType":883},{"uri":20469},"https://github.com/JoelGMSec/EvilnoVNC",[20471],{"data":20472,"marks":20473,"value":20475,"nodeType":864},{},[20474],{"type":1455},"EvilnoVNC",{"data":20477,"marks":20478,"value":20479,"nodeType":864},{},[],", which spins up Docker instances of VNC and proxies access to them, while also logging keystrokes and cookies to facilitate account compromise. Tools like ",{"data":20481,"content":20483,"nodeType":883},{"uri":20482},"https://posts.specterops.io/phishing-with-dynamite-7d33d8fac038",[20484],{"data":20485,"marks":20486,"value":20488,"nodeType":864},{},[20487],{"type":1455},"Cuddlephish",{"data":20490,"marks":20491,"value":20492,"nodeType":864},{},[]," offer similar functionality using WebRTC. ",{"data":20494,"content":20495,"nodeType":860},{},[20496,20500,20505],{"data":20497,"marks":20498,"value":20499,"nodeType":864},{},[],"The advantage of this approach is that ",{"data":20501,"marks":20502,"value":20504,"nodeType":864},{},[20503],{"type":899},"it is incredibly difficult for the target websites to do anything to stop it",{"data":20506,"marks":20507,"value":20508,"nodeType":864},{},[],". From their perspective, all they see is a legitimate browser accessing their website and logging in. None of the JavaScript tricks for checking the origin will work. They aren’t in a position to be able to see that the browser is secretly being controlled remotely by the victim user without their knowledge. ",{"data":20510,"content":20511,"nodeType":860},{},[20512],{"data":20513,"marks":20514,"value":20515,"nodeType":864},{},[],"On the downside, while noVNC can be extremely convincing, the illusion can sometimes be broken due to it not behaving exactly like a real website would due it being a graphical rendering. For example, something as simple as resizing the browser window can introduce render resolution issues. It’s also more difficult to scale for attacking large numbers of users than a reverse proxy technique.",{"data":20517,"content":20518,"nodeType":860},{},[20519],{"data":20520,"marks":20521,"value":20522,"nodeType":864},{},[],"Footnote: BitM is not to be confused with Browser-in-the-Browser (BitB), which is more of a malicious pop-up (think when a login button spawns a new browser window). ",{"data":20524,"content":20525,"nodeType":1009},{},[20526],{"data":20527,"marks":20528,"value":20529,"nodeType":864},{},[],"Beyond initial access",{"data":20531,"content":20532,"nodeType":860},{},[20533],{"data":20534,"marks":20535,"value":20536,"nodeType":864},{},[],"So maybe you’re thinking now “OK, sounds kinda bad, but I’m not that worried. Maybe some user accounts get compromised by this method despite all my MFA protections, but at least the attacker only has temporary access, right?” ",{"data":20538,"content":20539,"nodeType":860},{},[20540],{"data":20541,"marks":20542,"value":20543,"nodeType":864},{},[],"In theory, access is temporary as sessions time out. And if spotted, the security team can respond by killing the authenticated sessions and forcing password changes for the compromised users. Then the attacker is back to square one, right? Their session is lost, they still don’t have MFA, and even the password they keylogged has now been changed.",{"data":20545,"content":20546,"nodeType":860},{},[20547],{"data":20548,"marks":20549,"value":20550,"nodeType":864},{},[],"In practice, it’s not this simple. We mentioned earlier how SSO portals are often the most common targets for these attacks. For most modern organizations, this means their core identity provider, which just so happens to be the gateway to accessing many other web applications, whether internal applications or a multitude of SaaS applications. ",{"data":20552,"content":20553,"nodeType":860},{},[20554,20558,20567],{"data":20555,"marks":20556,"value":20557,"nodeType":864},{},[],"Let’s consider the example of an organization using Okta where their Okta login portal has been used as the target for AitM phishing. A smart attacker is going to immediately leverage this access to establish authenticated sessions on every single application that Okta provides the user access to. They are also going to ",{"data":20559,"content":20561,"nodeType":883},{"uri":20560},"https://pushsecurity.com/blog/okta-swa/",[20562],{"data":20563,"marks":20564,"value":20566,"nodeType":864},{},[20565],{"type":1455},"abuse Okta SWA",{"data":20568,"marks":20569,"value":20570,"nodeType":864},{},[]," to steal valid credentials for whichever applications support this method. And if that’s not enough, there are a variety of simple methods to achieve persistence on most downstream SaaS applications and sometimes even identity providers themselves.",{"data":20572,"content":20573,"nodeType":860},{},[20574,20578,20586],{"data":20575,"marks":20576,"value":20577,"nodeType":864},{},[],"While the full details of these persistence attacks are outside the scope of this article, more details on some key attacks can be found in a resource we created called the ",{"data":20579,"content":20580,"nodeType":883},{"uri":13662},[20581],{"data":20582,"marks":20583,"value":20585,"nodeType":864},{},[20584],{"type":1455},"SaaS attacks matrix",{"data":20587,"marks":20588,"value":20589,"nodeType":864},{},[],". Some of the most common techniques that apply here are: ",{"data":20591,"content":20592,"nodeType":941},{},[20593,20613,20634,20654,20674],{"data":20594,"content":20595,"nodeType":945},{},[20596],{"data":20597,"content":20598,"nodeType":860},{},[20599,20602,20610],{"data":20600,"marks":20601,"value":21,"nodeType":864},{},[],{"data":20603,"content":20604,"nodeType":883},{"uri":17377},[20605],{"data":20606,"marks":20607,"value":20609,"nodeType":864},{},[20608],{"type":1455},"SAT1004 - API keys",{"data":20611,"marks":20612,"value":21,"nodeType":864},{},[],{"data":20614,"content":20615,"nodeType":945},{},[20616],{"data":20617,"content":20618,"nodeType":860},{},[20619,20622,20631],{"data":20620,"marks":20621,"value":21,"nodeType":864},{},[],{"data":20623,"content":20625,"nodeType":883},{"uri":20624},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_sharing/description.md",[20626],{"data":20627,"marks":20628,"value":20630,"nodeType":864},{},[20629],{"type":1455},"SAT1022 - Link sharing",{"data":20632,"marks":20633,"value":21,"nodeType":864},{},[],{"data":20635,"content":20636,"nodeType":945},{},[20637],{"data":20638,"content":20639,"nodeType":860},{},[20640,20643,20651],{"data":20641,"marks":20642,"value":21,"nodeType":864},{},[],{"data":20644,"content":20645,"nodeType":883},{"uri":13750},[20646],{"data":20647,"marks":20648,"value":20650,"nodeType":864},{},[20649],{"type":1455},"SAT1017 - Ghost logins",{"data":20652,"marks":20653,"value":21,"nodeType":864},{},[],{"data":20655,"content":20656,"nodeType":945},{},[20657],{"data":20658,"content":20659,"nodeType":860},{},[20660,20663,20671],{"data":20661,"marks":20662,"value":21,"nodeType":864},{},[],{"data":20664,"content":20665,"nodeType":883},{"uri":15899},[20666],{"data":20667,"marks":20668,"value":20670,"nodeType":864},{},[20669],{"type":1455},"SAT1027 - OAuth tokens",{"data":20672,"marks":20673,"value":21,"nodeType":864},{},[],{"data":20675,"content":20676,"nodeType":945},{},[20677],{"data":20678,"content":20679,"nodeType":860},{},[20680,20683,20692],{"data":20681,"marks":20682,"value":21,"nodeType":864},{},[],{"data":20684,"content":20686,"nodeType":883},{"uri":20685},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[20687],{"data":20688,"marks":20689,"value":20691,"nodeType":864},{},[20690],{"type":1455},"SAT1033 - Shadow workflows",{"data":20693,"marks":20694,"value":21,"nodeType":864},{},[],{"data":20696,"content":20697,"nodeType":860},{},[20698],{"data":20699,"marks":20700,"value":20701,"nodeType":864},{},[],"Suddenly, containing the breach just got a LOT more complicated.",{"data":20703,"content":20704,"nodeType":860},{},[20705,20709,20716],{"data":20706,"marks":20707,"value":20708,"nodeType":864},{},[],"It’s not just application-level lateral movement and persistence to worry about, though. It’s possible the attacker can start moving laterally across other user accounts. If they have selected their targets well, they might even find they have admin access to some downstream SaaS application that has been configured for SAML logins using Okta. For example, maybe they compromise a finance employee who has admin access to their business expenses SaaS application. Then the attacker might be able to use a new technique like ",{"data":20710,"content":20711,"nodeType":883},{"uri":19022},[20712],{"data":20713,"marks":20714,"value":13680,"nodeType":864},{},[20715],{"type":1455},{"data":20717,"marks":20718,"value":20719,"nodeType":864},{},[]," to start attacking other users in a watering hole attack to achieve lateral movement.",{"data":20721,"content":20722,"nodeType":1009},{},[20723],{"data":20724,"marks":20725,"value":20726,"nodeType":864},{},[],"Video demo – chaining it all together",{"data":20728,"content":20729,"nodeType":860},{},[20730],{"data":20731,"marks":20732,"value":20733,"nodeType":864},{},[],"OK, so we’ve just jumped from an account compromise for initial access using an AitM phishing attack to bringing up a huge number of other connected techniques. Let’s look at a quick video demonstration of an AitM phishing attack chained together with post-exploitation steps for persistence and lateral movement so we can see how it all fits together.",{"data":20735,"content":20736,"nodeType":860},{},[20737],{"data":20738,"marks":20739,"value":20740,"nodeType":864},{},[],"In this case, we’ll use EvilnoVNC targeting Okta as the core example for the AitM phishing attack:",{"data":20742,"content":20746,"nodeType":996},{"target":20743},{"sys":20744},{"id":20745,"type":1001,"linkType":1002},"QGTEWzmOL1vrgjXPuV4Gg",[],{"data":20748,"content":20749,"nodeType":860},{},[20750],{"data":20751,"marks":20752,"value":20753,"nodeType":864},{},[],"We can see here that AitM phishing attacks are not only highly effective even in the presence of MFA, but that post-exploitation steps have become so numerous that effective response and containment for even a low-privileged user account are now a significant challenge.",{"data":20755,"content":20756,"nodeType":1009},{},[20757],{"data":20758,"marks":20759,"value":20760,"nodeType":864},{},[],"Post-exploitation automation is coming",{"data":20762,"content":20763,"nodeType":860},{},[20764],{"data":20765,"marks":20766,"value":20767,"nodeType":864},{},[],"There is a saying that attacks only become more effective over time. In the past, toolsets like Metasploit and Cobalt Strike became increasingly focused on post-exploitation and automation to enable much more sophisticated compromises.",{"data":20769,"content":20770,"nodeType":860},{},[20771,20775,20787,20791,20796],{"data":20772,"marks":20773,"value":20774,"nodeType":864},{},[],"As AitM becomes increasingly popular (for example, researchers at Lab539 have reported ",{"data":20776,"content":20777,"nodeType":883},{"uri":17655},[20778,20783],{"data":20779,"marks":20780,"value":20782,"nodeType":864},{},[20781],{"type":1455},"a significant ramp up in attacker infrastructure linked to AitM campaigns",{"data":20784,"marks":20785,"value":20786,"nodeType":864},{},[],")",{"data":20788,"marks":20789,"value":20790,"nodeType":864},{},[]," it’s only a matter of time now before we see AitM phishing frameworks moving in the same direction and performing many of the lateral movement and persistence steps we saw above – automatically on every successful account compromise. The threat will increase ",{"data":20792,"marks":20793,"value":20795,"nodeType":864},{},[20794],{"type":899},"significantly",{"data":20797,"marks":20798,"value":20799,"nodeType":864},{},[]," when this becomes the case.",{"data":20801,"content":20802,"nodeType":1009},{},[20803],{"data":20804,"marks":20805,"value":20806,"nodeType":864},{},[],"Impact summary",{"data":20808,"content":20809,"nodeType":860},{},[20810],{"data":20811,"marks":20812,"value":20813,"nodeType":864},{},[],"We’ve covered a lot of ground here, so let’s take a step back and consider the key points of impact:",{"data":20815,"content":20816,"nodeType":941},{},[20817,20827,20837],{"data":20818,"content":20819,"nodeType":945},{},[20820],{"data":20821,"content":20822,"nodeType":860},{},[20823],{"data":20824,"marks":20825,"value":20826,"nodeType":864},{},[],"AitM phishing techniques are highly effective and increasingly common, and can bypass most common forms of MFA.",{"data":20828,"content":20829,"nodeType":945},{},[20830],{"data":20831,"content":20832,"nodeType":860},{},[20833],{"data":20834,"marks":20835,"value":20836,"nodeType":864},{},[],"These techniques are being used by real threat actors and red teamers alike, with both criminal and open-source tools available for performing these attacks.",{"data":20838,"content":20839,"nodeType":945},{},[20840],{"data":20841,"content":20842,"nodeType":860},{},[20843],{"data":20844,"marks":20845,"value":20846,"nodeType":864},{},[],"There are many options for lateral movement and persistence after an account compromise, so simple containment actions like password resets for SSO credentials are not nearly enough to contain a knowledgeable attacker.",{"data":20848,"content":20849,"nodeType":1009},{},[20850],{"data":20851,"marks":20852,"value":20853,"nodeType":864},{},[],"What can blue teams do about it?",{"data":20855,"content":20856,"nodeType":860},{},[20857],{"data":20858,"marks":20859,"value":20860,"nodeType":864},{},[],"It’s important that organizations develop their capability to detect and respond to AitM attacks. Possible approaches include:",{"data":20862,"content":20863,"nodeType":941},{},[20864,20879,20914,20942],{"data":20865,"content":20866,"nodeType":945},{},[20867],{"data":20868,"content":20869,"nodeType":860},{},[20870,20875],{"data":20871,"marks":20872,"value":20874,"nodeType":864},{},[20873],{"type":899},"Move to FIDO MFA where possible",{"data":20876,"marks":20877,"value":20878,"nodeType":864},{},[]," (though, if no more susceptible backup methods are enabled, this does introduce operational challenges if passkeys are lost).",{"data":20880,"content":20881,"nodeType":945},{},[20882],{"data":20883,"content":20884,"nodeType":860},{},[20885,20890,20893,20898,20902,20911],{"data":20886,"marks":20887,"value":20889,"nodeType":864},{},[20888],{"type":899},"Detect and block known-bad malicious",{"data":20891,"marks":20892,"value":1171,"nodeType":864},{},[],{"data":20894,"marks":20895,"value":20897,"nodeType":864},{},[20896],{"type":899},"sites",{"data":20899,"marks":20900,"value":20901,"nodeType":864},{},[]," used in phishing campaigns. There are many threat intelligence feeds that can be ingested to achieve this. Usually, a domain has to be used in a malicious campaign before it can be catalogued – meaning there's typically a window of opportunity before the infrastructure is burned. That said, security researchers at Lab539 (yes, another shout out) have developed a way of identifying sites running AitM tooling – even before they are used for the first time. ",{"data":20903,"content":20905,"nodeType":883},{"uri":20904},"https://www.lab539.com/aitm",[20906],{"data":20907,"marks":20908,"value":20910,"nodeType":864},{},[20909],{"type":1455},"You can sign up to get access to their feed here.",{"data":20912,"marks":20913,"value":21,"nodeType":864},{},[],{"data":20915,"content":20916,"nodeType":945},{},[20917],{"data":20918,"content":20919,"nodeType":860},{},[20920,20925,20929,20938],{"data":20921,"marks":20922,"value":20924,"nodeType":864},{},[20923],{"type":899},"Introduce controls to detect phishing toolkits and cloned websites",{"data":20926,"marks":20927,"value":20928,"nodeType":864},{},[],". You can never rely on blocking malicious sites via TI feeds alone, so additional layers of defence are required. Push customers benefit from detection of AitM toolkits like Evilginx and EvilNoVNC in the browser (more to come on this soon!), while Thinkst Canary has developed ",{"data":20930,"content":20932,"nodeType":883},{"uri":20931},"https://blog.thinkst.com/2024/01/defending-against-the-attack-of-the-cloned-websites.html",[20933],{"data":20934,"marks":20935,"value":20937,"nodeType":864},{},[20936],{"type":1455},"methods of detecting whenever your website or login portal is cloned",{"data":20939,"marks":20940,"value":20941,"nodeType":864},{},[]," – very cool.  ",{"data":20943,"content":20944,"nodeType":945},{},[20945],{"data":20946,"content":20947,"nodeType":860},{},[20948,20953],{"data":20949,"marks":20950,"value":20952,"nodeType":864},{},[20951],{"type":899},"Update IR playbooks to to deal with SSO account compromise,",{"data":20954,"marks":20955,"value":20956,"nodeType":864},{},[]," factoring in lateral movement and persistence across cloud apps. This really necessitates that you understand what business apps your organization is using, how they are accessed (e.g. SSO or username and password) and what functionality exists that could be abused by an attacker. ",{"data":20958,"content":20959,"nodeType":860},{},[20960,20964,20971],{"data":20961,"marks":20962,"value":20963,"nodeType":864},{},[],"If you want to know more about how Push detects and blocks phishing tools in the browser, you can ",{"data":20965,"content":20966,"nodeType":883},{"uri":19629},[20967],{"data":20968,"marks":20969,"value":20970,"nodeType":864},{},[],"check out our article here",{"data":20972,"marks":20973,"value":1774,"nodeType":864},{},[],{"data":20975,"content":20976,"nodeType":1009},{},[20977],{"data":20978,"marks":20979,"value":19795,"nodeType":864},{},[],{"data":20981,"content":20982,"nodeType":860},{},[20983],{"data":20984,"marks":20985,"value":20986,"nodeType":864},{},[],"We’ve seen in this article how there are multiple ways to perform AitM phishing attacks and how they can be extremely effective at targeting users even when their accounts are protected by MFA.  ",{"data":20988,"content":20989,"nodeType":860},{},[20990],{"data":20991,"marks":20992,"value":20993,"nodeType":864},{},[],"Very few organizations are universally using phishing-resistant MFA, such as FIDO-based methods, and even those that do often have fallback options to handle situations where they cannot be used and/or tokens malfunction or are lost. Therefore, the vast majority of organizations are at risk of AitM phishing attacks.",{"data":20995,"content":20996,"nodeType":860},{},[20997],{"data":20998,"marks":20999,"value":21000,"nodeType":864},{},[],"To make things worse, there are lateral movement and persistence techniques that can be exploited to greatly extend the depth of compromise even for a single low-privilege user account. This makes response and containment a significant challenge.",{"data":21002,"content":21003,"nodeType":860},{},[21004,21008,21015,21018,21026,21030,21038,21042,21051],{"data":21005,"marks":21006,"value":21007,"nodeType":864},{},[],"Phishing attacks are clearly evolving. Phishing attacks are no longer limited to email-based delivery mechanisms or being hosted on custom domains. There are many options now for delivering phishing attacks using ",{"data":21009,"content":21010,"nodeType":883},{"uri":14193},[21011],{"data":21012,"marks":21013,"value":14199,"nodeType":864},{},[21014],{"type":1455},{"data":21016,"marks":21017,"value":13711,"nodeType":864},{},[],{"data":21019,"content":21020,"nodeType":883},{"uri":14205},[21021],{"data":21022,"marks":21023,"value":21025,"nodeType":864},{},[21024],{"type":1455},"Microsoft Teams",{"data":21027,"marks":21028,"value":21029,"nodeType":864},{},[],", using ",{"data":21031,"content":21032,"nodeType":883},{"uri":5876},[21033],{"data":21034,"marks":21035,"value":21037,"nodeType":864},{},[21036],{"type":1455},"SAMLjacking attacks",{"data":21039,"marks":21040,"value":21041,"nodeType":864},{},[]," to host the initial landing page on legitimate SaaS web domains or even using ",{"data":21043,"content":21045,"nodeType":883},{"uri":21044},"https://pushsecurity.com/blog/oktajacking/",[21046],{"data":21047,"marks":21048,"value":21050,"nodeType":864},{},[21049],{"type":1455},"Okta to keylog credentials",{"data":21052,"marks":21053,"value":21054,"nodeType":864},{},[]," on behalf of the attacker. ",{"data":21056,"content":21057,"nodeType":860},{},[21058],{"data":21059,"marks":21060,"value":21061,"nodeType":864},{},[],"Increasingly, we should expect to see AitM toolkits being used as a standard part of phishing campaigns, and featured in Initial Access Broker tooling – AitM will effectively supersede legacy phishing methods in line with MFA adoption. Rather, it already is. ",{"data":21063,"content":21064,"nodeType":1005},{},[],{"data":21066,"content":21067,"nodeType":860},{},[21068],{"data":21069,"marks":21070,"value":21071,"nodeType":864},{},[],"If you're interested in seeing some more AitM tools in action, you can watch our recent webinar on-demand via the link below. ",{"data":21073,"content":21076,"nodeType":996},{"target":21074},{"sys":21075},{"id":20326,"type":1001,"linkType":1002},[],{"data":21078,"content":21079,"nodeType":860},{},[21080],{"data":21081,"marks":21082,"value":21,"nodeType":864},{},[],"Phishing 2.0 – how phishing toolkits are evolving with AitM","Attackers are using Adversary in the Middle (AitM) phishing toolkits to bypass MFA. We look at what AitM is, how it works, and what you can do about it.","2024-05-23T00:00:00.000Z","phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm",{"items":21088},[21089,21091],{"sys":21090,"name":7555},{"id":7554},{"sys":21092,"name":342},{"id":12756},{"items":21094},[21095],{"fullName":21096,"firstName":21097,"jobTitle":21098,"profilePicture":21099},"Luke Jennings","Luke","Vice President, R&D",{"url":21100},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg",{"__typename":2059,"sys":21102,"content":21104,"title":21892,"synopsis":21893,"hashTags":59,"publishedDate":21894,"slug":21895,"tagsCollection":21896,"authorsCollection":21902},{"id":21103},"6VZQJzQ2FNetGNMEjiuXB2",{"json":21105},{"data":21106,"content":21107,"nodeType":856},{},[21108,21115,21122,21129,21136,21143,21150,21156,21174,21181,21226,21233,21240,21283,21303,21310,21317,21324,21344,21363,21370,21403,21410,21430,21437,21444,21474,21494,21501,21506,21513,21520,21527,21534,21541,21548,21555,21562,21569,21576,21583,21590,21606,21613,21683,21690,21697,21726,21741,21748,21755,21762,21795,21815,21822,21829,21836,21843,21862,21880,21886],{"data":21109,"content":21110,"nodeType":860},{},[21111],{"data":21112,"marks":21113,"value":21114,"nodeType":864},{},[],"Our goal at Push is simple — to stop identity attacks. Today, the vast majority of identity vulnerabilities exist in the context of SaaS apps. ",{"data":21116,"content":21117,"nodeType":860},{},[21118],{"data":21119,"marks":21120,"value":21121,"nodeType":864},{},[],"The reasons for this are clear: Security teams have reduced central oversight and control over SaaS apps than they are used to, these apps exist in large numbers per company, and the identities that are used to access these apps are... complicated, to say the least. Securing hundreds of apps, with thousands of associated identities, is therefore no mean feat. ",{"data":21123,"content":21124,"nodeType":860},{},[21125],{"data":21126,"marks":21127,"value":21128,"nodeType":864},{},[],"Securing SaaS use means building controls that are easy to use, easy to understand — and ultimately effective. Not just effective against the hand-wavy concept of “SaaS attacks,” but specific techniques — the most common techniques that are likely to cause real damage.",{"data":21130,"content":21131,"nodeType":860},{},[21132],{"data":21133,"marks":21134,"value":21135,"nodeType":864},{},[],"To talk about this, we need to have a shared understanding of what these techniques are. To get that conversation going, we’ve pulled together all the techniques we're aware of, and our research team has even added a bunch of new ones.",{"data":21137,"content":21138,"nodeType":1009},{},[21139],{"data":21140,"marks":21141,"value":21142,"nodeType":864},{},[],"The SaaS attack matrix",{"data":21144,"content":21145,"nodeType":860},{},[21146],{"data":21147,"marks":21148,"value":21149,"nodeType":864},{},[],"We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-specific. In fact, these techniques don’t touch endpoints (so they bypass EDR) or customer networks (so they bypass network detection) — so we’re calling them networkless attacks.",{"data":21151,"content":21155,"nodeType":996},{"target":21152},{"sys":21153},{"id":21154,"type":1001,"linkType":1002},"768Zv5gTVHyu5rbzJAzL4F",[],{"data":21157,"content":21158,"nodeType":860},{},[21159,21163,21171],{"data":21160,"marks":21161,"value":21162,"nodeType":864},{},[],"You can find more detailed descriptions of these techniques (and hopefully PRs for some we missed) on ",{"data":21164,"content":21165,"nodeType":883},{"uri":13662},[21166],{"data":21167,"marks":21168,"value":21170,"nodeType":864},{},[21169],{"type":1455},"GitHub",{"data":21172,"marks":21173,"value":2924,"nodeType":864},{},[],{"data":21175,"content":21176,"nodeType":860},{},[21177],{"data":21178,"marks":21179,"value":21180,"nodeType":864},{},[],"Since we’re not targeting endpoints, let’s talk about the new targets: The accounts/identities on SaaS apps. We found it was useful to think about these identities not as standalone isolated islands — but much more like a graph; less a single web-server on the internet and more like many Windows endpoints on an Active Directory. ",{"data":21182,"content":21183,"nodeType":860},{},[21184,21188,21197,21200,21209,21213,21222],{"data":21185,"marks":21186,"value":21187,"nodeType":864},{},[],"You can leverage this access to an identity on a trusted platform to target (so laterally move or escalate privilege to) other users or identities. For example, attacks like using access to SaaS apps to ",{"data":21189,"content":21191,"nodeType":883},{"uri":21190},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/in-app_phishing/description.md",[21192],{"data":21193,"marks":21194,"value":21196,"nodeType":864},{},[21195],{"type":1455},"phish other employees through comments",{"data":21198,"marks":21199,"value":902,"nodeType":864},{},[],{"data":21201,"content":21203,"nodeType":883},{"uri":21202},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_user_spoofing/description.md",[21204],{"data":21205,"marks":21206,"value":21208,"nodeType":864},{},[21207],{"type":1455},"spoofing users on IM platforms",{"data":21210,"marks":21211,"value":21212,"nodeType":864},{},[]," to social engineer them there — or perhaps ",{"data":21214,"content":21216,"nodeType":883},{"uri":21215},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_backdooring/description.md",[21217],{"data":21218,"marks":21219,"value":21221,"nodeType":864},{},[21220],{"type":1455},"backdooring links",{"data":21223,"marks":21224,"value":21225,"nodeType":864},{},[]," in documents.",{"data":21227,"content":21228,"nodeType":860},{},[21229],{"data":21230,"marks":21231,"value":21232,"nodeType":864},{},[],"In this case, unusually, it’s not the data in these hundreds of SaaS apps that create risk, and you need to consider low-risk (from a data perspective) apps as a vector to pivot to higher-risk apps in your estate.",{"data":21234,"content":21235,"nodeType":1312},{},[21236],{"data":21237,"marks":21238,"value":21239,"nodeType":864},{},[],"Initial access and poisoned tenants",{"data":21241,"content":21242,"nodeType":860},{},[21243,21247,21254,21257,21266,21270,21279],{"data":21244,"marks":21245,"value":21246,"nodeType":864},{},[],"Attacks like ",{"data":21248,"content":21249,"nodeType":883},{"uri":15835},[21250],{"data":21251,"marks":21252,"value":18453,"nodeType":864},{},[21253],{"type":1455},{"data":21255,"marks":21256,"value":902,"nodeType":864},{},[],{"data":21258,"content":21260,"nodeType":883},{"uri":21259},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/email_phishing/description.md",[21261],{"data":21262,"marks":21263,"value":21265,"nodeType":864},{},[21264],{"type":1455},"email phishing",{"data":21267,"marks":21268,"value":21269,"nodeType":864},{},[]," that get you initial access to SaaS apps are fairly well known — because they work and are widely used. We’re also starting to see tools and attacks that suggest that ",{"data":21271,"content":21273,"nodeType":883},{"uri":21272},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[21274],{"data":21275,"marks":21276,"value":21278,"nodeType":864},{},[21277],{"type":1455},"phishing employees through these IM apps",{"data":21280,"marks":21281,"value":21282,"nodeType":864},{},[]," is about to go mainstream.",{"data":21284,"content":21285,"nodeType":860},{},[21286,21290,21299],{"data":21287,"marks":21288,"value":21289,"nodeType":864},{},[],"Another interesting attack is a spin on the classic waterhole attack called a ",{"data":21291,"content":21293,"nodeType":883},{"uri":21292},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/poisoned_tenants/description.md",[21294],{"data":21295,"marks":21296,"value":21298,"nodeType":864},{},[21297],{"type":1455},"poisoned tenant",{"data":21300,"marks":21301,"value":21302,"nodeType":864},{},[],". Rather than attacking a customer tenant for a SaaS app, the attacker lures employees into joining an attacker-controlled tenant. ",{"data":21304,"content":21305,"nodeType":860},{},[21306],{"data":21307,"marks":21308,"value":21309,"nodeType":864},{},[],"SaaS apps allow anyone to name app tenants (a.k.a. spaces, teams, or instances) anything they like — including your company name. Attackers send invites to your employees from within the app with a customized message explaining why they should join this new tenant (or sign up to the app if they are not already a user). ",{"data":21311,"content":21312,"nodeType":860},{},[21313],{"data":21314,"marks":21315,"value":21316,"nodeType":864},{},[],"Attackers might even pay for premium licenses in the app to further entice employees to join. The attacker then waits for the employee to upload sensitive data or create integrations with other company apps containing crown jewels.",{"data":21318,"content":21319,"nodeType":1312},{},[21320],{"data":21321,"marks":21322,"value":21323,"nodeType":864},{},[],"Living-off-the-(SaaS)-land to persist and avoid detection",{"data":21325,"content":21326,"nodeType":860},{},[21327,21331,21340],{"data":21328,"marks":21329,"value":21330,"nodeType":864},{},[],"In the endpoint world, a favorite technique is the use of legit OS utilities or ",{"data":21332,"content":21334,"nodeType":883},{"uri":21333},"https://lolbas-project.github.io",[21335],{"data":21336,"marks":21337,"value":21339,"nodeType":864},{},[21338],{"type":1455},"LOLBaS",{"data":21341,"marks":21342,"value":21343,"nodeType":864},{},[]," (Living-Off-the-Land Binaries and Scripts), which are often signed Microsoft utilities. Perhaps the most well-known example is executing scripts through PowerShell rather than building custom malware. That isn’t as useful these days, but there was a time when PowerShell was routinely used to bypass AV, EDR, and even app allow-listing.",{"data":21345,"content":21346,"nodeType":860},{},[21347,21351,21359],{"data":21348,"marks":21349,"value":21350,"nodeType":864},{},[],"In that same living-off-the-land mindset, an attacker trying to maintain access to each SaaS app they compromise using custom OAuth integration apps might instead choose to use legit SaaS apps that specialize in workflow automation to create ",{"data":21352,"content":21353,"nodeType":883},{"uri":20685},[21354],{"data":21355,"marks":21356,"value":21358,"nodeType":864},{},[21357],{"type":1455},"shadow workflows",{"data":21360,"marks":21361,"value":21362,"nodeType":864},{},[],". Utilizing legit SaaS apps also means they can hide in plain sight from incident responders, instead of having to rely on unverified or unpublished integrations.",{"data":21364,"content":21365,"nodeType":860},{},[21366],{"data":21367,"marks":21368,"value":21369,"nodeType":864},{},[],"Perhaps the best example here is using a well-known automation app like Zapier, which claims to have more than 5,000 integrations. These integrations are often verified, approved, and connected to a trusted vendor (Zapier). An attacker might create workflows to:",{"data":21371,"content":21372,"nodeType":941},{},[21373,21383,21393],{"data":21374,"content":21375,"nodeType":945},{},[21376],{"data":21377,"content":21378,"nodeType":860},{},[21379],{"data":21380,"marks":21381,"value":21382,"nodeType":864},{},[],"Do daily data exfiltration from a victim’s data lake.",{"data":21384,"content":21385,"nodeType":945},{},[21386],{"data":21387,"content":21388,"nodeType":860},{},[21389],{"data":21390,"marks":21391,"value":21392,"nodeType":864},{},[],"Configure a webhook that adds malicious accounts to a Github repo on demand.",{"data":21394,"content":21395,"nodeType":945},{},[21396],{"data":21397,"content":21398,"nodeType":860},{},[21399],{"data":21400,"marks":21401,"value":21402,"nodeType":864},{},[],"Automatically find and replace bank account numbers in emails to the finance team.",{"data":21404,"content":21405,"nodeType":860},{},[21406],{"data":21407,"marks":21408,"value":21409,"nodeType":864},{},[],"All appear as legitimate Zapier integrations. But, before you put in alerts specifically for Zapier, know that it’s one of dozens of apps that support these kinds of offensive workflows.",{"data":21411,"content":21412,"nodeType":860},{},[21413,21417,21426],{"data":21414,"marks":21415,"value":21416,"nodeType":864},{},[],"A sneaky attacker might go further and use an ",{"data":21418,"content":21420,"nodeType":883},{"uri":21419},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md",[21421],{"data":21422,"marks":21423,"value":21425,"nodeType":864},{},[21424],{"type":1455},"evil twin integration",{"data":21427,"marks":21428,"value":21429,"nodeType":864},{},[]," to make another instance of an existing integration — making this backdoor almost impossible to discover.",{"data":21431,"content":21432,"nodeType":1312},{},[21433],{"data":21434,"marks":21435,"value":21436,"nodeType":864},{},[],"Features or vulnerabilities?",{"data":21438,"content":21439,"nodeType":860},{},[21440],{"data":21441,"marks":21442,"value":21443,"nodeType":864},{},[],"When looking for attack techniques, you’re typically going after features that have weaknesses you can abuse rather than bugs in a single app that will be patched. ",{"data":21445,"content":21446,"nodeType":860},{},[21447,21451,21460,21463,21470],{"data":21448,"marks":21449,"value":21450,"nodeType":864},{},[],"It’s pretty common for SaaS apps to skip email verification or allow multiple simultaneous authentication methods. Both of these are conscious design choices in the name of lowering the friction of account creation and reducing customer support. However, these features make techniques like ",{"data":21452,"content":21454,"nodeType":883},{"uri":21453},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/account_ambushing/description.md",[21455],{"data":21456,"marks":21457,"value":21459,"nodeType":864},{},[21458],{"type":1455},"account ambushing",{"data":21461,"marks":21462,"value":902,"nodeType":864},{},[],{"data":21464,"content":21465,"nodeType":883},{"uri":13750},[21466],{"data":21467,"marks":21468,"value":13757,"nodeType":864},{},[21469],{"type":1455},{"data":21471,"marks":21472,"value":21473,"nodeType":864},{},[]," possible. If these attacks become widespread, these might come to be seen more as bugs rather than a positive feature for users.",{"data":21475,"content":21476,"nodeType":860},{},[21477,21481,21490],{"data":21478,"marks":21479,"value":21480,"nodeType":864},{},[],"In other cases, the bugs are serious enough and hard enough to patch that they’re worth noting as a technique. The recently disclosed (and perfectly named) ",{"data":21482,"content":21484,"nodeType":883},{"uri":21483},"https://www.descope.com/blog/post/noauth",[21485],{"data":21486,"marks":21487,"value":21489,"nodeType":864},{},[21488],{"type":1455},"nOAuth",{"data":21491,"marks":21492,"value":21493,"nodeType":864},{},[]," bug fits this bill. ",{"data":21495,"content":21496,"nodeType":860},{},[21497],{"data":21498,"marks":21499,"value":21500,"nodeType":864},{},[],"The bug arises from a confusion between an email identity and email metadata field in Microsoft integrations and without a central fix from MS (the fix isn’t trivial), these bugs are likely to be discovered and re-occur on third-party OAuth apps for a while to come.",{"data":21502,"content":21505,"nodeType":996},{"target":21503},{"sys":21504},{"id":17804,"type":1001,"linkType":1002},[],{"data":21507,"content":21508,"nodeType":1009},{},[21509],{"data":21510,"marks":21511,"value":21512,"nodeType":864},{},[],"The SaaS market is driving these offensive techniques",{"data":21514,"content":21515,"nodeType":860},{},[21516],{"data":21517,"marks":21518,"value":21519,"nodeType":864},{},[],"SaaS apps are basically web apps that are run in the cloud and accessed from endpoints, so then WebApp, endpoint, and cloud security should cover all of SaaS, right? ",{"data":21521,"content":21522,"nodeType":860},{},[21523],{"data":21524,"marks":21525,"value":21526,"nodeType":864},{},[],"That was our assumption when we started, but what we found instead was that SaaS marketing practices are driving a lot of pretty interesting techniques that you don’t run into in standalone web apps.",{"data":21528,"content":21529,"nodeType":1312},{},[21530],{"data":21531,"marks":21532,"value":21533,"nodeType":864},{},[],"Modern SaaS is easy to adopt, easy to use, low friction, low cost, low overhead",{"data":21535,"content":21536,"nodeType":860},{},[21537],{"data":21538,"marks":21539,"value":21540,"nodeType":864},{},[],"Making apps easy to sign up for and low effort to support means you need to make some interesting choices when it comes to designing account creation and recovery flows. ",{"data":21542,"content":21543,"nodeType":860},{},[21544],{"data":21545,"marks":21546,"value":21547,"nodeType":864},{},[],"Many apps allow users to sign into apps using multiple methods, easily invite collaborators (internal and external) and avoid any additional friction during the signup process. ",{"data":21549,"content":21550,"nodeType":860},{},[21551],{"data":21552,"marks":21553,"value":21554,"nodeType":864},{},[],"For example, many apps avoid verifying new account email addresses. This is not laziness, these are conscious design choices — not driven by security clearly, but not accidents.",{"data":21556,"content":21557,"nodeType":1312},{},[21558],{"data":21559,"marks":21560,"value":21561,"nodeType":864},{},[],"Modern SaaS is highly integrated",{"data":21563,"content":21564,"nodeType":860},{},[21565],{"data":21566,"marks":21567,"value":21568,"nodeType":864},{},[],"Most SaaS apps are trying to build app marketplaces or perform well in other apps' marketplaces (often both), and it’s rare these days to find apps that don’t integrate with other apps. ",{"data":21570,"content":21571,"nodeType":860},{},[21572],{"data":21573,"marks":21574,"value":21575,"nodeType":864},{},[],"OAuth has become the de facto standard protocol for doing this, and most users have become quite used to approving OAuth2.0 consent flows. These integrations have opened up lots of incredibly useful doors for attackers to persist access and move laterally across SaaS apps that few incident response teams have run into yet. These tokens don’t expire when you reset passwords, aren’t protected by MFA, and actions they performed are rarely logged. ",{"data":21577,"content":21578,"nodeType":860},{},[21579],{"data":21580,"marks":21581,"value":21582,"nodeType":864},{},[],"These are not bugs or oversights but rather a consequence of how these APIs are intended to be used (by machines, not human adversaries).",{"data":21584,"content":21585,"nodeType":1009},{},[21586],{"data":21587,"marks":21588,"value":21589,"nodeType":864},{},[],"Problems with observing SaaS attacks ",{"data":21591,"content":21592,"nodeType":860},{},[21593,21597,21602],{"data":21594,"marks":21595,"value":21596,"nodeType":864},{},[],"This research begs one question above others: ",{"data":21598,"marks":21599,"value":21601,"nodeType":864},{},[21600],{"type":2246},"“Are we seeing these attacks in the wild?",{"data":21603,"marks":21604,"value":21605,"nodeType":864},{},[],"” ",{"data":21607,"content":21608,"nodeType":1312},{},[21609],{"data":21610,"marks":21611,"value":21612,"nodeType":864},{},[],"Yes, definitely",{"data":21614,"content":21615,"nodeType":860},{},[21616,21620,21629,21632,21641,21645,21654,21658,21666,21670,21679],{"data":21617,"marks":21618,"value":21619,"nodeType":864},{},[],"For some of the better-known techniques, like credential stuffing and email phishing, the answer is an easy yes. Stats from ",{"data":21621,"content":21623,"nodeType":883},{"uri":21622},"https://www.microsoft.com/en-us/security/blog/2023/05/04/how-microsoft-can-help-you-go-passwordless-this-world-password-day/",[21624],{"data":21625,"marks":21626,"value":21628,"nodeType":864},{},[21627],{"type":1455},"Microsoft (1,287 password attacks every second)",{"data":21630,"marks":21631,"value":902,"nodeType":864},{},[],{"data":21633,"content":21635,"nodeType":883},{"uri":21634},"https://auth0.com/blog/top-insights-from-our-2022-state-of-secure-identity-report/",[21636],{"data":21637,"marks":21638,"value":21640,"nodeType":864},{},[21639],{"type":1455},"Auth0 (a third of their traffic is credential stuffing)",{"data":21642,"marks":21643,"value":21644,"nodeType":864},{},[]," speaks volumes. Other sources like the ",{"data":21646,"content":21648,"nodeType":883},{"uri":21647},"https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2022/cyber-security-breaches-survey-2022",[21649],{"data":21650,"marks":21651,"value":21653,"nodeType":864},{},[21652],{"type":1455},"NCSC's Cyber Security Breaches Survey 2022",{"data":21655,"marks":21656,"value":21657,"nodeType":864},{},[]," and the ",{"data":21659,"content":21660,"nodeType":883},{"uri":17644},[21661],{"data":21662,"marks":21663,"value":21665,"nodeType":864},{},[21664],{"type":1455},"Verizon 2023 Data Breach Investigations Report",{"data":21667,"marks":21668,"value":21669,"nodeType":864},{},[]," suggest that phishing is also a major cause of SaaS breaches. Anecdotal reports from colleagues in the Incident Response field suggest that malicious mail forwarding rules are seen a lot, something which is supported by the ",{"data":21671,"content":21673,"nodeType":883},{"uri":21672},"https://expel.com/expel-quarterly-threat-report/",[21674],{"data":21675,"marks":21676,"value":21678,"nodeType":864},{},[21677],{"type":1455},"Expel Quarterly Threat Report for Q1 2023",{"data":21680,"marks":21681,"value":21682,"nodeType":864},{},[]," (see page 6).",{"data":21684,"content":21685,"nodeType":860},{},[21686],{"data":21687,"marks":21688,"value":21689,"nodeType":864},{},[],"The takeaway is that the current focus for defenders should be to ensure users have good phishing-resistant account security in place — make sure you have basics like strong unique passwords and MFA in place across your entire SaaS estate.",{"data":21691,"content":21692,"nodeType":1312},{},[21693],{"data":21694,"marks":21695,"value":21696,"nodeType":864},{},[],"For newer OAuth attacks, it’s a lot less clear …",{"data":21698,"content":21699,"nodeType":860},{},[21700,21704,21709,21713,21722],{"data":21701,"marks":21702,"value":21703,"nodeType":864},{},[],"Other techniques like consent phishing have been discussed in some breach disclosures like the ",{"data":21705,"marks":21706,"value":21708,"nodeType":864},{},[21707],{"type":1455},"2020 SANS breach",{"data":21710,"marks":21711,"value":21712,"nodeType":864},{},[],". These OAuth techniques also pop up in the news (for example, the ",{"data":21714,"content":21716,"nodeType":883},{"uri":21715},"https://www.bleepingcomputer.com/news/security/github-how-stolen-oauth-tokens-helped-breach-dozens-of-orgs/",[21717],{"data":21718,"marks":21719,"value":21721,"nodeType":864},{},[21720],{"type":1455},"2022 Github/Heroku/Travis-CI breach",{"data":21723,"marks":21724,"value":21725,"nodeType":864},{},[]," where GitHub accounts were breached using stolen Heroku and Travis-CI OAuth tokens). ",{"data":21727,"content":21728,"nodeType":860},{},[21729,21733,21738],{"data":21730,"marks":21731,"value":21732,"nodeType":864},{},[],"That said, none of these techniques come up as frequently as their usefulness would suggest. This means one of two things: ",{"data":21734,"marks":21735,"value":21737,"nodeType":864},{},[21736],{"type":2246},"Either attackers aren’t yet using them widely, or they are and we aren’t detecting them",{"data":21739,"marks":21740,"value":2924,"nodeType":864},{},[],{"data":21742,"content":21743,"nodeType":860},{},[21744],{"data":21745,"marks":21746,"value":21747,"nodeType":864},{},[],"There is certainly a case to be made that attackers simply don’t need these newer techniques yet. Many organizations don’t have a way of discovering SaaS use in their organization yet, never mind breached accounts, so new persistence techniques might be a bit more than necessary at the moment.",{"data":21749,"content":21750,"nodeType":1312},{},[21751],{"data":21752,"marks":21753,"value":21754,"nodeType":864},{},[],"But would we know if it was happening?",{"data":21756,"content":21757,"nodeType":860},{},[21758],{"data":21759,"marks":21760,"value":21761,"nodeType":864},{},[],"On the other hand, there is certainly the possibility that these attacks are increasingly used, but are simply not being discovered. A strong argument in favor of this view is the difficulty in investigating these attacks. Very few SaaS apps provide enough logging capability to discover these attacks as a customer. This is true even for the biggest, most mature apps like Office 365 and Google Workspace unless you are on top license tiers. This is doubly true for attacks that use OAuth, with many apps providing no insight or details into actions made using OAuth-authenticated APIs. ",{"data":21763,"content":21764,"nodeType":860},{},[21765,21769,21778,21782,21791],{"data":21766,"marks":21767,"value":21768,"nodeType":864},{},[],"This suggests only the SaaS providers for these apps are really in a position to discover and investigate them. This does ring true when you consider that ",{"data":21770,"content":21772,"nodeType":883},{"uri":21771},"https://blog.heroku.com/april-2022-incident-review",[21773],{"data":21774,"marks":21775,"value":21777,"nodeType":864},{},[21776],{"type":1455},"Heroku",{"data":21779,"marks":21780,"value":21781,"nodeType":864},{},[]," relied heavily on Github during the investigation (and in one case even the detection of) their 2022 breaches, and the same seems true for a similar breach affecting ",{"data":21783,"content":21785,"nodeType":883},{"uri":21784},"https://circleci.com/blog/jan-4-2023-incident-report/",[21786],{"data":21787,"marks":21788,"value":21790,"nodeType":864},{},[21789],{"type":1455},"CircleCI",{"data":21792,"marks":21793,"value":21794,"nodeType":864},{},[]," later that year. Github and CircleCI’s customers prompted the investigation after seeing strange behavior, but Github had access to the logs to investigate. It’s difficult to imagine that most or even many SaaS vendors have the resources or inclination to run these investigations effectively as GitHub appears to have.",{"data":21796,"content":21797,"nodeType":860},{},[21798,21802,21812],{"data":21799,"marks":21800,"value":21801,"nodeType":864},{},[],"So, are these attacks happening in the real world? My best guess is it’s a little bit of column A and a little bit of column B — there are likely not so many of these attacks happening yet, and when they do, I suspect the vast majority go undetected. ",{"data":21803,"content":21805,"nodeType":883},{"uri":21804},"https://www.youtube.com/watch?v=j95kNwZw8YY",[21806],{"data":21807,"marks":21808,"value":21811,"nodeType":864},{},[21809,21810],{"type":1455},{"type":2246},"But that’s just like my opinion, man.",{"data":21813,"marks":21814,"value":21,"nodeType":864},{},[],{"data":21816,"content":21817,"nodeType":860},{},[21818],{"data":21819,"marks":21820,"value":21821,"nodeType":864},{},[],"This is part of the reason we think enabling red teamers to try these techniques in anger is useful — this is the time-proven way to understand these risks.",{"data":21823,"content":21824,"nodeType":1009},{},[21825],{"data":21826,"marks":21827,"value":21828,"nodeType":864},{},[],"What’s next?",{"data":21830,"content":21831,"nodeType":860},{},[21832],{"data":21833,"marks":21834,"value":21835,"nodeType":864},{},[],"We’ve barely scratched the surface, but perhaps there is enough here to get the discussion going. From past experience, discussion may not be enough, and it’s likely that live offensive work like penetration tests or more likely red team exercises will be required to make the risks of using these techniques real for the wider security community. ",{"data":21837,"content":21838,"nodeType":860},{},[21839],{"data":21840,"marks":21841,"value":21842,"nodeType":864},{},[],"After all, seeing is believing. We think some more practical examples and tools to help red  teamers use these techniques on engagements will help drive awareness forward, so we’ll be looking to build out this content.",{"data":21844,"content":21845,"nodeType":860},{},[21846,21850,21859],{"data":21847,"marks":21848,"value":21849,"nodeType":864},{},[],"We’ve started with pure networkless attacks that don’t touch customer networks or endpoints, but there are many useful techniques to connect the old endpoint world to the SaaS world. Consider stealing OAuth tokens from a thick client on an endpoint, or using a ",{"data":21851,"content":21853,"nodeType":883},{"uri":21852},"https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/",[21854],{"data":21855,"marks":21856,"value":21858,"nodeType":864},{},[21857],{"type":1455},"backdoored GitHub repo to get code execution on endpoints",{"data":21860,"marks":21861,"value":2924,"nodeType":864},{},[],{"data":21863,"content":21864,"nodeType":860},{},[21865,21869,21876],{"data":21866,"marks":21867,"value":21868,"nodeType":864},{},[],"Help us all better understand how widespread these attacks are by sharing some war stories. We’d love some comments, discussions, or PRs on ",{"data":21870,"content":21871,"nodeType":883},{"uri":13662},[21872],{"data":21873,"marks":21874,"value":21170,"nodeType":864},{},[21875],{"type":1455},{"data":21877,"marks":21878,"value":21879,"nodeType":864},{},[],"!",{"data":21881,"content":21885,"nodeType":996},{"target":21882},{"sys":21883},{"id":21884,"type":1001,"linkType":1002},"2y0INxqAi594O7rCAVKhTI",[],{"data":21887,"content":21888,"nodeType":860},{},[21889],{"data":21890,"marks":21891,"value":21,"nodeType":864},{},[],"Let’s talk about SaaS attack techniques","Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.","2023-07-27T00:00:00.000Z","saas-attack-techniques",{"items":21897},[21898,21900],{"sys":21899,"name":7555},{"id":7554},{"sys":21901,"name":342},{"id":12756},{"items":21903},[21904],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":21908},"Jacques Louw","Jacques","Co-founder / CRO",{"url":21909},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg","the-web-proxy-is-dead-long-live-the-browser-extension","blog/the-web-proxy-is-dead-long-live-the-browser-extension",{"json":21913},{"data":21914,"content":21915,"nodeType":856},{},[21916],{"data":21917,"content":21918,"nodeType":860},{},[21919],{"data":21920,"marks":21921,"value":21922,"nodeType":864},{},[],"Right now the majority of detections for identity attacks rely on web proxy telemetry. Here’s why the browser can be a better alternative.",{"id":21924,"publishedAt":21925},"7yCGcUryKQGOHYHRtipn6W","2026-08-12T11:55:20.455Z",{"items":21927},[21928,21930],{"sys":21929,"name":342},{"id":12756},{"sys":21931,"name":7555},{"id":7554},{"items":21933},[21934,21936,21938,21940,21942,21944],{"sys":21935,"name":297,"slug":298,"tier":31},{"id":294},{"sys":21937,"name":342,"slug":343,"tier":31},{"id":339},{"sys":21939,"name":279,"slug":280,"tier":31},{"id":276},{"sys":21941,"name":624,"slug":625,"tier":45},{"id":621},{"sys":21943,"name":306,"slug":307,"tier":45},{"id":303},{"sys":21945,"name":404,"slug":405,"tier":45},{"id":401},"uN3iX_Im-BmML48Vy7SjdFvwjG_lkn3C60qo7BzREZ0",{"id":21948,"title":21949,"authorsCollection":21950,"content":21956,"extension":228,"faqItemsCollection":23643,"faqTitle":59,"featured":6,"hashTags":59,"meta":23645,"metaTitle":23646,"ogImage":23647,"postType":23649,"publishedDate":23650,"relatedBlogPostsCollection":23651,"slug":25119,"stem":25120,"subtitle":59,"summary":25121,"synopsis":25132,"sys":25133,"tagsCollection":25136,"topicsCollection":25142,"__hash__":25164},"blog/blog/protect-your-data-across-all-your-apps-even-the-ones-employees-use-without.json","The no-jargon guide to solving shadow SaaS ",{"items":21951},[21952],{"fullName":21905,"firstName":21906,"jobTitle":21907,"socialLinks":21953,"profilePicture":21955},[21954],"https://www.linkedin.com/in/jacques-louw-o-62608594/",{"url":21909},{"json":21957,"links":23516},{"data":21958,"content":21959,"nodeType":856},{},[21960,21967,21989,21996,22003,22014,22021,22028,22071,22078,22085,22091,22098,22105,22112,22118,22141,22148,22155,22162,22169,22176,22285,22292,22299,22306,22319,22326,22333,22340,22347,22353,22360,22367,22374,22380,22388,22395,22402,22409,22416,22423,22430,22436,22443,22450,22457,22464,22470,22477,22520,22526,22533,22556,22563,22586,22593,22600,22607,22614,22621,22731,22737,22744,22753,22760,22767,22774,22781,22788,22795,22801,22808,22815,22834,22841,22848,22855,22861,22868,22875,22882,22915,22922,22929,22936,22943,22950,22957,22964,22971,22978,22985,23028,23035,23041,23063,23070,23077,23084,23091,23098,23105,23112,23119,23126,23133,23140,23147,23154,23196,23202,23209,23225,23241,23248,23255,23262,23269,23276,23283,23290,23297,23304,23310,23317,23324,23330,23337,23344,23351,23358,23367,23374,23381,23444,23450,23457,23464,23470,23477,23484,23491,23497,23509],{"data":21961,"content":21962,"nodeType":1009},{},[21963],{"data":21964,"marks":21965,"value":21966,"nodeType":864},{},[],"Introduction",{"data":21968,"content":21969,"nodeType":860},{},[21970,21974,21985],{"data":21971,"marks":21972,"value":21973,"nodeType":864},{},[],"Here’s hoping you’ve read my previous blog: ",{"data":21975,"content":21979,"nodeType":17737},{"target":21976},{"sys":21977},{"id":21978,"type":1001,"linkType":1002},"3ic4Ok5kwIE8UuUClhPFPn",[21980],{"data":21981,"marks":21982,"value":21984,"nodeType":864},{},[21983],{"type":2246},"SaaS sprawl isn't a problem - if you completely change your approach",{"data":21986,"marks":21987,"value":21988,"nodeType":864},{},[],"If you haven’t, the key takeaway of that piece is that SaaS vendors have changed how software is adopted into a business. Now, the majority of SaaS vendors build their products on a product-led growth model - which simply means they want users (your employees) to self-adopt their apps, start using them (and integrating with your data to do so), and become a useful tool for the employee. ",{"data":21990,"content":21991,"nodeType":860},{},[21992],{"data":21993,"marks":21994,"value":21995,"nodeType":864},{},[],"Vendors want to bypass the security and IT software-onboarding processes we’d all gotten used to in the past. They know if they prove their tool is valuable with the user from the start, it’s much easier and quicker for them to gain traction and customers than it was waiting for security and IT teams to audit (and potentially refuse) their software.",{"data":21997,"content":21998,"nodeType":860},{},[21999],{"data":22000,"marks":22001,"value":22002,"nodeType":864},{},[],"This self-adoption has turned the product-adoption process on its head - leaving security and IT teams blind to which apps sensitive company data is flowing into. ",{"data":22004,"content":22005,"nodeType":860},{},[22006,22011],{"data":22007,"marks":22008,"value":22010,"nodeType":864},{},[22009],{"type":899},"How do you make sure your data stays secure in this new software-adoption flow?",{"data":22012,"marks":22013,"value":6408,"nodeType":864},{},[],{"data":22015,"content":22016,"nodeType":860},{},[22017],{"data":22018,"marks":22019,"value":22020,"nodeType":864},{},[],"In this book, we’ll offer some practical guidance on how to manage supply chain risk without slowing down the business.",{"data":22022,"content":22023,"nodeType":860},{},[22024],{"data":22025,"marks":22026,"value":22027,"nodeType":864},{},[],"We’ll cover how to:",{"data":22029,"content":22030,"nodeType":941},{},[22031,22041,22051,22061],{"data":22032,"content":22033,"nodeType":945},{},[22034],{"data":22035,"content":22036,"nodeType":860},{},[22037],{"data":22038,"marks":22039,"value":22040,"nodeType":864},{},[],"Split SaaS risk into supply chain risk and account compromise risk so you can tackle them in parallel.",{"data":22042,"content":22043,"nodeType":945},{},[22044],{"data":22045,"content":22046,"nodeType":860},{},[22047],{"data":22048,"marks":22049,"value":22050,"nodeType":864},{},[],"Tap into the SaaS self adoption process in real time so you can manage supply chain risk without being a blocker. ",{"data":22052,"content":22053,"nodeType":945},{},[22054],{"data":22055,"content":22056,"nodeType":860},{},[22057],{"data":22058,"marks":22059,"value":22060,"nodeType":864},{},[],"How to prioritize account security controls and prevent the most common SaaS attacks.",{"data":22062,"content":22063,"nodeType":945},{},[22064],{"data":22065,"content":22066,"nodeType":860},{},[22067],{"data":22068,"marks":22069,"value":22070,"nodeType":864},{},[],"Better choose a SaaS security product by looking at the data these tools are built on.",{"data":22072,"content":22073,"nodeType":1009},{},[22074],{"data":22075,"marks":22076,"value":22077,"nodeType":864},{},[],"\nThe two halves of SaaS Security",{"data":22079,"content":22080,"nodeType":860},{},[22081],{"data":22082,"marks":22083,"value":22084,"nodeType":864},{},[],"It’s useful to consider the shared-responsibility model to understand the two main parts of SaaS security. Consider the following diagram that shows the customer’s responsibility in various as-a-Service models:",{"data":22086,"content":22090,"nodeType":996},{"target":22087},{"sys":22088},{"id":22089,"type":1001,"linkType":1002},"17rMTpxgCAU5ropjkGIIjK",[],{"data":22092,"content":22093,"nodeType":860},{},[22094],{"data":22095,"marks":22096,"value":22097,"nodeType":864},{},[],"In this SaaS model, we’re delegating a lot of responsibility for security to the vendor. That’s great because it takes the load off of us - the customer - and the vendor is better placed to secure their software. However, this requires far greater trust in the vendor.",{"data":22099,"content":22100,"nodeType":860},{},[22101],{"data":22102,"marks":22103,"value":22104,"nodeType":864},{},[],"While we’re offloading a lot to the SaaS vendor, we aren’t offloading everything. You still need to take care of your responsibilities, limited as they are!",{"data":22106,"content":22107,"nodeType":860},{},[22108],{"data":22109,"marks":22110,"value":22111,"nodeType":864},{},[],"This gets us to the two halves of SaaS security:",{"data":22113,"content":22117,"nodeType":996},{"target":22114},{"sys":22115},{"id":22116,"type":1001,"linkType":1002},"ToDXz2MBbEygwtJjiIKRX",[],{"data":22119,"content":22120,"nodeType":941},{},[22121,22131],{"data":22122,"content":22123,"nodeType":945},{},[22124],{"data":22125,"content":22126,"nodeType":860},{},[22127],{"data":22128,"marks":22129,"value":22130,"nodeType":864},{},[],"Supply chain risk - can you trust the product, the vendor, and the vendor’s sub processors to secure your data and the access you grant them to your systems?",{"data":22132,"content":22133,"nodeType":945},{},[22134],{"data":22135,"content":22136,"nodeType":860},{},[22137],{"data":22138,"marks":22139,"value":22140,"nodeType":864},{},[],"Customer responsibility - how can you make sure you’re using the product securely? You’ll need to focus here specifically on account security and application configuration.",{"data":22142,"content":22143,"nodeType":860},{},[22144],{"data":22145,"marks":22146,"value":22147,"nodeType":864},{},[],"Let’s look at each of these in turn.",{"data":22149,"content":22150,"nodeType":1009},{},[22151],{"data":22152,"marks":22153,"value":22154,"nodeType":864},{},[],"Manage supply-chain risk",{"data":22156,"content":22157,"nodeType":860},{},[22158],{"data":22159,"marks":22160,"value":22161,"nodeType":864},{},[],"Security due diligence or app risk assessments are typically how you answer the question “should we use this app?” These are standard processes for most organizations as part of a software procurement process.",{"data":22163,"content":22164,"nodeType":860},{},[22165],{"data":22166,"marks":22167,"value":22168,"nodeType":864},{},[],"However, security no longer controls the cadence of software adoption - employees are self-adopting the tools they want without oversight - so we must work to find serious risks as soon as possible once the self-adoption process begins (normally by the first employee creating an account on the app).",{"data":22170,"content":22171,"nodeType":860},{},[22172],{"data":22173,"marks":22174,"value":22175,"nodeType":864},{},[],"The security relevant areas of this risk assessment can typically be broken into:",{"data":22177,"content":22178,"nodeType":941},{},[22179,22212,22275],{"data":22180,"content":22181,"nodeType":945},{},[22182,22189],{"data":22183,"content":22184,"nodeType":860},{},[22185],{"data":22186,"marks":22187,"value":22188,"nodeType":864},{},[],"Product risk ",{"data":22190,"content":22191,"nodeType":941},{},[22192,22202],{"data":22193,"content":22194,"nodeType":945},{},[22195],{"data":22196,"content":22197,"nodeType":860},{},[22198],{"data":22199,"marks":22200,"value":22201,"nodeType":864},{},[],"Does the product have the necessary security features (MFA, SSO, etc.) to protect our data, and ",{"data":22203,"content":22204,"nodeType":945},{},[22205],{"data":22206,"content":22207,"nodeType":860},{},[22208],{"data":22209,"marks":22210,"value":22211,"nodeType":864},{},[],"Has the product security been technically verified (e.g. through a third party penetration test)?",{"data":22213,"content":22214,"nodeType":945},{},[22215,22222],{"data":22216,"content":22217,"nodeType":860},{},[22218],{"data":22219,"marks":22220,"value":22221,"nodeType":864},{},[],"Vendor risk ",{"data":22223,"content":22224,"nodeType":941},{},[22225,22235,22245,22255,22265],{"data":22226,"content":22227,"nodeType":945},{},[22228],{"data":22229,"content":22230,"nodeType":860},{},[22231],{"data":22232,"marks":22233,"value":22234,"nodeType":864},{},[],"Does the vendor have the resources to secure the product? ",{"data":22236,"content":22237,"nodeType":945},{},[22238],{"data":22239,"content":22240,"nodeType":860},{},[22241],{"data":22242,"marks":22243,"value":22244,"nodeType":864},{},[],"Have they invested in a security team and implemented appropriate security processes?",{"data":22246,"content":22247,"nodeType":945},{},[22248],{"data":22249,"content":22250,"nodeType":860},{},[22251],{"data":22252,"marks":22253,"value":22254,"nodeType":864},{},[],"Have those processes been independently audited (e.g. SOC2)? ",{"data":22256,"content":22257,"nodeType":945},{},[22258],{"data":22259,"content":22260,"nodeType":860},{},[22261],{"data":22262,"marks":22263,"value":22264,"nodeType":864},{},[],"Does the vendor operate in a high risk region?",{"data":22266,"content":22267,"nodeType":945},{},[22268],{"data":22269,"content":22270,"nodeType":860},{},[22271],{"data":22272,"marks":22273,"value":22274,"nodeType":864},{},[],"Does the vendor have a history of repeated security incidents?",{"data":22276,"content":22277,"nodeType":945},{},[22278],{"data":22279,"content":22280,"nodeType":860},{},[22281],{"data":22282,"marks":22283,"value":22284,"nodeType":864},{},[],"Vendor sub processors - the majority of SaaS applications are build on other *-as-a-Service platforms. These vendors are also part of your supply chain. Just because you don’t directly use a tool or app doesn’t mean you’re not affected when they’re popped. Realistically, you’re probably not going to be able to go very deep here, but when you’re wondering whether you’re affected by a breach in the news, you may want to know whether your vendors are using the affected SaaS app. ",{"data":22286,"content":22287,"nodeType":860},{},[22288],{"data":22289,"marks":22290,"value":22291,"nodeType":864},{},[],"Ultimately, how much you care about any of the above comes down to the risk of the data in the application or the level of access you grant this application into the rest of your infrastructure (often through integrations with other SaaS apps). ",{"data":22293,"content":22294,"nodeType":860},{},[22295],{"data":22296,"marks":22297,"value":22298,"nodeType":864},{},[],"Therefore, a useful first step to knowing where to prioritize your time is to understand the sensitivity of the data and access granted to the app (or that will likely be granted by employees in future to make the app work as expected).",{"data":22300,"content":22301,"nodeType":860},{},[22302],{"data":22303,"marks":22304,"value":22305,"nodeType":864},{},[],"For self-adopted SaaS apps, aspects that are typically very important for software procurement like legal agreements (terms and conditions, master service agreements etc.), spend (through licensing cost etc.), and uptime and availability (SLAs etc.) are typically dealt with after the app has been adopted. Often, this comes up once employees need to upgrade to a paid account or higher license tier, or once it makes financial sense to commit to longer term agreements. ",{"data":22307,"content":22308,"nodeType":860},{},[22309,22313],{"data":22310,"marks":22311,"value":22312,"nodeType":864},{},[],"For that reason, ",{"data":22314,"marks":22315,"value":22318,"nodeType":864},{},[22316,22317],{"type":899},{"type":2246},"I recommend you keep the security risk assessment focused on the direct security aspects initially so you reduce the work required to ask “is there a security reason to stop our employees from using this app right now?”",{"data":22320,"content":22321,"nodeType":860},{},[22322],{"data":22323,"marks":22324,"value":22325,"nodeType":864},{},[],"All of the above is relatively straightforward advice, but there are some very practical non-obvious lessons learned from others who've walked this path already that are worth highlighting, so let’s jump into those.",{"data":22327,"content":22328,"nodeType":1312},{},[22329],{"data":22330,"marks":22331,"value":22332,"nodeType":864},{},[],"Focus on the new stuff first",{"data":22334,"content":22335,"nodeType":860},{},[22336],{"data":22337,"marks":22338,"value":22339,"nodeType":864},{},[],"It’s both technically, and politically, very difficult to migrate users away from apps, especially when users have invested significant time into setting up an app and love how it works. It’s hard to spend the goodwill you’ve built up on something like this unless there really is a truly unacceptable risk or compliance issue.",{"data":22341,"content":22342,"nodeType":860},{},[22343],{"data":22344,"marks":22345,"value":22346,"nodeType":864},{},[],"There is an exception to this - if you get in before employees have sunk too much time and effort into an app they are far more open to input and steering. This is why we recommend that you focus your risk assessment efforts on new apps and integrations, rather than spending the majority of your time working through the backlog of already-adopted work apps.",{"data":22348,"content":22352,"nodeType":996},{"target":22349},{"sys":22350},{"id":22351,"type":1001,"linkType":1002},"49tL50Pga47pnhp1WMHfPY",[],{"data":22354,"content":22355,"nodeType":860},{},[22356],{"data":22357,"marks":22358,"value":22359,"nodeType":864},{},[],"If you focus on apps that are still in the testing phases, it's much easier to steer the course towards lower-risk alternatives or pump the brakes when there really is significant risk to the business.",{"data":22361,"content":22362,"nodeType":1009},{},[22363],{"data":22364,"marks":22365,"value":22366,"nodeType":864},{},[],"Buy yourself time",{"data":22368,"content":22369,"nodeType":860},{},[22370],{"data":22371,"marks":22372,"value":22373,"nodeType":864},{},[],"Remember, even the newest apps will only be new for a brief time. Once employees have invested significant time into an app (learning how it works, putting data into it, etc) they will be resistant to considering alternatives and will push to accept risks rather and make exceptions to policies rather than moving to an alternative app. This is just natural, but it does mean that there is a clock running for you and your team as soon as an employee creates an account on a new SaaS app.",{"data":22375,"content":22379,"nodeType":996},{"target":22376},{"sys":22377},{"id":22378,"type":1001,"linkType":1002},"6HzSQ8wPVn9RfDSFWGaCh8",[],{"data":22381,"content":22382,"nodeType":860},{},[22383],{"data":22384,"marks":22385,"value":22387,"nodeType":864},{},[22386],{"type":899},"Your goal is to give your security team as much time to assess the app before the employee decides for sure they want to use it for work. ",{"data":22389,"content":22390,"nodeType":860},{},[22391],{"data":22392,"marks":22393,"value":22394,"nodeType":864},{},[],"It’s far less useful if you discover an app once the team is talking to finance about upgrading to a paid subscription. At that point, so much time and effort has been invested that it’s very difficult to motivate employees/teams to move to a lower-risk app. In this scenario, you’ll be stuck in a “let’s do as much as we can to secure this” mode, which isn’t ideal.",{"data":22396,"content":22397,"nodeType":860},{},[22398],{"data":22399,"marks":22400,"value":22401,"nodeType":864},{},[],"The way to give the security team as much time as possible is to reduce the delta between an employee signing up for an account and the IT and security teams finding out about it. You need a way to find out about new apps being adopted in real-time or within hours, rather than days or weeks. The tools to do this exist, but more on how you should choose the right tool in the “importance of choosing the right data source” section.",{"data":22403,"content":22404,"nodeType":1312},{},[22405],{"data":22406,"marks":22407,"value":22408,"nodeType":864},{},[],"You need accurate data to take action",{"data":22410,"content":22411,"nodeType":860},{},[22412],{"data":22413,"marks":22414,"value":22415,"nodeType":864},{},[],"To discover SaaS apps and simply inventory which apps are being used for reporting purposes, you won’t need perfect accuracy and you’ll be able to live with some false positives.",{"data":22417,"content":22418,"nodeType":860},{},[22419],{"data":22420,"marks":22421,"value":22422,"nodeType":864},{},[],"Most security teams start out just by getting visibility of what SaaS is being used across their business. Then you know what you’re dealing with. The downside is that you’ll want to use this data to spin off a risk assessment process. If you are kicking off risk assessments based on false positives, that’s just pure wasted effort.",{"data":22424,"content":22425,"nodeType":860},{},[22426],{"data":22427,"marks":22428,"value":22429,"nodeType":864},{},[],"You will likely also want to get in touch with the employee that adopted the app, for example to understand their intended use-case and the data that might be going into the app. Employees will also notice quickly if the security team can’t tell the difference between accessing an app website or using an app and get annoyed with the interruptions from your team.",{"data":22431,"content":22435,"nodeType":996},{"target":22432},{"sys":22433},{"id":22434,"type":1001,"linkType":1002},"5winuguRBMaNKNnkDakMWv",[],{"data":22437,"content":22438,"nodeType":860},{},[22439],{"data":22440,"marks":22441,"value":22442,"nodeType":864},{},[],"Many tools will use things like scanning employee email inboxes or network-level data to “discover employee SaaS use,” but this leads to a frustrating rate of false positives for your team. If the security team needs to first confirm if a data point is a false-positive through some unspecified process, then that seriously increases the work needed to take action. ",{"data":22444,"content":22445,"nodeType":860},{},[22446],{"data":22447,"marks":22448,"value":22449,"nodeType":864},{},[],"At the risk of sounding like a broken record, accurate data is the thing that turns this problem from something that’s impossible to something which is manageable, even at scale.",{"data":22451,"content":22452,"nodeType":1009},{},[22453],{"data":22454,"marks":22455,"value":22456,"nodeType":864},{},[],"Customer responsibility for self-adopted SaaS",{"data":22458,"content":22459,"nodeType":860},{},[22460],{"data":22461,"marks":22462,"value":22463,"nodeType":864},{},[],"As a reminder, I’m referring in this section to your responsibility as a customer (highlighted in purple) in terms of NCSC’s shared-responsibility model shown below:",{"data":22465,"content":22469,"nodeType":996},{"target":22466},{"sys":22467},{"id":22468,"type":1001,"linkType":1002},"4jeDpoYQzPmg5TFApeopSA",[],{"data":22471,"content":22472,"nodeType":860},{},[22473],{"data":22474,"marks":22475,"value":22476,"nodeType":864},{},[],"Let’s start with the bulk of the work, which for self-adopted SaaS is account security. This includes all the usual suspects like ensuring that, you’re:",{"data":22478,"content":22479,"nodeType":941},{},[22480,22490,22500,22510],{"data":22481,"content":22482,"nodeType":945},{},[22483],{"data":22484,"content":22485,"nodeType":860},{},[22486],{"data":22487,"marks":22488,"value":22489,"nodeType":864},{},[],"Enabling MFA for all accounts",{"data":22491,"content":22492,"nodeType":945},{},[22493],{"data":22494,"content":22495,"nodeType":860},{},[22496],{"data":22497,"marks":22498,"value":22499,"nodeType":864},{},[],"Encouraging employees to use strong passwords (ideally through a password manager)",{"data":22501,"content":22502,"nodeType":945},{},[22503],{"data":22504,"content":22505,"nodeType":860},{},[22506],{"data":22507,"marks":22508,"value":22509,"nodeType":864},{},[],"Using SSO, where possible and practical",{"data":22511,"content":22512,"nodeType":945},{},[22513],{"data":22514,"content":22515,"nodeType":860},{},[22516],{"data":22517,"marks":22518,"value":22519,"nodeType":864},{},[],"Reviewing access delegated to third-parties (through e.g. OAuth integrations) ",{"data":22521,"content":22525,"nodeType":996},{"target":22522},{"sys":22523},{"id":22524,"type":1001,"linkType":1002},"2T7DtBRBBITb4Wy8unQHZV",[],{"data":22527,"content":22528,"nodeType":860},{},[22529],{"data":22530,"marks":22531,"value":22532,"nodeType":864},{},[],"In contrast to SaaS apps like Office 365 or Salesforce that are extraordinarily configurable and often have teams managing and securing them, there’s some mixed news when it comes to self-adopted SaaS apps. The bad news is that many of these apps provide virtually no security features or configurable settings that can be hardened. The good news is that this means there is now very little work to do here. When they exist, configuration settings are typically around:",{"data":22534,"content":22535,"nodeType":941},{},[22536,22546],{"data":22537,"content":22538,"nodeType":945},{},[22539],{"data":22540,"content":22541,"nodeType":860},{},[22542],{"data":22543,"marks":22544,"value":22545,"nodeType":864},{},[],"Forcing the above controls for all users (e.g. force MFA)",{"data":22547,"content":22548,"nodeType":945},{},[22549],{"data":22550,"content":22551,"nodeType":860},{},[22552],{"data":22553,"marks":22554,"value":22555,"nodeType":864},{},[],"Configuring external or public-sharing settings",{"data":22557,"content":22558,"nodeType":860},{},[22559],{"data":22560,"marks":22561,"value":22562,"nodeType":864},{},[],"Finally, though not mentioned explicitly in the NCSC’s version of the shared-responsibility model, it’s worth remembering that things go wrong even if all the above is in place. That’s where security monitoring comes in. In practice, though, few self-adopted SaaS apps offer audit trails or similar options that can be integrated with SIEM infrastructure. However, you can monitor things like:",{"data":22564,"content":22565,"nodeType":941},{},[22566,22576],{"data":22567,"content":22568,"nodeType":945},{},[22569],{"data":22570,"content":22571,"nodeType":860},{},[22572],{"data":22573,"marks":22574,"value":22575,"nodeType":864},{},[],"Breached passwords in passwords dumps (think haveibeenpwned.com)",{"data":22577,"content":22578,"nodeType":945},{},[22579],{"data":22580,"content":22581,"nodeType":860},{},[22582],{"data":22583,"marks":22584,"value":22585,"nodeType":864},{},[],"Typical post-exploitation or persistence techniques (e.g. OAuth integrations or API keys being created, forwarding rules, etc.)",{"data":22587,"content":22588,"nodeType":860},{},[22589],{"data":22590,"marks":22591,"value":22592,"nodeType":864},{},[],"These are the controls that fall into that “easy to understand, easy to recommend, but pretty hard to do at scale” category. Very few organizations have account security controls in place across the bulk of SaaS apps, and especially the apps that were self-adopted. The reality is that most companies still don’t even know about those self-adopted apps. So where should we start?",{"data":22594,"content":22595,"nodeType":860},{},[22596],{"data":22597,"marks":22598,"value":22599,"nodeType":864},{},[],"I think the most sane approach is to avoid speculation and focus on the techniques that are actually being used to attack SaaS apps today. I’ll cut to the chase - it’s credential stuffing we need to prevent. ",{"data":22601,"content":22602,"nodeType":1312},{},[22603],{"data":22604,"marks":22605,"value":22606,"nodeType":864},{},[],"Start with preventing credential stuffing",{"data":22608,"content":22609,"nodeType":860},{},[22610],{"data":22611,"marks":22612,"value":22613,"nodeType":864},{},[],"The most common attack against SaaS today is credential stuffing – where attackers use tools that automate the process of taking a list of breached passwords (from public password dumps or traded on underground crime marketplaces) and retargeting those credentials against different apps. ",{"data":22615,"content":22616,"nodeType":860},{},[22617],{"data":22618,"marks":22619,"value":22620,"nodeType":864},{},[],"Slightly more sophisticated attackers might even try expanding their targets by using marketing and advertising services to match private accounts to work accounts in case employees re-used similar passwords. In the example for acme.com in the graphic below, we see how this plays out to get access to a company’s MailChimp. At this point, attackers are able to start sending scam emails to your customers from your domain in emails that look completely legit. This type of attack where compromised SaaS apps are used to send customers malicious emails are something we’ve seen play out a few times recently:",{"data":22622,"content":22623,"nodeType":941},{},[22624,22646,22667,22689,22710],{"data":22625,"content":22626,"nodeType":945},{},[22627],{"data":22628,"content":22629,"nodeType":860},{},[22630,22634,22643],{"data":22631,"marks":22632,"value":22633,"nodeType":864},{},[],"In this ",{"data":22635,"content":22637,"nodeType":883},{"uri":22636},"https://www.bleepingcomputer.com/news/security/chipotle-s-marketing-account-hacked-to-send-phishing-emails/",[22638],{"data":22639,"marks":22640,"value":22642,"nodeType":864},{},[22641],{"type":1455},"Chipotle attack",{"data":22644,"marks":22645,"value":21,"nodeType":864},{},[],{"data":22647,"content":22648,"nodeType":945},{},[22649],{"data":22650,"content":22651,"nodeType":860},{},[22652,22655,22664],{"data":22653,"marks":22654,"value":22633,"nodeType":864},{},[],{"data":22656,"content":22658,"nodeType":883},{"uri":22657},"https://www.bleepingcomputer.com/news/security/doordash-discloses-new-data-breach-tied-to-twilio-hackers/",[22659],{"data":22660,"marks":22661,"value":22663,"nodeType":864},{},[22662],{"type":1455},"DoorDash attack",{"data":22665,"marks":22666,"value":21,"nodeType":864},{},[],{"data":22668,"content":22669,"nodeType":945},{},[22670],{"data":22671,"content":22672,"nodeType":860},{},[22673,22677,22686],{"data":22674,"marks":22675,"value":22676,"nodeType":864},{},[],"In this",{"data":22678,"content":22680,"nodeType":883},{"uri":22679},"https://www.bleepingcomputer.com/news/security/namecheaps-email-hacked-to-send-metamask-dhl-phishing-emails/",[22681],{"data":22682,"marks":22683,"value":22685,"nodeType":864},{},[22684],{"type":1455}," attack against domain registrar NameCheap",{"data":22687,"marks":22688,"value":21,"nodeType":864},{},[],{"data":22690,"content":22691,"nodeType":945},{},[22692],{"data":22693,"content":22694,"nodeType":860},{},[22695,22698,22707],{"data":22696,"marks":22697,"value":22633,"nodeType":864},{},[],{"data":22699,"content":22701,"nodeType":883},{"uri":22700},"https://www.bleepingcomputer.com/news/security/hacked-sendgrid-accounts-used-in-phishing-attacks-to-steal-logins/",[22702],{"data":22703,"marks":22704,"value":22706,"nodeType":864},{},[22705],{"type":1455},"SendGrid attack",{"data":22708,"marks":22709,"value":21,"nodeType":864},{},[],{"data":22711,"content":22712,"nodeType":945},{},[22713],{"data":22714,"content":22715,"nodeType":860},{},[22716,22719,22728],{"data":22717,"marks":22718,"value":22633,"nodeType":864},{},[],{"data":22720,"content":22722,"nodeType":883},{"uri":22721},"https://www.bleepingcomputer.com/news/security/mailchimp-discloses-new-breach-after-employees-got-hacked/",[22723],{"data":22724,"marks":22725,"value":22727,"nodeType":864},{},[22726],{"type":1455},"MailChimp attack",{"data":22729,"marks":22730,"value":21,"nodeType":864},{},[],{"data":22732,"content":22736,"nodeType":996},{"target":22733},{"sys":22734},{"id":22735,"type":1001,"linkType":1002},"o6eDG116P2tdWdq4oNllR",[],{"data":22738,"content":22739,"nodeType":860},{},[22740],{"data":22741,"marks":22742,"value":22743,"nodeType":864},{},[],"PLG and the increase in employee-adopted apps has led to employees creating more accounts, on more apps and without the guiding hand of security to make sure strong identity and access controls are in place. ",{"data":22745,"content":22746,"nodeType":860},{},[22747],{"data":22748,"marks":22749,"value":22752,"nodeType":864},{},[22750,22751],{"type":899},{"type":2246},"Opportunistic attackers now have a huge, unmonitored attack surface to target using low effort/cost techniques that generate reliable results for them. ",{"data":22754,"content":22755,"nodeType":1312},{},[22756],{"data":22757,"marks":22758,"value":22759,"nodeType":864},{},[],"Why SSO is not the answer to our SaaS account security prayers",{"data":22761,"content":22762,"nodeType":860},{},[22763],{"data":22764,"marks":22765,"value":22766,"nodeType":864},{},[],"Many security teams are leaning on SSO to address this issue. They’ll require that apps used in their company use SSO, specifically SAML (Security Assertion Markup Language) before they can be approved or used. This works really, really well for the apps that provide this functionality. It’s the gold standard for authentication. ",{"data":22768,"content":22769,"nodeType":860},{},[22770],{"data":22771,"marks":22772,"value":22773,"nodeType":864},{},[],"With SAML SSO, there’s just one account, just one password, and you can centrally deprovision accounts when employees leave the organization. In fact, you’re probably already paying for a SAML IdP (Identity Provider) like Google Directory or Azure AD. Many others are using tools like Okta.   ",{"data":22775,"content":22776,"nodeType":860},{},[22777],{"data":22778,"marks":22779,"value":22780,"nodeType":864},{},[],"There’s one obvious point we need to make here: SSO isn’t going to help you discover which apps employees are using. But, once you discover them and determine they support SAML, you can integrate them with your solution.",{"data":22782,"content":22783,"nodeType":860},{},[22784],{"data":22785,"marks":22786,"value":22787,"nodeType":864},{},[],"But here lies the problem…when we reviewed 500 of the most popular apps that Push supports, we found that: ",{"data":22789,"content":22790,"nodeType":1312},{},[22791],{"data":22792,"marks":22793,"value":22794,"nodeType":864},{},[],"Only around 30% of apps offer SSO and, of those, very few make it available on their lower-priced tiers.",{"data":22796,"content":22800,"nodeType":996},{"target":22797},{"sys":22798},{"id":22799,"type":1001,"linkType":1002},"56nd8Na4I0efwOf9pfmB8s",[],{"data":22802,"content":22803,"nodeType":860},{},[22804],{"data":22805,"marks":22806,"value":22807,"nodeType":864},{},[],"We also noticed that the more modern, newer apps were less likely to offer SAML support than the larger, more established business apps. So if your strategy is to block access to any app that doesn’t offer SSO integrations, you’re going to have to block the majority of self-adopted apps your employees are using. ",{"data":22809,"content":22810,"nodeType":860},{},[22811],{"data":22812,"marks":22813,"value":22814,"nodeType":864},{},[],"There are some other complications and nuances around SAML. Sometimes the SAML integration will only cover one tenant or instance and not the entire app. In this case, every time you find a new workspace or instance, you need to integrate it again. Worse, you can often only integrate one workspace or instance with your SAML IdP. ",{"data":22816,"content":22817,"nodeType":860},{},[22818,22822,22830],{"data":22819,"marks":22820,"value":22821,"nodeType":864},{},[],"Then there’s the ethically dubious issue of “",{"data":22823,"content":22824,"nodeType":883},{"uri":13628},[22825],{"data":22826,"marks":22827,"value":22829,"nodeType":864},{},[22828],{"type":1455},"SSO tax",{"data":22831,"marks":22832,"value":22833,"nodeType":864},{},[],"” where vendors that do offer SSO reserve it only for their enterprise tiers designed for organizations buying huge volumes of licenses, which makes this impractical for many if not most of us.",{"data":22835,"content":22836,"nodeType":1312},{},[22837],{"data":22838,"marks":22839,"value":22840,"nodeType":864},{},[],"A game plan for preventing credential stuffing",{"data":22842,"content":22843,"nodeType":860},{},[22844],{"data":22845,"marks":22846,"value":22847,"nodeType":864},{},[],"I like the idea of going passwordless as much as the next security person, but that’s not practical for many apps right now. So we’re going to rely on passwords as well, at least for the foreseeable future. Strong, unique passwords, coupled with MFA, are very effective identity and access controls, so it’s not the end of the world.",{"data":22849,"content":22850,"nodeType":860},{},[22851],{"data":22852,"marks":22853,"value":22854,"nodeType":864},{},[],"To prevent credential stuffing attacks (and a whole host of other attacks to boot) you will need to implement the following controls:",{"data":22856,"content":22860,"nodeType":996},{"target":22857},{"sys":22858},{"id":22859,"type":1001,"linkType":1002},"JU64Zj7eiqS1s5OfWmZyo",[],{"data":22862,"content":22863,"nodeType":860},{},[22864],{"data":22865,"marks":22866,"value":22867,"nodeType":864},{},[],"It’s useful to note from the requirements that you must be in a position to discover SaaS apps being onboarded, but also discover how these apps are accessed.",{"data":22869,"content":22870,"nodeType":860},{},[22871],{"data":22872,"marks":22873,"value":22874,"nodeType":864},{},[],"There’s only one place where we can get data about who is using which SaaS apps, as well as the ability to inspect passwords and check MFA status for each user. And that’s in the employee’s browsers.",{"data":22876,"content":22877,"nodeType":860},{},[22878],{"data":22879,"marks":22880,"value":22881,"nodeType":864},{},[],"This is the reason we have chosen to build our solution using a browser extension. It allows us to:",{"data":22883,"content":22884,"nodeType":941},{},[22885,22895,22905],{"data":22886,"content":22887,"nodeType":945},{},[22888],{"data":22889,"content":22890,"nodeType":860},{},[22891],{"data":22892,"marks":22893,"value":22894,"nodeType":864},{},[],"Observe username and password logins, ",{"data":22896,"content":22897,"nodeType":945},{},[22898],{"data":22899,"content":22900,"nodeType":860},{},[22901],{"data":22902,"marks":22903,"value":22904,"nodeType":864},{},[],"Assess their strength and whether they are being shared or reused, and ",{"data":22906,"content":22907,"nodeType":945},{},[22908],{"data":22909,"content":22910,"nodeType":860},{},[22911],{"data":22912,"marks":22913,"value":22914,"nodeType":864},{},[],"Allow security teams to fix any accounts that don’t meet their policies or expectations.",{"data":22916,"content":22917,"nodeType":860},{},[22918],{"data":22919,"marks":22920,"value":22921,"nodeType":864},{},[],"More on that in a moment, but first, the last piece of advice:",{"data":22923,"content":22924,"nodeType":1009},{},[22925],{"data":22926,"marks":22927,"value":22928,"nodeType":864},{},[],"Tackle risk assessment and account security in parallel",{"data":22930,"content":22931,"nodeType":860},{},[22932],{"data":22933,"marks":22934,"value":22935,"nodeType":864},{},[],"Quite often when I talk to security leaders, they’re fixated on supply chain risk and the risk of account compromise is an afterthought. This is understandable - these are the attacks that are widely reported, and require high-level decision making, so this feels like the natural first step. They’re aware that employees are using unvetted apps, but they don’t feel like they’re in a position to secure the employee account until they have identified and vetted all the apps in use. ",{"data":22937,"content":22938,"nodeType":860},{},[22939],{"data":22940,"marks":22941,"value":22942,"nodeType":864},{},[],"It seems logical to want to approve apps first and then secure the accounts. It might make sense if you are starting from zero, however, when organizations get visibility of SaaS apps in use, they usually see hundreds on the list that employees are already using. In this case, waiting to get through the entire backlog of app risk assessment first is counter productive. Regardless of whether an app is approved yet, if it’s in use there is the risk of an attacker compromising a weak employee account with a credential stuffing attack, which is arguably a greater risk than a SaaS vendor being compromised in a supply chain attack. That’s because attacks against employee SaaS accounts are more common, just reported less often than supply chain attacks.",{"data":22944,"content":22945,"nodeType":860},{},[22946],{"data":22947,"marks":22948,"value":22949,"nodeType":864},{},[],"The best way to bring down as much SaaS risk as quickly as possible is to tackle both streams independently and in parallel. But to do this, you need the right tools.  ",{"data":22951,"content":22952,"nodeType":860},{},[22953],{"data":22954,"marks":22955,"value":22956,"nodeType":864},{},[],"Push collects usage data from the same place we collect account security data so we can also identify password and MFA data about the employee’s SaaS account. We don’t require you to integrate Push with each app you discover. Instead, usage and security data are collected at the same time we’re discovering the app because we’re using a browser extension. The extension gives us relevant security context so you can address both risks together. On that note, let’s dig into the data that SaaS security tools use.",{"data":22958,"content":22959,"nodeType":1009},{},[22960],{"data":22961,"marks":22962,"value":22963,"nodeType":864},{},[],"Choose the right data source",{"data":22965,"content":22966,"nodeType":860},{},[22967],{"data":22968,"marks":22969,"value":22970,"nodeType":864},{},[],"Since we’ve moved from a world in which we as security teams got visibility through process (IT or procurement) to a world where we rely on technology to give us that visibility (for e.g. self-adopted apps) - we’re going to need tooling, and that’s where things get complicated.",{"data":22972,"content":22973,"nodeType":860},{},[22974],{"data":22975,"marks":22976,"value":22977,"nodeType":864},{},[],"The list of SaaS security product categories and tools is growing almost weekly, from Cloud Access Security Broker (CASBs), Security Service Edge (SSEs), SaaS Security Posture Management (SSPMs) and any number of other new buzzwords. The only thing growing faster is the promises they make, so it’s no surprise that it’s very difficult to identify solutions that can actually deliver what’s required.",{"data":22979,"content":22980,"nodeType":860},{},[22981],{"data":22982,"marks":22983,"value":22984,"nodeType":864},{},[],"One critical factor to consider when choosing tooling is the data that these tools build on. The requirements we’ve identified for doing SaaS security in the previous section are that we need to be able to:",{"data":22986,"content":22987,"nodeType":941},{},[22988,22998,23008,23018],{"data":22989,"content":22990,"nodeType":945},{},[22991],{"data":22992,"content":22993,"nodeType":860},{},[22994],{"data":22995,"marks":22996,"value":22997,"nodeType":864},{},[],"Discover new SaaS apps being adopted (and self-adopted).",{"data":22999,"content":23000,"nodeType":945},{},[23001],{"data":23002,"content":23003,"nodeType":860},{},[23004],{"data":23005,"marks":23006,"value":23007,"nodeType":864},{},[],"Keep a low rate of false positives, in other words we need to be able to tell the difference between, for example, accessing a SaaS app website or actually login into the app.",{"data":23009,"content":23010,"nodeType":945},{},[23011],{"data":23012,"content":23013,"nodeType":860},{},[23014],{"data":23015,"marks":23016,"value":23017,"nodeType":864},{},[],"Get insight into the identities or accounts used to access these apps - we need to know which users are authenticating to these apps and how (SSO, Social Logins, Local passwords)",{"data":23019,"content":23020,"nodeType":945},{},[23021],{"data":23022,"content":23023,"nodeType":860},{},[23024],{"data":23025,"marks":23026,"value":23027,"nodeType":864},{},[],"Identify account security issues such as disabled MFA, weak, reused and breached passwords.",{"data":23029,"content":23030,"nodeType":860},{},[23031],{"data":23032,"marks":23033,"value":23034,"nodeType":864},{},[],"The following is a summary of the most common data sources SaaS security tools are built on, and how they stack up in terms of the requirements above:",{"data":23036,"content":23040,"nodeType":996},{"target":23037},{"sys":23038},{"id":23039,"type":1001,"linkType":1002},"E8ThSCqbNNa9nggaKE3p1",[],{"data":23042,"content":23043,"nodeType":860},{},[23044,23048,23059],{"data":23045,"marks":23046,"value":23047,"nodeType":864},{},[],"Each data source has pros and cons, but let’s take a look at the most common sources to see what the high-level trade-offs are. We’ve got a short ",{"data":23049,"content":23053,"nodeType":17737},{"target":23050},{"sys":23051},{"id":23052,"type":1001,"linkType":1002},"45iZ69EdPF4629gZ6yf7p5",[23054],{"data":23055,"marks":23056,"value":23058,"nodeType":864},{},[23057],{"type":1455},"blog post ",{"data":23060,"marks":23061,"value":23062,"nodeType":864},{},[],"on this topic if you want to share with your teammates and peers.",{"data":23064,"content":23065,"nodeType":1312},{},[23066],{"data":23067,"marks":23068,"value":23069,"nodeType":864},{},[],"Financial records",{"data":23071,"content":23072,"nodeType":860},{},[23073],{"data":23074,"marks":23075,"value":23076,"nodeType":864},{},[],"Looking through invoices can provide some visibility into paid SaaS apps, which is why it has a very low false positive rate. However, there are blind spots - you won’t see any free tier or trial accounts, nor will you get any useful business context about who’s using it, how they’re using it, if logins are secure, and what data it has access to. That said, it’s a quick and dirty way to get a partial view of SaaS usage and might be the best place to start. ",{"data":23078,"content":23079,"nodeType":860},{},[23080],{"data":23081,"marks":23082,"value":23083,"nodeType":864},{},[],"The main downside of using finance as a data source is that it will discover apps very slowly, most apps will only move to a paid tier once employees have already been using the app for a while on free-tier and have become reliant enough on it that they need additional features or users. This is often too late to steer these users to a different app if there are critical risks identified with the app or vendor.",{"data":23085,"content":23086,"nodeType":1312},{},[23087],{"data":23088,"marks":23089,"value":23090,"nodeType":864},{},[],"Email analytics",{"data":23092,"content":23093,"nodeType":860},{},[23094],{"data":23095,"marks":23096,"value":23097,"nodeType":864},{},[],"You can look at all the emails every employee receives and match these emails to different SaaS apps and vendors and based on that information make some statistical guesses about which employees are using which apps. This improves on finance records in a significant metric - speed of detection, but the trade-off is a high rate of false positives. One aspect that email detection is great for that isn’t included in the table is the ability to detect historic SaaS apps.",{"data":23099,"content":23100,"nodeType":860},{},[23101],{"data":23102,"marks":23103,"value":23104,"nodeType":864},{},[],"Unfortunately, except for some very limited edge cases it’s not possible to broadly detect account security issues using email, so at best this is a first-step data source.",{"data":23106,"content":23107,"nodeType":1312},{},[23108],{"data":23109,"marks":23110,"value":23111,"nodeType":864},{},[],"Network data",{"data":23113,"content":23114,"nodeType":860},{},[23115],{"data":23116,"marks":23117,"value":23118,"nodeType":864},{},[],"This is the old-school approach that tools like CASBs use to do SaaS discovery, taking data from edge devices like firewalls, proxies, or DNS relays. This makes it very difficult to implement for companies that are distributed and cloud-native. There are now solutions that are more appropriate for distributed teams that work either by collecting network data from the endpoint with an agent, or perhaps your organization is very office-based and has excellent network telemetry - in which case these solutions might be easier to deploy.",{"data":23120,"content":23121,"nodeType":860},{},[23122],{"data":23123,"marks":23124,"value":23125,"nodeType":864},{},[],"While network data is relatively well understood, it’s not a great source for discovering SaaS use (as opposed to detecting when an employee simply accesses SaaS app websites - false positives galore) or for finding account security issues. It’s useful to get an idea of which apps might be used and indications on who might be using the app. But network data doesn’t provide the level of detail needed to discover account security issues. This is why CASB solutions have almost all started including API integrations to augment this data and make it useful - though this has its own problems.",{"data":23127,"content":23128,"nodeType":860},{},[23129],{"data":23130,"marks":23131,"value":23132,"nodeType":864},{},[],"If you’re looking to get a quick outline of which SaaS may be in use, a finance or email-based solution would likely be much easier to deploy and more cost effective. If you want to discover and remediate problems and actually reduce SaaS risk, you need to look elsewhere.",{"data":23134,"content":23135,"nodeType":1312},{},[23136],{"data":23137,"marks":23138,"value":23139,"nodeType":864},{},[],"Application API data",{"data":23141,"content":23142,"nodeType":860},{},[23143],{"data":23144,"marks":23145,"value":23146,"nodeType":864},{},[],"Many of the more established SaaS apps (especially those that are almost Platform-as-a-Service or PaaS) like 365, Salesforce, Slack, Github etc. offer APIs that expose security-relevant data. However, for apps that do support these APIs, this is an amazing data source that typically provides the ability to extract user-lists or check account security controls like MFA are enabled for all users, or list third-party integrations. Audit log feeds also provide a useful data source for ingestion into SIEM systems. ",{"data":23148,"content":23149,"nodeType":860},{},[23150],{"data":23151,"marks":23152,"value":23153,"nodeType":864},{},[],"However, APIs as a data source for doing SaaS security has 2 major limitations:",{"data":23155,"content":23156,"nodeType":23195},{},[23157,23176],{"data":23158,"content":23159,"nodeType":945},{},[23160],{"data":23161,"content":23162,"nodeType":860},{},[23163,23167,23172],{"data":23164,"marks":23165,"value":23166,"nodeType":864},{},[],"No discovery features. ",{"data":23168,"marks":23169,"value":23171,"nodeType":864},{},[23170],{"type":899},"You must already know that an app is in use",{"data":23173,"marks":23174,"value":23175,"nodeType":864},{},[]," (or more specifically know about every app tenant in use) before you can integrate it with your SaaS security solutions (typically SSPM tools). This means you need some other data source to discover SaaS apps and tenants.",{"data":23177,"content":23178,"nodeType":945},{},[23179],{"data":23180,"content":23181,"nodeType":860},{},[23182,23186,23191],{"data":23183,"marks":23184,"value":23185,"nodeType":864},{},[],"Lack of support. These APIs are typically available ",{"data":23187,"marks":23188,"value":23190,"nodeType":864},{},[23189],{"type":899},"only for “core” SaaS platforms",{"data":23192,"marks":23193,"value":23194,"nodeType":864},{},[],", and a very small minority of the types of SaaS apps employees might self-adopt will other these security monitoring integrations.","ordered-list",{"data":23197,"content":23198,"nodeType":1312},{},[23199],{"data":23200,"marks":23201,"value":288,"nodeType":864},{},[],{"data":23203,"content":23204,"nodeType":860},{},[23205],{"data":23206,"marks":23207,"value":23208,"nodeType":864},{},[],"The idea behind using browser extensions for SaaS security is simple: if all the data you care about monitoring exists in your employees’ browsers, let’s analyze the data in the browser. Browser extensions allow you to deeply inspect users' interactions with SaaS apps. This means you can get close to perfect accuracy in terms of discovering which apps are in-use (vs browser the website) because you can actually observe the login process directly. ",{"data":23210,"content":23211,"nodeType":860},{},[23212,23216,23221],{"data":23213,"marks":23214,"value":23215,"nodeType":864},{},[],"Since you observe the login process with the extension, it’s easy to discover account security issues like weak passwords or missing MFA. You can also tell when employees are logging into apps without using SSO. Best of all you don’t need to create a dragnet and collect all this data centrally creating a privacy nightmare, instead ",{"data":23217,"marks":23218,"value":23220,"nodeType":864},{},[23219],{"type":899},"you can analyze this data where it already exists, inside the safe confines of the browser sandbox",{"data":23222,"marks":23223,"value":23224,"nodeType":864},{},[],". The only data you report out is a flag when you find an issue.",{"data":23226,"content":23227,"nodeType":860},{},[23228,23232,23237],{"data":23229,"marks":23230,"value":23231,"nodeType":864},{},[],"Another benefit of browser extensions is that they are not passive. ",{"data":23233,"marks":23234,"value":23236,"nodeType":864},{},[23235],{"type":899},"You can easily add active features to extensions that do things like warn users before they even set bad passwords",{"data":23238,"marks":23239,"value":23240,"nodeType":864},{},[]," - preventing these issues from occurring in the first place.",{"data":23242,"content":23243,"nodeType":860},{},[23244],{"data":23245,"marks":23246,"value":23247,"nodeType":864},{},[],"The downside is that you need to deploy these browser extensions to employees. This used to be a much bigger issue in the past, but these days it’s easy to deploy extensions to your whole fleet of Chrome, Edge, Firefox, Safari, Brave and Opera browsers using an MDM or GPO policy. Another nice thing about extensions, is that unlike endpoint agents, extensions are cross platform (they don’t care if you are on Windows, Mac or Linux), are isolated to the browser and automatically update through the browser extension store.",{"data":23249,"content":23250,"nodeType":860},{},[23251],{"data":23252,"marks":23253,"value":23254,"nodeType":864},{},[],"I’m sure I’m not doing a great job of hiding my enthusiasm for browser extensions as a platform to build SaaS security tools on, but they truly do provide the kind of fast, accurate and detailed data we need to solve both the supply-chain and customer responsibility sides of SaaS security.",{"data":23256,"content":23257,"nodeType":1312},{},[23258],{"data":23259,"marks":23260,"value":23261,"nodeType":864},{},[],"Push uses a browser extension and APIs ",{"data":23263,"content":23264,"nodeType":860},{},[23265],{"data":23266,"marks":23267,"value":23268,"nodeType":864},{},[],"That’s why we decided to build Push on a browser extension. To discover and provide security-relevant data about the integrations to your core cloud platforms, we also use APIs. Together, these two data sources provided a full view of the SaaS apps employees are using.",{"data":23270,"content":23271,"nodeType":1009},{},[23272],{"data":23273,"marks":23274,"value":23275,"nodeType":864},{},[],"How can Push help?",{"data":23277,"content":23278,"nodeType":860},{},[23279],{"data":23280,"marks":23281,"value":23282,"nodeType":864},{},[],"It probably won’t come as a surprise to find out that we’ve designed Push so security teams can get a handle on employee-adopted SaaS apps without needing to block them.",{"data":23284,"content":23285,"nodeType":860},{},[23286],{"data":23287,"marks":23288,"value":23289,"nodeType":864},{},[],"Here’s a quick rundown of how Push can help you:",{"data":23291,"content":23292,"nodeType":1312},{},[23293],{"data":23294,"marks":23295,"value":23296,"nodeType":864},{},[],"Get visibility of shadow SaaS apps and unmanaged cloud accounts",{"data":23298,"content":23299,"nodeType":860},{},[23300],{"data":23301,"marks":23302,"value":23303,"nodeType":864},{},[],"If you’re going to get a handle on employee-adopted SaaS apps, you need to get visibility of them first. Push uses data from our browser extension to find SaaS apps that are logged into with usernames and passwords and SSO (OIDC). This gives you complete visibility of your SaaS environment, including shadow SaaS apps and cloud accounts that are not managed by IT. ",{"data":23305,"content":23309,"nodeType":996},{"target":23306},{"sys":23307},{"id":23308,"type":1001,"linkType":1002},"2PW9tNBBo0ohoqXYZ04kxA",[],{"data":23311,"content":23312,"nodeType":1312},{},[23313],{"data":23314,"marks":23315,"value":23316,"nodeType":864},{},[],"Detect the new apps and integrations employees are adopting in real time",{"data":23318,"content":23319,"nodeType":860},{},[23320],{"data":23321,"marks":23322,"value":23323,"nodeType":864},{},[],"Push detects employees signing up to new apps, or integrating third-party apps to your core work platforms in real-time. That allows you to step in at the earliest opportunity to vet the app for critical issues and guide the employee through the appropriate app onboarding steps. This allows you to focus on the new stuff and buy yourself time as I recommended earlier. ",{"data":23325,"content":23329,"nodeType":996},{"target":23326},{"sys":23327},{"id":23328,"type":1001,"linkType":1002},"1hqMZl60NhvhHIfnO7FttV",[],{"data":23331,"content":23332,"nodeType":1312},{},[23333],{"data":23334,"marks":23335,"value":23336,"nodeType":864},{},[],"Avoid wasting time on false-positives",{"data":23338,"content":23339,"nodeType":860},{},[23340],{"data":23341,"marks":23342,"value":23343,"nodeType":864},{},[],"You need to trust your data if you want to take action based on the visibility you have of what apps employees are using and how they’re using them. Doing risk assessments or chasing employees about apps they’re not using wastes time and burns goodwill. ",{"data":23345,"content":23346,"nodeType":860},{},[23347],{"data":23348,"marks":23349,"value":23350,"nodeType":864},{},[],"Throughout this piece I’ve banged on about how critical it is to have the right data. Good data allows you to quickly and accurately identify new SaaS apps and integrations as employees adopt them. Good data is also required to identify the security issues that attackers can exploit to compromise your data through common attacks like Credential Stuffing. The best foundational data to lean on for SaaS visibility and risk is browser extension data.",{"data":23352,"content":23353,"nodeType":860},{},[23354],{"data":23355,"marks":23356,"value":23357,"nodeType":864},{},[],"Push collects data directly from the app using a browser extension, rather than guessing possible use from other sources like network traffic or email. ",{"data":23359,"content":23360,"nodeType":860},{},[23361],{"data":23362,"marks":23363,"value":23366,"nodeType":864},{},[23364,23365],{"type":899},{"type":2246},"That makes Push the only SaaS security solution that can directly observe all SaaS use and the only solution that can identify account security issues across hundreds of apps - completely automatically. No need for API support, no need for an admin account. It just works.",{"data":23368,"content":23369,"nodeType":1312},{},[23370],{"data":23371,"marks":23372,"value":23373,"nodeType":864},{},[],"Identify account security risks and discover shadow SaaS at the same time",{"data":23375,"content":23376,"nodeType":860},{},[23377],{"data":23378,"marks":23379,"value":23380,"nodeType":864},{},[],"Supply chain risk is important, but I’d argue account compromise risks are greater for most organizations. Push can identify account security issues that make it possible for attackers to compromise your employees accounts using credential stuffing, brute forcing and phishing attacks. These include:",{"data":23382,"content":23383,"nodeType":941},{},[23384,23394,23404,23414,23424,23434],{"data":23385,"content":23386,"nodeType":945},{},[23387],{"data":23388,"content":23389,"nodeType":860},{},[23390],{"data":23391,"marks":23392,"value":23393,"nodeType":864},{},[],"Compromised passwords",{"data":23395,"content":23396,"nodeType":945},{},[23397],{"data":23398,"content":23399,"nodeType":860},{},[23400],{"data":23401,"marks":23402,"value":23403,"nodeType":864},{},[],"Guessable passwords",{"data":23405,"content":23406,"nodeType":945},{},[23407],{"data":23408,"content":23409,"nodeType":860},{},[23410],{"data":23411,"marks":23412,"value":23413,"nodeType":864},{},[],"Account-sharing between multiple employees",{"data":23415,"content":23416,"nodeType":945},{},[23417],{"data":23418,"content":23419,"nodeType":860},{},[23420],{"data":23421,"marks":23422,"value":23423,"nodeType":864},{},[],"Sharing passwords across multiple accounts",{"data":23425,"content":23426,"nodeType":945},{},[23427],{"data":23428,"content":23429,"nodeType":860},{},[23430],{"data":23431,"marks":23432,"value":23433,"nodeType":864},{},[],"Missing MFA",{"data":23435,"content":23436,"nodeType":945},{},[23437],{"data":23438,"content":23439,"nodeType":860},{},[23440],{"data":23441,"marks":23442,"value":23443,"nodeType":864},{},[],"Password manager use",{"data":23445,"content":23449,"nodeType":996},{"target":23446},{"sys":23447},{"id":23448,"type":1001,"linkType":1002},"3hR2N6WoP5WDyD6O6zdJP1",[],{"data":23451,"content":23452,"nodeType":860},{},[23453],{"data":23454,"marks":23455,"value":23456,"nodeType":864},{},[],"We identify these issues at the same time we discover shadow SaaS apps, so you can tackle account compromise at the same time as supply chain risk to reduce your SaaS security risk exposure faster.",{"data":23458,"content":23459,"nodeType":860},{},[23460],{"data":23461,"marks":23462,"value":23463,"nodeType":864},{},[],"How do we actually reduce the risks? We engage employees directly via Slack or MS Teams, explain the account security issue we’ve identified in a way they’ll understand, and help them understand how it’s putting them and the business at risk. Then we guide them on how to fix it...",{"data":23465,"content":23469,"nodeType":996},{"target":23466},{"sys":23467},{"id":23468,"type":1001,"linkType":1002},"7Hgf81IlfZKoUMOp26ZXmq",[],{"data":23471,"content":23472,"nodeType":1312},{},[23473],{"data":23474,"marks":23475,"value":23476,"nodeType":864},{},[],"Use Push to secure accounts that aren’t under SSO",{"data":23478,"content":23479,"nodeType":860},{},[23480],{"data":23481,"marks":23482,"value":23483,"nodeType":864},{},[],"In an ideal world, you could stick all your SaaS under your SSO solution, but we’ve already explained why that’s not practical for all apps. For apps and accounts that can’t use SSO, Push makes sure employees are using strong, unique passwords that aren’t published on a password breach list. We’ll also guide employees to use MFA when possible. ",{"data":23485,"content":23486,"nodeType":860},{},[23487],{"data":23488,"marks":23489,"value":23490,"nodeType":864},{},[],"In some instances, we can prevent account security issues from occurring in the first place. When Push detects an employee creating a new account in their browser, we’ll guide them to set up strong identity and access controls on their account, at the first signup...",{"data":23492,"content":23496,"nodeType":996},{"target":23493},{"sys":23494},{"id":23495,"type":1001,"linkType":1002},"44U1ByoQns6vTqCSS3XrJf",[],{"data":23498,"content":23499,"nodeType":1312},{},[23500,23504],{"data":23501,"marks":23502,"value":23503,"nodeType":864},{},[],"Get a handle on employee-adopted apps ",{"data":23505,"marks":23506,"value":23508,"nodeType":864},{},[23507],{"type":2246},"without being a blocker",{"data":23510,"content":23511,"nodeType":860},{},[23512],{"data":23513,"marks":23514,"value":23515,"nodeType":864},{},[],"By using Push, you can have complete visibility of all SaaS apps in your environment, including those adopted by employees without the oversight of IT and Security. We’ll automatically find the security issues that put your data at risk and enlist the support of employees to fix them. This allows you to embrace app self-adoption and adopt a default allow approach that enables your business while scaling security so you don’t lose control of SaaS security risks.  ",{"entries":23517},{"inline":23518,"hyperlink":23519,"block":23527},[],[23520,23523],{"sys":23521,"__typename":2059,"title":21984,"slug":23522},{"id":21978},"saas-has-changed-how-we-adopt-software-how-should-security-adapt",{"sys":23524,"__typename":2059,"title":23525,"slug":23526},{"id":23052},"How to roll-your-own SaaS discovery","rolling-your-own-saas-discovery",[23528,23537,23543,23551,23559,23566,23573,23581,23588,23596,23603,23611,23617,23623,23631,23637],{"sys":23529,"__typename":1724,"title":23530,"caption":23531,"layoutMode":23532,"file":23533},{"id":22089},"Shared responsibility model NCSC","Source: https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model","Centre aligned",{"url":23534,"width":23535,"height":23536},"https://images.ctfassets.net/y1cdw1ablpvd/2QR4exoDHiiI32zLx7MBOL/d169ba9438f1782aba60c5c35413706d/image7.png",1662,992,{"sys":23538,"__typename":1724,"title":23539,"caption":23539,"layoutMode":23532,"file":23540},{"id":22116},"Two parts of SaaS security",{"url":23541,"width":1736,"height":23542},"https://images.ctfassets.net/y1cdw1ablpvd/2dRhaTc75s2mHGYmreOZDS/8d0c2dddbabfeaddd99f3f9aa781e718/image3.png",806,{"sys":23544,"__typename":1724,"title":23545,"caption":23546,"layoutMode":23532,"file":23547},{"id":22351},"Focus on the new stuff PLG","By focusing on newly-tested/adopted apps, you have more sway with employees on their app choices.",{"url":23548,"width":23549,"height":23550},"https://images.ctfassets.net/y1cdw1ablpvd/3qFd7mDWRzdyySkgAOmr14/5d4fd61bb45b4ff8a8780a6ec543d493/image1.png",1976,1100,{"sys":23552,"__typename":1724,"title":23553,"caption":23554,"layoutMode":23532,"file":23555},{"id":22378},"Risk assessment timeline PLG","When security can make the most impact on assessing employee-adopted SaaS apps",{"url":23556,"width":23557,"height":23558},"https://images.ctfassets.net/y1cdw1ablpvd/5Vxv5h3OpO3DXpsil5GBUa/d1ca5df575cb5e9cfc612b8b757411ff/image15.png",2000,1118,{"sys":23560,"__typename":1724,"title":23561,"caption":23562,"layoutMode":23532,"file":23563},{"id":22434},"False positives employee interaction","Interacting with employees about apps they're not even using burns goodwill and wastes everyones' time",{"url":23564,"width":1730,"height":23565},"https://images.ctfassets.net/y1cdw1ablpvd/5LRJyodNqCidY9UlUIY5Jw/ad795b2e44bff77f9d746e2ccb910f18/image2.png",884,{"sys":23567,"__typename":1724,"title":23568,"caption":59,"layoutMode":23532,"file":23569},{"id":22468},"Customer responsibility for SaaS apps PLG",{"url":23570,"width":23571,"height":23572},"https://images.ctfassets.net/y1cdw1ablpvd/6jaP9nk2U89Y1TidafgXLB/9c3af2cd634ea0621b3e2ac05739582d/image7.png",1980,1214,{"sys":23574,"__typename":1724,"title":23575,"caption":23576,"layoutMode":23532,"file":23577},{"id":22524},"Shared responsibility model - customer responsibilities - PLG","The security controls customers are responsible for",{"url":23578,"width":23579,"height":23580},"https://images.ctfassets.net/y1cdw1ablpvd/5NHny8Lh0CQjkK3N6WEbAM/ae9ee10605795c547d25177061b42391/image6.png",1966,1096,{"sys":23582,"__typename":1724,"title":23583,"caption":23584,"layoutMode":23532,"file":23585},{"id":22735},"Supply chain attack timeline - PLG"," An example of a credential stuffing attack to compromise cloud identities",{"url":23586,"width":1736,"height":23587},"https://images.ctfassets.net/y1cdw1ablpvd/4dw9aikRRKmga5pVWBAXWU/0649644e0f0aaf29510738307546d5b1/image16.png",1104,{"sys":23589,"__typename":1724,"title":23590,"caption":23591,"layoutMode":23532,"file":23592},{"id":22799},"SSO only available for a small subset of apps","SSO is the gold standard, but a lack of universal support means we'll still need to deal with passwords for the foreseeable future.",{"url":23593,"width":23594,"height":23595},"https://images.ctfassets.net/y1cdw1ablpvd/7FDQf7atru96r1DRAjb52k/213136ebecccb073334878befc0c3dc8/image12.png",1790,1002,{"sys":23597,"__typename":1724,"title":23598,"caption":23599,"layoutMode":23532,"file":23600},{"id":22859},"Controls to prevent credential stuffing attacks - PLG","Controls to prevent credential stuffing attacks",{"url":23601,"width":1736,"height":23602},"https://images.ctfassets.net/y1cdw1ablpvd/7b0CDfnOLHjOAZgp9UMzlZ/8bdf95a1e66162f155c22db703f40048/image16.png",782,{"sys":23604,"__typename":1724,"title":23605,"caption":23606,"layoutMode":23532,"file":23607},{"id":23039},"SaaS discovery data source comparison","Strengths and weaknesses for finding employee SaaS use via commonly-used discovery data sources ",{"url":23608,"width":23609,"height":23610},"https://images.ctfassets.net/y1cdw1ablpvd/7FRyXaw4o4baUqG1cta41n/57a9476e83daf0386600c5bb8d4e827b/Screenshot_2023-04-24_at_9.09.16_AM.png",1796,1010,{"sys":23612,"__typename":1724,"title":23613,"caption":23613,"layoutMode":23532,"file":23614},{"id":23308},"Push SaaS dashboard",{"url":23615,"width":1736,"height":23616},"https://images.ctfassets.net/y1cdw1ablpvd/OsnXflsAKGaZU9Dl4lUTA/a49ef3631a4c35d259950dd395abc662/image9.png",1034,{"sys":23618,"__typename":1724,"title":23619,"caption":23620,"layoutMode":23532,"file":23621},{"id":23328},"Slack message new app alert for Security team","Channel message to security team via Slack about new app ",{"url":23622,"width":1736,"height":23616},"https://images.ctfassets.net/y1cdw1ablpvd/6CKhrva6Jh3jpHfnt0Maq5/edeeac0b00f1109e8601016f5a6e0c63/image17.png",{"sys":23624,"__typename":1724,"title":23625,"caption":23626,"layoutMode":23532,"file":23627},{"id":23448},"Push's account security dashboard","Push's account security dashboard shows you which accounts need attention",{"url":23628,"width":23629,"height":23630},"https://images.ctfassets.net/y1cdw1ablpvd/2LmWdqq57ZdIXHUSublBLK/eed71e0fa5c3039ae06f780c64057651/image4.png",1580,945,{"sys":23632,"__typename":1724,"title":23633,"caption":23634,"layoutMode":23532,"file":23635},{"id":23468},"Slack message to employee about MFA","Slack message to employee about enabling MFA for their SaaS account",{"url":23636,"width":1736,"height":23616},"https://images.ctfassets.net/y1cdw1ablpvd/1vWInHTSFEwt2kTXj0SK1I/5312ff9147b78837a71e367c9a59492f/image11.png",{"sys":23638,"__typename":1724,"title":23639,"caption":23640,"layoutMode":23532,"file":23641},{"id":23495},"Dropbox signin guidance","Push browser extension helping an employee securely sign up for Dropbox",{"url":23642,"width":1736,"height":23616},"https://images.ctfassets.net/y1cdw1ablpvd/7aqfsVnZS2LP1ur6SUdc4h/fc4cfddfa625af478238bc9303c34cf1/image8.png",{"items":23644},[],{},"How to find and secure shadow SaaS",{"url":23648},"https://images.ctfassets.net/y1cdw1ablpvd/2G9eUljiJXW11zOTpqRSUk/0e41dc83190b8be5d6ea8ec58d83da90/blog_image.png","guide","2023-06-27T00:00:00.000Z",{"items":23652},[23653],{"__typename":2059,"sys":23654,"content":23655,"title":21984,"synopsis":25107,"hashTags":59,"publishedDate":25108,"slug":23522,"tagsCollection":25109,"authorsCollection":25115},{"id":21978},{"json":23656},{"data":23657,"content":23658,"nodeType":856},{},[23659,23665,23672,23679,23686,23693,23700,23707,23714,23757,23764,23771,23778,23785,23792,23798,23805,23812,23819,23827,23834,23841,23848,23855,23862,23869,23876,23896,23902,23909,23916,23927,23935,23942,23948,23955,23962,23968,23975,23984,24000,24023,24030,24037,24044,24051,24057,24064,24071,24078,24085,24092,24099,24119,24126,24133,24140,24147,24163,24196,24205,24212,24219,24226,24233,24240,24247,24254,24260,24267,24274,24281,24288,24295,24302,24322,24329,24334,24341,24364,24371,24378,24411,24418,24425,24432,24439,24452,24459,24529,24536,24543,24566,24571,24578,24585,24592,24625,24632,25028,25035,25054,25061,25070,25086,25093,25100],{"data":23660,"content":23661,"nodeType":1009},{},[23662],{"data":23663,"marks":23664,"value":21966,"nodeType":864},{},[],{"data":23666,"content":23667,"nodeType":860},{},[23668],{"data":23669,"marks":23670,"value":23671,"nodeType":864},{},[],"Employees using a new work app used to be the final step of the software-onboarding process. ",{"data":23673,"content":23674,"nodeType":860},{},[23675],{"data":23676,"marks":23677,"value":23678,"nodeType":864},{},[],"Now it's the first. ",{"data":23680,"content":23681,"nodeType":860},{},[23682],{"data":23683,"marks":23684,"value":23685,"nodeType":864},{},[],"SaaS vendors bypass IT and security and hook employees with free apps and trials. This has led to sensitive data on shadow SaaS applications (more on this later) that is accessible via unmanaged cloud accounts (accounts that aren’t protected by SSO or logged into via social login accounts). Attackers exploit this unmonitored attack surface with new takes on old techniques that are going undetected.",{"data":23687,"content":23688,"nodeType":860},{},[23689],{"data":23690,"marks":23691,"value":23692,"nodeType":864},{},[],"Employees self-adopting apps might sound like a security nightmare, but it doesn’t have to be. In fact, it can be a really good thing that enables employees to be more productive and your business to be more competitive. And, frankly, there’s no way to stop it without causing a SaaS sprawl issue. ",{"data":23694,"content":23695,"nodeType":860},{},[23696],{"data":23697,"marks":23698,"value":23699,"nodeType":864},{},[],"What’s clear is that this new landscape has fundamentally changed the way software is brought into the business. The days of security acting as a gatekeeper that all apps must pass through before they can touch live data are over. The market forces driving self-service apps aren’t stopping, so the security industry needs to adapt.",{"data":23701,"content":23702,"nodeType":860},{},[23703],{"data":23704,"marks":23705,"value":23706,"nodeType":864},{},[],"Security teams need to regain visibility and control over company data and how it’s secured. ",{"data":23708,"content":23709,"nodeType":860},{},[23710],{"data":23711,"marks":23712,"value":23713,"nodeType":864},{},[],"In this guide I’ll show security teams: ",{"data":23715,"content":23716,"nodeType":941},{},[23717,23727,23737,23747],{"data":23718,"content":23719,"nodeType":945},{},[23720],{"data":23721,"content":23722,"nodeType":860},{},[23723],{"data":23724,"marks":23725,"value":23726,"nodeType":864},{},[],"What’s driving employee app self-adoption and the impact on security teams",{"data":23728,"content":23729,"nodeType":945},{},[23730],{"data":23731,"content":23732,"nodeType":860},{},[23733],{"data":23734,"marks":23735,"value":23736,"nodeType":864},{},[],"Why the go-to solutions of policies and tools that block access to unsanctioned apps don’t work",{"data":23738,"content":23739,"nodeType":945},{},[23740],{"data":23741,"content":23742,"nodeType":860},{},[23743],{"data":23744,"marks":23745,"value":23746,"nodeType":864},{},[],"What new approaches can work and how to apply them",{"data":23748,"content":23749,"nodeType":945},{},[23750],{"data":23751,"content":23752,"nodeType":860},{},[23753],{"data":23754,"marks":23755,"value":23756,"nodeType":864},{},[],"The two aspects to address when securing SaaS and managing risk ",{"data":23758,"content":23759,"nodeType":860},{},[23760],{"data":23761,"marks":23762,"value":23763,"nodeType":864},{},[],"At the end of this book, we’ll link to a guide filled with practical guidance on how to manage those risks and quickly reduce your risk exposure. In that guide, we’ll also cover which data sources are available for SaaS security and why the choice is crucial.",{"data":23765,"content":23766,"nodeType":860},{},[23767],{"data":23768,"marks":23769,"value":23770,"nodeType":864},{},[],"The guidance provided here has been developed after talking with security leaders and CISOs that are already successfully embracing SaaS self-adoption while keeping a handle on risks. There are too many folks here to thank personally, but if you recognize some of this from our discussions, please accept my thanks, and hopefully there’s something new and useful here for you as well!",{"data":23772,"content":23773,"nodeType":1009},{},[23774],{"data":23775,"marks":23776,"value":23777,"nodeType":864},{},[],"Why is it so easy for employees to self-adopt new apps without IT?",{"data":23779,"content":23780,"nodeType":1312},{},[23781],{"data":23782,"marks":23783,"value":23784,"nodeType":864},{},[],"Memories of a simpler time",{"data":23786,"content":23787,"nodeType":860},{},[23788],{"data":23789,"marks":23790,"value":23791,"nodeType":864},{},[],"Before cloud computing was a thing, IT teams procured and managed hardware, software, networks and services for their businesses. The business was dependent on IT deploying new software across their on-prem network and managing it, so it was nearly impossible to bypass them. They became, in effect, the gatekeepers to the business’ IT environment. The onboarding process typically looked something like this:",{"data":23793,"content":23797,"nodeType":996},{"target":23794},{"sys":23795},{"id":23796,"type":1001,"linkType":1002},"1Dw4V0Fd0wI8yB6juzyWjg",[],{"data":23799,"content":23800,"nodeType":860},{},[23801],{"data":23802,"marks":23803,"value":23804,"nodeType":864},{},[],"IT asked Security to review a new app and its vendor to identify risks and determine if it should be adopted. At this point, security would specify which controls were required for it to be used securely. This all happened  before an app touched their network and interacted with any live data.",{"data":23806,"content":23807,"nodeType":860},{},[23808],{"data":23809,"marks":23810,"value":23811,"nodeType":864},{},[],"In return, Security could rely on IT to give them accurate information about all the businesses’ technology assets that needed to be protected. This process gave both teams great visibility across their total IT environment. Security and IT could maintain a high degree of control over how technology was used. ",{"data":23813,"content":23814,"nodeType":860},{},[23815],{"data":23816,"marks":23817,"value":23818,"nodeType":864},{},[],"In other words, life was wonderful and no one ever got hacked (maybe, it’s hard to remember now). Then the cloud happened and ruined everything.",{"data":23820,"content":23821,"nodeType":860},{},[23822],{"data":23823,"marks":23824,"value":23826,"nodeType":864},{},[23825],{"type":2246},"Clearly I’m joking, but while very few orgs got it perfect, it was “good enough” at providing process-driven visibility of what enterprise software was being deployed for most.",{"data":23828,"content":23829,"nodeType":1312},{},[23830],{"data":23831,"marks":23832,"value":23833,"nodeType":864},{},[],"The birth of the “as-a-Service” era",{"data":23835,"content":23836,"nodeType":860},{},[23837],{"data":23838,"marks":23839,"value":23840,"nodeType":864},{},[],"I jest, the cloud hasn’t ruined everything. It gave organizations the opportunity to be faster, more flexible and more efficient. Businesses no longer had to buy and manage all their own infrastructure and apps, they could just pay for what they used when they needed it. It led to a wave of “as-a-service” business models that stretched across infrastructure, platforms and software. ",{"data":23842,"content":23843,"nodeType":860},{},[23844],{"data":23845,"marks":23846,"value":23847,"nodeType":864},{},[],"Thousands of new software-as-a-service (SaaS) companies emerged with high quality apps that were easy to use over the internet. Essentially SaaS created software employees could use on-demand, which was a huge departure from the old days when IT and Security would do loads of security vetting upfront because they knew they’d be stuck with the software for years after deploying.",{"data":23849,"content":23850,"nodeType":860},{},[23851],{"data":23852,"marks":23853,"value":23854,"nodeType":864},{},[],"Leveraging great on-demand software tools boosted employee productivity and made their businesses more competitive. Tech-savvy employees, used to subscribing to on-demand software services in their personal lives, started to demand more autonomy over the technology they use at work. They were no longer satisfied with the generic suite of programs that IT could provide for them. Instead, they wanted the specialist tools designed and built for people like them by people like them. ",{"data":23856,"content":23857,"nodeType":860},{},[23858],{"data":23859,"marks":23860,"value":23861,"nodeType":864},{},[],"Despite users loving the software once they tried it, SaaS vendors were struggling to sell into large organizations with complicated procurement processes - it was too difficult to get their software in user's hands, and got more difficult the more niche and specialized the app was.",{"data":23863,"content":23864,"nodeType":1312},{},[23865],{"data":23866,"marks":23867,"value":23868,"nodeType":864},{},[],"The rise of Product-Led Growth",{"data":23870,"content":23871,"nodeType":860},{},[23872],{"data":23873,"marks":23874,"value":23875,"nodeType":864},{},[],"Enter Wes Bush, a young SaaS marketer who published his book Product Led Growth in 2019. In it, he showed SaaS vendors how they can increase their sales revenues while reducing their sales cycles and costs by using their products as their primary go-to-market vehicle, as opposed to traditional sales teams. ",{"data":23877,"content":23878,"nodeType":860},{},[23879,23883,23892],{"data":23880,"marks":23881,"value":23882,"nodeType":864},{},[],"The premise is simple; prospective customers prefer to experience the value of a product rather than be told about it by sales people. Back in 2015 Forrester ",{"data":23884,"content":23886,"nodeType":883},{"uri":23885},"https://www.forrester.com/blogs/15-04-14-death_of_a_b2b_salesman/",[23887],{"data":23888,"marks":23889,"value":23891,"nodeType":864},{},[23890],{"type":1455},"reported",{"data":23893,"marks":23894,"value":23895,"nodeType":864},{},[]," that 75% of B2B buyers prefer a sales-rep-free buying process. The book became a phenomenon within the SaaS industry. Product-led growth (PLG) is now the norm for SaaS companies, and around 60% of SaaS companies now use PLG and that’s only going to increase.",{"data":23897,"content":23901,"nodeType":996},{"target":23898},{"sys":23899},{"id":23900,"type":1001,"linkType":1002},"747PuaJ26IbolPB1ugxd2h",[],{"data":23903,"content":23904,"nodeType":860},{},[23905],{"data":23906,"marks":23907,"value":23908,"nodeType":864},{},[],"Why is PLG turning software adoption on its head? In order to establish a PLG go-to-market motion, SaaS vendors need end users to try their product, either as a free trial or a free version of the app, and quickly experience value from it so  they’re motivated to champion the internal business case through to a successful purchase. ",{"data":23910,"content":23911,"nodeType":860},{},[23912],{"data":23913,"marks":23914,"value":23915,"nodeType":864},{},[],"PLG not only relies upon end users as the initial adopters of a new app, but for them to experience meaningful value during that initial experience. This nearly always necessitates that the new app interacts with real data in a live environment. What’s more, it’s only the apps that end users want to use in a paid tier that are likely to ever get submitted to the app-onboarding process. The freemium and trial versions of apps that are just tried out are unlikely to ever be presented to IT and security. ",{"data":23917,"content":23918,"nodeType":860},{},[23919,23923],{"data":23920,"marks":23921,"value":23922,"nodeType":864},{},[],"This obviously poses a problem from an IT and security standpoint.",{"data":23924,"marks":23925,"value":1171,"nodeType":864},{},[23926],{"type":899},{"data":23928,"content":23929,"nodeType":860},{},[23930],{"data":23931,"marks":23932,"value":23934,"nodeType":864},{},[23933],{"type":899},"SaaS vendors are deliberately bypassing the traditional software procurement processes that used to give IT and security teams visibility of the third party apps that had their data. ",{"data":23936,"content":23937,"nodeType":860},{},[23938],{"data":23939,"marks":23940,"value":23941,"nodeType":864},{},[],"Instead, SaaS vendors are directly targeting employees with their apps and encouraging them to plug them straight into live environments before they’ve been vetted. Software onboarding now looks a lot more like this:",{"data":23943,"content":23947,"nodeType":996},{"target":23944},{"sys":23945},{"id":23946,"type":1001,"linkType":1002},"61Oj6GzX4amLxEJ5fPDJCq",[],{"data":23949,"content":23950,"nodeType":1312},{},[23951],{"data":23952,"marks":23953,"value":23954,"nodeType":864},{},[],"IT and security teams might be the last to know about PLG and miss the scale of the change",{"data":23956,"content":23957,"nodeType":860},{},[23958],{"data":23959,"marks":23960,"value":23961,"nodeType":864},{},[],"IT & security folks are usually ahead of the curve when it comes to technology shifts, but in this case many might have missed the scale or speed of the change. That’s because IT and security tools are among the least product-led of any sector. Most of our industry’s tools require heavy integrations, complicated setup, agent deployments, and so on. ",{"data":23963,"content":23967,"nodeType":996},{"target":23964},{"sys":23965},{"id":23966,"type":1001,"linkType":1002},"2ldVELsUQIU0xaPSPJyXBR",[],{"data":23969,"content":23970,"nodeType":860},{},[23971],{"data":23972,"marks":23973,"value":23974,"nodeType":864},{},[],"Unfortunately, few security companies are making products as easy to set up and use as new tools for marketing, sales, finance, development, engineering design, legal, HR, and basically every other sector that can’t rely on a technical first user. ",{"data":23976,"content":23977,"nodeType":860},{},[23978],{"data":23979,"marks":23980,"value":23983,"nodeType":864},{},[23981,23982],{"type":2246},{"type":899},"This leads to a misconception in IT and Security teams that self-adopted apps are fringe and don’t contain significant sensitive data.",{"data":23985,"content":23986,"nodeType":860},{},[23987,23991,23996],{"data":23988,"marks":23989,"value":23990,"nodeType":864},{},[],"Most concerning for security teams is that ",{"data":23992,"marks":23993,"value":23995,"nodeType":864},{},[23994],{"type":899},"the sheer number of apps in use has increased dramatically",{"data":23997,"marks":23998,"value":23999,"nodeType":864},{},[]," and will continue to do so. There are a couple reasons for this: ",{"data":24001,"content":24002,"nodeType":23195},{},[24003,24013],{"data":24004,"content":24005,"nodeType":945},{},[24006],{"data":24007,"content":24008,"nodeType":860},{},[24009],{"data":24010,"marks":24011,"value":24012,"nodeType":864},{},[],"The big old monolithic on-prem software is being replaced not by a single SaaS app, but an ecosystem of specialized apps. Each new app integrates and extends the functionality as the team using the stack learns what they need, so there is a one-to-many shift happening. ",{"data":24014,"content":24015,"nodeType":945},{},[24016],{"data":24017,"content":24018,"nodeType":860},{},[24019],{"data":24020,"marks":24021,"value":24022,"nodeType":864},{},[],"Since apps are virtually zero-maintenance these days, the operating cost (if not the licensing cost) of running multiple apps is almost the same as one (compared to on-prem apps), so duplicate apps are far less of a problem. This also makes them pretty common and further multiplies the number of apps and vendors.",{"data":24024,"content":24025,"nodeType":1009},{},[24026],{"data":24027,"marks":24028,"value":24029,"nodeType":864},{},[],"The impact of self-adoption on security",{"data":24031,"content":24032,"nodeType":1312},{},[24033],{"data":24034,"marks":24035,"value":24036,"nodeType":864},{},[],"Loss of visibility",{"data":24038,"content":24039,"nodeType":860},{},[24040],{"data":24041,"marks":24042,"value":24043,"nodeType":864},{},[],"We’ve seen how SaaS vendors' move to PLG has led to greater employee self-adoption of work apps that don’t require IT or Security to be involved. The direct consequence of this is that Security teams have lost process-driven visibility of their company’s SaaS estate. This problem is often called “Shadow SaaS.” It is also the first problem to solve -  the old adage “you can’t secure what you don’t know about” is as true in the SaaS world as it is in any other security domain.",{"data":24045,"content":24046,"nodeType":860},{},[24047],{"data":24048,"marks":24049,"value":24050,"nodeType":864},{},[],"The lack of visibility means many IT and security teams missed the explosion of SaaS apps, plugins, extensions, and integrations that make up the modern IT stack.  More crucially, they’ve missed the movement of company data into these apps. Complicating matters further, many of these apps are duplicate, abandoned or unmanaged - an issue often called “SaaS sprawl.”",{"data":24052,"content":24056,"nodeType":996},{"target":24053},{"sys":24054},{"id":24055,"type":1001,"linkType":1002},"5NfrrDeIPs7TE213UYly7E",[],{"data":24058,"content":24059,"nodeType":1312},{},[24060],{"data":24061,"marks":24062,"value":24063,"nodeType":864},{},[],"Increasing incidents and impacts",{"data":24065,"content":24066,"nodeType":860},{},[24067],{"data":24068,"marks":24069,"value":24070,"nodeType":864},{},[],"Though security teams have lost direct visibility, they’ve not lost complete visibility and many are finding out about at least a fraction of these apps - typically by working with finance teams once employees want apps to go from free-tier to licensed plans. And all too often, security teams find out about shadow SaaS apps in the worst way possible - when something has already gone wrong and security is asked to respond to an incident on a SaaS platform.",{"data":24072,"content":24073,"nodeType":860},{},[24074],{"data":24075,"marks":24076,"value":24077,"nodeType":864},{},[],"In both cases, security is getting visibility too late to be of much value. Once a team has been using an app (even on a free tier) for a year, there is very little Security can do that will convince them to move to a more secure app, or for multiple teams to use a single app. Typically, this intervention from Security needs to happen very early - long before finance is involved - in order to make a positive impact. ",{"data":24079,"content":24080,"nodeType":860},{},[24081],{"data":24082,"marks":24083,"value":24084,"nodeType":864},{},[],"Incident Response is necessary, of course, when a SaaS account is breached (or an ex-employee SaaS account that was never properly offboarded), but cannot recover the lost data after the proverbial horse has bolted. It’s now possible to get into the process early, so security teams can get ahead of the problem to reduce the risk.",{"data":24086,"content":24087,"nodeType":860},{},[24088],{"data":24089,"marks":24090,"value":24091,"nodeType":864},{},[],"Another situation that is increasingly pressing, and difficult for security teams to deal with is the increasingly regular: “App X has just had a major breach, are we using AppX, is any of our data there?” It’s an embarrassing situation to not be able to answer these questions.",{"data":24093,"content":24094,"nodeType":1312},{},[24095],{"data":24096,"marks":24097,"value":24098,"nodeType":864},{},[],"Core problem",{"data":24100,"content":24101,"nodeType":860},{},[24102,24106,24115],{"data":24103,"marks":24104,"value":24105,"nodeType":864},{},[],"Once teams get visibility into the scope of the Shadow SaaS and sprawl problem, they find that Security no longer dictates the pace of adoption. They’re also typically surprised by the sheer volume of apps employees have adopted. A ",{"data":24107,"content":24109,"nodeType":883},{"uri":24108},"https://ascendixtech.com/number-saas-companies-statistics/",[24110],{"data":24111,"marks":24112,"value":24114,"nodeType":864},{},[24113],{"type":1455},"report from Ascendix",{"data":24116,"marks":24117,"value":24118,"nodeType":864},{},[]," claims that “by the end of 2023, there will be anywhere from 30,000-72,000 SaaS companies in operation.” Clearly these aren’t all work apps or hyper specialized, but there should be no doubt that we aren’t talking about a few dozen apps being adopted.",{"data":24120,"content":24121,"nodeType":860},{},[24122],{"data":24123,"marks":24124,"value":24125,"nodeType":864},{},[],"Once teams get visibility of the pace that news apps are added they realize they need to risk assess dozens of apps a month instead of the dozen a year that were going through IT in the old, managed and controlled process. To deal with this massive influx of new apps, security teams feel they must either radically increase the headcount, cut corners or drastically increase acceptable risk levels for data security. None of these are pleasant options.",{"data":24127,"content":24128,"nodeType":1312},{},[24129],{"data":24130,"marks":24131,"value":24132,"nodeType":864},{},[],"Temptation to revert to the old ways of block-first",{"data":24134,"content":24135,"nodeType":860},{},[24136],{"data":24137,"marks":24138,"value":24139,"nodeType":864},{},[],"When the idea of the options above proves daunting or impossible, Security often tries to revert to the old process - regain the ability to set the pace of adoption by re-establishing the gate. Practically, this means that you’re deploying technical controls to try block all SaaS apps until they are approved (and marked as allowed) by IT or Security. Cloud Access Security Brokers (CASBs) were built to do exactly this - help security teams control (and block) access to “unsanctioned” SaaS that IT hasn’t approved (incidentally I think this explains why the CASB segment has failed). ",{"data":24141,"content":24142,"nodeType":860},{},[24143],{"data":24144,"marks":24145,"value":24146,"nodeType":864},{},[],"Technically, this makes total sense. But the unforeseen consequence is that it positions Security as blockers (aka the “department of no”), and puts them at odds with the rest of the business, rather than working towards a shared goal. ",{"data":24148,"content":24149,"nodeType":860},{},[24150,24154,24159],{"data":24151,"marks":24152,"value":24153,"nodeType":864},{},[],"This block-everything-until-security-approves-it position requires incredible executive support to maintain. For all but the most risk-sensitive organizations (read .gov), this position also normalizes employee behavior to bypass Security in favor of working quickly and effectively. In the end, Security actually ",{"data":24155,"marks":24156,"value":24158,"nodeType":864},{},[24157],{"type":2246},"loses visibility",{"data":24160,"marks":24161,"value":24162,"nodeType":864},{},[]," into employee SaaS use and effectively loses control, rather than locking it down. On behalf of all the employees out there, I want to make a point to say employees aren’t trying to break rules Security put in place, they’re just trying to get their jobs done, and might try and find ways around things they see as unreasonably slowing them down or preventing them from reaching their targets. Seen in this light, it’s no surprise that:",{"data":24164,"content":24165,"nodeType":941},{},[24166,24176,24186],{"data":24167,"content":24168,"nodeType":945},{},[24169],{"data":24170,"content":24171,"nodeType":860},{},[24172],{"data":24173,"marks":24174,"value":24175,"nodeType":864},{},[],"If you block websites, employees bypass network controls, ",{"data":24177,"content":24178,"nodeType":945},{},[24179],{"data":24180,"content":24181,"nodeType":860},{},[24182],{"data":24183,"marks":24184,"value":24185,"nodeType":864},{},[],"if you block social logins, employees use passwords, ",{"data":24187,"content":24188,"nodeType":945},{},[24189],{"data":24190,"content":24191,"nodeType":860},{},[24192],{"data":24193,"marks":24194,"value":24195,"nodeType":864},{},[],"if you stop them using work devices to sign up to apps, they use personal devices.",{"data":24197,"content":24198,"nodeType":860},{},[24199],{"data":24200,"marks":24201,"value":24204,"nodeType":864},{},[24202,24203],{"type":2246},{"type":899},"Each blocking action leads to a worse security outcome, and blinds the security team further - losing control rather than regaining it.",{"data":24206,"content":24207,"nodeType":860},{},[24208],{"data":24209,"marks":24210,"value":24211,"nodeType":864},{},[],"You can attempt to delay this process by blocking, or you can adapt.",{"data":24213,"content":24214,"nodeType":1312},{},[24215],{"data":24216,"marks":24217,"value":24218,"nodeType":864},{},[],"Surely there’s a better way",{"data":24220,"content":24221,"nodeType":860},{},[24222],{"data":24223,"marks":24224,"value":24225,"nodeType":864},{},[],"Of course we think there’s a better way, or we wouldn’t have written this. And don’t call me Shirley. ",{"data":24227,"content":24228,"nodeType":860},{},[24229],{"data":24230,"marks":24231,"value":24232,"nodeType":864},{},[],"The first thing we need to do as an industry is agree that we don’t want to be the blockers. We don’t want to stop employees from self-adopting apps. We understand they are best placed to find and select the tools that are going to allow them to be more productive and help your company succeed. We need to embrace SaaS app self-adoption. Stop asking employees to adapt to fit our legacy processes and meet them halfway. Security can no longer be a gate with a default stance of “No, until.” Instead Security needs to be a business enablement partner that says “Yes, unless.”",{"data":24234,"content":24235,"nodeType":1312},{},[24236],{"data":24237,"marks":24238,"value":24239,"nodeType":864},{},[],"Yes, unless?",{"data":24241,"content":24242,"nodeType":860},{},[24243],{"data":24244,"marks":24245,"value":24246,"nodeType":864},{},[],"To adapt to this new SaaS-first world, security must move from saying “No, until we’ve had time to fully vet and onboard this app officially” to “Yes! You can use that app, unless we quickly identify security risks that outweigh the value of the tool.” I understand this is deeply uncomfortable for many security practitioners (as it still is for me), but let me explain why I think this leads to a better long-term outcome.",{"data":24248,"content":24249,"nodeType":860},{},[24250],{"data":24251,"marks":24252,"value":24253,"nodeType":864},{},[],"Obviously, self-adoption of SaaS is fundamentally different to IT/Security adopted and managed from a risk perspective. With SaaS, there’s no giant commitment upfront. SaaS apps aren’t forever - quite the opposite! Apps aren’t just unused and not-adopted and then suddenly fully-adopted. Just like adopting software was a process for Security and IT back in the day, employees follow a (less rigid) process with SaaS - from testing > to using > to finding value > to inviting teammates, etc. The risk grows as we proceed through the adoption process as employees add more data into the app and integrate it with other apps. ",{"data":24255,"content":24259,"nodeType":996},{"target":24256},{"sys":24257},{"id":24258,"type":1001,"linkType":1002},"2nzyuXDxjBGZN0YMvskGak",[],{"data":24261,"content":24262,"nodeType":860},{},[24263],{"data":24264,"marks":24265,"value":24266,"nodeType":864},{},[],"The upside for Security is that because SaaS adoption is a process over time, we can use that time to assess the risk of the app before it’s fully adopted, as long as we know about the app from the start. Luckily, many apps employees are using might ultimately be very low risk, so not every app will require a full security vetting like you would have done in the old-school process.",{"data":24268,"content":24269,"nodeType":860},{},[24270],{"data":24271,"marks":24272,"value":24273,"nodeType":864},{},[],"Our role as Security is to catch those apps that are high risk, either because the data going into them (or that will be) is high risk or because the app can perform some high-risk action (like managing your inventory or sending emails to customers or your behalf). Security can focus their efforts on these high-risk vendors and apps to make sure they can be trusted with their data. But the key thing is that Security needs to get involved early in the adoption process. ",{"data":24275,"content":24276,"nodeType":860},{},[24277],{"data":24278,"marks":24279,"value":24280,"nodeType":864},{},[],"I’m getting into the details now - so this feels like a good time to take a step back and think about the elements that make up a SaaS security program.",{"data":24282,"content":24283,"nodeType":1009},{},[24284],{"data":24285,"marks":24286,"value":24287,"nodeType":864},{},[],"What’s a good SaaS security program?",{"data":24289,"content":24290,"nodeType":860},{},[24291],{"data":24292,"marks":24293,"value":24294,"nodeType":864},{},[],"The shared-responsibility model between cloud platforms and their customers is a great place to start, as it helps customers understand what their responsibilities are, and which responsibilities they’re delegating to their cloud provider.",{"data":24296,"content":24297,"nodeType":1312},{},[24298],{"data":24299,"marks":24300,"value":24301,"nodeType":864},{},[],"Delegate to the cloud provider when you can ",{"data":24303,"content":24304,"nodeType":860},{},[24305,24309,24318],{"data":24306,"marks":24307,"value":24308,"nodeType":864},{},[],"It’s ",{"data":24310,"content":24312,"nodeType":883},{"uri":24311},"https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model",[24313],{"data":24314,"marks":24315,"value":24317,"nodeType":864},{},[24316],{"type":1455},"generally preferable",{"data":24319,"marks":24320,"value":24321,"nodeType":864},{},[]," to delegate as much responsibility as possible to the cloud provider, so it’s no surprise that the SaaS model is the most common and fastest growing sector.",{"data":24323,"content":24324,"nodeType":860},{},[24325],{"data":24326,"marks":24327,"value":24328,"nodeType":864},{},[],"The following summary table produced by the National Cyber Security Centre (NCSC) does a great job at showing how much of the balance of security responsibility is outsourced to the SaaS provider. For reference, IaaS = infrastructure-as-a-service; PaaS = platform-as-a-service; SaaS = software-as-a-service:",{"data":24330,"content":24333,"nodeType":996},{"target":24331},{"sys":24332},{"id":22089,"type":1001,"linkType":1002},[],{"data":24335,"content":24336,"nodeType":860},{},[24337],{"data":24338,"marks":24339,"value":24340,"nodeType":864},{},[],"According to NCSC, the customer is responsible only for:",{"data":24342,"content":24343,"nodeType":23195},{},[24344,24354],{"data":24345,"content":24346,"nodeType":945},{},[24347],{"data":24348,"content":24349,"nodeType":860},{},[24350],{"data":24351,"marks":24352,"value":24353,"nodeType":864},{},[],"The configuration of the SaaS app and ",{"data":24355,"content":24356,"nodeType":945},{},[24357],{"data":24358,"content":24359,"nodeType":860},{},[24360],{"data":24361,"marks":24362,"value":24363,"nodeType":864},{},[],"Making sure that the identity and access control features provided by the vendor are used properly.",{"data":24365,"content":24366,"nodeType":860},{},[24367],{"data":24368,"marks":24369,"value":24370,"nodeType":864},{},[],"It’s worth pointing out here that the way application configuration is presented here is a bit of a red herring. The vast majority of SaaS apps (and especially self-adopted apps) allow very little, if any, configuration. Sure, the big core apps like Salesforce, Google Workspace, Microsoft 365 do (and often require a dedicated team or partner to run them), but they are highly unlikely to be self-adopted by employees.  As far as configuration is concerned, Security teams will often be limited to enabling “force MFA for all users” or “disallow public sharing” type of controls that are accessible even to non-technical users.",{"data":24372,"content":24373,"nodeType":860},{},[24374],{"data":24375,"marks":24376,"value":24377,"nodeType":864},{},[],"For the vast majority of apps in the organization, Security’s responsibility will boil down to:",{"data":24379,"content":24380,"nodeType":941},{},[24381,24391,24401],{"data":24382,"content":24383,"nodeType":945},{},[24384],{"data":24385,"content":24386,"nodeType":860},{},[24387],{"data":24388,"marks":24389,"value":24390,"nodeType":864},{},[],"Account security, i.e. making sure MFA and SSO (where available) is in place. ",{"data":24392,"content":24393,"nodeType":945},{},[24394],{"data":24395,"content":24396,"nodeType":860},{},[24397],{"data":24398,"marks":24399,"value":24400,"nodeType":864},{},[],"Ensuring  employees are using strong passwords, especially if MFA and/or SSO aren’t available.",{"data":24402,"content":24403,"nodeType":945},{},[24404],{"data":24405,"content":24406,"nodeType":860},{},[24407],{"data":24408,"marks":24409,"value":24410,"nodeType":864},{},[],"Removing external accounts (and accounts for those that have left the company) when no longer needed.",{"data":24412,"content":24413,"nodeType":860},{},[24414],{"data":24415,"marks":24416,"value":24417,"nodeType":864},{},[],"Isn’t it risky to delegate responsibility? While delegating security responsibilities is great and takes a huge load off your team, we do, unfortunately, need to consider who we’re delegating it to. Those gray boxes in the diagram above need to be taken care of.",{"data":24419,"content":24420,"nodeType":860},{},[24421],{"data":24422,"marks":24423,"value":24424,"nodeType":864},{},[],"This is what’s sometimes understood as “supply chain” security. You need to trust the SaaS vendor to uphold their end of the bargain and, more often than not, also the SaaS/cloud vendors they use (their sub-processors) as well.",{"data":24426,"content":24427,"nodeType":860},{},[24428],{"data":24429,"marks":24430,"value":24431,"nodeType":864},{},[],"This sounds a lot scarier than it is and in practice many SaaS vendors do a great job, with many providing easy-to-audit, externally-verified, policies through a framework such as SOC2, and most do regular penetration tests and have bug bounty programs etc.",{"data":24433,"content":24434,"nodeType":860},{},[24435],{"data":24436,"marks":24437,"value":24438,"nodeType":864},{},[],"There are exceptions when it makes sense to think more carefully about whether a third party can be trusted. Common reasons Push customers have cited for not trusting third parties include; ",{"data":24440,"content":24441,"nodeType":941},{},[24442],{"data":24443,"content":24444,"nodeType":945},{},[24445],{"data":24446,"content":24447,"nodeType":860},{},[24448],{"data":24449,"marks":24450,"value":24451,"nodeType":864},{},[],"The data going into these apps is simply too high risk. Many organizations have very sensitive customer information or intellectual property that they simply aren’t willing to entrust to a third party. Many don’t trust a third party with administrative access to the systems where this data is held.",{"data":24453,"content":24454,"nodeType":860},{},[24455],{"data":24456,"marks":24457,"value":24458,"nodeType":864},{},[],"If the data in the app, or the access the app has represents some significant (but not unacceptable) risk, you may also care about:",{"data":24460,"content":24461,"nodeType":941},{},[24462,24509,24519],{"data":24463,"content":24464,"nodeType":945},{},[24465],{"data":24466,"content":24467,"nodeType":860},{},[24468,24472,24481,24484,24493,24496,24505],{"data":24469,"marks":24470,"value":24471,"nodeType":864},{},[],"Vendors who’ve had a string of repeated breaches or security incidents. This is troubling because it’s a fairly common pattern for attackers to breach apps in ways that don’t impact customer information, but then use the information they learn from these breaches to launch far more successful breaches in future. Consider the string of breaches at ",{"data":24473,"content":24475,"nodeType":883},{"uri":24474},"https://www.bleepingcomputer.com/search/?q=lastpass+breach",[24476],{"data":24477,"marks":24478,"value":24480,"nodeType":864},{},[24479],{"type":1455},"LastPass",{"data":24482,"marks":24483,"value":3731,"nodeType":864},{},[],{"data":24485,"content":24487,"nodeType":883},{"uri":24486},"https://www.bleepingcomputer.com/search/?q=okta+breach",[24488],{"data":24489,"marks":24490,"value":24492,"nodeType":864},{},[24491],{"type":1455},"Okta",{"data":24494,"marks":24495,"value":3731,"nodeType":864},{},[],{"data":24497,"content":24499,"nodeType":883},{"uri":24498},"https://www.bleepingcomputer.com/search/?q=twilio+breach",[24500],{"data":24501,"marks":24502,"value":24504,"nodeType":864},{},[24503],{"type":1455},"Twilio",{"data":24506,"marks":24507,"value":24508,"nodeType":864},{},[]," (and many others) or as a typical example of this.",{"data":24510,"content":24511,"nodeType":945},{},[24512],{"data":24513,"content":24514,"nodeType":860},{},[24515],{"data":24516,"marks":24517,"value":24518,"nodeType":864},{},[],"Products that don’t offer adequate security features. Customers expect features such as MFA, SSO (either social login through OIDC or, ideally, SAML), and the ability to enforce these controls. This is especially important on platforms where the data is high-risk.",{"data":24520,"content":24521,"nodeType":945},{},[24522],{"data":24523,"content":24524,"nodeType":860},{},[24525],{"data":24526,"marks":24527,"value":24528,"nodeType":864},{},[],"The vendor operates in a sanctioned country or may not have the resources to adequately protect your data. Clearly vendors operating from (or that have close ties with) sanctioned or politically-complicated countries represent additional risk, as do vendors that are “one man bands” or are so small that it is hard to imagine they can afford to spend significant resources on security.",{"data":24530,"content":24531,"nodeType":1312},{},[24532],{"data":24533,"marks":24534,"value":24535,"nodeType":864},{},[],"The two questions you need to ask to assess risk ",{"data":24537,"content":24538,"nodeType":860},{},[24539],{"data":24540,"marks":24541,"value":24542,"nodeType":864},{},[],"The essence of the shared-responsibility model can summarized as two questions:",{"data":24544,"content":24545,"nodeType":23195},{},[24546,24556],{"data":24547,"content":24548,"nodeType":945},{},[24549],{"data":24550,"content":24551,"nodeType":860},{},[24552],{"data":24553,"marks":24554,"value":24555,"nodeType":864},{},[],"Should we be using this app?",{"data":24557,"content":24558,"nodeType":945},{},[24559],{"data":24560,"content":24561,"nodeType":860},{},[24562],{"data":24563,"marks":24564,"value":24565,"nodeType":864},{},[],"Are we using it securely?",{"data":24567,"content":24570,"nodeType":996},{"target":24568},{"sys":24569},{"id":22116,"type":1001,"linkType":1002},[],{"data":24572,"content":24573,"nodeType":860},{},[24574],{"data":24575,"marks":24576,"value":24577,"nodeType":864},{},[],"A successful SaaS security program must address both these questions. We can’t spend all our time doing risk assessments and due diligence exercises on our supply chain while dropping the ball on account security. Similarly, we can’t just focus on making sure all accounts have MFA in place when the vendor is leaving the back door open.",{"data":24579,"content":24580,"nodeType":1009},{},[24581],{"data":24582,"marks":24583,"value":24584,"nodeType":864},{},[],"When shared responsibility goes wrong",{"data":24586,"content":24587,"nodeType":860},{},[24588],{"data":24589,"marks":24590,"value":24591,"nodeType":864},{},[],"The following is an extract of some well-covered recent(ish) breaches of SaaS companies. As we go through it, pay attention to which side is dropping the ball in terms of the shared responsibility. The same organization can be:",{"data":24593,"content":24594,"nodeType":941},{},[24595,24605,24615],{"data":24596,"content":24597,"nodeType":945},{},[24598],{"data":24599,"content":24600,"nodeType":860},{},[24601],{"data":24602,"marks":24603,"value":24604,"nodeType":864},{},[],"the source of a breach, ",{"data":24606,"content":24607,"nodeType":945},{},[24608],{"data":24609,"content":24610,"nodeType":860},{},[24611],{"data":24612,"marks":24613,"value":24614,"nodeType":864},{},[],"the ultimate target that motivated a breach at a partner that was a softer target, ",{"data":24616,"content":24617,"nodeType":945},{},[24618],{"data":24619,"content":24620,"nodeType":860},{},[24621],{"data":24622,"marks":24623,"value":24624,"nodeType":864},{},[],"or simply the unlucky victim of a breach further down its supply chain.",{"data":24626,"content":24627,"nodeType":860},{},[24628],{"data":24629,"marks":24630,"value":24631,"nodeType":864},{},[],"That’s the thing about supply chain attacks, organizations are the attacker’s stepping stones. Where they are in the attack chain determines how we label their victims. ",{"data":24633,"content":24634,"nodeType":4845},{},[24635,24660,24741,24798,24841,24966],{"data":24636,"content":24637,"nodeType":4581},{},[24638,24649],{"data":24639,"content":24640,"nodeType":4569},{},[24641],{"data":24642,"content":24643,"nodeType":860},{},[24644],{"data":24645,"marks":24646,"value":24648,"nodeType":864},{},[24647],{"type":899},"Date",{"data":24650,"content":24651,"nodeType":4569},{},[24652],{"data":24653,"content":24654,"nodeType":860},{},[24655],{"data":24656,"marks":24657,"value":24659,"nodeType":864},{},[24658],{"type":899},"SaaS attack",{"data":24661,"content":24662,"nodeType":4581},{},[24663,24673],{"data":24664,"content":24665,"nodeType":4569},{},[24666],{"data":24667,"content":24668,"nodeType":860},{},[24669],{"data":24670,"marks":24671,"value":24672,"nodeType":864},{},[],"April 2021",{"data":24674,"content":24675,"nodeType":4569},{},[24676,24704],{"data":24677,"content":24678,"nodeType":860},{},[24679,24682,24691,24695,24700],{"data":24680,"marks":24681,"value":21,"nodeType":864},{},[],{"data":24683,"content":24685,"nodeType":883},{"uri":24684},"https://about.codecov.io/security-update/",[24686],{"data":24687,"marks":24688,"value":24690,"nodeType":864},{},[24689],{"type":1455},"Backdoors inserted into some Codecov.io",{"data":24692,"marks":24693,"value":24694,"nodeType":864},{},[]," (a software development SaaS) tools after a credential breach grants access to their ",{"data":24696,"marks":24697,"value":24699,"nodeType":864},{},[24698],{"type":899},"Google Cloud Project",{"data":24701,"marks":24702,"value":24703,"nodeType":864},{},[]," (cloud infrastructure SaaS).  ",{"data":24705,"content":24706,"nodeType":860},{},[24707,24711,24720,24724,24729,24733,24737],{"data":24708,"marks":24709,"value":24710,"nodeType":864},{},[],"This breach ",{"data":24712,"content":24714,"nodeType":883},{"uri":24713},"https://www.twilio.com/blog/response-to-the-codecov-vulnerability",[24715],{"data":24716,"marks":24717,"value":24719,"nodeType":864},{},[24718],{"type":1455},"affected multiple customers",{"data":24721,"marks":24722,"value":24723,"nodeType":864},{},[],", including ",{"data":24725,"marks":24726,"value":24728,"nodeType":864},{},[24727],{"type":899},"Atlassian",{"data":24730,"marks":24731,"value":24732,"nodeType":864},{},[]," (a developer and collaboration SaaS platform) and ",{"data":24734,"marks":24735,"value":24504,"nodeType":864},{},[24736],{"type":899},{"data":24738,"marks":24739,"value":24740,"nodeType":864},{},[]," (communications tooling SaaS company).  ",{"data":24742,"content":24743,"nodeType":4581},{},[24744,24754],{"data":24745,"content":24746,"nodeType":4569},{},[24747],{"data":24748,"content":24749,"nodeType":860},{},[24750],{"data":24751,"marks":24752,"value":24753,"nodeType":864},{},[],"Jan 2022",{"data":24755,"content":24756,"nodeType":4569},{},[24757],{"data":24758,"content":24759,"nodeType":860},{},[24760,24764,24768,24777,24781,24786,24790,24794],{"data":24761,"marks":24762,"value":24492,"nodeType":864},{},[24763],{"type":899},{"data":24765,"marks":24766,"value":24767,"nodeType":864},{},[]," (identity provider SaaS) ",{"data":24769,"content":24771,"nodeType":883},{"uri":24770},"https://www.okta.com/blog/2022/03/oktas-investigation-of-the-january-2022-compromise/",[24772],{"data":24773,"marks":24774,"value":24776,"nodeType":864},{},[24775],{"type":1455},"systems breached",{"data":24778,"marks":24779,"value":24780,"nodeType":864},{},[]," through a breach at ",{"data":24782,"marks":24783,"value":24785,"nodeType":864},{},[24784],{"type":899},"Sitel",{"data":24787,"marks":24788,"value":24789,"nodeType":864},{},[],", a support partner - attackers got access to Okta’s instances of ",{"data":24791,"marks":24792,"value":24728,"nodeType":864},{},[24793],{"type":899},{"data":24795,"marks":24796,"value":24797,"nodeType":864},{},[]," Jira, Slack, Splunk, RingCentral, and support tickets through Salesforce.  ",{"data":24799,"content":24800,"nodeType":4581},{},[24801,24811],{"data":24802,"content":24803,"nodeType":4569},{},[24804],{"data":24805,"content":24806,"nodeType":860},{},[24807],{"data":24808,"marks":24809,"value":24810,"nodeType":864},{},[],"March 2022",{"data":24812,"content":24813,"nodeType":4569},{},[24814],{"data":24815,"content":24816,"nodeType":860},{},[24817,24821,24825,24829,24838],{"data":24818,"marks":24819,"value":24820,"nodeType":864},{},[],"“0ktapus” phishing toolkit targeting ",{"data":24822,"marks":24823,"value":24492,"nodeType":864},{},[24824],{"type":899},{"data":24826,"marks":24827,"value":24828,"nodeType":864},{},[]," customers ",{"data":24830,"content":24832,"nodeType":883},{"uri":24831},"https://www.bleepingcomputer.com/news/security/twilio-hackers-hit-over-130-orgs-in-massive-okta-phishing-attack/",[24833],{"data":24834,"marks":24835,"value":24837,"nodeType":864},{},[24836],{"type":1455},"is released",{"data":24839,"marks":24840,"value":21,"nodeType":864},{},[],{"data":24842,"content":24843,"nodeType":4581},{},[24844,24854],{"data":24845,"content":24846,"nodeType":4569},{},[24847],{"data":24848,"content":24849,"nodeType":860},{},[24850],{"data":24851,"marks":24852,"value":24853,"nodeType":864},{},[],"Aug 2022",{"data":24855,"content":24856,"nodeType":4569},{},[24857,24898,24925,24940,24959],{"data":24858,"content":24859,"nodeType":860},{},[24860,24864,24868,24872,24876,24885,24889,24894],{"data":24861,"marks":24862,"value":24504,"nodeType":864},{},[24863],{"type":899},{"data":24865,"marks":24866,"value":24867,"nodeType":864},{},[]," (one such ",{"data":24869,"marks":24870,"value":24492,"nodeType":864},{},[24871],{"type":899},{"data":24873,"marks":24874,"value":24875,"nodeType":864},{},[]," customer) ",{"data":24877,"content":24879,"nodeType":883},{"uri":24878},"https://www.twilio.com/blog/august-2022-social-engineering-attack",[24880],{"data":24881,"marks":24882,"value":24884,"nodeType":864},{},[24883],{"type":1455},"was again breached",{"data":24886,"marks":24887,"value":24888,"nodeType":864},{},[]," and attackers used access to one of their products (",{"data":24890,"marks":24891,"value":24893,"nodeType":864},{},[24892],{"type":899},"Authy",{"data":24895,"marks":24896,"value":24897,"nodeType":864},{},[],", an MFA mobile app) to bypass MFA for some of their customers. ",{"data":24899,"content":24900,"nodeType":860},{},[24901,24905,24909,24912,24921],{"data":24902,"marks":24903,"value":24904,"nodeType":864},{},[],"Attackers appear to also have used ",{"data":24906,"marks":24907,"value":24504,"nodeType":864},{},[24908],{"type":899},{"data":24910,"marks":24911,"value":1171,"nodeType":864},{},[],{"data":24913,"content":24915,"nodeType":883},{"uri":24914},"https://www.bleepingcomputer.com/news/security/okta-one-time-mfa-passcodes-exposed-in-twilio-cyberattack/",[24916],{"data":24917,"marks":24918,"value":24920,"nodeType":864},{},[24919],{"type":1455},"to gain access to SMS’s",{"data":24922,"marks":24923,"value":24924,"nodeType":864},{},[]," that were delivering Okta MFA codes to customers: ",{"data":24926,"content":24927,"nodeType":860},{},[24928,24932,24936],{"data":24929,"marks":24930,"value":24931,"nodeType":864},{},[],"This leads to a breach at",{"data":24933,"marks":24934,"value":1171,"nodeType":864},{},[24935],{"type":899},{"data":24937,"marks":24938,"value":24939,"nodeType":864},{},[],"Mailchimp (email marketing SaaS), which in turn affects many upstream customers like Digital Ocean (infrastructure hosting SaaS) and Signal Messenger",{"data":24941,"content":24942,"nodeType":860},{},[24943,24947,24956],{"data":24944,"marks":24945,"value":24946,"nodeType":864},{},[],"Klaviyo (another email marketing SaaS) ",{"data":24948,"content":24950,"nodeType":883},{"uri":24949},"https://www.bleepingcomputer.com/news/security/email-marketing-firm-hacked-to-steal-crypto-focused-mailing-lists/",[24951],{"data":24952,"marks":24953,"value":24955,"nodeType":864},{},[24954],{"type":1455},"is also impacted",{"data":24957,"marks":24958,"value":6570,"nodeType":864},{},[],{"data":24960,"content":24961,"nodeType":860},{},[24962],{"data":24963,"marks":24964,"value":24965,"nodeType":864},{},[],"Breaches on these email marketing SaaS apps lead to even more downstream breaches for customers in finance and crypto spaces, such as Trezor, Edge Wallet, Cointelegraph, Ethereum FESP, Messari and Decrypt.",{"data":24967,"content":24968,"nodeType":4581},{},[24969,24979],{"data":24970,"content":24971,"nodeType":4569},{},[24972],{"data":24973,"content":24974,"nodeType":860},{},[24975],{"data":24976,"marks":24977,"value":24978,"nodeType":864},{},[],"Sept and Dec 2022",{"data":24980,"content":24981,"nodeType":4569},{},[24982],{"data":24983,"content":24984,"nodeType":860},{},[24985,24989,24998,25002,25006,25009,25024],{"data":24986,"marks":24987,"value":24988,"nodeType":864},{},[],"Product source code ",{"data":24990,"content":24992,"nodeType":883},{"uri":24991},"https://www.bleepingcomputer.com/news/security/oktas-source-code-stolen-after-github-repositories-hacked/",[24993],{"data":24994,"marks":24995,"value":24997,"nodeType":864},{},[24996],{"type":1455},"stolen from the Github repositories",{"data":24999,"marks":25000,"value":25001,"nodeType":864},{},[]," of ",{"data":25003,"marks":25004,"value":24492,"nodeType":864},{},[25005],{"type":899},{"data":25007,"marks":25008,"value":902,"nodeType":864},{},[],{"data":25010,"content":25012,"nodeType":883},{"uri":25011},"https://www.bleepingcomputer.com/news/security/auth0-warns-that-some-source-code-repos-may-have-been-stolen/",[25013,25019],{"data":25014,"marks":25015,"value":25018,"nodeType":864},{},[25016,25017],{"type":1455},{"type":899},"Auth0",{"data":25020,"marks":25021,"value":25023,"nodeType":864},{},[25022],{"type":1455}," (an Okta subsidiary",{"data":25025,"marks":25026,"value":25027,"nodeType":864},{},[]," that is also an identity provider SaaS platform)",{"data":25029,"content":25030,"nodeType":860},{},[25031],{"data":25032,"marks":25033,"value":25034,"nodeType":864},{},[],"This is a very shallow summary of a small sample of events during this time frame, but it’s interesting how interrelated these SaaS services are. Many are part of each other’s supply chains (for example, Twilio is targeted as an Okta customer itself, and used to compromise Okta customer MFA codes that are delivered by Twilio to other Okta customers) and so breaches in one SaaS have rippling effects that sometimes take months or even years to materialize after a breach occurs.",{"data":25036,"content":25037,"nodeType":860},{},[25038,25042,25050],{"data":25039,"marks":25040,"value":25041,"nodeType":864},{},[],"There’s an interesting trend to call out here: breaches at a SaaS vendor appear to lead to (or correlate with) further breaches, such as the string of breaches at ",{"data":25043,"content":25045,"nodeType":883},{"uri":25044},"https://thehackernews.com/2023/02/lastpass-reveals-second-attack.html",[25046],{"data":25047,"marks":25048,"value":24480,"nodeType":864},{},[25049],{"type":1455},{"data":25051,"marks":25052,"value":25053,"nodeType":864},{},[],". But it’s incredibly unclear how to balance the risk of using these vendors, especially when some of these companies (like Okta) are a big part of many organization’s security strategies.",{"data":25055,"content":25056,"nodeType":860},{},[25057],{"data":25058,"marks":25059,"value":25060,"nodeType":864},{},[],"Ultimately, though… ",{"data":25062,"content":25063,"nodeType":860},{},[25064],{"data":25065,"marks":25066,"value":25069,"nodeType":864},{},[25067,25068],{"type":899},{"type":2246},"The root of most of these networks of supply chain attacks are simple account compromises. ",{"data":25071,"content":25072,"nodeType":860},{},[25073,25077,25082],{"data":25074,"marks":25075,"value":25076,"nodeType":864},{},[],"While most organizations think of the supply chain aspect (should we be using this app?) as the majority of the problem, or at least the first problem to solve - ",{"data":25078,"marks":25079,"value":25081,"nodeType":864},{},[25080],{"type":2246},"account security",{"data":25083,"marks":25084,"value":25085,"nodeType":864},{},[]," is ultimately at the heart of the problem. A developer or support engineer with a weak password or missing MFA is all it takes for them to get phished, kicking off this string of attacks. Unlike the complex supply chain risk questions, account security issues are straightforward to fix. We’d be a whole lot closer to securing the whole supply chain if we could improve account security for all employees across all the SaaS apps they use. ",{"data":25087,"content":25088,"nodeType":1009},{},[25089],{"data":25090,"marks":25091,"value":25092,"nodeType":864},{},[],"Where do we go from here?",{"data":25094,"content":25095,"nodeType":860},{},[25096],{"data":25097,"marks":25098,"value":25099,"nodeType":864},{},[],"So we’ve discussed the domino-like string of effects from SaaS sales, to PLG, to self-adoption, to shadow SaaS, to growing SaaS risks and the news stories we read about.",{"data":25101,"content":25102,"nodeType":860},{},[25103],{"data":25104,"marks":25105,"value":25106,"nodeType":864},{},[],"We’ve unpacked the shared responsibility model - and I hope I’ve convinced you that we need to look at both the supply chain and account security side equally (and in parallel!) to manage this risk. ","Employees using a new work app used to be the final step of the software-onboarding process. Now it's the first. Security must adapt to secure business data. \n","2023-06-22T00:00:00.000Z",{"items":25110},[25111,25113],{"sys":25112,"name":7555},{"id":7554},{"sys":25114,"name":4904},{"id":4903},{"items":25116},[25117],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":25118},{"url":21909},"protect-your-data-across-all-your-apps-even-the-ones-employees-use-without","blog/protect-your-data-across-all-your-apps-even-the-ones-employees-use-without",{"json":25122},{"data":25123,"content":25124,"nodeType":856},{},[25125],{"data":25126,"content":25127,"nodeType":860},{},[25128],{"data":25129,"marks":25130,"value":25131,"nodeType":864},{},[],"SaaS vendors want your employees to self-adopt their apps and start using them (and integrating with your data to do so). This leaves security and IT teams blind to which apps sensitive company data is flowing into. We’ll offer some practical guidance on how to manage supply chain risk without slowing down the business.","Adapt your thinking to secure your data. Security needs to move from being the Department of No to the Department of Yes, Unless... ",{"id":25134,"publishedAt":25135},"tkUfN6TKuYyVNYDpsGWrE","2026-08-12T11:56:12.640Z",{"items":25137},[25138,25140],{"sys":25139,"name":2729},{"id":2728},{"sys":25141,"name":4904},{"id":4903},{"items":25143},[25144,25146,25148,25150,25152,25154,25156,25158,25160,25162],{"sys":25145,"name":545,"slug":546,"tier":31},{"id":542},{"sys":25147,"name":413,"slug":414,"tier":31},{"id":410},{"sys":25149,"name":297,"slug":298,"tier":31},{"id":294},{"sys":25151,"name":589,"slug":590,"tier":45},{"id":586},{"sys":25153,"name":633,"slug":634,"tier":45},{"id":630},{"sys":25155,"name":457,"slug":458,"tier":45},{"id":454},{"sys":25157,"name":502,"slug":503,"tier":45},{"id":499},{"sys":25159,"name":333,"slug":334,"tier":45},{"id":330},{"sys":25161,"name":484,"slug":485,"tier":45},{"id":481},{"sys":25163,"name":306,"slug":307,"tier":45},{"id":303},"-bQA9rAlyrS_a91LX2wj01cmQDZ14Zx-XzOqf-qw6jo",{"id":25166,"title":25167,"authorsCollection":25168,"content":25174,"extension":228,"faqItemsCollection":25954,"faqTitle":59,"featured":6,"hashTags":59,"meta":25956,"metaTitle":25957,"ogImage":59,"postType":23649,"publishedDate":25958,"relatedBlogPostsCollection":25959,"slug":27615,"stem":27616,"subtitle":59,"summary":27617,"synopsis":27628,"sys":27629,"tagsCollection":27632,"topicsCollection":27638,"__hash__":27658},"blog/blog/3-steps-to-secure-your-data-across-shadow-saas-apps.json","7 Steps to secure your data across shadow SaaS apps",{"items":25169},[25170],{"fullName":25171,"firstName":25171,"jobTitle":59,"socialLinks":59,"profilePicture":25172},"The Push Team",{"url":25173},"https://images.ctfassets.net/y1cdw1ablpvd/7xpR9kiHAQWtZBj2rpOmmU/052ddfbb96afb37962278062047ab16d/Twitter_Linkedin_icon_white.png",{"json":25175,"links":25908},{"data":25176,"content":25177,"nodeType":856},{},[25178,25185,25191,25198,25207,25214,25219,25226,25231,25238,25245,25252,25259,25266,25272,25279,25285,25292,25307,25314,25321,25326,25332,25338,25354,25373,25380,25387,25394,25401,25408,25415,25435,25442,25449,25456,25463,25470,25477,25484,25491,25505,25535,25544,25550,25557,25564,25571,25594,25601,25608,25615,25622,25629,25636,25643,25650,25655,25662,25669,25676,25688,25695,25702,25709,25714,25721,25727,25734,25757,25764,25770,25777,25793,25800,25807,25814,25871,25876,25883,25890,25897,25902],{"data":25179,"content":25180,"nodeType":860},{},[25181],{"data":25182,"marks":25183,"value":25184,"nodeType":864},{},[],"Employees using a new work SaaS application used to be the final step of the software-onboarding process. ",{"data":25186,"content":25187,"nodeType":860},{},[25188],{"data":25189,"marks":25190,"value":23678,"nodeType":864},{},[],{"data":25192,"content":25193,"nodeType":860},{},[25194],{"data":25195,"marks":25196,"value":25197,"nodeType":864},{},[],"SaaS providers bypass IT and security and hook employees with free apps and trials. This has led to sensitive data on shadow SaaS applications that’s accessible via unmanaged cloud accounts – all those accounts that aren’t protected by SSO or logged into via social login accounts. This leads to security threats because attackers know SaaS is a blind spot for most organizations.",{"data":25199,"content":25200,"nodeType":860},{},[25201],{"data":25202,"marks":25203,"value":25206,"nodeType":864},{},[25204,25205],{"type":899},{"type":2246},"Attackers exploit this unmonitored attack surface with new takes on old techniques that are going undetected.",{"data":25208,"content":25209,"nodeType":860},{},[25210],{"data":25211,"marks":25212,"value":25213,"nodeType":864},{},[],"We’ve gone from this:",{"data":25215,"content":25218,"nodeType":996},{"target":25216},{"sys":25217},{"id":23796,"type":1001,"linkType":1002},[],{"data":25220,"content":25221,"nodeType":860},{},[25222],{"data":25223,"marks":25224,"value":25225,"nodeType":864},{},[],"To this: ",{"data":25227,"content":25230,"nodeType":996},{"target":25228},{"sys":25229},{"id":23946,"type":1001,"linkType":1002},[],{"data":25232,"content":25233,"nodeType":860},{},[25234],{"data":25235,"marks":25236,"value":25237,"nodeType":864},{},[],"Security is now coming in at the end of their old software procurement process and needs to figure out how to regain control of their data. ",{"data":25239,"content":25240,"nodeType":1009},{},[25241],{"data":25242,"marks":25243,"value":25244,"nodeType":864},{},[],"You don’t want to stop employees from adopting SaaS apps… ",{"data":25246,"content":25247,"nodeType":860},{},[25248],{"data":25249,"marks":25250,"value":25251,"nodeType":864},{},[],"Employees self-adopting SaaS platforms might sound like a security nightmare, but it doesn’t have to be. This actually enables employees to be more productive and your business to be more competitive. ",{"data":25253,"content":25254,"nodeType":860},{},[25255],{"data":25256,"marks":25257,"value":25258,"nodeType":864},{},[],"This new landscape has fundamentally changed how software is brought into the business. The days of security acting as a gatekeeper that all apps must pass through before they can touch live data are over. The market forces driving self-service apps aren’t stopping, so the security industry needs to adapt.",{"data":25260,"content":25261,"nodeType":1009},{},[25262],{"data":25263,"marks":25264,"value":25265,"nodeType":864},{},[],"What’s the impact of self-adoption on security?",{"data":25267,"content":25268,"nodeType":1312},{},[25269],{"data":25270,"marks":25271,"value":24036,"nodeType":864},{},[],{"data":25273,"content":25274,"nodeType":860},{},[25275],{"data":25276,"marks":25277,"value":25278,"nodeType":864},{},[],"Most SaaS providers have moved to the product-led growth (PLG) model as the fastest and easiest way to get users for their apps. They want employees to start using SaaS without going through IT and security teams’ lengthy approval processes. This SaaS vendor sales model has had a massive impact on security and introduced SaaS security risks, but most security teams are unaware of the scale and scope of the problem because they can’t get necessary visibility into all the tools and apps their employees are using.",{"data":25280,"content":25281,"nodeType":1312},{},[25282],{"data":25283,"marks":25284,"value":589,"nodeType":864},{},[],{"data":25286,"content":25287,"nodeType":860},{},[25288],{"data":25289,"marks":25290,"value":25291,"nodeType":864},{},[],"This problem is often called “Shadow SaaS” and it’s also the first problem to solve -  the old adage “you can’t secure what you don’t know about” is as true in the SaaS world as it is in any other security domain.",{"data":25293,"content":25294,"nodeType":860},{},[25295,25299,25304],{"data":25296,"marks":25297,"value":25298,"nodeType":864},{},[],"The lack of visibility means many IT and security teams missed the explosion of SaaS apps, plugins, extensions, and integrations that make up the modern IT stack. More crucially,",{"data":25300,"marks":25301,"value":25303,"nodeType":864},{},[25302],{"type":2246}," they’ve missed the movement of company data into these apps.",{"data":25305,"marks":25306,"value":6408,"nodeType":864},{},[],{"data":25308,"content":25309,"nodeType":1312},{},[25310],{"data":25311,"marks":25312,"value":25313,"nodeType":864},{},[],"SaaS Sprawl",{"data":25315,"content":25316,"nodeType":860},{},[25317],{"data":25318,"marks":25319,"value":25320,"nodeType":864},{},[],"Complicating matters further, many of these apps are duplicate, abandoned or unmanaged - an issue often called “SaaS sprawl.”",{"data":25322,"content":25325,"nodeType":996},{"target":25323},{"sys":25324},{"id":24055,"type":1001,"linkType":1002},[],{"data":25327,"content":25328,"nodeType":1312},{},[25329],{"data":25330,"marks":25331,"value":24063,"nodeType":864},{},[],{"data":25333,"content":25334,"nodeType":860},{},[25335],{"data":25336,"marks":25337,"value":24070,"nodeType":864},{},[],{"data":25339,"content":25340,"nodeType":860},{},[25341,25345,25350],{"data":25342,"marks":25343,"value":25344,"nodeType":864},{},[],"In both cases, ",{"data":25346,"marks":25347,"value":25349,"nodeType":864},{},[25348],{"type":2246},"Security is getting visibility too late to be of much value",{"data":25351,"marks":25352,"value":25353,"nodeType":864},{},[],". Once a team has been using an app (even on a free tier) for a year, there’s not much Security can do that will convince employees/teams to move to a more secure app. ",{"data":25355,"content":25356,"nodeType":860},{},[25357,25363,25368],{"data":25358,"marks":25359,"value":25362,"nodeType":864},{},[25360,25361],{"type":899},{"type":2246},"To change that, Security needs to intervene and get involved very early in the app adoption process ",{"data":25364,"marks":25365,"value":25367,"nodeType":864},{},[25366],{"type":2246},"- long before finance is involved.",{"data":25369,"marks":25370,"value":6408,"nodeType":864},{},[25371,25372],{"type":899},{"type":2246},{"data":25374,"content":25375,"nodeType":860},{},[25376],{"data":25377,"marks":25378,"value":25379,"nodeType":864},{},[],"Incident Response is necessary, of course, when a SaaS account is breached, but can’t recover the lost data after attackers have had access to it. ",{"data":25381,"content":25382,"nodeType":1312},{},[25383],{"data":25384,"marks":25385,"value":25386,"nodeType":864},{},[],"Holy S*it - there are so many apps!",{"data":25388,"content":25389,"nodeType":860},{},[25390],{"data":25391,"marks":25392,"value":25393,"nodeType":864},{},[],"Once teams get visibility into the scope of the Shadow SaaS and sprawl problem, they’re usually surprised by the sheer volume of apps employees have adopted. \n\nThen they realize they need to do risk assessments on dozens of apps a month instead of the dozen a year that were going through IT in the old, managed and controlled process. To deal with this massive influx of new apps, security teams feel they must either radically increase the headcount, cut corners or drastically increase acceptable risk levels for data security. Neither of these are great options.",{"data":25395,"content":25396,"nodeType":1312},{},[25397],{"data":25398,"marks":25399,"value":25400,"nodeType":864},{},[],"This is why SSPMs and CASBs exist, right?",{"data":25402,"content":25403,"nodeType":860},{},[25404],{"data":25405,"marks":25406,"value":25407,"nodeType":864},{},[],"SaaS Security Posture Management (SSPMs) and Cloud Access Security Brokers (CASBs) are the most common categories of solutions meant to attack this visibility blindspot issue, but none of these tools are getting the full picture of the problem. ",{"data":25409,"content":25410,"nodeType":860},{},[25411],{"data":25412,"marks":25413,"value":25414,"nodeType":864},{},[],"At best, they simply chip away at the problem and make security feel like they’ve got a handle on employee-adopted SaaS. At worst, they give a false sense of security while only actually covering a small portion of the SaaS apps where business data actually lives. ",{"data":25416,"content":25417,"nodeType":860},{},[25418,25422,25432],{"data":25419,"marks":25420,"value":25421,"nodeType":864},{},[],"The key thing to consider about any of these solutions is what data sources they’re using to collect (typically network data, financial records, email data, application or endpoint data). We won’t dig into the full list of pros and cons of these types of tools, but we encourage you to read about them more ",{"data":25423,"content":25426,"nodeType":17737},{"target":25424},{"sys":25425},{"id":23052,"type":1001,"linkType":1002},[25427],{"data":25428,"marks":25429,"value":25431,"nodeType":864},{},[25430],{"type":1455},"here",{"data":25433,"marks":25434,"value":6570,"nodeType":864},{},[],{"data":25436,"content":25437,"nodeType":860},{},[25438],{"data":25439,"marks":25440,"value":25441,"nodeType":864},{},[],"SSPM tools typically don’t do SaaS discovery - they don’t find apps employees log into, but they do tackle the application hardening and monitoring problem because they focus on policy enforcement and log-monitoring through APIs. ",{"data":25443,"content":25444,"nodeType":860},{},[25445],{"data":25446,"marks":25447,"value":25448,"nodeType":864},{},[],"Both SSPMs and CASBs make sense logically as a way to regain control of the situation. But we’d like to challenge the thinking that regaining control has to mean enforcing rigid security policies and restricting app access. ",{"data":25450,"content":25451,"nodeType":1009},{},[25452],{"data":25453,"marks":25454,"value":25455,"nodeType":864},{},[],"Adjust your thinking to secure SaaS",{"data":25457,"content":25458,"nodeType":1312},{},[25459],{"data":25460,"marks":25461,"value":25462,"nodeType":864},{},[],"Resist the temptation to revert to the old ways ",{"data":25464,"content":25465,"nodeType":860},{},[25466],{"data":25467,"marks":25468,"value":25469,"nodeType":864},{},[],"When the idea of the options above proves daunting or impossible, Security often tries to revert to the old process - putting security measures in place to regain the ability to set the pace of adoption by re-establishing the gate. ",{"data":25471,"content":25472,"nodeType":860},{},[25473],{"data":25474,"marks":25475,"value":25476,"nodeType":864},{},[],"Practically, this means that you’re deploying technical controls to try block all SaaS apps until they are approved (and marked as allowed) by IT or Security. Technically, this makes total sense. But the unforeseen consequence is that it positions Security as blockers (aka the “Department of No”) and puts them at odds with the rest of the business, rather than working towards a shared goal. ",{"data":25478,"content":25479,"nodeType":1312},{},[25480],{"data":25481,"marks":25482,"value":25483,"nodeType":864},{},[],"Why being the “Department of No” doesn’t work ",{"data":25485,"content":25486,"nodeType":860},{},[25487],{"data":25488,"marks":25489,"value":25490,"nodeType":864},{},[],"This block-everything-until-security-approves-it position requires incredible executive support to maintain. For all but the most risk-sensitive organizations (read .gov), this position also normalizes employee behavior to bypass Security in favor of working quickly and effectively. ",{"data":25492,"content":25493,"nodeType":860},{},[25494,25498,25502],{"data":25495,"marks":25496,"value":25497,"nodeType":864},{},[],"In the end, Security actually ",{"data":25499,"marks":25500,"value":24158,"nodeType":864},{},[25501],{"type":2246},{"data":25503,"marks":25504,"value":24162,"nodeType":864},{},[],{"data":25506,"content":25507,"nodeType":941},{},[25508,25517,25526],{"data":25509,"content":25510,"nodeType":945},{},[25511],{"data":25512,"content":25513,"nodeType":860},{},[25514],{"data":25515,"marks":25516,"value":24175,"nodeType":864},{},[],{"data":25518,"content":25519,"nodeType":945},{},[25520],{"data":25521,"content":25522,"nodeType":860},{},[25523],{"data":25524,"marks":25525,"value":24185,"nodeType":864},{},[],{"data":25527,"content":25528,"nodeType":945},{},[25529],{"data":25530,"content":25531,"nodeType":860},{},[25532],{"data":25533,"marks":25534,"value":24195,"nodeType":864},{},[],{"data":25536,"content":25537,"nodeType":860},{},[25538],{"data":25539,"marks":25540,"value":25543,"nodeType":864},{},[25541,25542],{"type":899},{"type":2246},"Each blocking action leads to a worse security outcome and blinds the security team further - losing control rather than regaining it.",{"data":25545,"content":25546,"nodeType":860},{},[25547],{"data":25548,"marks":25549,"value":24211,"nodeType":864},{},[],{"data":25551,"content":25552,"nodeType":1312},{},[25553],{"data":25554,"marks":25555,"value":25556,"nodeType":864},{},[],"Don’t worry, there’s a better way, but you must adapt your thinking",{"data":25558,"content":25559,"nodeType":860},{},[25560],{"data":25561,"marks":25562,"value":25563,"nodeType":864},{},[],"The first thing we need to do as an industry is agree that we don’t want to be the blockers. We don’t want to stop employees from self-adopting apps. We understand they are best placed to find and select the tools that are going to allow them to be more productive and help your company succeed. ",{"data":25565,"content":25566,"nodeType":860},{},[25567],{"data":25568,"marks":25569,"value":25570,"nodeType":864},{},[],"We need to:",{"data":25572,"content":25573,"nodeType":941},{},[25574,25584],{"data":25575,"content":25576,"nodeType":945},{},[25577],{"data":25578,"content":25579,"nodeType":860},{},[25580],{"data":25581,"marks":25582,"value":25583,"nodeType":864},{},[],"embrace SaaS app self-adoption, and ",{"data":25585,"content":25586,"nodeType":945},{},[25587],{"data":25588,"content":25589,"nodeType":860},{},[25590],{"data":25591,"marks":25592,"value":25593,"nodeType":864},{},[],"stop asking employees to adapt to fit our legacy processes. ",{"data":25595,"content":25596,"nodeType":860},{},[25597],{"data":25598,"marks":25599,"value":25600,"nodeType":864},{},[],"Security can no longer be a gate with a default stance of “No, until.” Instead Security needs to be a partner that says “Yes, unless.”",{"data":25602,"content":25603,"nodeType":1312},{},[25604],{"data":25605,"marks":25606,"value":25607,"nodeType":864},{},[],"From the “Department of No” to the “Department of Yes, Unless?”",{"data":25609,"content":25610,"nodeType":860},{},[25611],{"data":25612,"marks":25613,"value":25614,"nodeType":864},{},[],"To adapt to this new SaaS-first world, security must move from saying “No, until we’ve had time to fully vet and onboard this app officially” to “Yes! You can use that app, unless we quickly identify security risks that outweigh the value of the tool.”",{"data":25616,"content":25617,"nodeType":860},{},[25618],{"data":25619,"marks":25620,"value":25621,"nodeType":864},{},[],"We know this is deeply uncomfortable for many security practitioners, but it will lead to a better long-term outcome.",{"data":25623,"content":25624,"nodeType":1009},{},[25625],{"data":25626,"marks":25627,"value":25628,"nodeType":864},{},[],"How to regain control of the SaaS explosion",{"data":25630,"content":25631,"nodeType":1312},{},[25632],{"data":25633,"marks":25634,"value":25635,"nodeType":864},{},[],"Step 1: Understand how employees typically test drive and eventually adopt SaaS",{"data":25637,"content":25638,"nodeType":860},{},[25639],{"data":25640,"marks":25641,"value":25642,"nodeType":864},{},[],"Obviously, self-adoption of SaaS is fundamentally different to IT/Security adopted and managed from a risk perspective. With SaaS, there’s no giant commitment upfront. Apps don’t (usually) just go from unknown and unused to adopted in a day. Just like adopting software was a process for Security and IT back in the day, employees follow a (less rigid) process with SaaS - from testing > to using > to finding value > to inviting teammates, etc. ",{"data":25644,"content":25645,"nodeType":860},{},[25646],{"data":25647,"marks":25648,"value":25649,"nodeType":864},{},[],"The risk grows as we proceed through the adoption process as employees add more data into the app and integrate it with other apps. The workflow below outlines a fairly typical SaaS testing and adopting process for employees:",{"data":25651,"content":25654,"nodeType":996},{"target":25652},{"sys":25653},{"id":24258,"type":1001,"linkType":1002},[],{"data":25656,"content":25657,"nodeType":1312},{},[25658],{"data":25659,"marks":25660,"value":25661,"nodeType":864},{},[],"Step 2: Get involved early to have a real security impact",{"data":25663,"content":25664,"nodeType":860},{},[25665],{"data":25666,"marks":25667,"value":25668,"nodeType":864},{},[],"The upside for Security is that because SaaS adoption is a process over time, we can use that time to assess the risk of the app before it’s fully adopted, as long as we know about the app from the start. ",{"data":25670,"content":25671,"nodeType":860},{},[25672],{"data":25673,"marks":25674,"value":25675,"nodeType":864},{},[],"The goal is to catch those apps that are high risk, either because the data going into them (or that will be) is high risk or because the app can perform some high-risk action (like managing your inventory or sending emails to customers or your behalf). Security can focus their efforts on these high-risk vendors and apps to make sure they can be trusted with their data. ",{"data":25677,"content":25678,"nodeType":860},{},[25679,25683],{"data":25680,"marks":25681,"value":25682,"nodeType":864},{},[],"But this is key: ",{"data":25684,"marks":25685,"value":25687,"nodeType":864},{},[25686],{"type":2246},"Security needs to get involved early in the adoption process. ",{"data":25689,"content":25690,"nodeType":1312},{},[25691],{"data":25692,"marks":25693,"value":25694,"nodeType":864},{},[],"Step 3: Get real-time visibility into SaaS apps and risks as employees sign up for them",{"data":25696,"content":25697,"nodeType":860},{},[25698],{"data":25699,"marks":25700,"value":25701,"nodeType":864},{},[],"You guessed it - Push can help!",{"data":25703,"content":25704,"nodeType":860},{},[25705],{"data":25706,"marks":25707,"value":25708,"nodeType":864},{},[],"We detect employees signing up to new apps and integrating third-party apps to your core work platforms in real-time. That allows you to step in at the earliest opportunity to vet the app for critical issues and guide the employee through the appropriate app onboarding steps. This allows you to focus on the new stuff and buy yourself time. ",{"data":25710,"content":25713,"nodeType":996},{"target":25711},{"sys":25712},{"id":23328,"type":1001,"linkType":1002},[],{"data":25715,"content":25716,"nodeType":1312},{},[25717],{"data":25718,"marks":25719,"value":25720,"nodeType":864},{},[],"Step 4: Avoid wasting time on false-positives",{"data":25722,"content":25723,"nodeType":860},{},[25724],{"data":25725,"marks":25726,"value":23343,"nodeType":864},{},[],{"data":25728,"content":25729,"nodeType":860},{},[25730],{"data":25731,"marks":25732,"value":25733,"nodeType":864},{},[],"Good data allows you to:",{"data":25735,"content":25736,"nodeType":941},{},[25737,25747],{"data":25738,"content":25739,"nodeType":945},{},[25740],{"data":25741,"content":25742,"nodeType":860},{},[25743],{"data":25744,"marks":25745,"value":25746,"nodeType":864},{},[],"Quickly and accurately identify new SaaS apps and integrations as employees adopt them. ",{"data":25748,"content":25749,"nodeType":945},{},[25750],{"data":25751,"content":25752,"nodeType":860},{},[25753],{"data":25754,"marks":25755,"value":25756,"nodeType":864},{},[],"Identify the security issues that attackers can exploit to compromise your data through common attacks like Credential Stuffing. ",{"data":25758,"content":25759,"nodeType":1312},{},[25760],{"data":25761,"marks":25762,"value":25763,"nodeType":864},{},[],"Step 5: Use Browser extension data to get the most accurate and useful data for SaaS visibility and risk ",{"data":25765,"content":25766,"nodeType":860},{},[25767],{"data":25768,"marks":25769,"value":23357,"nodeType":864},{},[],{"data":25771,"content":25772,"nodeType":860},{},[25773],{"data":25774,"marks":25775,"value":25776,"nodeType":864},{},[],"That makes Push the only SaaS security solution that can directly observe all SaaS use and the only solution that can identify account security issues across hundreds of apps - completely automatically. ",{"data":25778,"content":25779,"nodeType":860},{},[25780,25784,25789],{"data":25781,"marks":25782,"value":25783,"nodeType":864},{},[],"No need for API support, no need for an admin account. It just works. For ",{"data":25785,"marks":25786,"value":25788,"nodeType":864},{},[25787],{"type":899},"all",{"data":25790,"marks":25791,"value":25792,"nodeType":864},{},[]," your SaaS.",{"data":25794,"content":25795,"nodeType":1312},{},[25796],{"data":25797,"marks":25798,"value":25799,"nodeType":864},{},[],"Step 6: Identify account security risks and discover shadow SaaS at the same time",{"data":25801,"content":25802,"nodeType":860},{},[25803],{"data":25804,"marks":25805,"value":25806,"nodeType":864},{},[],"Of course you need to start by discovering SaaS and getting a reliable inventory - but this on its own won’t stop accounts on those apps from getting breached. The most common way SaaS accounts are breached is through attacks like credential stuffing that target weak, breached or shared passwords on accounts that don’t have MFA enabled. ",{"data":25808,"content":25809,"nodeType":860},{},[25810],{"data":25811,"marks":25812,"value":25813,"nodeType":864},{},[],"Push can identify account security issues to prevent these common attacks. These include:",{"data":25815,"content":25816,"nodeType":941},{},[25817,25826,25835,25844,25853,25862],{"data":25818,"content":25819,"nodeType":945},{},[25820],{"data":25821,"content":25822,"nodeType":860},{},[25823],{"data":25824,"marks":25825,"value":23393,"nodeType":864},{},[],{"data":25827,"content":25828,"nodeType":945},{},[25829],{"data":25830,"content":25831,"nodeType":860},{},[25832],{"data":25833,"marks":25834,"value":23403,"nodeType":864},{},[],{"data":25836,"content":25837,"nodeType":945},{},[25838],{"data":25839,"content":25840,"nodeType":860},{},[25841],{"data":25842,"marks":25843,"value":23413,"nodeType":864},{},[],{"data":25845,"content":25846,"nodeType":945},{},[25847],{"data":25848,"content":25849,"nodeType":860},{},[25850],{"data":25851,"marks":25852,"value":23423,"nodeType":864},{},[],{"data":25854,"content":25855,"nodeType":945},{},[25856],{"data":25857,"content":25858,"nodeType":860},{},[25859],{"data":25860,"marks":25861,"value":23433,"nodeType":864},{},[],{"data":25863,"content":25864,"nodeType":945},{},[25865],{"data":25866,"content":25867,"nodeType":860},{},[25868],{"data":25869,"marks":25870,"value":23443,"nodeType":864},{},[],{"data":25872,"content":25875,"nodeType":996},{"target":25873},{"sys":25874},{"id":23448,"type":1001,"linkType":1002},[],{"data":25877,"content":25878,"nodeType":860},{},[25879],{"data":25880,"marks":25881,"value":25882,"nodeType":864},{},[],"We identify these issues at the same time we discover shadow SaaS apps, so you can tackle account compromise at the same time as SaaS discovery to reduce your SaaS security risk exposure faster.",{"data":25884,"content":25885,"nodeType":1312},{},[25886],{"data":25887,"marks":25888,"value":25889,"nodeType":864},{},[],"Step 7: Automatically reduce the risks we find by engaging employees",{"data":25891,"content":25892,"nodeType":860},{},[25893],{"data":25894,"marks":25895,"value":25896,"nodeType":864},{},[],"How do we actually reduce the risks? We engage employees directly via Slack or MS Teams, explain the account security issue we’ve identified in a way they’ll understand, and help them understand how it’s putting them and the business at risk. Then we guide them on how to fix it.",{"data":25898,"content":25901,"nodeType":996},{"target":25899},{"sys":25900},{"id":23468,"type":1001,"linkType":1002},[],{"data":25903,"content":25904,"nodeType":860},{},[25905],{"data":25906,"marks":25907,"value":21,"nodeType":864},{},[],{"entries":25909},{"inline":25910,"hyperlink":25911,"block":25914},[],[25912],{"sys":25913,"__typename":2059,"title":23525,"slug":23526},{"id":23052},[25915,25923,25930,25937,25945,25948,25951],{"sys":25916,"__typename":1724,"title":25917,"caption":25918,"layoutMode":59,"file":25919},{"id":23796},"Old software procurement process","Traditional software procurement process",{"url":25920,"width":25921,"height":25922},"https://images.ctfassets.net/y1cdw1ablpvd/5WwGnHoSxS9HFJMNYNrn4V/16c03fe426dce8a4d131a6185dcc9dc7/image__33_.png",1412,502,{"sys":25924,"__typename":1724,"title":25925,"caption":25926,"layoutMode":59,"file":25927},{"id":23946},"New way of procuring software due to PLG","The new way of procuring software due to PLG",{"url":25928,"width":25921,"height":25929},"https://images.ctfassets.net/y1cdw1ablpvd/1bwMESg7gXQ5XsSYJax69u/664c3d2a124535c98c68e6d20432ce02/image__32_.png",634,{"sys":25931,"__typename":1724,"title":25932,"caption":25932,"layoutMode":23532,"file":25933},{"id":24055},"SaaS sprawl",{"url":25934,"width":25935,"height":25936},"https://images.ctfassets.net/y1cdw1ablpvd/1KIj9P7eQ7UfOWgnUmTWUU/5f9d7369dd1ce148227db632aa1fabc7/image1.png",1731,658,{"sys":25938,"__typename":1724,"title":25939,"caption":25940,"layoutMode":23532,"file":25941},{"id":24258},"Get in early to assess SaaS apps","\"Yes, unless\" is a good fit for self adoption because risk increases gradually",{"url":25942,"width":25943,"height":25944},"https://images.ctfassets.net/y1cdw1ablpvd/6KEFysuMJJS96lSqhGCGDV/f99004f71f088ff37e0fbbc0d81cff38/image8.png",1758,864,{"sys":25946,"__typename":1724,"title":23619,"caption":23620,"layoutMode":23532,"file":25947},{"id":23328},{"url":23622,"width":1736,"height":23616},{"sys":25949,"__typename":1724,"title":23625,"caption":23626,"layoutMode":23532,"file":25950},{"id":23448},{"url":23628,"width":23629,"height":23630},{"sys":25952,"__typename":1724,"title":23633,"caption":23634,"layoutMode":23532,"file":25953},{"id":23468},{"url":23636,"width":1736,"height":23616},{"items":25955},[],{},"Secure your data across shadow SaaS apps in 7 steps","2023-06-26T00:00:00.000Z",{"items":25960},[25961,27229],{"__typename":2059,"sys":25962,"content":25963,"title":21984,"synopsis":25107,"hashTags":59,"publishedDate":25108,"slug":23522,"tagsCollection":27219,"authorsCollection":27225},{"id":21978},{"json":25964},{"data":25965,"content":25966,"nodeType":856},{},[25967,25973,25979,25985,25991,25997,26003,26009,26015,26054,26060,26066,26072,26078,26084,26089,26095,26101,26107,26114,26120,26126,26132,26138,26144,26150,26156,26172,26177,26183,26189,26199,26206,26212,26217,26223,26229,26234,26240,26248,26261,26282,26288,26294,26300,26306,26311,26317,26323,26329,26335,26341,26347,26363,26369,26375,26381,26387,26400,26430,26438,26444,26450,26456,26462,26468,26474,26480,26485,26491,26497,26503,26509,26515,26521,26537,26543,26548,26554,26575,26581,26587,26617,26623,26629,26635,26641,26653,26659,26719,26725,26731,26752,26757,26763,26769,26775,26805,26811,27152,27158,27174,27180,27188,27201,27207,27213],{"data":25968,"content":25969,"nodeType":1009},{},[25970],{"data":25971,"marks":25972,"value":21966,"nodeType":864},{},[],{"data":25974,"content":25975,"nodeType":860},{},[25976],{"data":25977,"marks":25978,"value":23671,"nodeType":864},{},[],{"data":25980,"content":25981,"nodeType":860},{},[25982],{"data":25983,"marks":25984,"value":23678,"nodeType":864},{},[],{"data":25986,"content":25987,"nodeType":860},{},[25988],{"data":25989,"marks":25990,"value":23685,"nodeType":864},{},[],{"data":25992,"content":25993,"nodeType":860},{},[25994],{"data":25995,"marks":25996,"value":23692,"nodeType":864},{},[],{"data":25998,"content":25999,"nodeType":860},{},[26000],{"data":26001,"marks":26002,"value":23699,"nodeType":864},{},[],{"data":26004,"content":26005,"nodeType":860},{},[26006],{"data":26007,"marks":26008,"value":23706,"nodeType":864},{},[],{"data":26010,"content":26011,"nodeType":860},{},[26012],{"data":26013,"marks":26014,"value":23713,"nodeType":864},{},[],{"data":26016,"content":26017,"nodeType":941},{},[26018,26027,26036,26045],{"data":26019,"content":26020,"nodeType":945},{},[26021],{"data":26022,"content":26023,"nodeType":860},{},[26024],{"data":26025,"marks":26026,"value":23726,"nodeType":864},{},[],{"data":26028,"content":26029,"nodeType":945},{},[26030],{"data":26031,"content":26032,"nodeType":860},{},[26033],{"data":26034,"marks":26035,"value":23736,"nodeType":864},{},[],{"data":26037,"content":26038,"nodeType":945},{},[26039],{"data":26040,"content":26041,"nodeType":860},{},[26042],{"data":26043,"marks":26044,"value":23746,"nodeType":864},{},[],{"data":26046,"content":26047,"nodeType":945},{},[26048],{"data":26049,"content":26050,"nodeType":860},{},[26051],{"data":26052,"marks":26053,"value":23756,"nodeType":864},{},[],{"data":26055,"content":26056,"nodeType":860},{},[26057],{"data":26058,"marks":26059,"value":23763,"nodeType":864},{},[],{"data":26061,"content":26062,"nodeType":860},{},[26063],{"data":26064,"marks":26065,"value":23770,"nodeType":864},{},[],{"data":26067,"content":26068,"nodeType":1009},{},[26069],{"data":26070,"marks":26071,"value":23777,"nodeType":864},{},[],{"data":26073,"content":26074,"nodeType":1312},{},[26075],{"data":26076,"marks":26077,"value":23784,"nodeType":864},{},[],{"data":26079,"content":26080,"nodeType":860},{},[26081],{"data":26082,"marks":26083,"value":23791,"nodeType":864},{},[],{"data":26085,"content":26088,"nodeType":996},{"target":26086},{"sys":26087},{"id":23796,"type":1001,"linkType":1002},[],{"data":26090,"content":26091,"nodeType":860},{},[26092],{"data":26093,"marks":26094,"value":23804,"nodeType":864},{},[],{"data":26096,"content":26097,"nodeType":860},{},[26098],{"data":26099,"marks":26100,"value":23811,"nodeType":864},{},[],{"data":26102,"content":26103,"nodeType":860},{},[26104],{"data":26105,"marks":26106,"value":23818,"nodeType":864},{},[],{"data":26108,"content":26109,"nodeType":860},{},[26110],{"data":26111,"marks":26112,"value":23826,"nodeType":864},{},[26113],{"type":2246},{"data":26115,"content":26116,"nodeType":1312},{},[26117],{"data":26118,"marks":26119,"value":23833,"nodeType":864},{},[],{"data":26121,"content":26122,"nodeType":860},{},[26123],{"data":26124,"marks":26125,"value":23840,"nodeType":864},{},[],{"data":26127,"content":26128,"nodeType":860},{},[26129],{"data":26130,"marks":26131,"value":23847,"nodeType":864},{},[],{"data":26133,"content":26134,"nodeType":860},{},[26135],{"data":26136,"marks":26137,"value":23854,"nodeType":864},{},[],{"data":26139,"content":26140,"nodeType":860},{},[26141],{"data":26142,"marks":26143,"value":23861,"nodeType":864},{},[],{"data":26145,"content":26146,"nodeType":1312},{},[26147],{"data":26148,"marks":26149,"value":23868,"nodeType":864},{},[],{"data":26151,"content":26152,"nodeType":860},{},[26153],{"data":26154,"marks":26155,"value":23875,"nodeType":864},{},[],{"data":26157,"content":26158,"nodeType":860},{},[26159,26162,26169],{"data":26160,"marks":26161,"value":23882,"nodeType":864},{},[],{"data":26163,"content":26164,"nodeType":883},{"uri":23885},[26165],{"data":26166,"marks":26167,"value":23891,"nodeType":864},{},[26168],{"type":1455},{"data":26170,"marks":26171,"value":23895,"nodeType":864},{},[],{"data":26173,"content":26176,"nodeType":996},{"target":26174},{"sys":26175},{"id":23900,"type":1001,"linkType":1002},[],{"data":26178,"content":26179,"nodeType":860},{},[26180],{"data":26181,"marks":26182,"value":23908,"nodeType":864},{},[],{"data":26184,"content":26185,"nodeType":860},{},[26186],{"data":26187,"marks":26188,"value":23915,"nodeType":864},{},[],{"data":26190,"content":26191,"nodeType":860},{},[26192,26195],{"data":26193,"marks":26194,"value":23922,"nodeType":864},{},[],{"data":26196,"marks":26197,"value":1171,"nodeType":864},{},[26198],{"type":899},{"data":26200,"content":26201,"nodeType":860},{},[26202],{"data":26203,"marks":26204,"value":23934,"nodeType":864},{},[26205],{"type":899},{"data":26207,"content":26208,"nodeType":860},{},[26209],{"data":26210,"marks":26211,"value":23941,"nodeType":864},{},[],{"data":26213,"content":26216,"nodeType":996},{"target":26214},{"sys":26215},{"id":23946,"type":1001,"linkType":1002},[],{"data":26218,"content":26219,"nodeType":1312},{},[26220],{"data":26221,"marks":26222,"value":23954,"nodeType":864},{},[],{"data":26224,"content":26225,"nodeType":860},{},[26226],{"data":26227,"marks":26228,"value":23961,"nodeType":864},{},[],{"data":26230,"content":26233,"nodeType":996},{"target":26231},{"sys":26232},{"id":23966,"type":1001,"linkType":1002},[],{"data":26235,"content":26236,"nodeType":860},{},[26237],{"data":26238,"marks":26239,"value":23974,"nodeType":864},{},[],{"data":26241,"content":26242,"nodeType":860},{},[26243],{"data":26244,"marks":26245,"value":23983,"nodeType":864},{},[26246,26247],{"type":2246},{"type":899},{"data":26249,"content":26250,"nodeType":860},{},[26251,26254,26258],{"data":26252,"marks":26253,"value":23990,"nodeType":864},{},[],{"data":26255,"marks":26256,"value":23995,"nodeType":864},{},[26257],{"type":899},{"data":26259,"marks":26260,"value":23999,"nodeType":864},{},[],{"data":26262,"content":26263,"nodeType":23195},{},[26264,26273],{"data":26265,"content":26266,"nodeType":945},{},[26267],{"data":26268,"content":26269,"nodeType":860},{},[26270],{"data":26271,"marks":26272,"value":24012,"nodeType":864},{},[],{"data":26274,"content":26275,"nodeType":945},{},[26276],{"data":26277,"content":26278,"nodeType":860},{},[26279],{"data":26280,"marks":26281,"value":24022,"nodeType":864},{},[],{"data":26283,"content":26284,"nodeType":1009},{},[26285],{"data":26286,"marks":26287,"value":24029,"nodeType":864},{},[],{"data":26289,"content":26290,"nodeType":1312},{},[26291],{"data":26292,"marks":26293,"value":24036,"nodeType":864},{},[],{"data":26295,"content":26296,"nodeType":860},{},[26297],{"data":26298,"marks":26299,"value":24043,"nodeType":864},{},[],{"data":26301,"content":26302,"nodeType":860},{},[26303],{"data":26304,"marks":26305,"value":24050,"nodeType":864},{},[],{"data":26307,"content":26310,"nodeType":996},{"target":26308},{"sys":26309},{"id":24055,"type":1001,"linkType":1002},[],{"data":26312,"content":26313,"nodeType":1312},{},[26314],{"data":26315,"marks":26316,"value":24063,"nodeType":864},{},[],{"data":26318,"content":26319,"nodeType":860},{},[26320],{"data":26321,"marks":26322,"value":24070,"nodeType":864},{},[],{"data":26324,"content":26325,"nodeType":860},{},[26326],{"data":26327,"marks":26328,"value":24077,"nodeType":864},{},[],{"data":26330,"content":26331,"nodeType":860},{},[26332],{"data":26333,"marks":26334,"value":24084,"nodeType":864},{},[],{"data":26336,"content":26337,"nodeType":860},{},[26338],{"data":26339,"marks":26340,"value":24091,"nodeType":864},{},[],{"data":26342,"content":26343,"nodeType":1312},{},[26344],{"data":26345,"marks":26346,"value":24098,"nodeType":864},{},[],{"data":26348,"content":26349,"nodeType":860},{},[26350,26353,26360],{"data":26351,"marks":26352,"value":24105,"nodeType":864},{},[],{"data":26354,"content":26355,"nodeType":883},{"uri":24108},[26356],{"data":26357,"marks":26358,"value":24114,"nodeType":864},{},[26359],{"type":1455},{"data":26361,"marks":26362,"value":24118,"nodeType":864},{},[],{"data":26364,"content":26365,"nodeType":860},{},[26366],{"data":26367,"marks":26368,"value":24125,"nodeType":864},{},[],{"data":26370,"content":26371,"nodeType":1312},{},[26372],{"data":26373,"marks":26374,"value":24132,"nodeType":864},{},[],{"data":26376,"content":26377,"nodeType":860},{},[26378],{"data":26379,"marks":26380,"value":24139,"nodeType":864},{},[],{"data":26382,"content":26383,"nodeType":860},{},[26384],{"data":26385,"marks":26386,"value":24146,"nodeType":864},{},[],{"data":26388,"content":26389,"nodeType":860},{},[26390,26393,26397],{"data":26391,"marks":26392,"value":24153,"nodeType":864},{},[],{"data":26394,"marks":26395,"value":24158,"nodeType":864},{},[26396],{"type":2246},{"data":26398,"marks":26399,"value":24162,"nodeType":864},{},[],{"data":26401,"content":26402,"nodeType":941},{},[26403,26412,26421],{"data":26404,"content":26405,"nodeType":945},{},[26406],{"data":26407,"content":26408,"nodeType":860},{},[26409],{"data":26410,"marks":26411,"value":24175,"nodeType":864},{},[],{"data":26413,"content":26414,"nodeType":945},{},[26415],{"data":26416,"content":26417,"nodeType":860},{},[26418],{"data":26419,"marks":26420,"value":24185,"nodeType":864},{},[],{"data":26422,"content":26423,"nodeType":945},{},[26424],{"data":26425,"content":26426,"nodeType":860},{},[26427],{"data":26428,"marks":26429,"value":24195,"nodeType":864},{},[],{"data":26431,"content":26432,"nodeType":860},{},[26433],{"data":26434,"marks":26435,"value":24204,"nodeType":864},{},[26436,26437],{"type":2246},{"type":899},{"data":26439,"content":26440,"nodeType":860},{},[26441],{"data":26442,"marks":26443,"value":24211,"nodeType":864},{},[],{"data":26445,"content":26446,"nodeType":1312},{},[26447],{"data":26448,"marks":26449,"value":24218,"nodeType":864},{},[],{"data":26451,"content":26452,"nodeType":860},{},[26453],{"data":26454,"marks":26455,"value":24225,"nodeType":864},{},[],{"data":26457,"content":26458,"nodeType":860},{},[26459],{"data":26460,"marks":26461,"value":24232,"nodeType":864},{},[],{"data":26463,"content":26464,"nodeType":1312},{},[26465],{"data":26466,"marks":26467,"value":24239,"nodeType":864},{},[],{"data":26469,"content":26470,"nodeType":860},{},[26471],{"data":26472,"marks":26473,"value":24246,"nodeType":864},{},[],{"data":26475,"content":26476,"nodeType":860},{},[26477],{"data":26478,"marks":26479,"value":24253,"nodeType":864},{},[],{"data":26481,"content":26484,"nodeType":996},{"target":26482},{"sys":26483},{"id":24258,"type":1001,"linkType":1002},[],{"data":26486,"content":26487,"nodeType":860},{},[26488],{"data":26489,"marks":26490,"value":24266,"nodeType":864},{},[],{"data":26492,"content":26493,"nodeType":860},{},[26494],{"data":26495,"marks":26496,"value":24273,"nodeType":864},{},[],{"data":26498,"content":26499,"nodeType":860},{},[26500],{"data":26501,"marks":26502,"value":24280,"nodeType":864},{},[],{"data":26504,"content":26505,"nodeType":1009},{},[26506],{"data":26507,"marks":26508,"value":24287,"nodeType":864},{},[],{"data":26510,"content":26511,"nodeType":860},{},[26512],{"data":26513,"marks":26514,"value":24294,"nodeType":864},{},[],{"data":26516,"content":26517,"nodeType":1312},{},[26518],{"data":26519,"marks":26520,"value":24301,"nodeType":864},{},[],{"data":26522,"content":26523,"nodeType":860},{},[26524,26527,26534],{"data":26525,"marks":26526,"value":24308,"nodeType":864},{},[],{"data":26528,"content":26529,"nodeType":883},{"uri":24311},[26530],{"data":26531,"marks":26532,"value":24317,"nodeType":864},{},[26533],{"type":1455},{"data":26535,"marks":26536,"value":24321,"nodeType":864},{},[],{"data":26538,"content":26539,"nodeType":860},{},[26540],{"data":26541,"marks":26542,"value":24328,"nodeType":864},{},[],{"data":26544,"content":26547,"nodeType":996},{"target":26545},{"sys":26546},{"id":22089,"type":1001,"linkType":1002},[],{"data":26549,"content":26550,"nodeType":860},{},[26551],{"data":26552,"marks":26553,"value":24340,"nodeType":864},{},[],{"data":26555,"content":26556,"nodeType":23195},{},[26557,26566],{"data":26558,"content":26559,"nodeType":945},{},[26560],{"data":26561,"content":26562,"nodeType":860},{},[26563],{"data":26564,"marks":26565,"value":24353,"nodeType":864},{},[],{"data":26567,"content":26568,"nodeType":945},{},[26569],{"data":26570,"content":26571,"nodeType":860},{},[26572],{"data":26573,"marks":26574,"value":24363,"nodeType":864},{},[],{"data":26576,"content":26577,"nodeType":860},{},[26578],{"data":26579,"marks":26580,"value":24370,"nodeType":864},{},[],{"data":26582,"content":26583,"nodeType":860},{},[26584],{"data":26585,"marks":26586,"value":24377,"nodeType":864},{},[],{"data":26588,"content":26589,"nodeType":941},{},[26590,26599,26608],{"data":26591,"content":26592,"nodeType":945},{},[26593],{"data":26594,"content":26595,"nodeType":860},{},[26596],{"data":26597,"marks":26598,"value":24390,"nodeType":864},{},[],{"data":26600,"content":26601,"nodeType":945},{},[26602],{"data":26603,"content":26604,"nodeType":860},{},[26605],{"data":26606,"marks":26607,"value":24400,"nodeType":864},{},[],{"data":26609,"content":26610,"nodeType":945},{},[26611],{"data":26612,"content":26613,"nodeType":860},{},[26614],{"data":26615,"marks":26616,"value":24410,"nodeType":864},{},[],{"data":26618,"content":26619,"nodeType":860},{},[26620],{"data":26621,"marks":26622,"value":24417,"nodeType":864},{},[],{"data":26624,"content":26625,"nodeType":860},{},[26626],{"data":26627,"marks":26628,"value":24424,"nodeType":864},{},[],{"data":26630,"content":26631,"nodeType":860},{},[26632],{"data":26633,"marks":26634,"value":24431,"nodeType":864},{},[],{"data":26636,"content":26637,"nodeType":860},{},[26638],{"data":26639,"marks":26640,"value":24438,"nodeType":864},{},[],{"data":26642,"content":26643,"nodeType":941},{},[26644],{"data":26645,"content":26646,"nodeType":945},{},[26647],{"data":26648,"content":26649,"nodeType":860},{},[26650],{"data":26651,"marks":26652,"value":24451,"nodeType":864},{},[],{"data":26654,"content":26655,"nodeType":860},{},[26656],{"data":26657,"marks":26658,"value":24458,"nodeType":864},{},[],{"data":26660,"content":26661,"nodeType":941},{},[26662,26701,26710],{"data":26663,"content":26664,"nodeType":945},{},[26665],{"data":26666,"content":26667,"nodeType":860},{},[26668,26671,26678,26681,26688,26691,26698],{"data":26669,"marks":26670,"value":24471,"nodeType":864},{},[],{"data":26672,"content":26673,"nodeType":883},{"uri":24474},[26674],{"data":26675,"marks":26676,"value":24480,"nodeType":864},{},[26677],{"type":1455},{"data":26679,"marks":26680,"value":3731,"nodeType":864},{},[],{"data":26682,"content":26683,"nodeType":883},{"uri":24486},[26684],{"data":26685,"marks":26686,"value":24492,"nodeType":864},{},[26687],{"type":1455},{"data":26689,"marks":26690,"value":3731,"nodeType":864},{},[],{"data":26692,"content":26693,"nodeType":883},{"uri":24498},[26694],{"data":26695,"marks":26696,"value":24504,"nodeType":864},{},[26697],{"type":1455},{"data":26699,"marks":26700,"value":24508,"nodeType":864},{},[],{"data":26702,"content":26703,"nodeType":945},{},[26704],{"data":26705,"content":26706,"nodeType":860},{},[26707],{"data":26708,"marks":26709,"value":24518,"nodeType":864},{},[],{"data":26711,"content":26712,"nodeType":945},{},[26713],{"data":26714,"content":26715,"nodeType":860},{},[26716],{"data":26717,"marks":26718,"value":24528,"nodeType":864},{},[],{"data":26720,"content":26721,"nodeType":1312},{},[26722],{"data":26723,"marks":26724,"value":24535,"nodeType":864},{},[],{"data":26726,"content":26727,"nodeType":860},{},[26728],{"data":26729,"marks":26730,"value":24542,"nodeType":864},{},[],{"data":26732,"content":26733,"nodeType":23195},{},[26734,26743],{"data":26735,"content":26736,"nodeType":945},{},[26737],{"data":26738,"content":26739,"nodeType":860},{},[26740],{"data":26741,"marks":26742,"value":24555,"nodeType":864},{},[],{"data":26744,"content":26745,"nodeType":945},{},[26746],{"data":26747,"content":26748,"nodeType":860},{},[26749],{"data":26750,"marks":26751,"value":24565,"nodeType":864},{},[],{"data":26753,"content":26756,"nodeType":996},{"target":26754},{"sys":26755},{"id":22116,"type":1001,"linkType":1002},[],{"data":26758,"content":26759,"nodeType":860},{},[26760],{"data":26761,"marks":26762,"value":24577,"nodeType":864},{},[],{"data":26764,"content":26765,"nodeType":1009},{},[26766],{"data":26767,"marks":26768,"value":24584,"nodeType":864},{},[],{"data":26770,"content":26771,"nodeType":860},{},[26772],{"data":26773,"marks":26774,"value":24591,"nodeType":864},{},[],{"data":26776,"content":26777,"nodeType":941},{},[26778,26787,26796],{"data":26779,"content":26780,"nodeType":945},{},[26781],{"data":26782,"content":26783,"nodeType":860},{},[26784],{"data":26785,"marks":26786,"value":24604,"nodeType":864},{},[],{"data":26788,"content":26789,"nodeType":945},{},[26790],{"data":26791,"content":26792,"nodeType":860},{},[26793],{"data":26794,"marks":26795,"value":24614,"nodeType":864},{},[],{"data":26797,"content":26798,"nodeType":945},{},[26799],{"data":26800,"content":26801,"nodeType":860},{},[26802],{"data":26803,"marks":26804,"value":24624,"nodeType":864},{},[],{"data":26806,"content":26807,"nodeType":860},{},[26808],{"data":26809,"marks":26810,"value":24631,"nodeType":864},{},[],{"data":26812,"content":26813,"nodeType":4845},{},[26814,26837,26905,26954,26992,27099],{"data":26815,"content":26816,"nodeType":4581},{},[26817,26827],{"data":26818,"content":26819,"nodeType":4569},{},[26820],{"data":26821,"content":26822,"nodeType":860},{},[26823],{"data":26824,"marks":26825,"value":24648,"nodeType":864},{},[26826],{"type":899},{"data":26828,"content":26829,"nodeType":4569},{},[26830],{"data":26831,"content":26832,"nodeType":860},{},[26833],{"data":26834,"marks":26835,"value":24659,"nodeType":864},{},[26836],{"type":899},{"data":26838,"content":26839,"nodeType":4581},{},[26840,26849],{"data":26841,"content":26842,"nodeType":4569},{},[26843],{"data":26844,"content":26845,"nodeType":860},{},[26846],{"data":26847,"marks":26848,"value":24672,"nodeType":864},{},[],{"data":26850,"content":26851,"nodeType":4569},{},[26852,26875],{"data":26853,"content":26854,"nodeType":860},{},[26855,26858,26865,26868,26872],{"data":26856,"marks":26857,"value":21,"nodeType":864},{},[],{"data":26859,"content":26860,"nodeType":883},{"uri":24684},[26861],{"data":26862,"marks":26863,"value":24690,"nodeType":864},{},[26864],{"type":1455},{"data":26866,"marks":26867,"value":24694,"nodeType":864},{},[],{"data":26869,"marks":26870,"value":24699,"nodeType":864},{},[26871],{"type":899},{"data":26873,"marks":26874,"value":24703,"nodeType":864},{},[],{"data":26876,"content":26877,"nodeType":860},{},[26878,26881,26888,26891,26895,26898,26902],{"data":26879,"marks":26880,"value":24710,"nodeType":864},{},[],{"data":26882,"content":26883,"nodeType":883},{"uri":24713},[26884],{"data":26885,"marks":26886,"value":24719,"nodeType":864},{},[26887],{"type":1455},{"data":26889,"marks":26890,"value":24723,"nodeType":864},{},[],{"data":26892,"marks":26893,"value":24728,"nodeType":864},{},[26894],{"type":899},{"data":26896,"marks":26897,"value":24732,"nodeType":864},{},[],{"data":26899,"marks":26900,"value":24504,"nodeType":864},{},[26901],{"type":899},{"data":26903,"marks":26904,"value":24740,"nodeType":864},{},[],{"data":26906,"content":26907,"nodeType":4581},{},[26908,26917],{"data":26909,"content":26910,"nodeType":4569},{},[26911],{"data":26912,"content":26913,"nodeType":860},{},[26914],{"data":26915,"marks":26916,"value":24753,"nodeType":864},{},[],{"data":26918,"content":26919,"nodeType":4569},{},[26920],{"data":26921,"content":26922,"nodeType":860},{},[26923,26927,26930,26937,26940,26944,26947,26951],{"data":26924,"marks":26925,"value":24492,"nodeType":864},{},[26926],{"type":899},{"data":26928,"marks":26929,"value":24767,"nodeType":864},{},[],{"data":26931,"content":26932,"nodeType":883},{"uri":24770},[26933],{"data":26934,"marks":26935,"value":24776,"nodeType":864},{},[26936],{"type":1455},{"data":26938,"marks":26939,"value":24780,"nodeType":864},{},[],{"data":26941,"marks":26942,"value":24785,"nodeType":864},{},[26943],{"type":899},{"data":26945,"marks":26946,"value":24789,"nodeType":864},{},[],{"data":26948,"marks":26949,"value":24728,"nodeType":864},{},[26950],{"type":899},{"data":26952,"marks":26953,"value":24797,"nodeType":864},{},[],{"data":26955,"content":26956,"nodeType":4581},{},[26957,26966],{"data":26958,"content":26959,"nodeType":4569},{},[26960],{"data":26961,"content":26962,"nodeType":860},{},[26963],{"data":26964,"marks":26965,"value":24810,"nodeType":864},{},[],{"data":26967,"content":26968,"nodeType":4569},{},[26969],{"data":26970,"content":26971,"nodeType":860},{},[26972,26975,26979,26982,26989],{"data":26973,"marks":26974,"value":24820,"nodeType":864},{},[],{"data":26976,"marks":26977,"value":24492,"nodeType":864},{},[26978],{"type":899},{"data":26980,"marks":26981,"value":24828,"nodeType":864},{},[],{"data":26983,"content":26984,"nodeType":883},{"uri":24831},[26985],{"data":26986,"marks":26987,"value":24837,"nodeType":864},{},[26988],{"type":1455},{"data":26990,"marks":26991,"value":21,"nodeType":864},{},[],{"data":26993,"content":26994,"nodeType":4581},{},[26995,27004],{"data":26996,"content":26997,"nodeType":4569},{},[26998],{"data":26999,"content":27000,"nodeType":860},{},[27001],{"data":27002,"marks":27003,"value":24853,"nodeType":864},{},[],{"data":27005,"content":27006,"nodeType":4569},{},[27007,27041,27064,27077,27093],{"data":27008,"content":27009,"nodeType":860},{},[27010,27014,27017,27021,27024,27031,27034,27038],{"data":27011,"marks":27012,"value":24504,"nodeType":864},{},[27013],{"type":899},{"data":27015,"marks":27016,"value":24867,"nodeType":864},{},[],{"data":27018,"marks":27019,"value":24492,"nodeType":864},{},[27020],{"type":899},{"data":27022,"marks":27023,"value":24875,"nodeType":864},{},[],{"data":27025,"content":27026,"nodeType":883},{"uri":24878},[27027],{"data":27028,"marks":27029,"value":24884,"nodeType":864},{},[27030],{"type":1455},{"data":27032,"marks":27033,"value":24888,"nodeType":864},{},[],{"data":27035,"marks":27036,"value":24893,"nodeType":864},{},[27037],{"type":899},{"data":27039,"marks":27040,"value":24897,"nodeType":864},{},[],{"data":27042,"content":27043,"nodeType":860},{},[27044,27047,27051,27054,27061],{"data":27045,"marks":27046,"value":24904,"nodeType":864},{},[],{"data":27048,"marks":27049,"value":24504,"nodeType":864},{},[27050],{"type":899},{"data":27052,"marks":27053,"value":1171,"nodeType":864},{},[],{"data":27055,"content":27056,"nodeType":883},{"uri":24914},[27057],{"data":27058,"marks":27059,"value":24920,"nodeType":864},{},[27060],{"type":1455},{"data":27062,"marks":27063,"value":24924,"nodeType":864},{},[],{"data":27065,"content":27066,"nodeType":860},{},[27067,27070,27074],{"data":27068,"marks":27069,"value":24931,"nodeType":864},{},[],{"data":27071,"marks":27072,"value":1171,"nodeType":864},{},[27073],{"type":899},{"data":27075,"marks":27076,"value":24939,"nodeType":864},{},[],{"data":27078,"content":27079,"nodeType":860},{},[27080,27083,27090],{"data":27081,"marks":27082,"value":24946,"nodeType":864},{},[],{"data":27084,"content":27085,"nodeType":883},{"uri":24949},[27086],{"data":27087,"marks":27088,"value":24955,"nodeType":864},{},[27089],{"type":1455},{"data":27091,"marks":27092,"value":6570,"nodeType":864},{},[],{"data":27094,"content":27095,"nodeType":860},{},[27096],{"data":27097,"marks":27098,"value":24965,"nodeType":864},{},[],{"data":27100,"content":27101,"nodeType":4581},{},[27102,27111],{"data":27103,"content":27104,"nodeType":4569},{},[27105],{"data":27106,"content":27107,"nodeType":860},{},[27108],{"data":27109,"marks":27110,"value":24978,"nodeType":864},{},[],{"data":27112,"content":27113,"nodeType":4569},{},[27114],{"data":27115,"content":27116,"nodeType":860},{},[27117,27120,27127,27130,27134,27137,27149],{"data":27118,"marks":27119,"value":24988,"nodeType":864},{},[],{"data":27121,"content":27122,"nodeType":883},{"uri":24991},[27123],{"data":27124,"marks":27125,"value":24997,"nodeType":864},{},[27126],{"type":1455},{"data":27128,"marks":27129,"value":25001,"nodeType":864},{},[],{"data":27131,"marks":27132,"value":24492,"nodeType":864},{},[27133],{"type":899},{"data":27135,"marks":27136,"value":902,"nodeType":864},{},[],{"data":27138,"content":27139,"nodeType":883},{"uri":25011},[27140,27145],{"data":27141,"marks":27142,"value":25018,"nodeType":864},{},[27143,27144],{"type":1455},{"type":899},{"data":27146,"marks":27147,"value":25023,"nodeType":864},{},[27148],{"type":1455},{"data":27150,"marks":27151,"value":25027,"nodeType":864},{},[],{"data":27153,"content":27154,"nodeType":860},{},[27155],{"data":27156,"marks":27157,"value":25034,"nodeType":864},{},[],{"data":27159,"content":27160,"nodeType":860},{},[27161,27164,27171],{"data":27162,"marks":27163,"value":25041,"nodeType":864},{},[],{"data":27165,"content":27166,"nodeType":883},{"uri":25044},[27167],{"data":27168,"marks":27169,"value":24480,"nodeType":864},{},[27170],{"type":1455},{"data":27172,"marks":27173,"value":25053,"nodeType":864},{},[],{"data":27175,"content":27176,"nodeType":860},{},[27177],{"data":27178,"marks":27179,"value":25060,"nodeType":864},{},[],{"data":27181,"content":27182,"nodeType":860},{},[27183],{"data":27184,"marks":27185,"value":25069,"nodeType":864},{},[27186,27187],{"type":899},{"type":2246},{"data":27189,"content":27190,"nodeType":860},{},[27191,27194,27198],{"data":27192,"marks":27193,"value":25076,"nodeType":864},{},[],{"data":27195,"marks":27196,"value":25081,"nodeType":864},{},[27197],{"type":2246},{"data":27199,"marks":27200,"value":25085,"nodeType":864},{},[],{"data":27202,"content":27203,"nodeType":1009},{},[27204],{"data":27205,"marks":27206,"value":25092,"nodeType":864},{},[],{"data":27208,"content":27209,"nodeType":860},{},[27210],{"data":27211,"marks":27212,"value":25099,"nodeType":864},{},[],{"data":27214,"content":27215,"nodeType":860},{},[27216],{"data":27217,"marks":27218,"value":25106,"nodeType":864},{},[],{"items":27220},[27221,27223],{"sys":27222,"name":7555},{"id":7554},{"sys":27224,"name":4904},{"id":4903},{"items":27226},[27227],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":27228},{"url":21909},{"__typename":2059,"sys":27230,"content":27232,"title":27601,"synopsis":27602,"hashTags":59,"publishedDate":27603,"slug":27604,"tagsCollection":27605,"authorsCollection":27611},{"id":27231},"19dT3oWX2H3EYtZIT3J5UO",{"json":27233},{"data":27234,"content":27235,"nodeType":856},{},[27236,27243,27250,27257,27263,27270,27290,27309,27316,27323,27330,27335,27342,27361,27381,27388,27395,27415,27431,27447,27454,27474,27481,27500,27507,27514,27521,27528,27535,27553,27560,27567,27574,27581,27588,27594],{"data":27237,"content":27238,"nodeType":860},{},[27239],{"data":27240,"marks":27241,"value":27242,"nodeType":864},{},[],"Security teams know they need full visibility into which SaaS platforms employees are using to even start focusing on SaaS management and security. Even better, they want to understand how employees are using them, right? ",{"data":27244,"content":27245,"nodeType":860},{},[27246],{"data":27247,"marks":27248,"value":27249,"nodeType":864},{},[],"Many people we talk to are starting to chip away at getting visibility into employee-adopted apps by using some combination of central information repositories such as email discovery, financial records, OAuth logs, SSO logs, web proxy logs, etc. So why would anyone want or need to use a browser extension? Browser extensions are the most effective SaaS discovery tool because they can capture employee SaaS use and adoption in real time, as employees sign up. The browser also allows us to work with the user to guide them to use SaaS more securely right where they’re working - in the browser.",{"data":27251,"content":27252,"nodeType":860},{},[27253],{"data":27254,"marks":27255,"value":27256,"nodeType":864},{},[],"We’ll dig into this topic a bit more in this article and we’d love to hear questions, concerns, and have a healthy debate on our social media channels, so hit us up!",{"data":27258,"content":27259,"nodeType":1312},{},[27260],{"data":27261,"marks":27262,"value":21966,"nodeType":864},{},[],{"data":27264,"content":27265,"nodeType":860},{},[27266],{"data":27267,"marks":27268,"value":27269,"nodeType":864},{},[],"Different approaches for discovering SaaS use have unique advantages and disadvantages and the most effective solution is usually to combine several approaches that complement one another. That being said, in the case of SaaS discovery, browser extensions have some really significant advantages that can’t be matched by other approaches - so if you could only pick one approach, then a browser extension is the way to go.",{"data":27271,"content":27272,"nodeType":860},{},[27273,27277,27286],{"data":27274,"marks":27275,"value":27276,"nodeType":864},{},[],"The first point to consider is that it is extremely common for SaaS solutions to be self-adopted by individual employees or teams within a business, without working with IT or following the established procurement process. ",{"data":27278,"content":27280,"nodeType":883},{"uri":27279},"https://track.g2.com/resources/shadow-it-statistics",[27281],{"data":27282,"marks":27283,"value":27285,"nodeType":864},{},[27284],{"type":1455},"According to G2",{"data":27287,"marks":27288,"value":27289,"nodeType":864},{},[],", 80% of workers admit to using SaaS applications at work without getting approval from IT. Employees are likely to access SaaS however is easiest and most familiar for them. So, employees aren’t going to set up a full SSO connection with your own authentication provider (on the off chance that the app even provides SSO integration). They might not be using a social login using your M365/Google tenant and they might not even be using their company email to sign up/login - they could just be using a personal webmail account.",{"data":27291,"content":27292,"nodeType":860},{},[27293,27297,27305],{"data":27294,"marks":27295,"value":27296,"nodeType":864},{},[],"That leaves security teams with limited or no visibility of employee SaaS use using other centralized methods. We found that only around 30% of SaaS providers we analyzed support SSO and of those that do, many require paying for the highest cost enterprise plan in order to gain access to it - i.e. “",{"data":27298,"content":27299,"nodeType":883},{"uri":13628},[27300],{"data":27301,"marks":27302,"value":27304,"nodeType":864},{},[27303],{"type":1455},"The SSO tax",{"data":27306,"marks":27307,"value":27308,"nodeType":864},{},[],".” ",{"data":27310,"content":27311,"nodeType":860},{},[27312],{"data":27313,"marks":27314,"value":27315,"nodeType":864},{},[],"Many don’t support social logins and, if they do, you’ll find M365 social logins are much less commonly supported than Google, so if you’re a Microsoft house, that pushes users towards individual email/password logins, which are far less secure.",{"data":27317,"content":27318,"nodeType":1312},{},[27319],{"data":27320,"marks":27321,"value":27322,"nodeType":864},{},[],"A comparison of data sources for SaaS discovery",{"data":27324,"content":27325,"nodeType":860},{},[27326],{"data":27327,"marks":27328,"value":27329,"nodeType":864},{},[],"We won’t do a deep dive of comparing data sources for SaaS discovery in this post, but here’s a quick and dirty overview. As we mentioned above, most companies (and off-the-shelf SaaS security and SaaS management tools) use some combination of the data sources depicted in the image below. ",{"data":27331,"content":27334,"nodeType":996},{"target":27332},{"sys":27333},{"id":23039,"type":1001,"linkType":1002},[],{"data":27336,"content":27337,"nodeType":860},{},[27338],{"data":27339,"marks":27340,"value":27341,"nodeType":864},{},[]," Now, it goes without saying that we’re a bit biased, but as we were deciding how to build our own SaaS discovery methods, we analyzed the pros and cons of each of these approaches before realizing that the most power was in the browser. Ease of deployment, you’ll notice, takes a bit more work than a couple other methods, but it’s worth it once you realize the powerful capabilities uniquely available in the browser. We’ll address the deployment and rollout challenges in a bit more detail later in this post. ",{"data":27343,"content":27344,"nodeType":860},{},[27345,27349,27358],{"data":27346,"marks":27347,"value":27348,"nodeType":864},{},[],"To dig into each of these approaches and how to potentially combine them to build your own SaaS discovery engine, check out ",{"data":27350,"content":27352,"nodeType":883},{"uri":27351},"https://pushsecurity.com/blog/rolling-your-own-saas-discovery/",[27353],{"data":27354,"marks":27355,"value":27357,"nodeType":864},{},[27356],{"type":1455},"this post.",{"data":27359,"marks":27360,"value":6408,"nodeType":864},{},[],{"data":27362,"content":27363,"nodeType":860},{},[27364,27368,27377],{"data":27365,"marks":27366,"value":27367,"nodeType":864},{},[],"If you already know you don’t have the resources (time, team, budget) to build your own and you’re thinking about evaluating solutions, head over to ",{"data":27369,"content":27371,"nodeType":883},{"uri":27370},"https://pushsecurity.com/blog/how-to-find-the-right-saas-security-solution-for-your-organization/",[27372],{"data":27373,"marks":27374,"value":27376,"nodeType":864},{},[27375],{"type":1455},"this post",{"data":27378,"marks":27379,"value":27380,"nodeType":864},{},[]," to understand which might be the best fit for your company. ",{"data":27382,"content":27383,"nodeType":860},{},[27384],{"data":27385,"marks":27386,"value":27387,"nodeType":864},{},[],"Next, we’ll dig into how we manage our own SaaS security to provide some relevant context and we’ll explain where the browser extension fits in",{"data":27389,"content":27390,"nodeType":1312},{},[27391],{"data":27392,"marks":27393,"value":27394,"nodeType":864},{},[],"A case study…with us!",{"data":27396,"content":27397,"nodeType":860},{},[27398,27402,27411],{"data":27399,"marks":27400,"value":27401,"nodeType":864},{},[],"To put this into context, we’ll use ourselves as an example, since we’re a fully SaaS-native company. Our entire business is SaaS security, we have no physical or virtual infrastructure to manage and we actively encourage our employees to self-adopt SaaS solutions to solve their own business needs. We’re also a Google workspace enterprise customer and we educate our employees to ",{"data":27403,"content":27405,"nodeType":883},{"uri":27404},"https://pushsecurity.com/blog/should-i-let-my-employees-login-with-their-work-google-account",[27406],{"data":27407,"marks":27408,"value":27410,"nodeType":864},{},[27409],{"type":1455},"always use Google social logins",{"data":27412,"marks":27413,"value":27414,"nodeType":864},{},[]," for SaaS solutions as the first choice when available ). ",{"data":27416,"content":27417,"nodeType":860},{},[27418,27422,27427],{"data":27419,"marks":27420,"value":27421,"nodeType":864},{},[],"We tuck all SaaS apps behind SSO, wherever we can and wherever our licenses will let us. And since we’re a fairly new company, we’ve been able to push social logins and “login with Google” to our employees since day one, so that’s a pretty clean and ideal world compared to the environments many security folks are working in. This means we really should be a best case example when it comes to centralized SaaS discovery methods. That said, we also use almost 100 different SaaS platforms across the company and, despite everything else above, 33% of these SaaS platforms are ",{"data":27423,"marks":27424,"value":27426,"nodeType":864},{},[27425],{"type":2246},"only ",{"data":27428,"marks":27429,"value":27430,"nodeType":864},{},[],"visible because we’re using a browser extension to discover them as our employees sign up.",{"data":27432,"content":27433,"nodeType":860},{},[27434,27438,27443],{"data":27435,"marks":27436,"value":27437,"nodeType":864},{},[],"A similar company without a browser extension ",{"data":27439,"marks":27440,"value":27442,"nodeType":864},{},[27441],{"type":899},"could be missing out on a third of their SaaS platforms",{"data":27444,"marks":27445,"value":27446,"nodeType":864},{},[],". Once we look at similar stats for our customers, particularly M365 users, we see the percentage of SaaS platforms that are only discovered via the browser extension increase and this is sometimes even as high as 70-80%. If you’re serious about SaaS discovery, then you should really not settle for missing such a large percentage of platforms.",{"data":27448,"content":27449,"nodeType":1312},{},[27450],{"data":27451,"marks":27452,"value":27453,"nodeType":864},{},[],"Why does a browser see so much more?",{"data":27455,"content":27456,"nodeType":860},{},[27457,27461,27470],{"data":27458,"marks":27459,"value":27460,"nodeType":864},{},[],"Since SaaS is often self-adopted, the problem can often be attributed to a decentralized problem. Many SaaS vendors even encourage this as they have a product-led growth (PLG) model and prefer the frictionless growth of a PLG model over the high-friction sales cycle in a centralized procurement model. We’ve got a ",{"data":27462,"content":27464,"nodeType":883},{"uri":27463},"https://pushsecurity.com/webinar/securing-employee-adopted-saas-apps",[27465],{"data":27466,"marks":27467,"value":27469,"nodeType":864},{},[27468],{"type":1455},"webinar with our co-founder",{"data":27471,"marks":27472,"value":27473,"nodeType":864},{},[]," on this topic if you want to explore further. ",{"data":27475,"content":27476,"nodeType":860},{},[27477],{"data":27478,"marks":27479,"value":27480,"nodeType":864},{},[],"Additionally, your average non-technical employee may not be familiar with SSO or social logins as access methods, but everyone knows how to sign-up for a website with an email address, username and password. Consequently, it’s just common for centralized data sources to end up missing a lot of SaaS use if they’re looking at logs, proxies, and other data sources.",{"data":27482,"content":27483,"nodeType":860},{},[27484,27488,27496],{"data":27485,"marks":27486,"value":27487,"nodeType":864},{},[],"Without SSO or social logins, you aren’t seeing anything via those data sources. If you use email discovery, you’ll have lots of false positives to deal with from marketing spam and you’ll only know about it for employees that used their corporate email address and for SaaS platforms that actively send out emails. If you’re relying on network data sources like web proxy data then you need to be capturing everything including home/mobile employees and even then most details will be hidden behind HTTPS connections. You could intercept and decrypt all HTTPS traffic via your proxy, but then you’d be introducing a huge security risk by decrypting all communications in one place. We’ve got a more thorough article on the topic of ",{"data":27489,"content":27490,"nodeType":883},{"uri":27351},[27491],{"data":27492,"marks":27493,"value":27495,"nodeType":864},{},[27494],{"type":1455},"SaaS discovery data sources ",{"data":27497,"marks":27498,"value":27499,"nodeType":864},{},[],"and their pros and cons to read up on, too. ",{"data":27501,"content":27502,"nodeType":860},{},[27503],{"data":27504,"marks":27505,"value":27506,"nodeType":864},{},[],"On the other hand, browsers are quickly becoming the main way people operate from a desktop environment, with the browser as the way they’re doing almost every task. Since they’re using the browser to access their apps, it makes sense to use data collected from the browser to get visibility of SaaS. It doesn’t matter if they use an SSO login, a social login, an email address/password login, a corporate email or a personal webmail account - as long as they login or access the SaaS platform from a browser, then a browser extension is best placed to see that. Wherever the user is in the world, whatever they are doing, the extension can keep an eye out.",{"data":27508,"content":27509,"nodeType":1312},{},[27510],{"data":27511,"marks":27512,"value":27513,"nodeType":864},{},[],"There are so many other security benefits beyond basic visibility",{"data":27515,"content":27516,"nodeType":860},{},[27517],{"data":27518,"marks":27519,"value":27520,"nodeType":864},{},[],"We’ve covered general visibility of SaaS platforms (i.e. whether they are in use or not, what login method is in use and by who), but there’s much more useful information for managing SaaS security risks. To secure SaaS, you also need to know whether multi-factor authentication (MFA) is in use; If the password is secure; If passwords are shared between different accounts; If accounts are shared between users; If sensitive files are uploaded to a particular SaaS platform.",{"data":27522,"content":27523,"nodeType":860},{},[27524],{"data":27525,"marks":27526,"value":27527,"nodeType":864},{},[],"Some SaaS vendors may provide APIs and logs that can answer some of these questions, but this tends to be limited to the biggest or most security conscious vendors. It’s overwhelming to handle this manually because you need to consider separate integrations with all your different SaaS vendors, and that’s assuming you already know they are in use. It might be viable for some of the most important SaaS platforms you use (think Salesforce, Slack, Trello, etc.) , but it’s not easy to go much further when you have hundreds of different SaaS platforms to consider.",{"data":27529,"content":27530,"nodeType":860},{},[27531],{"data":27532,"marks":27533,"value":27534,"nodeType":864},{},[],"A browser extension, on the other hand, can see all the interactions between users and any given SaaS platform, so it can provide insights that may not be visible via a SaaS vendor’s own APIs or logs. This is especially true for fairly standardized mechanisms such as web-based logins, where it provides an easy opportunity to provide password security checks and MFA checks. ",{"data":27536,"content":27537,"nodeType":860},{},[27538,27542,27550],{"data":27539,"marks":27540,"value":27541,"nodeType":864},{},[],"Being a decentralized model, this can all be achieved without sending lots of highly sensitive data (e.g. passwords) to a centralized point. Instead, the browser extension can just report individual security findings as necessary without feeding that private data to a central repository. The Push browser extension identifies weak passwords in use, MFA status, passwords shared between different SaaS platforms and even accounts being shared by multiple different users - none of this requires sending passwords or any other sensitive data to our central servers - just the findings themselves. You can find more information about what data we collect ",{"data":27543,"content":27545,"nodeType":883},{"uri":27544},"https://pushsecurity.com/help/audience/administrators/docs/install-the-browser-extension",[27546],{"data":27547,"marks":27548,"value":25431,"nodeType":864},{},[27549],{"type":1455},{"data":27551,"marks":27552,"value":6570,"nodeType":864},{},[],{"data":27554,"content":27555,"nodeType":1312},{},[27556],{"data":27557,"marks":27558,"value":27559,"nodeType":864},{},[],"How do I roll out a browser extension to every single employee?",{"data":27561,"content":27562,"nodeType":860},{},[27563],{"data":27564,"marks":27565,"value":27566,"nodeType":864},{},[],"Traditionally, browser extensions have been focused on self-adoption by users via a browser extension store. In that case, the user makes the decision to install, rather than IT or security managing the deployment.",{"data":27568,"content":27569,"nodeType":860},{},[27570],{"data":27571,"marks":27572,"value":27573,"nodeType":864},{},[],"However, the major browser vendors have made it easy to install and manage browser extensions centrally, as well as making them more resilient to ensure they’re both secure and cannot induce significant performance issues in the browser.",{"data":27575,"content":27576,"nodeType":860},{},[27577],{"data":27578,"marks":27579,"value":27580,"nodeType":864},{},[],"Most larger organizations will be familiar with deploying desktop software remotely using central device management software, especially for endpoint security software like anti-virus and EDR. The same idea works with a browser extension using most of the common browser and operating system combinations. The Push browser extension can be deployed centrally on Chrome, Edge, Firefox and Brave, depending on the device management software and operating system in use. ",{"data":27582,"content":27583,"nodeType":860},{},[27584],{"data":27585,"marks":27586,"value":27587,"nodeType":864},{},[],"What’s more, browser extensions consist of JavaScript running in a tightly-controlled environment with additional performance controls in place by the browser and they even auto-update too. Compare this with the common case for endpoint security software of having an agent running as SYSTEM/root and users complaining it’s stealing all their CPU cycles and centralized browser deployment starts looking like a more attractive prospect than traditional endpoint agent deployment.",{"data":27589,"content":27590,"nodeType":1312},{},[27591],{"data":27592,"marks":27593,"value":19795,"nodeType":864},{},[],{"data":27595,"content":27596,"nodeType":860},{},[27597],{"data":27598,"marks":27599,"value":27600,"nodeType":864},{},[],"We’re pretty into browser extensions here, but it’s not just because that’s how our product works. We’re not trying to sell you a new thing just for the sake of building something novel. Browser extensions are going to become one of the most important methods of managing SaaS security going forward. They’ve got advantages that other approaches just can’t match and centralized deployment and management is now a slick, easy and - frankly - solved problem. ","Want to discover the full extent of your SaaS sprawl? Embrace browser extensions ","Browser extensions are the most effective SaaS discovery tool because they can capture employee SaaS use and adoption in real time, as employees sign up. ","2023-04-25T00:00:00.000Z","want-to-discover-the-full-extent-of-your-saas-sprawl-embrace-browser",{"items":27606},[27607,27609],{"sys":27608,"name":4904},{"id":4903},{"sys":27610,"name":297},{"id":2732},{"items":27612},[27613],{"fullName":21096,"firstName":21097,"jobTitle":21098,"profilePicture":27614},{"url":21100},"3-steps-to-secure-your-data-across-shadow-saas-apps","blog/3-steps-to-secure-your-data-across-shadow-saas-apps",{"json":27618},{"data":27619,"content":27620,"nodeType":856},{},[27621],{"data":27622,"content":27623,"nodeType":860},{},[27624],{"data":27625,"marks":27626,"value":27627,"nodeType":864},{},[],"Attackers commonly target SaaS apps because they know employees sign up without running them past IT first. Learn how to adjust to secure your data.","Attackers commonly target SaaS apps because they know employees sign up without running them past IT first. Learn how to adjust to secure your data.\n",{"id":27630,"publishedAt":27631},"6ppEa7WXiKcgLQ9yGn7q3k","2026-08-12T11:56:16.601Z",{"items":27633},[27634,27636],{"sys":27635,"name":4904},{"id":4903},{"sys":27637,"name":2729},{"id":2728},{"items":27639},[27640,27642,27644,27646,27648,27650,27652,27654,27656],{"sys":27641,"name":545,"slug":546,"tier":31},{"id":542},{"sys":27643,"name":413,"slug":414,"tier":31},{"id":410},{"sys":27645,"name":297,"slug":298,"tier":31},{"id":294},{"sys":27647,"name":589,"slug":590,"tier":45},{"id":586},{"sys":27649,"name":333,"slug":334,"tier":45},{"id":330},{"sys":27651,"name":457,"slug":458,"tier":45},{"id":454},{"sys":27653,"name":502,"slug":503,"tier":45},{"id":499},{"sys":27655,"name":306,"slug":307,"tier":45},{"id":303},{"sys":27657,"name":633,"slug":634,"tier":45},{"id":630},"bfrjaJRm7WwQudAcaQuYFML0hKXe-_vosmuho_T4aXg",{"id":27660,"title":21984,"authorsCollection":27661,"content":27666,"extension":228,"faqItemsCollection":28960,"faqTitle":59,"featured":6,"hashTags":59,"meta":28962,"metaTitle":28963,"ogImage":59,"postType":6304,"publishedDate":25108,"relatedBlogPostsCollection":28964,"slug":23522,"stem":29309,"subtitle":59,"summary":29310,"synopsis":25107,"sys":29321,"tagsCollection":29323,"topicsCollection":29329,"__hash__":29353},"blog/blog/saas-has-changed-how-we-adopt-software-how-should-security-adapt.json",{"items":27662},[27663],{"fullName":21905,"firstName":21906,"jobTitle":21907,"socialLinks":27664,"profilePicture":27665},[21954],{"url":21909},{"json":27667,"links":28922},{"data":27668,"content":27669,"nodeType":856},{},[27670,27676,27682,27688,27694,27700,27706,27712,27718,27757,27763,27769,27775,27781,27787,27792,27798,27804,27810,27817,27823,27829,27835,27841,27847,27853,27859,27875,27880,27886,27892,27902,27909,27915,27920,27926,27932,27937,27943,27951,27964,27985,27991,27997,28003,28009,28014,28020,28026,28032,28038,28044,28050,28066,28072,28078,28084,28090,28103,28133,28141,28147,28153,28159,28165,28171,28177,28183,28188,28194,28200,28206,28212,28218,28224,28240,28246,28251,28257,28278,28284,28290,28320,28326,28332,28338,28344,28356,28362,28422,28428,28434,28455,28460,28466,28472,28478,28508,28514,28855,28861,28877,28883,28891,28904,28910,28916],{"data":27671,"content":27672,"nodeType":1009},{},[27673],{"data":27674,"marks":27675,"value":21966,"nodeType":864},{},[],{"data":27677,"content":27678,"nodeType":860},{},[27679],{"data":27680,"marks":27681,"value":23671,"nodeType":864},{},[],{"data":27683,"content":27684,"nodeType":860},{},[27685],{"data":27686,"marks":27687,"value":23678,"nodeType":864},{},[],{"data":27689,"content":27690,"nodeType":860},{},[27691],{"data":27692,"marks":27693,"value":23685,"nodeType":864},{},[],{"data":27695,"content":27696,"nodeType":860},{},[27697],{"data":27698,"marks":27699,"value":23692,"nodeType":864},{},[],{"data":27701,"content":27702,"nodeType":860},{},[27703],{"data":27704,"marks":27705,"value":23699,"nodeType":864},{},[],{"data":27707,"content":27708,"nodeType":860},{},[27709],{"data":27710,"marks":27711,"value":23706,"nodeType":864},{},[],{"data":27713,"content":27714,"nodeType":860},{},[27715],{"data":27716,"marks":27717,"value":23713,"nodeType":864},{},[],{"data":27719,"content":27720,"nodeType":941},{},[27721,27730,27739,27748],{"data":27722,"content":27723,"nodeType":945},{},[27724],{"data":27725,"content":27726,"nodeType":860},{},[27727],{"data":27728,"marks":27729,"value":23726,"nodeType":864},{},[],{"data":27731,"content":27732,"nodeType":945},{},[27733],{"data":27734,"content":27735,"nodeType":860},{},[27736],{"data":27737,"marks":27738,"value":23736,"nodeType":864},{},[],{"data":27740,"content":27741,"nodeType":945},{},[27742],{"data":27743,"content":27744,"nodeType":860},{},[27745],{"data":27746,"marks":27747,"value":23746,"nodeType":864},{},[],{"data":27749,"content":27750,"nodeType":945},{},[27751],{"data":27752,"content":27753,"nodeType":860},{},[27754],{"data":27755,"marks":27756,"value":23756,"nodeType":864},{},[],{"data":27758,"content":27759,"nodeType":860},{},[27760],{"data":27761,"marks":27762,"value":23763,"nodeType":864},{},[],{"data":27764,"content":27765,"nodeType":860},{},[27766],{"data":27767,"marks":27768,"value":23770,"nodeType":864},{},[],{"data":27770,"content":27771,"nodeType":1009},{},[27772],{"data":27773,"marks":27774,"value":23777,"nodeType":864},{},[],{"data":27776,"content":27777,"nodeType":1312},{},[27778],{"data":27779,"marks":27780,"value":23784,"nodeType":864},{},[],{"data":27782,"content":27783,"nodeType":860},{},[27784],{"data":27785,"marks":27786,"value":23791,"nodeType":864},{},[],{"data":27788,"content":27791,"nodeType":996},{"target":27789},{"sys":27790},{"id":23796,"type":1001,"linkType":1002},[],{"data":27793,"content":27794,"nodeType":860},{},[27795],{"data":27796,"marks":27797,"value":23804,"nodeType":864},{},[],{"data":27799,"content":27800,"nodeType":860},{},[27801],{"data":27802,"marks":27803,"value":23811,"nodeType":864},{},[],{"data":27805,"content":27806,"nodeType":860},{},[27807],{"data":27808,"marks":27809,"value":23818,"nodeType":864},{},[],{"data":27811,"content":27812,"nodeType":860},{},[27813],{"data":27814,"marks":27815,"value":23826,"nodeType":864},{},[27816],{"type":2246},{"data":27818,"content":27819,"nodeType":1312},{},[27820],{"data":27821,"marks":27822,"value":23833,"nodeType":864},{},[],{"data":27824,"content":27825,"nodeType":860},{},[27826],{"data":27827,"marks":27828,"value":23840,"nodeType":864},{},[],{"data":27830,"content":27831,"nodeType":860},{},[27832],{"data":27833,"marks":27834,"value":23847,"nodeType":864},{},[],{"data":27836,"content":27837,"nodeType":860},{},[27838],{"data":27839,"marks":27840,"value":23854,"nodeType":864},{},[],{"data":27842,"content":27843,"nodeType":860},{},[27844],{"data":27845,"marks":27846,"value":23861,"nodeType":864},{},[],{"data":27848,"content":27849,"nodeType":1312},{},[27850],{"data":27851,"marks":27852,"value":23868,"nodeType":864},{},[],{"data":27854,"content":27855,"nodeType":860},{},[27856],{"data":27857,"marks":27858,"value":23875,"nodeType":864},{},[],{"data":27860,"content":27861,"nodeType":860},{},[27862,27865,27872],{"data":27863,"marks":27864,"value":23882,"nodeType":864},{},[],{"data":27866,"content":27867,"nodeType":883},{"uri":23885},[27868],{"data":27869,"marks":27870,"value":23891,"nodeType":864},{},[27871],{"type":1455},{"data":27873,"marks":27874,"value":23895,"nodeType":864},{},[],{"data":27876,"content":27879,"nodeType":996},{"target":27877},{"sys":27878},{"id":23900,"type":1001,"linkType":1002},[],{"data":27881,"content":27882,"nodeType":860},{},[27883],{"data":27884,"marks":27885,"value":23908,"nodeType":864},{},[],{"data":27887,"content":27888,"nodeType":860},{},[27889],{"data":27890,"marks":27891,"value":23915,"nodeType":864},{},[],{"data":27893,"content":27894,"nodeType":860},{},[27895,27898],{"data":27896,"marks":27897,"value":23922,"nodeType":864},{},[],{"data":27899,"marks":27900,"value":1171,"nodeType":864},{},[27901],{"type":899},{"data":27903,"content":27904,"nodeType":860},{},[27905],{"data":27906,"marks":27907,"value":23934,"nodeType":864},{},[27908],{"type":899},{"data":27910,"content":27911,"nodeType":860},{},[27912],{"data":27913,"marks":27914,"value":23941,"nodeType":864},{},[],{"data":27916,"content":27919,"nodeType":996},{"target":27917},{"sys":27918},{"id":23946,"type":1001,"linkType":1002},[],{"data":27921,"content":27922,"nodeType":1312},{},[27923],{"data":27924,"marks":27925,"value":23954,"nodeType":864},{},[],{"data":27927,"content":27928,"nodeType":860},{},[27929],{"data":27930,"marks":27931,"value":23961,"nodeType":864},{},[],{"data":27933,"content":27936,"nodeType":996},{"target":27934},{"sys":27935},{"id":23966,"type":1001,"linkType":1002},[],{"data":27938,"content":27939,"nodeType":860},{},[27940],{"data":27941,"marks":27942,"value":23974,"nodeType":864},{},[],{"data":27944,"content":27945,"nodeType":860},{},[27946],{"data":27947,"marks":27948,"value":23983,"nodeType":864},{},[27949,27950],{"type":2246},{"type":899},{"data":27952,"content":27953,"nodeType":860},{},[27954,27957,27961],{"data":27955,"marks":27956,"value":23990,"nodeType":864},{},[],{"data":27958,"marks":27959,"value":23995,"nodeType":864},{},[27960],{"type":899},{"data":27962,"marks":27963,"value":23999,"nodeType":864},{},[],{"data":27965,"content":27966,"nodeType":23195},{},[27967,27976],{"data":27968,"content":27969,"nodeType":945},{},[27970],{"data":27971,"content":27972,"nodeType":860},{},[27973],{"data":27974,"marks":27975,"value":24012,"nodeType":864},{},[],{"data":27977,"content":27978,"nodeType":945},{},[27979],{"data":27980,"content":27981,"nodeType":860},{},[27982],{"data":27983,"marks":27984,"value":24022,"nodeType":864},{},[],{"data":27986,"content":27987,"nodeType":1009},{},[27988],{"data":27989,"marks":27990,"value":24029,"nodeType":864},{},[],{"data":27992,"content":27993,"nodeType":1312},{},[27994],{"data":27995,"marks":27996,"value":24036,"nodeType":864},{},[],{"data":27998,"content":27999,"nodeType":860},{},[28000],{"data":28001,"marks":28002,"value":24043,"nodeType":864},{},[],{"data":28004,"content":28005,"nodeType":860},{},[28006],{"data":28007,"marks":28008,"value":24050,"nodeType":864},{},[],{"data":28010,"content":28013,"nodeType":996},{"target":28011},{"sys":28012},{"id":24055,"type":1001,"linkType":1002},[],{"data":28015,"content":28016,"nodeType":1312},{},[28017],{"data":28018,"marks":28019,"value":24063,"nodeType":864},{},[],{"data":28021,"content":28022,"nodeType":860},{},[28023],{"data":28024,"marks":28025,"value":24070,"nodeType":864},{},[],{"data":28027,"content":28028,"nodeType":860},{},[28029],{"data":28030,"marks":28031,"value":24077,"nodeType":864},{},[],{"data":28033,"content":28034,"nodeType":860},{},[28035],{"data":28036,"marks":28037,"value":24084,"nodeType":864},{},[],{"data":28039,"content":28040,"nodeType":860},{},[28041],{"data":28042,"marks":28043,"value":24091,"nodeType":864},{},[],{"data":28045,"content":28046,"nodeType":1312},{},[28047],{"data":28048,"marks":28049,"value":24098,"nodeType":864},{},[],{"data":28051,"content":28052,"nodeType":860},{},[28053,28056,28063],{"data":28054,"marks":28055,"value":24105,"nodeType":864},{},[],{"data":28057,"content":28058,"nodeType":883},{"uri":24108},[28059],{"data":28060,"marks":28061,"value":24114,"nodeType":864},{},[28062],{"type":1455},{"data":28064,"marks":28065,"value":24118,"nodeType":864},{},[],{"data":28067,"content":28068,"nodeType":860},{},[28069],{"data":28070,"marks":28071,"value":24125,"nodeType":864},{},[],{"data":28073,"content":28074,"nodeType":1312},{},[28075],{"data":28076,"marks":28077,"value":24132,"nodeType":864},{},[],{"data":28079,"content":28080,"nodeType":860},{},[28081],{"data":28082,"marks":28083,"value":24139,"nodeType":864},{},[],{"data":28085,"content":28086,"nodeType":860},{},[28087],{"data":28088,"marks":28089,"value":24146,"nodeType":864},{},[],{"data":28091,"content":28092,"nodeType":860},{},[28093,28096,28100],{"data":28094,"marks":28095,"value":24153,"nodeType":864},{},[],{"data":28097,"marks":28098,"value":24158,"nodeType":864},{},[28099],{"type":2246},{"data":28101,"marks":28102,"value":24162,"nodeType":864},{},[],{"data":28104,"content":28105,"nodeType":941},{},[28106,28115,28124],{"data":28107,"content":28108,"nodeType":945},{},[28109],{"data":28110,"content":28111,"nodeType":860},{},[28112],{"data":28113,"marks":28114,"value":24175,"nodeType":864},{},[],{"data":28116,"content":28117,"nodeType":945},{},[28118],{"data":28119,"content":28120,"nodeType":860},{},[28121],{"data":28122,"marks":28123,"value":24185,"nodeType":864},{},[],{"data":28125,"content":28126,"nodeType":945},{},[28127],{"data":28128,"content":28129,"nodeType":860},{},[28130],{"data":28131,"marks":28132,"value":24195,"nodeType":864},{},[],{"data":28134,"content":28135,"nodeType":860},{},[28136],{"data":28137,"marks":28138,"value":24204,"nodeType":864},{},[28139,28140],{"type":2246},{"type":899},{"data":28142,"content":28143,"nodeType":860},{},[28144],{"data":28145,"marks":28146,"value":24211,"nodeType":864},{},[],{"data":28148,"content":28149,"nodeType":1312},{},[28150],{"data":28151,"marks":28152,"value":24218,"nodeType":864},{},[],{"data":28154,"content":28155,"nodeType":860},{},[28156],{"data":28157,"marks":28158,"value":24225,"nodeType":864},{},[],{"data":28160,"content":28161,"nodeType":860},{},[28162],{"data":28163,"marks":28164,"value":24232,"nodeType":864},{},[],{"data":28166,"content":28167,"nodeType":1312},{},[28168],{"data":28169,"marks":28170,"value":24239,"nodeType":864},{},[],{"data":28172,"content":28173,"nodeType":860},{},[28174],{"data":28175,"marks":28176,"value":24246,"nodeType":864},{},[],{"data":28178,"content":28179,"nodeType":860},{},[28180],{"data":28181,"marks":28182,"value":24253,"nodeType":864},{},[],{"data":28184,"content":28187,"nodeType":996},{"target":28185},{"sys":28186},{"id":24258,"type":1001,"linkType":1002},[],{"data":28189,"content":28190,"nodeType":860},{},[28191],{"data":28192,"marks":28193,"value":24266,"nodeType":864},{},[],{"data":28195,"content":28196,"nodeType":860},{},[28197],{"data":28198,"marks":28199,"value":24273,"nodeType":864},{},[],{"data":28201,"content":28202,"nodeType":860},{},[28203],{"data":28204,"marks":28205,"value":24280,"nodeType":864},{},[],{"data":28207,"content":28208,"nodeType":1009},{},[28209],{"data":28210,"marks":28211,"value":24287,"nodeType":864},{},[],{"data":28213,"content":28214,"nodeType":860},{},[28215],{"data":28216,"marks":28217,"value":24294,"nodeType":864},{},[],{"data":28219,"content":28220,"nodeType":1312},{},[28221],{"data":28222,"marks":28223,"value":24301,"nodeType":864},{},[],{"data":28225,"content":28226,"nodeType":860},{},[28227,28230,28237],{"data":28228,"marks":28229,"value":24308,"nodeType":864},{},[],{"data":28231,"content":28232,"nodeType":883},{"uri":24311},[28233],{"data":28234,"marks":28235,"value":24317,"nodeType":864},{},[28236],{"type":1455},{"data":28238,"marks":28239,"value":24321,"nodeType":864},{},[],{"data":28241,"content":28242,"nodeType":860},{},[28243],{"data":28244,"marks":28245,"value":24328,"nodeType":864},{},[],{"data":28247,"content":28250,"nodeType":996},{"target":28248},{"sys":28249},{"id":22089,"type":1001,"linkType":1002},[],{"data":28252,"content":28253,"nodeType":860},{},[28254],{"data":28255,"marks":28256,"value":24340,"nodeType":864},{},[],{"data":28258,"content":28259,"nodeType":23195},{},[28260,28269],{"data":28261,"content":28262,"nodeType":945},{},[28263],{"data":28264,"content":28265,"nodeType":860},{},[28266],{"data":28267,"marks":28268,"value":24353,"nodeType":864},{},[],{"data":28270,"content":28271,"nodeType":945},{},[28272],{"data":28273,"content":28274,"nodeType":860},{},[28275],{"data":28276,"marks":28277,"value":24363,"nodeType":864},{},[],{"data":28279,"content":28280,"nodeType":860},{},[28281],{"data":28282,"marks":28283,"value":24370,"nodeType":864},{},[],{"data":28285,"content":28286,"nodeType":860},{},[28287],{"data":28288,"marks":28289,"value":24377,"nodeType":864},{},[],{"data":28291,"content":28292,"nodeType":941},{},[28293,28302,28311],{"data":28294,"content":28295,"nodeType":945},{},[28296],{"data":28297,"content":28298,"nodeType":860},{},[28299],{"data":28300,"marks":28301,"value":24390,"nodeType":864},{},[],{"data":28303,"content":28304,"nodeType":945},{},[28305],{"data":28306,"content":28307,"nodeType":860},{},[28308],{"data":28309,"marks":28310,"value":24400,"nodeType":864},{},[],{"data":28312,"content":28313,"nodeType":945},{},[28314],{"data":28315,"content":28316,"nodeType":860},{},[28317],{"data":28318,"marks":28319,"value":24410,"nodeType":864},{},[],{"data":28321,"content":28322,"nodeType":860},{},[28323],{"data":28324,"marks":28325,"value":24417,"nodeType":864},{},[],{"data":28327,"content":28328,"nodeType":860},{},[28329],{"data":28330,"marks":28331,"value":24424,"nodeType":864},{},[],{"data":28333,"content":28334,"nodeType":860},{},[28335],{"data":28336,"marks":28337,"value":24431,"nodeType":864},{},[],{"data":28339,"content":28340,"nodeType":860},{},[28341],{"data":28342,"marks":28343,"value":24438,"nodeType":864},{},[],{"data":28345,"content":28346,"nodeType":941},{},[28347],{"data":28348,"content":28349,"nodeType":945},{},[28350],{"data":28351,"content":28352,"nodeType":860},{},[28353],{"data":28354,"marks":28355,"value":24451,"nodeType":864},{},[],{"data":28357,"content":28358,"nodeType":860},{},[28359],{"data":28360,"marks":28361,"value":24458,"nodeType":864},{},[],{"data":28363,"content":28364,"nodeType":941},{},[28365,28404,28413],{"data":28366,"content":28367,"nodeType":945},{},[28368],{"data":28369,"content":28370,"nodeType":860},{},[28371,28374,28381,28384,28391,28394,28401],{"data":28372,"marks":28373,"value":24471,"nodeType":864},{},[],{"data":28375,"content":28376,"nodeType":883},{"uri":24474},[28377],{"data":28378,"marks":28379,"value":24480,"nodeType":864},{},[28380],{"type":1455},{"data":28382,"marks":28383,"value":3731,"nodeType":864},{},[],{"data":28385,"content":28386,"nodeType":883},{"uri":24486},[28387],{"data":28388,"marks":28389,"value":24492,"nodeType":864},{},[28390],{"type":1455},{"data":28392,"marks":28393,"value":3731,"nodeType":864},{},[],{"data":28395,"content":28396,"nodeType":883},{"uri":24498},[28397],{"data":28398,"marks":28399,"value":24504,"nodeType":864},{},[28400],{"type":1455},{"data":28402,"marks":28403,"value":24508,"nodeType":864},{},[],{"data":28405,"content":28406,"nodeType":945},{},[28407],{"data":28408,"content":28409,"nodeType":860},{},[28410],{"data":28411,"marks":28412,"value":24518,"nodeType":864},{},[],{"data":28414,"content":28415,"nodeType":945},{},[28416],{"data":28417,"content":28418,"nodeType":860},{},[28419],{"data":28420,"marks":28421,"value":24528,"nodeType":864},{},[],{"data":28423,"content":28424,"nodeType":1312},{},[28425],{"data":28426,"marks":28427,"value":24535,"nodeType":864},{},[],{"data":28429,"content":28430,"nodeType":860},{},[28431],{"data":28432,"marks":28433,"value":24542,"nodeType":864},{},[],{"data":28435,"content":28436,"nodeType":23195},{},[28437,28446],{"data":28438,"content":28439,"nodeType":945},{},[28440],{"data":28441,"content":28442,"nodeType":860},{},[28443],{"data":28444,"marks":28445,"value":24555,"nodeType":864},{},[],{"data":28447,"content":28448,"nodeType":945},{},[28449],{"data":28450,"content":28451,"nodeType":860},{},[28452],{"data":28453,"marks":28454,"value":24565,"nodeType":864},{},[],{"data":28456,"content":28459,"nodeType":996},{"target":28457},{"sys":28458},{"id":22116,"type":1001,"linkType":1002},[],{"data":28461,"content":28462,"nodeType":860},{},[28463],{"data":28464,"marks":28465,"value":24577,"nodeType":864},{},[],{"data":28467,"content":28468,"nodeType":1009},{},[28469],{"data":28470,"marks":28471,"value":24584,"nodeType":864},{},[],{"data":28473,"content":28474,"nodeType":860},{},[28475],{"data":28476,"marks":28477,"value":24591,"nodeType":864},{},[],{"data":28479,"content":28480,"nodeType":941},{},[28481,28490,28499],{"data":28482,"content":28483,"nodeType":945},{},[28484],{"data":28485,"content":28486,"nodeType":860},{},[28487],{"data":28488,"marks":28489,"value":24604,"nodeType":864},{},[],{"data":28491,"content":28492,"nodeType":945},{},[28493],{"data":28494,"content":28495,"nodeType":860},{},[28496],{"data":28497,"marks":28498,"value":24614,"nodeType":864},{},[],{"data":28500,"content":28501,"nodeType":945},{},[28502],{"data":28503,"content":28504,"nodeType":860},{},[28505],{"data":28506,"marks":28507,"value":24624,"nodeType":864},{},[],{"data":28509,"content":28510,"nodeType":860},{},[28511],{"data":28512,"marks":28513,"value":24631,"nodeType":864},{},[],{"data":28515,"content":28516,"nodeType":4845},{},[28517,28540,28608,28657,28695,28802],{"data":28518,"content":28519,"nodeType":4581},{},[28520,28530],{"data":28521,"content":28522,"nodeType":4569},{},[28523],{"data":28524,"content":28525,"nodeType":860},{},[28526],{"data":28527,"marks":28528,"value":24648,"nodeType":864},{},[28529],{"type":899},{"data":28531,"content":28532,"nodeType":4569},{},[28533],{"data":28534,"content":28535,"nodeType":860},{},[28536],{"data":28537,"marks":28538,"value":24659,"nodeType":864},{},[28539],{"type":899},{"data":28541,"content":28542,"nodeType":4581},{},[28543,28552],{"data":28544,"content":28545,"nodeType":4569},{},[28546],{"data":28547,"content":28548,"nodeType":860},{},[28549],{"data":28550,"marks":28551,"value":24672,"nodeType":864},{},[],{"data":28553,"content":28554,"nodeType":4569},{},[28555,28578],{"data":28556,"content":28557,"nodeType":860},{},[28558,28561,28568,28571,28575],{"data":28559,"marks":28560,"value":21,"nodeType":864},{},[],{"data":28562,"content":28563,"nodeType":883},{"uri":24684},[28564],{"data":28565,"marks":28566,"value":24690,"nodeType":864},{},[28567],{"type":1455},{"data":28569,"marks":28570,"value":24694,"nodeType":864},{},[],{"data":28572,"marks":28573,"value":24699,"nodeType":864},{},[28574],{"type":899},{"data":28576,"marks":28577,"value":24703,"nodeType":864},{},[],{"data":28579,"content":28580,"nodeType":860},{},[28581,28584,28591,28594,28598,28601,28605],{"data":28582,"marks":28583,"value":24710,"nodeType":864},{},[],{"data":28585,"content":28586,"nodeType":883},{"uri":24713},[28587],{"data":28588,"marks":28589,"value":24719,"nodeType":864},{},[28590],{"type":1455},{"data":28592,"marks":28593,"value":24723,"nodeType":864},{},[],{"data":28595,"marks":28596,"value":24728,"nodeType":864},{},[28597],{"type":899},{"data":28599,"marks":28600,"value":24732,"nodeType":864},{},[],{"data":28602,"marks":28603,"value":24504,"nodeType":864},{},[28604],{"type":899},{"data":28606,"marks":28607,"value":24740,"nodeType":864},{},[],{"data":28609,"content":28610,"nodeType":4581},{},[28611,28620],{"data":28612,"content":28613,"nodeType":4569},{},[28614],{"data":28615,"content":28616,"nodeType":860},{},[28617],{"data":28618,"marks":28619,"value":24753,"nodeType":864},{},[],{"data":28621,"content":28622,"nodeType":4569},{},[28623],{"data":28624,"content":28625,"nodeType":860},{},[28626,28630,28633,28640,28643,28647,28650,28654],{"data":28627,"marks":28628,"value":24492,"nodeType":864},{},[28629],{"type":899},{"data":28631,"marks":28632,"value":24767,"nodeType":864},{},[],{"data":28634,"content":28635,"nodeType":883},{"uri":24770},[28636],{"data":28637,"marks":28638,"value":24776,"nodeType":864},{},[28639],{"type":1455},{"data":28641,"marks":28642,"value":24780,"nodeType":864},{},[],{"data":28644,"marks":28645,"value":24785,"nodeType":864},{},[28646],{"type":899},{"data":28648,"marks":28649,"value":24789,"nodeType":864},{},[],{"data":28651,"marks":28652,"value":24728,"nodeType":864},{},[28653],{"type":899},{"data":28655,"marks":28656,"value":24797,"nodeType":864},{},[],{"data":28658,"content":28659,"nodeType":4581},{},[28660,28669],{"data":28661,"content":28662,"nodeType":4569},{},[28663],{"data":28664,"content":28665,"nodeType":860},{},[28666],{"data":28667,"marks":28668,"value":24810,"nodeType":864},{},[],{"data":28670,"content":28671,"nodeType":4569},{},[28672],{"data":28673,"content":28674,"nodeType":860},{},[28675,28678,28682,28685,28692],{"data":28676,"marks":28677,"value":24820,"nodeType":864},{},[],{"data":28679,"marks":28680,"value":24492,"nodeType":864},{},[28681],{"type":899},{"data":28683,"marks":28684,"value":24828,"nodeType":864},{},[],{"data":28686,"content":28687,"nodeType":883},{"uri":24831},[28688],{"data":28689,"marks":28690,"value":24837,"nodeType":864},{},[28691],{"type":1455},{"data":28693,"marks":28694,"value":21,"nodeType":864},{},[],{"data":28696,"content":28697,"nodeType":4581},{},[28698,28707],{"data":28699,"content":28700,"nodeType":4569},{},[28701],{"data":28702,"content":28703,"nodeType":860},{},[28704],{"data":28705,"marks":28706,"value":24853,"nodeType":864},{},[],{"data":28708,"content":28709,"nodeType":4569},{},[28710,28744,28767,28780,28796],{"data":28711,"content":28712,"nodeType":860},{},[28713,28717,28720,28724,28727,28734,28737,28741],{"data":28714,"marks":28715,"value":24504,"nodeType":864},{},[28716],{"type":899},{"data":28718,"marks":28719,"value":24867,"nodeType":864},{},[],{"data":28721,"marks":28722,"value":24492,"nodeType":864},{},[28723],{"type":899},{"data":28725,"marks":28726,"value":24875,"nodeType":864},{},[],{"data":28728,"content":28729,"nodeType":883},{"uri":24878},[28730],{"data":28731,"marks":28732,"value":24884,"nodeType":864},{},[28733],{"type":1455},{"data":28735,"marks":28736,"value":24888,"nodeType":864},{},[],{"data":28738,"marks":28739,"value":24893,"nodeType":864},{},[28740],{"type":899},{"data":28742,"marks":28743,"value":24897,"nodeType":864},{},[],{"data":28745,"content":28746,"nodeType":860},{},[28747,28750,28754,28757,28764],{"data":28748,"marks":28749,"value":24904,"nodeType":864},{},[],{"data":28751,"marks":28752,"value":24504,"nodeType":864},{},[28753],{"type":899},{"data":28755,"marks":28756,"value":1171,"nodeType":864},{},[],{"data":28758,"content":28759,"nodeType":883},{"uri":24914},[28760],{"data":28761,"marks":28762,"value":24920,"nodeType":864},{},[28763],{"type":1455},{"data":28765,"marks":28766,"value":24924,"nodeType":864},{},[],{"data":28768,"content":28769,"nodeType":860},{},[28770,28773,28777],{"data":28771,"marks":28772,"value":24931,"nodeType":864},{},[],{"data":28774,"marks":28775,"value":1171,"nodeType":864},{},[28776],{"type":899},{"data":28778,"marks":28779,"value":24939,"nodeType":864},{},[],{"data":28781,"content":28782,"nodeType":860},{},[28783,28786,28793],{"data":28784,"marks":28785,"value":24946,"nodeType":864},{},[],{"data":28787,"content":28788,"nodeType":883},{"uri":24949},[28789],{"data":28790,"marks":28791,"value":24955,"nodeType":864},{},[28792],{"type":1455},{"data":28794,"marks":28795,"value":6570,"nodeType":864},{},[],{"data":28797,"content":28798,"nodeType":860},{},[28799],{"data":28800,"marks":28801,"value":24965,"nodeType":864},{},[],{"data":28803,"content":28804,"nodeType":4581},{},[28805,28814],{"data":28806,"content":28807,"nodeType":4569},{},[28808],{"data":28809,"content":28810,"nodeType":860},{},[28811],{"data":28812,"marks":28813,"value":24978,"nodeType":864},{},[],{"data":28815,"content":28816,"nodeType":4569},{},[28817],{"data":28818,"content":28819,"nodeType":860},{},[28820,28823,28830,28833,28837,28840,28852],{"data":28821,"marks":28822,"value":24988,"nodeType":864},{},[],{"data":28824,"content":28825,"nodeType":883},{"uri":24991},[28826],{"data":28827,"marks":28828,"value":24997,"nodeType":864},{},[28829],{"type":1455},{"data":28831,"marks":28832,"value":25001,"nodeType":864},{},[],{"data":28834,"marks":28835,"value":24492,"nodeType":864},{},[28836],{"type":899},{"data":28838,"marks":28839,"value":902,"nodeType":864},{},[],{"data":28841,"content":28842,"nodeType":883},{"uri":25011},[28843,28848],{"data":28844,"marks":28845,"value":25018,"nodeType":864},{},[28846,28847],{"type":1455},{"type":899},{"data":28849,"marks":28850,"value":25023,"nodeType":864},{},[28851],{"type":1455},{"data":28853,"marks":28854,"value":25027,"nodeType":864},{},[],{"data":28856,"content":28857,"nodeType":860},{},[28858],{"data":28859,"marks":28860,"value":25034,"nodeType":864},{},[],{"data":28862,"content":28863,"nodeType":860},{},[28864,28867,28874],{"data":28865,"marks":28866,"value":25041,"nodeType":864},{},[],{"data":28868,"content":28869,"nodeType":883},{"uri":25044},[28870],{"data":28871,"marks":28872,"value":24480,"nodeType":864},{},[28873],{"type":1455},{"data":28875,"marks":28876,"value":25053,"nodeType":864},{},[],{"data":28878,"content":28879,"nodeType":860},{},[28880],{"data":28881,"marks":28882,"value":25060,"nodeType":864},{},[],{"data":28884,"content":28885,"nodeType":860},{},[28886],{"data":28887,"marks":28888,"value":25069,"nodeType":864},{},[28889,28890],{"type":899},{"type":2246},{"data":28892,"content":28893,"nodeType":860},{},[28894,28897,28901],{"data":28895,"marks":28896,"value":25076,"nodeType":864},{},[],{"data":28898,"marks":28899,"value":25081,"nodeType":864},{},[28900],{"type":2246},{"data":28902,"marks":28903,"value":25085,"nodeType":864},{},[],{"data":28905,"content":28906,"nodeType":1009},{},[28907],{"data":28908,"marks":28909,"value":25092,"nodeType":864},{},[],{"data":28911,"content":28912,"nodeType":860},{},[28913],{"data":28914,"marks":28915,"value":25099,"nodeType":864},{},[],{"data":28917,"content":28918,"nodeType":860},{},[28919],{"data":28920,"marks":28921,"value":25106,"nodeType":864},{},[],{"entries":28923},{"hyperlink":28924,"inline":28925,"block":28926},[],[],[28927,28930,28937,28940,28948,28951,28954,28957],{"sys":28928,"__typename":1724,"title":25917,"caption":25918,"layoutMode":59,"file":28929},{"id":23796},{"url":25920,"width":25921,"height":25922},{"sys":28931,"__typename":1724,"title":28932,"caption":28933,"layoutMode":23532,"file":28934},{"id":23900},"PLG apps ","all those highlighted buttons are pure PLG, thanks Wes!",{"url":28935,"width":1736,"height":28936},"https://images.ctfassets.net/y1cdw1ablpvd/MV2eQBx7w1P93Iy1bUKVZ/c4145800c0d7bd807a355c776b830cc0/image9.png",662,{"sys":28938,"__typename":1724,"title":25925,"caption":25926,"layoutMode":59,"file":28939},{"id":23946},{"url":25928,"width":25921,"height":25929},{"sys":28941,"__typename":1724,"title":28942,"caption":28943,"layoutMode":23532,"file":28944},{"id":23966},"Security apps aren't PLG","Security apps definitely aren't PLG",{"url":28945,"width":28946,"height":28947},"https://images.ctfassets.net/y1cdw1ablpvd/5YlsuwLiMkAh8cGII7XKMK/0c3399eb63990cb92dd813bdd2ba0b52/image6.png",1864,718,{"sys":28949,"__typename":1724,"title":25932,"caption":25932,"layoutMode":23532,"file":28950},{"id":24055},{"url":25934,"width":25935,"height":25936},{"sys":28952,"__typename":1724,"title":25939,"caption":25940,"layoutMode":23532,"file":28953},{"id":24258},{"url":25942,"width":25943,"height":25944},{"sys":28955,"__typename":1724,"title":23530,"caption":23531,"layoutMode":23532,"file":28956},{"id":22089},{"url":23534,"width":23535,"height":23536},{"sys":28958,"__typename":1724,"title":23539,"caption":23539,"layoutMode":23532,"file":28959},{"id":22116},{"url":23541,"width":1736,"height":23542},{"items":28961},[],{},"SaaS sprawl must be managed with a new approach",{"items":28965},[28966],{"__typename":2059,"sys":28967,"content":28969,"title":29295,"synopsis":29296,"hashTags":59,"publishedDate":29297,"slug":29298,"tagsCollection":29299,"authorsCollection":29305},{"id":28968},"4LOMe7ez5adQtwbPireIBc",{"json":28970},{"data":28971,"content":28972,"nodeType":856},{},[28973,28980,29000,29007,29014,29021,29028,29035,29042,29049,29056,29063,29070,29077,29084,29100,29107,29114,29121,29128,29135,29142,29160,29167,29174,29181,29187,29194,29202,29235,29243,29276],{"data":28974,"content":28975,"nodeType":860},{},[28976],{"data":28977,"marks":28978,"value":28979,"nodeType":864},{},[],"As part of your larger cloud security strategy, you’ve likely been asked to focus on how to secure SaaS apps used in your company. The first step to securing SaaS is getting a real sense of what platforms employees are actually using, beyond those that you already know about. Since SaaS is so easy for employees to adopt and start using without any input from IT and security, they’re likely using hundreds of SaaS apps that aren’t even on your radar. The first step in securing something is getting full visibility into what you even need to secure in the first place. ",{"data":28981,"content":28982,"nodeType":860},{},[28983,28987,28996],{"data":28984,"marks":28985,"value":28986,"nodeType":864},{},[],"To help guide folks through how you might do SaaS discovery on your own, we wrote an ",{"data":28988,"content":28991,"nodeType":17737},{"target":28989},{"sys":28990},{"id":23052,"type":1001,"linkType":1002},[28992],{"data":28993,"marks":28994,"value":28995,"nodeType":864},{},[],"article",{"data":28997,"marks":28998,"value":28999,"nodeType":864},{},[]," about how to manually find what apps employees are using. In it, we explored how to analyze data that you already have on hand to find the unknown apps (shadow IT) used within your business. That’s a pretty significant manual effort, though, and most security teams don’t have the resources to do it. Plus, while these manual attempts can chip away at the SaaS discovery process, none are great at giving you a comprehensive view of SaaS use, nor do they keep up with the constant influx of apps employees are signing up for daily. ",{"data":29001,"content":29002,"nodeType":860},{},[29003],{"data":29004,"marks":29005,"value":29006,"nodeType":864},{},[],"To get truly broad coverage of what SaaS employees are using, you need a large dataset of SaaS apps, the domains associated with them, and this dataset must constantly be updated and expanded to include new apps that are launched every day. ",{"data":29008,"content":29009,"nodeType":860},{},[29010],{"data":29011,"marks":29012,"value":29013,"nodeType":864},{},[],"Unless you can find such a dataset, you must create it. And creating a constantly updated dataset is no small undertaking. That’s why there are so many off-the-shelf solutions and tools that focus solely on SaaS discovery these days. Many say that they are full-scale SaaS security platforms, but what that means isn’t always clear, even after reading product marketing materials. If you were to look at a venn diagram of “SaaS security platforms,” you’d have a giant mess of interlocking circles, with some shared activities amongst all (or most) tools and then vastly different features from that core functionality.",{"data":29015,"content":29016,"nodeType":860},{},[29017],{"data":29018,"marks":29019,"value":29020,"nodeType":864},{},[],"How “good” they are at SaaS discovery really depends on what data they’re using, what they have access to within your environment, the quality of their proprietary datasets (breadth, depth, and timeliness of that data), and how they work with your existing data and tools. To help navigate this mess, we’re sharing some pros and cons of the categories of commercial tools on the market.",{"data":29022,"content":29023,"nodeType":860},{},[29024],{"data":29025,"marks":29026,"value":29027,"nodeType":864},{},[],"To determine which solution you need, you need to consider your tech stack, your specific needs, your risk tolerance, and your short and long term objectives. In this article, we’ll break down some major use cases and match them up with what solutions make the most sense to address them.",{"data":29029,"content":29030,"nodeType":1312},{},[29031],{"data":29032,"marks":29033,"value":29034,"nodeType":864},{},[],"You’re a large enterprise interested in securing core SaaS platforms",{"data":29036,"content":29037,"nodeType":860},{},[29038],{"data":29039,"marks":29040,"value":29041,"nodeType":864},{},[],"\nWorking to only secure 20 or so core applications that have already been sanctioned by the security team? A cloud security posture management (CSPM) or SaaS security posture management (SSPM) solution might be the answer you’re looking for, particularly if you’re on the highest tier license for those apps. ",{"data":29043,"content":29044,"nodeType":860},{},[29045],{"data":29046,"marks":29047,"value":29048,"nodeType":864},{},[],"You can make the most of these tools during in-depth investigations or threat hunting exercises. Leverage them to enforce custom SaaS or cloud app policies as well. The caveat with this one is that you’ll need a fairly sophisticated security team to manage, customize, and run SSPM and CSPM tools.",{"data":29050,"content":29051,"nodeType":860},{},[29052],{"data":29053,"marks":29054,"value":29055,"nodeType":864},{},[],"An ideal environment for these solutions is one that has a full SOC capability so that you extend your existing security monitoring and threat hunting coverage into these core SaaS platforms. You’ll be able to secure a small handful of your business critical applications as long as they’re large and well-established platforms. ",{"data":29057,"content":29058,"nodeType":860},{},[29059],{"data":29060,"marks":29061,"value":29062,"nodeType":864},{},[],"The reason you’ll need top-level licenses and well-established SaaS platforms to make these solutions work is because they rely on API data from those SaaS platforms. Those mature APIs provide necessary information about those core apps that CSPMs and SSPMs use to provide security insights you need to manage the risks. Unfortunately, they won’t cover the dozens of smaller SaaS apps most organizations use, and are normally only available on top license tiers.",{"data":29064,"content":29065,"nodeType":1312},{},[29066],{"data":29067,"marks":29068,"value":29069,"nodeType":864},{},[],"You’re a more traditional, on-prem enterprise interested in blocking unsanctioned SaaS",{"data":29071,"content":29072,"nodeType":860},{},[29073],{"data":29074,"marks":29075,"value":29076,"nodeType":864},{},[],"If your environment is traditional on-site internal networks and you have mature gateway monitoring technology in place already, a cloud access security broker (CASB) may be your best path to securing cloud apps. CASBs work best if you have no employees working from home or on the road or you’re forcing employees to only access work platforms and internet browsers through your corporate VPN.",{"data":29078,"content":29079,"nodeType":860},{},[29080],{"data":29081,"marks":29082,"value":29083,"nodeType":864},{},[],"CASBs typically pull network data such as DNS, SASE, VPN, proxy, and firewall logs. They may also require that you install an agent on each employees’ devices if you want coverage when they are out of the office. ",{"data":29085,"content":29086,"nodeType":860},{},[29087,29091,29096],{"data":29088,"marks":29089,"value":29090,"nodeType":864},{},[],"With those data sources, they provide good aggregate information about SaaS platforms that are accessed. What they ",{"data":29092,"marks":29093,"value":29095,"nodeType":864},{},[29094],{"type":2246},"can’t do well",{"data":29097,"marks":29098,"value":29099,"nodeType":864},{},[]," is provide any insight into how the SaaS app is being used, by which employees (you typically get IP addresses not user names), and for what purpose - as an example, they are typically not able to tell the difference between opening a SaaS product’s homepage, or actually logging into the application - so you are going to have a fairly large number of false positives. ",{"data":29101,"content":29102,"nodeType":860},{},[29103],{"data":29104,"marks":29105,"value":29106,"nodeType":864},{},[],"A CASB also really makes sense if you’re forced into complying with strict regulatory requirements to block everything until you’re able to do an in-depth due diligence process on each app. If your goal (or need) is to block access to unknown, unvetted, or unsanctioned SaaS at the network level with no exceptions, a CASB might be for you.",{"data":29108,"content":29109,"nodeType":1312},{},[29110],{"data":29111,"marks":29112,"value":29113,"nodeType":864},{},[],"You’re a cloud-native company who wants to enable SaaS without introducing too much risk",{"data":29115,"content":29116,"nodeType":860},{},[29117],{"data":29118,"marks":29119,"value":29120,"nodeType":864},{},[],"For cloud-native companies that need better coverage, and are looking for more nuanced controls than network-level blocking, a solution that discovers and secures SaaS through the browser is the way to go. Since employees access SaaS through their browser, it’s a logical step to collect data about who is using what apps through a browser extension. ",{"data":29122,"content":29123,"nodeType":860},{},[29124],{"data":29125,"marks":29126,"value":29127,"nodeType":864},{},[],"The browser approach lets you do true SaaS discovery - so you can find what employees are actually using (not just accessing) and then go about securing those apps. You also don’t need to do much in terms of managing a browser-based solution once it’s set up. It simply runs in the background and surfaces employee SaaS use data into a dashboard. ",{"data":29129,"content":29130,"nodeType":860},{},[29131],{"data":29132,"marks":29133,"value":29134,"nodeType":864},{},[],"By combining browser-level data and robust security APIs from those core business platforms that SSPMs typically tap into, you can get broad visibility of SaaS use in your company for those large in number, but less mature, more up-and-coming apps, and the depth of security data you need for those few core apps that most employees are using. ",{"data":29136,"content":29137,"nodeType":860},{},[29138],{"data":29139,"marks":29140,"value":29141,"nodeType":864},{},[],"The other key benefit of a browser-based approach for SaaS discovery is that you can get incredibly powerful data about who is using the app, how they’re using it, if they’re using security features such as MFA, if they’re reusing passwords across multiple apps, if they’re sharing passwords, when they’ve used it last, and so on. That data is critical when it comes to securing SaaS because the devil truly is in the details. ",{"data":29143,"content":29144,"nodeType":860},{},[29145,29149,29157],{"data":29146,"marks":29147,"value":29148,"nodeType":864},{},[],"If we’ve piqued your interest and you’re curious to see what we can discover about SaaS in your business, ",{"data":29150,"content":29152,"nodeType":883},{"uri":29151},"https://login.pushsecurity.com/",[29153],{"data":29154,"marks":29155,"value":29156,"nodeType":864},{},[],"try the free browser extension",{"data":29158,"marks":29159,"value":6570,"nodeType":864},{},[],{"data":29161,"content":29162,"nodeType":1312},{},[29163],{"data":29164,"marks":29165,"value":29166,"nodeType":864},{},[],"Consider their data sources  ",{"data":29168,"content":29169,"nodeType":860},{},[29170],{"data":29171,"marks":29172,"value":29173,"nodeType":864},{},[],"The critical thing to understand when you’re evaluating if a solution will work for you would be understanding what their data sources are, what weaknesses those data sources inherently have, and what aligns best with your goals. We’ve tried to surface some of that information within the use cases in this article.",{"data":29175,"content":29176,"nodeType":860},{},[29177],{"data":29178,"marks":29179,"value":29180,"nodeType":864},{},[],"So if you’re looking at an EDR that says they can discover SaaS usage, they’ll likely be leveraging endpoint data to detect SaaS use. If you’re looking at CASBs that integrate with your proxy, they’re probably looking at network level data – you get the idea.  ",{"data":29182,"content":29183,"nodeType":1312},{},[29184],{"data":29185,"marks":29186,"value":19795,"nodeType":864},{},[],{"data":29188,"content":29189,"nodeType":860},{},[29190],{"data":29191,"marks":29192,"value":29193,"nodeType":864},{},[],"To wrap this up, we’re going to summarize some key points and provide some questions to ask yourself, your team, or even the vendor of the solution you’re evaluating, as you consider what combination of efforts or what tool is right for you. ",{"data":29195,"content":29196,"nodeType":860},{},[29197],{"data":29198,"marks":29199,"value":29201,"nodeType":864},{},[29200],{"type":899},"Does this solution provide SaaS discovery?",{"data":29203,"content":29204,"nodeType":941},{},[29205,29215,29225],{"data":29206,"content":29207,"nodeType":945},{},[29208],{"data":29209,"content":29210,"nodeType":860},{},[29211],{"data":29212,"marks":29213,"value":29214,"nodeType":864},{},[],"Will this tool find what SaaS apps employees are using, including those you don’t already know about? If so, how? ",{"data":29216,"content":29217,"nodeType":945},{},[29218],{"data":29219,"content":29220,"nodeType":860},{},[29221],{"data":29222,"marks":29223,"value":29224,"nodeType":864},{},[],"Will the tool be able to differentiate between a user visiting a SaaS website, and actually logging into the app? How will it determine who the user is?",{"data":29226,"content":29227,"nodeType":945},{},[29228],{"data":29229,"content":29230,"nodeType":860},{},[29231],{"data":29232,"marks":29233,"value":29234,"nodeType":864},{},[],"If the tool doesn’t provide you with SaaS discovery (finding Shadow IT and the apps employees are using that aren’t on your radar), how will you deal with those apps employees are using without your knowledge?",{"data":29236,"content":29237,"nodeType":860},{},[29238],{"data":29239,"marks":29240,"value":29242,"nodeType":864},{},[29241],{"type":899},"Does the tool provide enough context so you can manage SaaS risk?",{"data":29244,"content":29245,"nodeType":941},{},[29246,29256,29266],{"data":29247,"content":29248,"nodeType":945},{},[29249],{"data":29250,"content":29251,"nodeType":860},{},[29252],{"data":29253,"marks":29254,"value":29255,"nodeType":864},{},[],"Are you getting context about how your users are using apps (are they logging in with social logins or passwords, do they have MFA enabled, are they admins on the app, etc.), or is it only providing generic information about the app?",{"data":29257,"content":29258,"nodeType":945},{},[29259],{"data":29260,"content":29261,"nodeType":860},{},[29262],{"data":29263,"marks":29264,"value":29265,"nodeType":864},{},[],"How will you engage employees that already rely on these SaaS platforms, or want to adopt new apps, can you handle that though email or in-person - or do you need something more scalable?",{"data":29267,"content":29268,"nodeType":945},{},[29269],{"data":29270,"content":29271,"nodeType":860},{},[29272],{"data":29273,"marks":29274,"value":29275,"nodeType":864},{},[],"Do you need the ability to apply progressive controls, or simply need the ability to block apps entirely?",{"data":29277,"content":29278,"nodeType":860},{},[29279,29283,29291],{"data":29280,"marks":29281,"value":29282,"nodeType":864},{},[],"\nIf you aren’t sure about these questions, why not consider what a ",{"data":29284,"content":29286,"nodeType":883},{"uri":29285},"/product",[29287],{"data":29288,"marks":29289,"value":29290,"nodeType":864},{},[],"user-powered security approach",{"data":29292,"marks":29293,"value":29294,"nodeType":864},{},[]," might look like for your organization.","How to find the right SaaS security solution for your organization ","In this guide, we’ll break down some major SaaS use cases and match them up with solutions that can address them, covering pros and cons for each.\n","2022-07-25T00:00:00.000Z","how-to-find-the-right-saas-security-solution-for-your-organization",{"items":29300},[29301,29303],{"sys":29302,"name":4904},{"id":4903},{"sys":29304,"name":2729},{"id":2728},{"items":29306},[29307],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":29308},{"url":21909},"blog/saas-has-changed-how-we-adopt-software-how-should-security-adapt",{"json":29311},{"data":29312,"content":29313,"nodeType":856},{},[29314],{"data":29315,"content":29316,"nodeType":860},{},[29317],{"data":29318,"marks":29319,"value":29320,"nodeType":864},{},[],"Employees using a new work app used to be the final step of the software-onboarding process. Now it's the first. Security teams need to regain visibility and control over company data and how it’s secured.",{"id":21978,"publishedAt":29322},"2026-08-12T11:56:18.203Z",{"items":29324},[29325,29327],{"sys":29326,"name":7555},{"id":7554},{"sys":29328,"name":4904},{"id":4903},{"items":29330},[29331,29333,29335,29337,29339,29341,29343,29345,29347,29349,29351],{"sys":29332,"name":545,"slug":546,"tier":31},{"id":542},{"sys":29334,"name":413,"slug":414,"tier":31},{"id":410},{"sys":29336,"name":297,"slug":298,"tier":31},{"id":294},{"sys":29338,"name":642,"slug":643,"tier":31},{"id":639},{"sys":29340,"name":589,"slug":590,"tier":45},{"id":586},{"sys":29342,"name":633,"slug":634,"tier":45},{"id":630},{"sys":29344,"name":333,"slug":334,"tier":45},{"id":330},{"sys":29346,"name":457,"slug":458,"tier":45},{"id":454},{"sys":29348,"name":502,"slug":503,"tier":45},{"id":499},{"sys":29350,"name":528,"slug":529,"tier":45},{"id":525},{"sys":29352,"name":306,"slug":307,"tier":45},{"id":303},"Q11y_kCnMj7it0PPqY5g5iqvGJ1RHRbid_CWiwdFGeg",{"id":29355,"title":27601,"authorsCollection":29356,"content":29362,"extension":228,"faqItemsCollection":29683,"faqTitle":59,"featured":6,"hashTags":59,"meta":29685,"metaTitle":29686,"ogImage":59,"postType":6304,"publishedDate":27603,"relatedBlogPostsCollection":29687,"slug":27604,"stem":30567,"subtitle":59,"summary":30568,"synopsis":27602,"sys":30579,"tagsCollection":30581,"topicsCollection":30587,"__hash__":30605},"blog/blog/want-to-discover-the-full-extent-of-your-saas-sprawl-embrace-browser.json",{"items":29357},[29358],{"fullName":21096,"firstName":21097,"jobTitle":21098,"socialLinks":29359,"profilePicture":29361},[29360],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":21100},{"json":29363,"links":29675},{"data":29364,"content":29365,"nodeType":856},{},[29366,29372,29378,29384,29390,29396,29412,29428,29434,29440,29446,29451,29457,29473,29489,29495,29501,29517,29530,29543,29549,29565,29571,29587,29593,29599,29605,29611,29617,29633,29639,29645,29651,29657,29663,29669],{"data":29367,"content":29368,"nodeType":860},{},[29369],{"data":29370,"marks":29371,"value":27242,"nodeType":864},{},[],{"data":29373,"content":29374,"nodeType":860},{},[29375],{"data":29376,"marks":29377,"value":27249,"nodeType":864},{},[],{"data":29379,"content":29380,"nodeType":860},{},[29381],{"data":29382,"marks":29383,"value":27256,"nodeType":864},{},[],{"data":29385,"content":29386,"nodeType":1312},{},[29387],{"data":29388,"marks":29389,"value":21966,"nodeType":864},{},[],{"data":29391,"content":29392,"nodeType":860},{},[29393],{"data":29394,"marks":29395,"value":27269,"nodeType":864},{},[],{"data":29397,"content":29398,"nodeType":860},{},[29399,29402,29409],{"data":29400,"marks":29401,"value":27276,"nodeType":864},{},[],{"data":29403,"content":29404,"nodeType":883},{"uri":27279},[29405],{"data":29406,"marks":29407,"value":27285,"nodeType":864},{},[29408],{"type":1455},{"data":29410,"marks":29411,"value":27289,"nodeType":864},{},[],{"data":29413,"content":29414,"nodeType":860},{},[29415,29418,29425],{"data":29416,"marks":29417,"value":27296,"nodeType":864},{},[],{"data":29419,"content":29420,"nodeType":883},{"uri":13628},[29421],{"data":29422,"marks":29423,"value":27304,"nodeType":864},{},[29424],{"type":1455},{"data":29426,"marks":29427,"value":27308,"nodeType":864},{},[],{"data":29429,"content":29430,"nodeType":860},{},[29431],{"data":29432,"marks":29433,"value":27315,"nodeType":864},{},[],{"data":29435,"content":29436,"nodeType":1312},{},[29437],{"data":29438,"marks":29439,"value":27322,"nodeType":864},{},[],{"data":29441,"content":29442,"nodeType":860},{},[29443],{"data":29444,"marks":29445,"value":27329,"nodeType":864},{},[],{"data":29447,"content":29450,"nodeType":996},{"target":29448},{"sys":29449},{"id":23039,"type":1001,"linkType":1002},[],{"data":29452,"content":29453,"nodeType":860},{},[29454],{"data":29455,"marks":29456,"value":27341,"nodeType":864},{},[],{"data":29458,"content":29459,"nodeType":860},{},[29460,29463,29470],{"data":29461,"marks":29462,"value":27348,"nodeType":864},{},[],{"data":29464,"content":29465,"nodeType":883},{"uri":27351},[29466],{"data":29467,"marks":29468,"value":27357,"nodeType":864},{},[29469],{"type":1455},{"data":29471,"marks":29472,"value":6408,"nodeType":864},{},[],{"data":29474,"content":29475,"nodeType":860},{},[29476,29479,29486],{"data":29477,"marks":29478,"value":27367,"nodeType":864},{},[],{"data":29480,"content":29481,"nodeType":883},{"uri":27370},[29482],{"data":29483,"marks":29484,"value":27376,"nodeType":864},{},[29485],{"type":1455},{"data":29487,"marks":29488,"value":27380,"nodeType":864},{},[],{"data":29490,"content":29491,"nodeType":860},{},[29492],{"data":29493,"marks":29494,"value":27387,"nodeType":864},{},[],{"data":29496,"content":29497,"nodeType":1312},{},[29498],{"data":29499,"marks":29500,"value":27394,"nodeType":864},{},[],{"data":29502,"content":29503,"nodeType":860},{},[29504,29507,29514],{"data":29505,"marks":29506,"value":27401,"nodeType":864},{},[],{"data":29508,"content":29509,"nodeType":883},{"uri":27404},[29510],{"data":29511,"marks":29512,"value":27410,"nodeType":864},{},[29513],{"type":1455},{"data":29515,"marks":29516,"value":27414,"nodeType":864},{},[],{"data":29518,"content":29519,"nodeType":860},{},[29520,29523,29527],{"data":29521,"marks":29522,"value":27421,"nodeType":864},{},[],{"data":29524,"marks":29525,"value":27426,"nodeType":864},{},[29526],{"type":2246},{"data":29528,"marks":29529,"value":27430,"nodeType":864},{},[],{"data":29531,"content":29532,"nodeType":860},{},[29533,29536,29540],{"data":29534,"marks":29535,"value":27437,"nodeType":864},{},[],{"data":29537,"marks":29538,"value":27442,"nodeType":864},{},[29539],{"type":899},{"data":29541,"marks":29542,"value":27446,"nodeType":864},{},[],{"data":29544,"content":29545,"nodeType":1312},{},[29546],{"data":29547,"marks":29548,"value":27453,"nodeType":864},{},[],{"data":29550,"content":29551,"nodeType":860},{},[29552,29555,29562],{"data":29553,"marks":29554,"value":27460,"nodeType":864},{},[],{"data":29556,"content":29557,"nodeType":883},{"uri":27463},[29558],{"data":29559,"marks":29560,"value":27469,"nodeType":864},{},[29561],{"type":1455},{"data":29563,"marks":29564,"value":27473,"nodeType":864},{},[],{"data":29566,"content":29567,"nodeType":860},{},[29568],{"data":29569,"marks":29570,"value":27480,"nodeType":864},{},[],{"data":29572,"content":29573,"nodeType":860},{},[29574,29577,29584],{"data":29575,"marks":29576,"value":27487,"nodeType":864},{},[],{"data":29578,"content":29579,"nodeType":883},{"uri":27351},[29580],{"data":29581,"marks":29582,"value":27495,"nodeType":864},{},[29583],{"type":1455},{"data":29585,"marks":29586,"value":27499,"nodeType":864},{},[],{"data":29588,"content":29589,"nodeType":860},{},[29590],{"data":29591,"marks":29592,"value":27506,"nodeType":864},{},[],{"data":29594,"content":29595,"nodeType":1312},{},[29596],{"data":29597,"marks":29598,"value":27513,"nodeType":864},{},[],{"data":29600,"content":29601,"nodeType":860},{},[29602],{"data":29603,"marks":29604,"value":27520,"nodeType":864},{},[],{"data":29606,"content":29607,"nodeType":860},{},[29608],{"data":29609,"marks":29610,"value":27527,"nodeType":864},{},[],{"data":29612,"content":29613,"nodeType":860},{},[29614],{"data":29615,"marks":29616,"value":27534,"nodeType":864},{},[],{"data":29618,"content":29619,"nodeType":860},{},[29620,29623,29630],{"data":29621,"marks":29622,"value":27541,"nodeType":864},{},[],{"data":29624,"content":29625,"nodeType":883},{"uri":27544},[29626],{"data":29627,"marks":29628,"value":25431,"nodeType":864},{},[29629],{"type":1455},{"data":29631,"marks":29632,"value":6570,"nodeType":864},{},[],{"data":29634,"content":29635,"nodeType":1312},{},[29636],{"data":29637,"marks":29638,"value":27559,"nodeType":864},{},[],{"data":29640,"content":29641,"nodeType":860},{},[29642],{"data":29643,"marks":29644,"value":27566,"nodeType":864},{},[],{"data":29646,"content":29647,"nodeType":860},{},[29648],{"data":29649,"marks":29650,"value":27573,"nodeType":864},{},[],{"data":29652,"content":29653,"nodeType":860},{},[29654],{"data":29655,"marks":29656,"value":27580,"nodeType":864},{},[],{"data":29658,"content":29659,"nodeType":860},{},[29660],{"data":29661,"marks":29662,"value":27587,"nodeType":864},{},[],{"data":29664,"content":29665,"nodeType":1312},{},[29666],{"data":29667,"marks":29668,"value":19795,"nodeType":864},{},[],{"data":29670,"content":29671,"nodeType":860},{},[29672],{"data":29673,"marks":29674,"value":27600,"nodeType":864},{},[],{"entries":29676},{"hyperlink":29677,"inline":29678,"block":29679},[],[],[29680],{"sys":29681,"__typename":1724,"title":23605,"caption":23606,"layoutMode":23532,"file":29682},{"id":23039},{"url":23608,"width":23609,"height":23610},{"items":29684},[],{},"Use browser extension to see the extent of your SaaS sprawl",{"items":29688},[29689,29983],{"__typename":2059,"sys":29690,"content":29691,"title":29295,"synopsis":29296,"hashTags":59,"publishedDate":29297,"slug":29298,"tagsCollection":29973,"authorsCollection":29979},{"id":28968},{"json":29692},{"data":29693,"content":29694,"nodeType":856},{},[29695,29701,29718,29724,29730,29736,29742,29748,29754,29760,29766,29772,29778,29784,29790,29803,29809,29815,29821,29827,29833,29839,29854,29860,29866,29872,29878,29884,29891,29921,29928,29958],{"data":29696,"content":29697,"nodeType":860},{},[29698],{"data":29699,"marks":29700,"value":28979,"nodeType":864},{},[],{"data":29702,"content":29703,"nodeType":860},{},[29704,29707,29715],{"data":29705,"marks":29706,"value":28986,"nodeType":864},{},[],{"data":29708,"content":29711,"nodeType":17737},{"target":29709},{"sys":29710},{"id":23052,"type":1001,"linkType":1002},[29712],{"data":29713,"marks":29714,"value":28995,"nodeType":864},{},[],{"data":29716,"marks":29717,"value":28999,"nodeType":864},{},[],{"data":29719,"content":29720,"nodeType":860},{},[29721],{"data":29722,"marks":29723,"value":29006,"nodeType":864},{},[],{"data":29725,"content":29726,"nodeType":860},{},[29727],{"data":29728,"marks":29729,"value":29013,"nodeType":864},{},[],{"data":29731,"content":29732,"nodeType":860},{},[29733],{"data":29734,"marks":29735,"value":29020,"nodeType":864},{},[],{"data":29737,"content":29738,"nodeType":860},{},[29739],{"data":29740,"marks":29741,"value":29027,"nodeType":864},{},[],{"data":29743,"content":29744,"nodeType":1312},{},[29745],{"data":29746,"marks":29747,"value":29034,"nodeType":864},{},[],{"data":29749,"content":29750,"nodeType":860},{},[29751],{"data":29752,"marks":29753,"value":29041,"nodeType":864},{},[],{"data":29755,"content":29756,"nodeType":860},{},[29757],{"data":29758,"marks":29759,"value":29048,"nodeType":864},{},[],{"data":29761,"content":29762,"nodeType":860},{},[29763],{"data":29764,"marks":29765,"value":29055,"nodeType":864},{},[],{"data":29767,"content":29768,"nodeType":860},{},[29769],{"data":29770,"marks":29771,"value":29062,"nodeType":864},{},[],{"data":29773,"content":29774,"nodeType":1312},{},[29775],{"data":29776,"marks":29777,"value":29069,"nodeType":864},{},[],{"data":29779,"content":29780,"nodeType":860},{},[29781],{"data":29782,"marks":29783,"value":29076,"nodeType":864},{},[],{"data":29785,"content":29786,"nodeType":860},{},[29787],{"data":29788,"marks":29789,"value":29083,"nodeType":864},{},[],{"data":29791,"content":29792,"nodeType":860},{},[29793,29796,29800],{"data":29794,"marks":29795,"value":29090,"nodeType":864},{},[],{"data":29797,"marks":29798,"value":29095,"nodeType":864},{},[29799],{"type":2246},{"data":29801,"marks":29802,"value":29099,"nodeType":864},{},[],{"data":29804,"content":29805,"nodeType":860},{},[29806],{"data":29807,"marks":29808,"value":29106,"nodeType":864},{},[],{"data":29810,"content":29811,"nodeType":1312},{},[29812],{"data":29813,"marks":29814,"value":29113,"nodeType":864},{},[],{"data":29816,"content":29817,"nodeType":860},{},[29818],{"data":29819,"marks":29820,"value":29120,"nodeType":864},{},[],{"data":29822,"content":29823,"nodeType":860},{},[29824],{"data":29825,"marks":29826,"value":29127,"nodeType":864},{},[],{"data":29828,"content":29829,"nodeType":860},{},[29830],{"data":29831,"marks":29832,"value":29134,"nodeType":864},{},[],{"data":29834,"content":29835,"nodeType":860},{},[29836],{"data":29837,"marks":29838,"value":29141,"nodeType":864},{},[],{"data":29840,"content":29841,"nodeType":860},{},[29842,29845,29851],{"data":29843,"marks":29844,"value":29148,"nodeType":864},{},[],{"data":29846,"content":29847,"nodeType":883},{"uri":29151},[29848],{"data":29849,"marks":29850,"value":29156,"nodeType":864},{},[],{"data":29852,"marks":29853,"value":6570,"nodeType":864},{},[],{"data":29855,"content":29856,"nodeType":1312},{},[29857],{"data":29858,"marks":29859,"value":29166,"nodeType":864},{},[],{"data":29861,"content":29862,"nodeType":860},{},[29863],{"data":29864,"marks":29865,"value":29173,"nodeType":864},{},[],{"data":29867,"content":29868,"nodeType":860},{},[29869],{"data":29870,"marks":29871,"value":29180,"nodeType":864},{},[],{"data":29873,"content":29874,"nodeType":1312},{},[29875],{"data":29876,"marks":29877,"value":19795,"nodeType":864},{},[],{"data":29879,"content":29880,"nodeType":860},{},[29881],{"data":29882,"marks":29883,"value":29193,"nodeType":864},{},[],{"data":29885,"content":29886,"nodeType":860},{},[29887],{"data":29888,"marks":29889,"value":29201,"nodeType":864},{},[29890],{"type":899},{"data":29892,"content":29893,"nodeType":941},{},[29894,29903,29912],{"data":29895,"content":29896,"nodeType":945},{},[29897],{"data":29898,"content":29899,"nodeType":860},{},[29900],{"data":29901,"marks":29902,"value":29214,"nodeType":864},{},[],{"data":29904,"content":29905,"nodeType":945},{},[29906],{"data":29907,"content":29908,"nodeType":860},{},[29909],{"data":29910,"marks":29911,"value":29224,"nodeType":864},{},[],{"data":29913,"content":29914,"nodeType":945},{},[29915],{"data":29916,"content":29917,"nodeType":860},{},[29918],{"data":29919,"marks":29920,"value":29234,"nodeType":864},{},[],{"data":29922,"content":29923,"nodeType":860},{},[29924],{"data":29925,"marks":29926,"value":29242,"nodeType":864},{},[29927],{"type":899},{"data":29929,"content":29930,"nodeType":941},{},[29931,29940,29949],{"data":29932,"content":29933,"nodeType":945},{},[29934],{"data":29935,"content":29936,"nodeType":860},{},[29937],{"data":29938,"marks":29939,"value":29255,"nodeType":864},{},[],{"data":29941,"content":29942,"nodeType":945},{},[29943],{"data":29944,"content":29945,"nodeType":860},{},[29946],{"data":29947,"marks":29948,"value":29265,"nodeType":864},{},[],{"data":29950,"content":29951,"nodeType":945},{},[29952],{"data":29953,"content":29954,"nodeType":860},{},[29955],{"data":29956,"marks":29957,"value":29275,"nodeType":864},{},[],{"data":29959,"content":29960,"nodeType":860},{},[29961,29964,29970],{"data":29962,"marks":29963,"value":29282,"nodeType":864},{},[],{"data":29965,"content":29966,"nodeType":883},{"uri":29285},[29967],{"data":29968,"marks":29969,"value":29290,"nodeType":864},{},[],{"data":29971,"marks":29972,"value":29294,"nodeType":864},{},[],{"items":29974},[29975,29977],{"sys":29976,"name":4904},{"id":4903},{"sys":29978,"name":2729},{"id":2728},{"items":29980},[29981],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":29982},{"url":21909},{"__typename":2059,"sys":29984,"content":29985,"title":23525,"synopsis":30549,"hashTags":30550,"publishedDate":30556,"slug":23526,"tagsCollection":30557,"authorsCollection":30563},{"id":23052},{"json":29986},{"data":29987,"content":29988,"nodeType":856},{},[29989,29996,30003,30010,30017,30024,30049,30056,30063,30070,30077,30089,30096,30135,30160,30167,30174,30190,30197,30204,30220,30227,30235,30251,30258,30265,30272,30280,30287,30294,30301,30328,30391,30398,30405,30411,30427,30434,30450,30457,30469,30476,30496,30502,30519],{"data":29990,"content":29991,"nodeType":860},{},[29992],{"data":29993,"marks":29994,"value":29995,"nodeType":864},{},[],"Over the past few years, there’s been massive growth in the number of SaaS apps used for work. With that comes new challenges – how do you allow employees to take advantage of all the SaaS the world has to offer without locking it all down and stifling innovation? How do you figure out if you can trust all these new third parties with access to your data? Well, the first step is figuring out which apps employees are actually using, so that’s where we’re starting.",{"data":29997,"content":29998,"nodeType":860},{},[29999],{"data":30000,"marks":30001,"value":30002,"nodeType":864},{},[],"We’ve compiled a list of various options and approaches we’ve seen people take to SaaS discovery, each with their own pros and cons. ",{"data":30004,"content":30005,"nodeType":1009},{},[30006],{"data":30007,"marks":30008,"value":30009,"nodeType":864},{},[],"Why is SaaS discovery so hard?",{"data":30011,"content":30012,"nodeType":860},{},[30013],{"data":30014,"marks":30015,"value":30016,"nodeType":864},{},[],"\nSomething to note straight off the bat is that with all the data-driven approaches we’re about to cover, you have to know how to extract SaaS use out of that data. That’s one of the reasons SaaS discovery is so hard. With the roll-your-own approaches in this post, you’ll be able to identify some common apps (like Trello, Slack, Dropbox, etc.), but what about all the new or lesser-known apps? Unfortunately, trying to keep track of all the SaaS apps that are available to employees is really difficult. There’s not really a great master list available on the Internet for you to cross-reference with your data.",{"data":30018,"content":30019,"nodeType":860},{},[30020],{"data":30021,"marks":30022,"value":30023,"nodeType":864},{},[],"That means that all of these roll-your-own approaches are dependent on you knowing what you’re looking for. If you must know what SaaS you’re looking for in order to determine if an asset is actually a SaaS app, you’re going to be left with quite a few blindspots given there seem to be new apps launching every day. ",{"data":30025,"content":30026,"nodeType":860},{},[30027,30031,30036,30040,30045],{"data":30028,"marks":30029,"value":30030,"nodeType":864},{},[],"The second hurdle with a roll-your-own discovery approach is differentiating between SaaS ",{"data":30032,"marks":30033,"value":30035,"nodeType":864},{},[30034],{"type":2246},"access",{"data":30037,"marks":30038,"value":30039,"nodeType":864},{},[]," and SaaS ",{"data":30041,"marks":30042,"value":30044,"nodeType":864},{},[30043],{"type":2246},"usage",{"data":30046,"marks":30047,"value":30048,"nodeType":864},{},[],". Just because an employee accesses a SaaS website, it doesn’t mean they’re using their app. Most of the data sources will produce a ton of domains, IPs, etc. for you to sift through, but differentiating access and usage based on this information alone will produce a large number of false positives unless you can correlate it with other data sources (we suggest some below). You will likely also want to know things like exactly who the users, owners and administrators of the app are which will be all but impossible from this “access” data alone.",{"data":30050,"content":30051,"nodeType":860},{},[30052],{"data":30053,"marks":30054,"value":30055,"nodeType":864},{},[],"If we ignore for the moment the difficulties in extracting information about SaaS usage, let’s run through your options for data sources and see which ones will give you the most useful data.",{"data":30057,"content":30058,"nodeType":1009},{},[30059],{"data":30060,"marks":30061,"value":30062,"nodeType":864},{},[],"Collecting financial records",{"data":30064,"content":30065,"nodeType":860},{},[30066],{"data":30067,"marks":30068,"value":30069,"nodeType":864},{},[],"Looking through invoices can provide some visibility into paid SaaS apps, which is probably the lowest false positive data source. However, there are blind spots - you won’t see any free tier or trial accounts, nor will you get any useful business context about who’s using it, how they’re using it, if logins are secure, and what data it has access to. That said, it’s a quick and dirty way to get a partial view of SaaS usage, and might be the best place to start.",{"data":30071,"content":30072,"nodeType":1009},{},[30073],{"data":30074,"marks":30075,"value":30076,"nodeType":864},{},[],"Network-level",{"data":30078,"content":30079,"nodeType":860},{},[30080,30084],{"data":30081,"marks":30082,"value":30083,"nodeType":864},{},[],"\n",{"data":30085,"marks":30086,"value":30088,"nodeType":864},{},[30087],{"type":2246},"Summary: Network level data is the standard old-school approach. If you already have great network monitoring in place it provides fairly broad visibility. There are some very key limitations especially around inferring usage from access, as well as outside the office visibility problems.",{"data":30090,"content":30091,"nodeType":860},{},[30092],{"data":30093,"marks":30094,"value":30095,"nodeType":864},{},[],"SaaS apps are accessed over a network - and so that seems like a sensible place to start looking for them. What if we just tried looking for all users accessing a SaaS app’s website? Let’s say we want to see if anyone is using e.g. Dropbox, so we do a Google search for all Dropbox domains and we find Dropbox.com, and a few regional domains as well. We then set about finding employees accessing those domains in our network logs - simple! Perhaps not so much…",{"data":30097,"content":30098,"nodeType":860},{},[30099,30103,30107,30111,30116,30120,30124,30128,30132],{"data":30100,"marks":30101,"value":30102,"nodeType":864},{},[],"As we mentioned in the intro, the best outcome you can hope for is to uncover SaaS ",{"data":30104,"marks":30105,"value":30035,"nodeType":864},{},[30106],{"type":2246},{"data":30108,"marks":30109,"value":30110,"nodeType":864},{},[],", not ",{"data":30112,"marks":30113,"value":30115,"nodeType":864},{},[30114],{"type":2246},"usage.",{"data":30117,"marks":30118,"value":30119,"nodeType":864},{},[]," This might seem like a subtle difference, but SaaS usage is what you want to find, not just information about which employees visited a SaaS website. If you’re looking at all app ",{"data":30121,"marks":30122,"value":30035,"nodeType":864},{},[30123],{"type":2246},{"data":30125,"marks":30126,"value":30127,"nodeType":864},{},[],", you’ll wind up with a massive list of SaaS, with only a portion of it indicating SaaS ",{"data":30129,"marks":30130,"value":30044,"nodeType":864},{},[30131],{"type":2246},{"data":30133,"marks":30134,"value":2924,"nodeType":864},{},[],{"data":30136,"content":30137,"nodeType":860},{},[30138,30142,30147,30151,30156],{"data":30139,"marks":30140,"value":30141,"nodeType":864},{},[],"Since you can’t discover app ",{"data":30143,"marks":30144,"value":30146,"nodeType":864},{},[30145],{"type":2246},"usage ",{"data":30148,"marks":30149,"value":30150,"nodeType":864},{},[],"with network data, you’d have to tie network traffic to a single employee to identify the user, then reach out to each employee to understand the business context of how they’re using the app. A network data approach can work ",{"data":30152,"marks":30153,"value":30155,"nodeType":864},{},[30154],{"type":2246},"if",{"data":30157,"marks":30158,"value":30159,"nodeType":864},{},[]," you have time to get that context by asking employees if they’re using the SaaS detected or by corroborating your findings with subscription invoices from the finance team. ",{"data":30161,"content":30162,"nodeType":860},{},[30163],{"data":30164,"marks":30165,"value":30166,"nodeType":864},{},[],"A few ways to collect SaaS data on the network level are ingesting firewall, web proxy and DNS and VPN logs. These inputs can give you some additional visibility into SaaS access, but you may still be left with significant blind spots to actual usage if you assume it all takes place on the corporate network using a VPN. It’s also a painfully tedious process. That said, a manual process still is better than having no SaaS visibility at all. ",{"data":30168,"content":30169,"nodeType":1009},{},[30170],{"data":30171,"marks":30172,"value":30173,"nodeType":864},{},[],"Endpoint-level",{"data":30175,"content":30176,"nodeType":860},{},[30177,30182,30185],{"data":30178,"marks":30179,"value":30181,"nodeType":864},{},[30180],{"type":2246},"Summary: Endpoint",{"data":30183,"marks":30184,"value":1171,"nodeType":864},{},[],{"data":30186,"marks":30187,"value":30189,"nodeType":864},{},[30188],{"type":2246},"data is hard to get, and of limited value. However, it may be useful if you already have this data available in a SIEM or if it’s otherwise easy to query.",{"data":30191,"content":30192,"nodeType":860},{},[30193],{"data":30194,"marks":30195,"value":30196,"nodeType":864},{},[],"Perhaps we’ll get closer to what we need (usage data instead of just access data and a low false positive rate) if we move up a level and get closer to the users? Users are going to be accessing the SaaS apps through some kind of endpoint and there are some things you could use to do discovery if you have some monitoring capability on that endpoint.",{"data":30198,"content":30199,"nodeType":860},{},[30200],{"data":30201,"marks":30202,"value":30203,"nodeType":864},{},[],"For example, many SaaS apps have desktop or mobile clients (thick clients) you install. You could look for e.g. the Slack client, or the OneDrive sync agent installed on the endpoint. However, many users prefer the in-browser version, so they may not have even installed the thick client and you wouldn’t see their usage by looking at their endpoint data. ",{"data":30205,"content":30206,"nodeType":860},{},[30207,30211,30216],{"data":30208,"marks":30209,"value":30210,"nodeType":864},{},[],"All the good data, the application level data, is in the browser, which is technically on the endpoint but not really accessible ",{"data":30212,"marks":30213,"value":30215,"nodeType":864},{},[30214],{"type":2246},"through the endpoint",{"data":30217,"marks":30218,"value":30219,"nodeType":864},{},[]," without doing something very hacky. Perhaps we need to go a level deeper - either closer to the application or get inside the browser.",{"data":30221,"content":30222,"nodeType":1009},{},[30223],{"data":30224,"marks":30225,"value":30226,"nodeType":864},{},[],"Application-level",{"data":30228,"content":30229,"nodeType":860},{},[30230],{"data":30231,"marks":30232,"value":30234,"nodeType":864},{},[30233],{"type":2246},"Summary: Application level integrations are very useful for discovering unsanctioned SaaS apps that are integrated with the SaaS apps you already know about. But when used in isolation, they have massive blind spots. Application-level data is also a goldmine for finding out how securely employees use the app.",{"data":30236,"content":30237,"nodeType":860},{},[30238,30242,30247],{"data":30239,"marks":30240,"value":30241,"nodeType":864},{},[],"Focusing on the SaaS app directly makes a lot of sense if you need to get really high quality usage data. The challenge is that you need to integrate with the SaaS app to get at this data. And you can’t just integrate with an app like Slack or Trello. In general, these integrations must be within a specific account or tenant that your employees are using if you want to see any of their usage or security data. So, if you must already know about the tenant to discover the SaaS - is this approach useless for detecting unknown SaaS? Maybe, ",{"data":30243,"marks":30244,"value":30246,"nodeType":864},{},[30245],{"type":2246},"but ",{"data":30248,"marks":30249,"value":30250,"nodeType":864},{},[],"there are some very useful edge cases.",{"data":30252,"content":30253,"nodeType":860},{},[30254],{"data":30255,"marks":30256,"value":30257,"nodeType":864},{},[],"For instance, integrations with SaaS apps that are known and sanctioned can be very useful, especially with those apps that are identity providers, like Microsoft Azure/365 and Google Workspace. Lots of SaaS apps let users login with another SaaS app, which is called social login or sometimes single sign-on (SSO). When a user does “login using Google” on Salesforce using their corporate Google account, they are actually integrating (in a very limited way) Salesforce with Google Workspace. If you have application-level access (normally by calling the APIs) to known SaaS apps, you can discover these social logins (among other) integrations with other SaaS apps. These SaaS-to-SaaS links then become very useful as a discovery mechanism.",{"data":30259,"content":30260,"nodeType":860},{},[30261],{"data":30262,"marks":30263,"value":30264,"nodeType":864},{},[],"Something else to keep in mind, application-level access to known SaaS can also be incredibly useful for security beyond simple SaaS discovery. You could check authentication controls, like which users don’t have MFA enabled, sharing settings (perhaps the SaaS allows you to share documents publicly), unusual login events, other anomalous behavior, and so on. ",{"data":30266,"content":30267,"nodeType":1009},{},[30268],{"data":30269,"marks":30270,"value":30271,"nodeType":864},{},[],"Browser-level  ",{"data":30273,"content":30274,"nodeType":860},{},[30275],{"data":30276,"marks":30277,"value":30279,"nodeType":864},{},[30278],{"type":2246},"Summary: Browser data is as good as you can get for SaaS discovery, but with the downside that you must build and deploy a browser extension to get at it.",{"data":30281,"content":30282,"nodeType":860},{},[30283],{"data":30284,"marks":30285,"value":30286,"nodeType":864},{},[],"What if I told you, you could get application level usage-data beyond what events the applications expose through their APIs without needing to know about the app first or fighting network encryption? The other methods in this guide allow you to get at the data using normal log processing techniques, SIEM queries, or even hacky scripts that call APIs, but there’s one reasonable option for SaaS discovery.",{"data":30288,"content":30289,"nodeType":860},{},[30290],{"data":30291,"marks":30292,"value":30293,"nodeType":864},{},[],"The only real viable way to get at this SaaS usage data is through a browser extension. The big hurdle with this approach is that browser extensions require you to develop an extension and a backend where it can send data…AND you need to deploy that extension to all employees. ",{"data":30295,"content":30296,"nodeType":860},{},[30297],{"data":30298,"marks":30299,"value":30300,"nodeType":864},{},[],"Deploying that browser extension might be as simple as setting the extension to default install itself in all managed browsers - that’s possible if you’re using Google Workspace. In other environments, it may be a bit more of a challenge. Fortunately, browser extensions don’t have the complexity of normal endpoint agents. They don’t have runtime dependencies, aren’t platform dependent, don’t need admin permissions to install, have automatic update mechanisms built-in, and don’t affect performance. At the end of the day, they’re just a special piece of JavaScript running in the browser.",{"data":30302,"content":30303,"nodeType":860},{},[30304,30308,30312,30316,30324],{"data":30305,"marks":30306,"value":30307,"nodeType":864},{},[],"If you ",{"data":30309,"marks":30310,"value":14755,"nodeType":864},{},[30311],{"type":899},{"data":30313,"marks":30314,"value":30315,"nodeType":864},{},[]," able to get access to the data in the browser (spoiler alert: we provide an easy - and free - out-of-the-box ",{"data":30317,"content":30319,"nodeType":883},{"uri":30318},"/features/saas-discovery/",[30320],{"data":30321,"marks":30322,"value":30323,"nodeType":864},{},[],"browser extension for SaaS discovery",{"data":30325,"marks":30326,"value":30327,"nodeType":864},{},[],"), there is almost limitless scope to what you can do with this data. You can observe not only access to SaaS websites, you can also see:",{"data":30329,"content":30330,"nodeType":941},{},[30331,30341,30351,30361,30371,30381],{"data":30332,"content":30333,"nodeType":945},{},[30334],{"data":30335,"content":30336,"nodeType":860},{},[30337],{"data":30338,"marks":30339,"value":30340,"nodeType":864},{},[],"the user login,",{"data":30342,"content":30343,"nodeType":945},{},[30344],{"data":30345,"content":30346,"nodeType":860},{},[30347],{"data":30348,"marks":30349,"value":30350,"nodeType":864},{},[],"whether that login was successful,",{"data":30352,"content":30353,"nodeType":945},{},[30354],{"data":30355,"content":30356,"nodeType":860},{},[30357],{"data":30358,"marks":30359,"value":30360,"nodeType":864},{},[],"whether they used MFA to login, ",{"data":30362,"content":30363,"nodeType":945},{},[30364],{"data":30365,"content":30366,"nodeType":860},{},[30367],{"data":30368,"marks":30369,"value":30370,"nodeType":864},{},[],"which email they used to login, ",{"data":30372,"content":30373,"nodeType":945},{},[30374],{"data":30375,"content":30376,"nodeType":860},{},[30377],{"data":30378,"marks":30379,"value":30380,"nodeType":864},{},[],"whether they are the owner/administrator of the SaaS app tenant, and ",{"data":30382,"content":30383,"nodeType":945},{},[30384],{"data":30385,"content":30386,"nodeType":860},{},[30387],{"data":30388,"marks":30389,"value":30390,"nodeType":864},{},[],"all their behavior and settings in the app. ",{"data":30392,"content":30393,"nodeType":860},{},[30394],{"data":30395,"marks":30396,"value":30397,"nodeType":864},{},[],"Best of all, there is no need to stream all this data to a single collection point where it becomes a privacy nightmare. By writing rules in the extension to look for specific issues, you can flag only security relevant events, redacted or anonymized as far as makes sense. You can even limit the scope to only monitor the app use when the employee logs into the SaaS app using their work account to further avoid employee privacy concerns. ",{"data":30399,"content":30400,"nodeType":860},{},[30401],{"data":30402,"marks":30403,"value":30404,"nodeType":864},{},[],"There’s a quick and easy solution to get the best out of the application and browser data approaches we’ve written about in the last two sections - and that’s with our free tool.",{"data":30406,"content":30407,"nodeType":1009},{},[30408],{"data":30409,"marks":30410,"value":23275,"nodeType":864},{},[],{"data":30412,"content":30413,"nodeType":860},{},[30414,30418,30423],{"data":30415,"marks":30416,"value":30417,"nodeType":864},{},[],"We found that the most comprehensive approach is to collect data from ",{"data":30419,"marks":30420,"value":30422,"nodeType":864},{},[30421],{"type":2246},"both ",{"data":30424,"marks":30425,"value":30426,"nodeType":864},{},[],"the application and browser level to give you full visibility and actionable security information. With our browser extension, we get full breadth of coverage so you can discover all SaaS usage and with our APIs, you get the depth of coverage you need to understand how employees are using SaaS and if they’re doing so securely. Our combined approach captures SaaS logins and adoption, in real-time, and provides the best visibility and context for security teams. ",{"data":30428,"content":30429,"nodeType":1312},{},[30430],{"data":30431,"marks":30432,"value":30433,"nodeType":864},{},[],"Fixing SaaS security issues automatically by partnering with employees  ",{"data":30435,"content":30436,"nodeType":860},{},[30437,30441,30446],{"data":30438,"marks":30439,"value":30440,"nodeType":864},{},[],"\nWhat we then do with that data is where the magic happens… we can automatically guide employees via ChatOps (Slack and Teams for now, more to come!) to improve SaaS security. Some of those messages will help us enrich our data by asking employees questions they’ll actually know the answers to (",{"data":30442,"marks":30443,"value":30445,"nodeType":864},{},[30444],{"type":2246},"“You logged into Slack from Mexico just now. Are you in Mexico?”",{"data":30447,"marks":30448,"value":30449,"nodeType":864},{},[],"), which provides you with a good snapshot of SaaS usage in your business and lets you make informed security decisions about SaaS use to better manage risks.",{"data":30451,"content":30452,"nodeType":860},{},[30453],{"data":30454,"marks":30455,"value":30456,"nodeType":864},{},[],"Employees can also make immediate improvements to your overall security posture. In case you’re curious about what that looks like, some of the prompts we push to employees are things like: ",{"data":30458,"content":30459,"nodeType":860},{},[30460,30465],{"data":30461,"marks":30462,"value":30464,"nodeType":864},{},[30463],{"type":2246},"“We noticed this SaaS app you’re using has access to all your emails, are you still using it?” Y/N.",{"data":30466,"marks":30467,"value":30468,"nodeType":864},{},[]," If not, they can click a button to remove it and you’ll get an immediate reduction of your attack surface. ",{"data":30470,"content":30471,"nodeType":860},{},[30472],{"data":30473,"marks":30474,"value":30475,"nodeType":864},{},[],"Or ",{"data":30477,"content":30478,"nodeType":860},{},[30479,30484,30488,30493],{"data":30480,"marks":30481,"value":30483,"nodeType":864},{},[30482],{"type":2246},"“It looks like you’re not using MFA for your account on this SaaS app. Can we get this set up really quickly?”",{"data":30485,"marks":30486,"value":30487,"nodeType":864},{},[]," or “",{"data":30489,"marks":30490,"value":30492,"nodeType":864},{},[30491],{"type":2246},"An app you installed called ‘Dropbox’ is not the official Dropbox app, click here to remove it and install the verified app instead.”",{"data":30494,"marks":30495,"value":6408,"nodeType":864},{},[],{"data":30497,"content":30501,"nodeType":996},{"target":30498},{"sys":30499},{"id":30500,"type":1001,"linkType":1002},"27MpbzErmDfAC3bA4dBibv",[],{"data":30503,"content":30504,"nodeType":860},{},[30505,30509,30516],{"data":30506,"marks":30507,"value":30508,"nodeType":864},{},[],"If you’re interested in learning more, check out how we can ",{"data":30510,"content":30511,"nodeType":883},{"uri":30318},[30512],{"data":30513,"marks":30514,"value":30515,"nodeType":864},{},[],"help you discover SaaS use and secure it",{"data":30517,"marks":30518,"value":2924,"nodeType":864},{},[],{"data":30520,"content":30521,"nodeType":860},{},[30522,30526,30534,30537,30545],{"data":30523,"marks":30524,"value":30525,"nodeType":864},{},[],"We’ll also be publishing a SaaS Discovery Evaluation Guide that will explore all the off-the-shelf tools you may consider and evaluate which one is the best fit for your needs as this really does depend on your tech stack. In that, we’ll share our experiences with those products and discuss what additional coverage and context they can provide, as well as where they fall short. Subscribe to our mailing list and follow us on ",{"data":30527,"content":30529,"nodeType":883},{"uri":30528},"https://twitter.com/PushSecurity",[30530],{"data":30531,"marks":30532,"value":30533,"nodeType":864},{},[],"Twitter @pushsecurity",{"data":30535,"marks":30536,"value":13711,"nodeType":864},{},[],{"data":30538,"content":30540,"nodeType":883},{"uri":30539},"https://www.linkedin.com/company/push-security",[30541],{"data":30542,"marks":30543,"value":30544,"nodeType":864},{},[],"LinkedIn",{"data":30546,"marks":30547,"value":30548,"nodeType":864},{},[]," to get a head’s up when that’s live so you can have a read.","We’ve compiled some methods for discovering SaaS. Lets explore each approach and learn new ways to discover unknown SaaS, capture SaaS use, and secure it.",[30551,30552,30553,30554,30555],"itassetdiscovery","saassecurity","saasdiscovery","sass","cloudfirst","2022-05-03T00:00:00.000+01:00",{"items":30558},[30559,30561],{"sys":30560,"name":4904},{"id":4903},{"sys":30562,"name":297},{"id":2732},{"items":30564},[30565],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":30566},{"url":21909},"blog/want-to-discover-the-full-extent-of-your-saas-sprawl-embrace-browser",{"json":30569},{"data":30570,"content":30571,"nodeType":856},{},[30572],{"data":30573,"content":30574,"nodeType":860},{},[30575],{"data":30576,"marks":30577,"value":30578,"nodeType":864},{},[],"Browser extensions are the most effective SaaS discovery tool because they can capture employee SaaS use and adoption in real time, as employees sign up. The browser also allows us to work with the user to guide them to use SaaS more securely right where they’re working - in the browser.",{"id":27231,"publishedAt":30580},"2026-08-12T11:56:22.058Z",{"items":30582},[30583,30585],{"sys":30584,"name":4904},{"id":4903},{"sys":30586,"name":297},{"id":2732},{"items":30588},[30589,30591,30593,30595,30597,30599,30601,30603],{"sys":30590,"name":545,"slug":546,"tier":31},{"id":542},{"sys":30592,"name":297,"slug":298,"tier":31},{"id":294},{"sys":30594,"name":413,"slug":414,"tier":31},{"id":410},{"sys":30596,"name":589,"slug":590,"tier":45},{"id":586},{"sys":30598,"name":288,"slug":289,"tier":45},{"id":285},{"sys":30600,"name":457,"slug":458,"tier":45},{"id":454},{"sys":30602,"name":502,"slug":503,"tier":45},{"id":499},{"sys":30604,"name":306,"slug":307,"tier":45},{"id":303},"C7xc-6uxjSSDEQ178kmqFaasLDFSLL5URgdeqMDeS0w",{"id":30607,"title":30608,"authorsCollection":30609,"content":30617,"extension":228,"faqItemsCollection":30979,"faqTitle":59,"featured":6,"hashTags":59,"meta":30981,"metaTitle":30982,"ogImage":59,"postType":30983,"publishedDate":30984,"relatedBlogPostsCollection":30985,"slug":31537,"stem":31538,"subtitle":59,"summary":31539,"synopsis":31549,"sys":31550,"tagsCollection":31553,"topicsCollection":31557,"__hash__":31575},"blog/blog/push-it-real-good-why-im-excited-to-join-pushs-board.json","Push it real good: Why I’m excited to join Push’s board",{"items":30610},[30611],{"fullName":30612,"firstName":30613,"jobTitle":30614,"socialLinks":59,"profilePicture":30615},"Jon Oberheide","Jon","Push board member, co-founder and former CTO Duo Security",{"url":30616},"https://images.ctfassets.net/y1cdw1ablpvd/2KPJNN6IWpB4rDtsnox5BH/77ea22710f9ae8c989ba4e05f5d7dcc3/jon-oberheide.jpeg",{"json":30618,"links":30970},{"data":30619,"content":30620,"nodeType":856},{},[30621,30654,30701,30758,30765,30785,30792,30812,30819,30826,30833,30840,30847,30880,30909,30916,30923,30930,30950],{"data":30622,"content":30623,"nodeType":860},{},[30624,30628,30637,30641,30650],{"data":30625,"marks":30626,"value":30627,"nodeType":864},{},[],"Software has been eating the world for the past decade. And boy, it turns out that software is still SUPER hungry (like, ",{"data":30629,"content":30631,"nodeType":883},{"uri":30630},"https://www.youtube.com/watch?v=QETfA9_b7wM",[30632],{"data":30633,"marks":30634,"value":30636,"nodeType":864},{},[30635],{"type":1455},"Audrey II hungry",{"data":30638,"marks":30639,"value":30640,"nodeType":864},{},[],"), as we’ve seen countless new SaaS apps spring up across the software ecosystem. This is great news for organizations of all shapes and sizes. Embracing modern SaaS enables employees to be more productive, use the apps they love, and, as many companies have been recently pressured, ",{"data":30642,"content":30644,"nodeType":883},{"uri":30643},"https://www.washingtonpost.com/business/interactive/2023/tech-layoffs-company-memos/",[30645],{"data":30646,"marks":30647,"value":30649,"nodeType":864},{},[30648],{"type":1455},"do more with less",{"data":30651,"marks":30652,"value":30653,"nodeType":864},{},[],". But it’s less of a fun time for security teams that are trying to grapple with this sprawl of shadow IT…and have always had to do more with less!",{"data":30655,"content":30656,"nodeType":860},{},[30657,30661,30669,30673,30682,30686,30697],{"data":30658,"marks":30659,"value":30660,"nodeType":864},{},[],"The sprawl of SaaS apps is not just a raw increase of apps in-use in a modern enterprise (which is often wildly underestimated by CIOs/CISOs), but also the result of bottoms-up adoption of new apps. Driven by the ",{"data":30662,"content":30664,"nodeType":883},{"uri":30663},"https://openviewpartners.com/product-led-growth/",[30665],{"data":30666,"marks":30667,"value":13563,"nodeType":864},{},[30668],{"type":1455},{"data":30670,"marks":30671,"value":30672,"nodeType":864},{},[]," (PLG) movement, employees now frequently sign-up in a self-service manner for new SaaS apps and put them immediately into use on an individual or team level, without the traditional review, procurement, and management by corporate IT/security teams. Move fast, and cross your fingers that you don’t ",{"data":30674,"content":30676,"nodeType":883},{"uri":30675},"https://hbr.org/2019/01/the-era-of-move-fast-and-break-things-is-over",[30677],{"data":30678,"marks":30679,"value":30681,"nodeType":864},{},[30680],{"type":1455},"break too many things",{"data":30683,"marks":30684,"value":30685,"nodeType":864},{},[],"? Push has ",{"data":30687,"content":30691,"nodeType":17737},{"target":30688},{"sys":30689},{"id":30690,"type":1001,"linkType":1002},"1t9lzEIIB2PNrN1pyG3RRy",[30692],{"data":30693,"marks":30694,"value":30696,"nodeType":864},{},[30695],{"type":1455},"written about this shift",{"data":30698,"marks":30699,"value":30700,"nodeType":864},{},[]," in more detail, which is worth reading. ",{"data":30702,"content":30703,"nodeType":860},{},[30704,30708,30716,30720,30729,30733,30741,30745,30754],{"data":30705,"marks":30706,"value":30707,"nodeType":864},{},[],"These unsanctioned/unmanaged SaaS apps represent a growing attack surface. While the problems of shadow IT are not necessarily new, I would argue that the true security risk, which perhaps was not fully-appreciated previously, has recently come to the forefront through high-profile ",{"data":30709,"content":30710,"nodeType":883},{"uri":21784},[30711],{"data":30712,"marks":30713,"value":30715,"nodeType":864},{},[30714],{"type":1455},"supply chain compromises",{"data":30717,"marks":30718,"value":30719,"nodeType":864},{},[],". Whether it’s a single user getting ",{"data":30721,"content":30723,"nodeType":883},{"uri":30722},"https://pushsecurity.com/blog/consent-phishing-the-emerging-phishing-technique-that-can-bypass-2fa",[30724],{"data":30725,"marks":30726,"value":30728,"nodeType":864},{},[30727],{"type":1455},"OAuth phished",{"data":30730,"marks":30731,"value":30732,"nodeType":864},{},[],", password reuse across SaaS apps targeted by ",{"data":30734,"content":30736,"nodeType":883},{"uri":30735},"https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/",[30737],{"data":30738,"marks":30739,"value":18453,"nodeType":864},{},[30740],{"type":1455},{"data":30742,"marks":30743,"value":30744,"nodeType":864},{},[],", or a breach of a ",{"data":30746,"content":30748,"nodeType":883},{"uri":30747},"https://www.proofpoint.com/us/blog/cloud-security/dangerous-consequences-threat-actors-abusing-microsofts-verified-publisher",[30749],{"data":30750,"marks":30751,"value":30753,"nodeType":864},{},[30752],{"type":1455},"third-party integration",{"data":30755,"marks":30756,"value":30757,"nodeType":864},{},[]," plugged into your Google Workspace or Microsoft 365, the risks are now clear and present.",{"data":30759,"content":30760,"nodeType":1312},{},[30761],{"data":30762,"marks":30763,"value":30764,"nodeType":864},{},[],"Work with employees, not around them",{"data":30766,"content":30767,"nodeType":860},{},[30768,30772,30781],{"data":30769,"marks":30770,"value":30771,"nodeType":864},{},[],"Despite SaaS sprawl and the proliferation of related attacks, I’ve always had a belief that users are good-intentioned, want to be productive in their job, and desire to keep their organization secure. We can’t ask users to walk a terrifying tightrope of security (“don’t get phished”, “don’t open attachments”, “don’t click links”, “don’t plug things into your computer”, etc) and still do their actual job effectively. In the modern day, you either design a ",{"data":30773,"content":30775,"nodeType":883},{"uri":30774},"https://www.oreilly.com/library/view/oscon-2017/9781491976227/video306724.html",[30776],{"data":30777,"marks":30778,"value":30780,"nodeType":864},{},[30779],{"type":1455},"paved path",{"data":30782,"marks":30783,"value":30784,"nodeType":864},{},[]," for your users to be able to move quickly and safely, or you risk the consequences when they go off-roading.",{"data":30786,"content":30787,"nodeType":860},{},[30788],{"data":30789,"marks":30790,"value":30791,"nodeType":864},{},[],"When there is no paved path for those good-intentioned users to get their job done, it’s no surprise that they find creative ways to work around poorly-designed security controls. For example, if an employee has to jump through a lot of hoops to get on the corporate VPN and access an internal Sharepoint instance in order to collaborate with colleagues, they’re likely to just sign-up for and use a self-service Box/Dropbox/Trello tenant. A violation of corporate security policy? Perhaps. A shadow IT risk to the organization? Sure. But they’re not being malicious, they’re just trying to get their job done.",{"data":30793,"content":30794,"nodeType":860},{},[30795,30799,30808],{"data":30796,"marks":30797,"value":30798,"nodeType":864},{},[],"Enter, Push Security. Push is tackling these challenges of shadow IT, helping to simplify SaaS security while meeting users where they are and enlisting them in the solution. Push allows security teams to get complete, real-time visibility into the SaaS apps in use in their enterprise, automates the fixing of any risky issues by involving the end user, and provides real-time guidance to head off new issues before they even happen. See ",{"data":30800,"content":30803,"nodeType":17737},{"target":30801},{"sys":30802},{"id":30690,"type":1001,"linkType":1002},[30804],{"data":30805,"marks":30806,"value":30807,"nodeType":864},{},[],"Adam’s blog post ",{"data":30809,"marks":30810,"value":30811,"nodeType":864},{},[],"for a double-click on all the capabilities of the Push platform.",{"data":30813,"content":30814,"nodeType":860},{},[30815],{"data":30816,"marks":30817,"value":30818,"nodeType":864},{},[],"Push’s vision particularly resonated with me, as it is a natural extension of the user-centric security that we built at Duo. Push allows security teams to go beyond just front door entrance of application access (eg. authentication) and look deeper into latent risks presented by SaaS applications themselves, the data contained within, and their risky app-to-app interconnectedness. And, often, the best first step after identifying the litany of unsanctioned apps in use in your organization is to quickly get the critical ones safely under your umbrella of SSO/MFA (via Duo, Okta, Azure AD, etc), which I know was a common challenge for our many customers at Duo.",{"data":30820,"content":30821,"nodeType":1312},{},[30822],{"data":30823,"marks":30824,"value":30825,"nodeType":864},{},[],"CASB and SSPM aren’t enough",{"data":30827,"content":30828,"nodeType":860},{},[30829],{"data":30830,"marks":30831,"value":30832,"nodeType":864},{},[],"Past attempts to tackle these problems, notably CASB vendors, have had limited success. It’s clear the network/proxy-based CASB approach is not a survivable architecture for the modern world of cloud and mobility. Even an API-only integration, the approach taken by some SSPM vendors, is necessary but not sufficient for the scope of the problem space. ",{"data":30834,"content":30835,"nodeType":860},{},[30836],{"data":30837,"marks":30838,"value":30839,"nodeType":864},{},[],"For example, it’s not enough to just know that Box is an app in-use by your users. Many organizations that have their corporate Box tenant “managed” with SSO/MFA/etc, but may be unaware of the 10+ shadow non-managed Box tenants that their users have created and are actively sharing documents through. Do you think you have just one Box, Slack, Monday, etc? Push, with its unique architecture of plugging into your SaaS apps as well as interfacing with the user via a browser extension, can achieve this accurate, fine-grained visibility into SaaS usage.",{"data":30841,"content":30842,"nodeType":1312},{},[30843],{"data":30844,"marks":30845,"value":30846,"nodeType":864},{},[],"Automate fixes by involving the end user, your employees",{"data":30848,"content":30849,"nodeType":860},{},[30850,30854,30863,30867,30876],{"data":30851,"marks":30852,"value":30853,"nodeType":864},{},[],"Push is also unique in enlisting the end user, not just in identifying the problems of SaaS sprawl, but in remediating discovered issues. This user-centric approach naturally resonated with my experience at Duo. After all, ",{"data":30855,"content":30857,"nodeType":883},{"uri":30856},"https://www.youtube.com/watch?v=JN0Hj0pKZ7U",[30858],{"data":30859,"marks":30860,"value":30862,"nodeType":864},{},[30861],{"type":1455},"Duo Push",{"data":30864,"marks":30865,"value":30866,"nodeType":864},{},[]," and our ",{"data":30868,"content":30870,"nodeType":883},{"uri":30869},"https://duo.com/blog/mobile-device-security-made-easy-with-duos-security-checkup",[30871],{"data":30872,"marks":30873,"value":30875,"nodeType":864},{},[30874],{"type":1455},"Security Checkup",{"data":30877,"marks":30878,"value":30879,"nodeType":864},{},[]," were just low-fidelity mechanisms to ask your users to engage positively in your security program. ",{"data":30881,"content":30882,"nodeType":860},{},[30883,30887,30896,30900,30905],{"data":30884,"marks":30885,"value":30886,"nodeType":864},{},[],"Push takes this philosophy much further with their ",{"data":30888,"content":30890,"nodeType":883},{"uri":30889},"https://pushsecurity.com/kb/10004/",[30891],{"data":30892,"marks":30893,"value":30895,"nodeType":864},{},[30894],{"type":1455},"ChatOps feature",{"data":30897,"marks":30898,"value":30899,"nodeType":864},{},[],", creating a direct, interactive interface to users. Sometimes users just need a gentle ",{"data":30901,"marks":30902,"value":30904,"nodeType":864},{},[30903],{"type":2246},"push",{"data":30906,"marks":30907,"value":30908,"nodeType":864},{},[]," in the right direction, to make good security decisions or improve the organization’s security hygiene. Push can help users adopt existing security controls (eg. MFA), identify risky configurations (eg. malicious mail forwarding), and reduce attack surface (eg. unused or risky OAuth integrations). Interfacing directly with users can increase fidelity (who knows better ground truth than the user themselves), increase remediation speed, and allow your security program to scale without hiring a bunch of analysts to run down endless lists of alerts. Of course, you're not just handing over the keys to the user, but selectively using their superpowers to augment your centralized visibility and control.",{"data":30910,"content":30911,"nodeType":860},{},[30912],{"data":30913,"marks":30914,"value":30915,"nodeType":864},{},[],"In essence, Push has created that paved path to allow your users to move quickly, but also with the appropriate guardrails for when they go off-roading. Maybe those guardrails are a 10-foot reinforced concrete wall for your security-sensitive organization. Maybe they’re a light safety barrier to help try to keep users on track. And maybe your org really embraces speed and employee autotomy, so you just want an “invisible fence” to be alerted when users go off the track. Regardless of your security culture, Push gives you the necessary visibility of your shadow IT to make informed risk decisions appropriate for your business and enact the right controls.",{"data":30917,"content":30918,"nodeType":1312},{},[30919],{"data":30920,"marks":30921,"value":30922,"nodeType":864},{},[],"Securing SaaS for everyone, not just large enterprises",{"data":30924,"content":30925,"nodeType":860},{},[30926],{"data":30927,"marks":30928,"value":30929,"nodeType":864},{},[],"Lastly, the explosion of SaaS is not a uniquely enterprise phenomena, but felt by companies of all shapes and sizes. As I experienced at Duo, designing security products for ease-of-use can be a game-changer for small/medium-sized organizations that lack the staff, time, and budget to manage complex security tools. But, whether you’re a SMB or a F500 enterprise, everyone is strapped for resources and wants to maximize the security impact of their limited team, not create more busy-work and alerts to run down. Push has built a platform that is easy to try, deploy, and manage, whether you’re a small business with a one-person security team or a large enterprise looking to scale your SaaS security across tens of thousands of employees.",{"data":30931,"content":30932,"nodeType":860},{},[30933,30937,30946],{"data":30934,"marks":30935,"value":30936,"nodeType":864},{},[],"I felt conviction about Push early on when I first met co-founders Adam, Tyrone, and Jacques in 2021. Not just excitement around the problem space and product philosophy, but a personal resonance with the team. Deep technical founders and security practitioners, fed up with the ",{"data":30938,"content":30940,"nodeType":883},{"uri":30939},"https://www.markerbench.com/blog/2005/05/04/Escaping-the-Hamster-Wheel-of-Pain/",[30941],{"data":30942,"marks":30943,"value":30945,"nodeType":864},{},[30944],{"type":1455},"hamster-wheel-of-pain",{"data":30947,"marks":30948,"value":30949,"nodeType":864},{},[]," of detection and response, and eager to battle the status quo of the security industry with a fresh and positive approach. It sure felt familiar! That conviction grew as I observed their early development and progress, when I joined in the seed round led by Decibel last year, and when I saw the customer adoption after their product launch less than a year ago. So, with their recent Series A round, led by Karim Faris at GV, I’m honored to join the board of Push and continue supporting a great team and product.",{"data":30951,"content":30952,"nodeType":860},{},[30953,30957,30966],{"data":30954,"marks":30955,"value":30956,"nodeType":864},{},[],"\nBut, hey, don’t just take my word for it, ",{"data":30958,"content":30960,"nodeType":883},{"uri":30959},"https://pushsecurity.com/signup",[30961],{"data":30962,"marks":30963,"value":30965,"nodeType":864},{},[30964],{"type":1455},"sign up for free today",{"data":30967,"marks":30968,"value":30969,"nodeType":864},{},[]," and bring some sanity to your SaaS security.",{"entries":30971},{"block":30972,"inline":30973,"hyperlink":30974},[],[],[30975],{"sys":30976,"__typename":2059,"title":30977,"slug":30978},{"id":30690},"From launch to series A ","from-launch-to-series-a",{"items":30980},[],{},"Jon Oberheide Joins Push Security's Board","company-news","2023-04-17T00:00:00.000Z",{"items":30986},[30987],{"__typename":2059,"sys":30988,"content":30989,"title":30977,"synopsis":31519,"hashTags":59,"publishedDate":31520,"slug":30978,"tagsCollection":31521,"authorsCollection":31529},{"id":30690},{"json":30990},{"data":30991,"content":30992,"nodeType":856},{},[30993,31026,31033,31040,31059,31066,31071,31076,31108,31115,31122,31138,31145,31152,31195,31201,31208,31215,31222,31238,31245,31252,31259,31265,31272,31279,31286,31293,31300,31306,31313,31355,31362,31369,31375,31382,31389,31396,31402,31409,31416,31423,31429,31436,31443,31450,31457,31473,31489],{"data":30994,"content":30995,"nodeType":860},{},[30996,31000,31008,31012,31022],{"data":30997,"marks":30998,"value":30999,"nodeType":864},{},[],"We’re proud to share that we’ve locked in our ",{"data":31001,"content":31003,"nodeType":883},{"uri":31002},"https://techcrunch.com/2023/04/03/push-security-raises-15m-to-help-saas-users-lower-their-online-vulnerability/",[31004],{"data":31005,"marks":31006,"value":31007,"nodeType":864},{},[],"Series A round",{"data":31009,"marks":31010,"value":31011,"nodeType":864},{},[],", led by GV (Google Ventures). We’ve learned a lot about what our customers need since we ",{"data":31013,"content":31017,"nodeType":17737},{"target":31014},{"sys":31015},{"id":31016,"type":1001,"linkType":1002},"1LWXA4OL7v5bqsS4acnnpr",[31018],{"data":31019,"marks":31020,"value":31021,"nodeType":864},{},[],"launched in July 2022",{"data":31023,"marks":31024,"value":31025,"nodeType":864},{},[]," - they want to help employees use SaaS more securely, of course, but they also need centralized visibility and the ability to make good decisions around the use of SaaS by knowing how their employees are using it. ",{"data":31027,"content":31028,"nodeType":860},{},[31029],{"data":31030,"marks":31031,"value":31032,"nodeType":864},{},[],"Most security-savvy organizations have a fairly good handle on IT-owned and managed SaaS platforms (like Microsoft 365, Google Workspace, Salesforce, Slack, etc) and many have started using newer security solutions that discover the SaaS work apps that employees have started using and often integrated with those IT-owned platforms. ",{"data":31034,"content":31035,"nodeType":1312},{},[31036],{"data":31037,"marks":31038,"value":31039,"nodeType":864},{},[],"The rise of PLG and how it impacts security ",{"data":31041,"content":31042,"nodeType":860},{},[31043,31047,31055],{"data":31044,"marks":31045,"value":31046,"nodeType":864},{},[],"What they’ve been missing is the ",{"data":31048,"content":31049,"nodeType":883},{"uri":30663},[31050],{"data":31051,"marks":31052,"value":31054,"nodeType":864},{},[31053],{"type":1455},"rise of product-led growth",{"data":31056,"marks":31057,"value":31058,"nodeType":864},{},[]," (PLG) - a popular sales motion that relies on the product itself as the primary driver for customer acquisition and conversion. Potential buyers sign up, integrate it, and experience the product value before going through any sales-cycle. ",{"data":31060,"content":31061,"nodeType":860},{},[31062],{"data":31063,"marks":31064,"value":31065,"nodeType":864},{},[],"The impact this has on security is that where in the past, employees would have needed to go centrally through procurement, which gives the security team an opportunity to assess the risk and determine whether or not the service would invalidate the organization’s security compliance. With PLG, employees can (and do) onboard sensitive applications themselves directly. This shift in buying behavior has contributed to a sharp increase of SaaS sprawl and shadow IT.",{"data":31067,"content":31070,"nodeType":996},{"target":31068},{"sys":31069},{"id":23796,"type":1001,"linkType":1002},[],{"data":31072,"content":31075,"nodeType":996},{"target":31073},{"sys":31074},{"id":23946,"type":1001,"linkType":1002},[],{"data":31077,"content":31078,"nodeType":860},{},[31079,31083,31087,31091,31096,31100,31104],{"data":31080,"marks":31081,"value":31082,"nodeType":864},{},[],"PLG is also the norm for app-to-app integrations as well. In our data, we found that",{"data":31084,"marks":31085,"value":1171,"nodeType":864},{},[31086],{"type":899},{"data":31088,"marks":31089,"value":31090,"nodeType":864},{},[],"around 37% of Microsoft 365 app integrations were IT-approved and owned. ",{"data":31092,"marks":31093,"value":31095,"nodeType":864},{},[31094],{"type":899},"The rest (63%) were all employee-owned and consented to. ",{"data":31097,"marks":31098,"value":31099,"nodeType":864},{},[],"That’s just looking at app-to-app integrations to the M365 tenant, so it doesn’t include all the SaaS apps accessed through the browser.",{"data":31101,"marks":31102,"value":1171,"nodeType":864},{},[31103],{"type":899},{"data":31105,"marks":31106,"value":31107,"nodeType":864},{},[],"Sure, some of those apps are used by a whole team and may be on IT’s radar if the department head went through the proper security measures. But many may just be used by one person or a team is just signing up for a free trial. And even for those free/trial instances, the apps need to integrate with business apps and data to work and test, so they can present as much risk as any other app used in your environment.",{"data":31109,"content":31110,"nodeType":1312},{},[31111],{"data":31112,"marks":31113,"value":31114,"nodeType":864},{},[],"What’s the risk of SaaS sprawl?",{"data":31116,"content":31117,"nodeType":860},{},[31118],{"data":31119,"marks":31120,"value":31121,"nodeType":864},{},[],"The unknowns - the old trope that you can’t protect what you don’t know is cliche for a reason - it’s true. Not every SaaS app or integration carries massive risk, but most apps employees are using to get important work done accesses sensitive data or need to integrate with business data, which is then shared with a third party in each instance.",{"data":31123,"content":31124,"nodeType":860},{},[31125,31129,31134],{"data":31126,"marks":31127,"value":31128,"nodeType":864},{},[],"Each app becomes an asset that security teams need to protect and each new account employees create forms part of the company’s public-facing attack surface. With PLG, apps are adopted ",{"data":31130,"marks":31131,"value":31133,"nodeType":864},{},[31132],{"type":2246},"before ",{"data":31135,"marks":31136,"value":31137,"nodeType":864},{},[],"security get a chance to onboard them onto SSO, so weak user accounts employees have created are a potential entry point for an attacker.",{"data":31139,"content":31140,"nodeType":860},{},[31141],{"data":31142,"marks":31143,"value":31144,"nodeType":864},{},[],"This can be a high ROI technique for an attacker. Instead of burning client-side exploits and C2 infrastructure, an attacker kicks off an automated password scan against all popular SaaS apps and gets alerted each time they access an account. Attackers are also utilizing credential stuffing by taking a single compromised employee password and trying it against every popular SaaS service to extend their access. ",{"data":31146,"content":31147,"nodeType":860},{},[31148],{"data":31149,"marks":31150,"value":31151,"nodeType":864},{},[],"The sensitivity of these applications vary depending on their capability, but some particularly high-risk examples we’ve come across include:",{"data":31153,"content":31154,"nodeType":23195},{},[31155,31165,31175,31185],{"data":31156,"content":31157,"nodeType":945},{},[31158],{"data":31159,"content":31160,"nodeType":860},{},[31161],{"data":31162,"marks":31163,"value":31164,"nodeType":864},{},[],"Apps that access employee email - attackers can use this access to do account resets and compromise other SaaS apps.",{"data":31166,"content":31167,"nodeType":945},{},[31168],{"data":31169,"content":31170,"nodeType":860},{},[31171],{"data":31172,"marks":31173,"value":31174,"nodeType":864},{},[],"Compromising development or testing tools that have access to API keys and production systems.",{"data":31176,"content":31177,"nodeType":945},{},[31178],{"data":31179,"content":31180,"nodeType":860},{},[31181],{"data":31182,"marks":31183,"value":31184,"nodeType":864},{},[],"Compromising data warehouses, or any independent SaaS app that integrates back with that data warehouse.",{"data":31186,"content":31187,"nodeType":945},{},[31188],{"data":31189,"content":31190,"nodeType":860},{},[31191],{"data":31192,"marks":31193,"value":31194,"nodeType":864},{},[],"Compromising marketing apps that can be used to control public facing assets such as the company social media account or website. ",{"data":31196,"content":31197,"nodeType":860},{},[31198],{"data":31199,"marks":31200,"value":21,"nodeType":864},{},[],{"data":31202,"content":31203,"nodeType":1009},{},[31204],{"data":31205,"marks":31206,"value":31207,"nodeType":864},{},[],"The Solution ",{"data":31209,"content":31210,"nodeType":1312},{},[31211],{"data":31212,"marks":31213,"value":31214,"nodeType":864},{},[],"Complete, real time, centralized visibility",{"data":31216,"content":31217,"nodeType":860},{},[31218],{"data":31219,"marks":31220,"value":31221,"nodeType":864},{},[],"To get a handle on the SaaS sprawl and shadow IT that the PLG movement has caused, security teams need complete visibility of every business application (SaaS apps, cloud apps, app-to-app integrations, etc.) employees are adopting, integrating with company data, and accessing through the browser.",{"data":31223,"content":31224,"nodeType":860},{},[31225,31229,31234],{"data":31226,"marks":31227,"value":31228,"nodeType":864},{},[],"Alongside visibility, security teams also need the option to turn on notifications to keep them up to date about potential security concerns around SaaS use in their organization. This provides security teams with near real-time visibility so they’re notified when someone has signed up for a new app. If an employee or team has been using an app for weeks or months, it can be much more difficult to migrate them to a more secure platform if security decides the risks outweigh the benefits for that app. It also means that security teams get to be part of the decision-making process again. So, even though the PLG model has put security in the mode of constantly having to play catch-up to do risk assessments ",{"data":31230,"marks":31231,"value":31233,"nodeType":864},{},[31232],{"type":2246},"after",{"data":31235,"marks":31236,"value":31237,"nodeType":864},{},[]," the app has been adopted, security teams can reclaim their role in the procurement process with timely notifications. ",{"data":31239,"content":31240,"nodeType":860},{},[31241],{"data":31242,"marks":31243,"value":31244,"nodeType":864},{},[],"The thing is, the notifications need to have enough information to be meaningful rather than just acting as another alert to distract them from their work. Enter channel messaging for security teams. ",{"data":31246,"content":31247,"nodeType":860},{},[31248],{"data":31249,"marks":31250,"value":31251,"nodeType":864},{},[],"Our new channel messaging feature tells security teams about new SaaS being onboarded, of course, but also provides useful security insights about that activity. If a new app is added to or integrated with the company’s Google Workspace or Microsoft 365 tenant, we can tell you in Slack or Teams, and we’ll also let you know if it’s low-risk or if it merits more investigation. ",{"data":31253,"content":31254,"nodeType":860},{},[31255],{"data":31256,"marks":31257,"value":31258,"nodeType":864},{},[],"In the case of app-to-app integrations, we’ve decided against providing an abstract risk score, which isn’t actually very helpful, and focused instead on tangible information on what data the integration exposes, so the security team can make the right risk assessment for their organization. See the example below:",{"data":31260,"content":31264,"nodeType":996},{"target":31261},{"sys":31262},{"id":31263,"type":1001,"linkType":1002},"4e6ERBq2KkDpM8VxwIW3zV",[],{"data":31266,"content":31267,"nodeType":860},{},[31268],{"data":31269,"marks":31270,"value":31271,"nodeType":864},{},[],"We’ll also flag you if an integration is high-risk because it’s asking for excessive data permissions. For instance, one interesting data point we’ve discovered since launch: 23% of the Microsoft app-to-app integrations we discovered granted access to high-risk assets or data, such as email inboxes, and shared drives like OneDrive. For Google workspace, 17% were equally high-risk.",{"data":31273,"content":31274,"nodeType":860},{},[31275],{"data":31276,"marks":31277,"value":31278,"nodeType":864},{},[],"Security teams need complete SaaS visibility and foundational insights into the security impact of those apps used in their business. Couple that visibility with a user-centric approach to security and you’ve got baseline SaaS security covered, whether you’re a small business with no dedicated team or you’re an enterprise with a highly skilled, dedicated team that’s overburdened with constant alerts and struggling to make actual improvements to your company’s security posture.",{"data":31280,"content":31281,"nodeType":1312},{},[31282],{"data":31283,"marks":31284,"value":31285,"nodeType":864},{},[],"Automate the fix by involving the user",{"data":31287,"content":31288,"nodeType":860},{},[31289],{"data":31290,"marks":31291,"value":31292,"nodeType":864},{},[],"The most sensible way we’ve found to scale SaaS security in an employee-adopted apps world is to put users at the center of helping to improve security. We prompt users at the right time to encourage them to take an action that will benefit an organization’s security, like updating their software or securing their user account with MFA or a stronger password.",{"data":31294,"content":31295,"nodeType":860},{},[31296],{"data":31297,"marks":31298,"value":31299,"nodeType":864},{},[],"This shared responsibility model is nothing new, really. It’s a concept that was pioneered by Slack, Netflix, and Duo Security before us. The way we’re applying it to securing employee SaaS use, however, is pretty novel. To us, a user-centric approach doesn’t simply mean building in ChatOps in Slack and Teams - it’s building in a variety of ways to notify and interact with the user when the time is right for them to take action. ",{"data":31301,"content":31305,"nodeType":996},{"target":31302},{"sys":31303},{"id":31304,"type":1001,"linkType":1002},"5wZDwVTGbh5f4qliO2ft3E",[],{"data":31307,"content":31308,"nodeType":860},{},[31309],{"data":31310,"marks":31311,"value":31312,"nodeType":864},{},[],"Our approach involves the user from beginning to end:",{"data":31314,"content":31315,"nodeType":941},{},[31316,31335,31345],{"data":31317,"content":31318,"nodeType":945},{},[31319],{"data":31320,"content":31321,"nodeType":860},{},[31322,31326,31331],{"data":31323,"marks":31324,"value":31325,"nodeType":864},{},[],"We provide real-time guidance to help prevent problems ",{"data":31327,"marks":31328,"value":31330,"nodeType":864},{},[31329],{"type":2246},"before they happen",{"data":31332,"marks":31333,"value":31334,"nodeType":864},{},[]," (in the browser),",{"data":31336,"content":31337,"nodeType":945},{},[31338],{"data":31339,"content":31340,"nodeType":860},{},[31341],{"data":31342,"marks":31343,"value":31344,"nodeType":864},{},[],"We nudge employees to self-remediate issues that have already happened, and",{"data":31346,"content":31347,"nodeType":945},{},[31348],{"data":31349,"content":31350,"nodeType":860},{},[31351],{"data":31352,"marks":31353,"value":31354,"nodeType":864},{},[],"We provide an overview for each employee, so the security team can see each employee’s security state for their SaaS use.",{"data":31356,"content":31357,"nodeType":1312},{},[31358],{"data":31359,"marks":31360,"value":31361,"nodeType":864},{},[],"Real-time guidance",{"data":31363,"content":31364,"nodeType":860},{},[31365],{"data":31366,"marks":31367,"value":31368,"nodeType":864},{},[],"Our just-in-time notifications act like password-checkers in the browser, but they’re more robust in that security teams can fully customize which words and phrases employees can’t use in their passwords as they’re creating new accounts; it might be company name, location, common words, street address, and so on). This helps prevent employees from creating weak passwords like those that were leaked in a password dump after a breach. Here’s how we’re doing that in the browser:",{"data":31370,"content":31374,"nodeType":996},{"target":31371},{"sys":31372},{"id":31373,"type":1001,"linkType":1002},"59eQuuZH8RICARjwXAJrWw",[],{"data":31376,"content":31377,"nodeType":860},{},[31378],{"data":31379,"marks":31380,"value":31381,"nodeType":864},{},[],"These simple measures help employees pick stronger passwords from the start, cutting down on the need for any nudges on ChatOps or any notifications to security. Why fix issues when you can prevent them from ever happening?",{"data":31383,"content":31384,"nodeType":1312},{},[31385],{"data":31386,"marks":31387,"value":31388,"nodeType":864},{},[],"Notifications",{"data":31390,"content":31391,"nodeType":860},{},[31392],{"data":31393,"marks":31394,"value":31395,"nodeType":864},{},[],"We use notifications in ChatOps (Slack or Teams) when employees can fix security issues with one click without the need for security to talk to them directly. An example of this is using a chat to check if an employee is still using a dormant or inactive app. If they’re not using it, they can automatically eliminate it from the company’s attack surface by clicking the “I’m not using it, you can remove” button. ",{"data":31397,"content":31401,"nodeType":996},{"target":31398},{"sys":31399},{"id":31400,"type":1001,"linkType":1002},"6deX1SbkDVkXGT7FthM9pd",[],{"data":31403,"content":31404,"nodeType":1312},{},[31405],{"data":31406,"marks":31407,"value":31408,"nodeType":864},{},[],"Employee SaaS security overview",{"data":31410,"content":31411,"nodeType":860},{},[31412],{"data":31413,"marks":31414,"value":31415,"nodeType":864},{},[],"The final component of user-centric security is to provide a personal view of an employee’s overall security state. Security teams can see each employee’s SaaS security state for a quick view of where they need to fix security issues and where they’re in the clear. This user security dashboard is really handy for visibility over particularly high-risk employees (usually those who use a lot of different SaaS apps and those who work with highly sensitive data - like legal teams, executives, HR, finance, etc.). ",{"data":31417,"content":31418,"nodeType":860},{},[31419],{"data":31420,"marks":31421,"value":31422,"nodeType":864},{},[],"By displaying this information in a single, clean, easy to read panel, both employees and security teams can work together to take actions to fix issues quickly and easily.",{"data":31424,"content":31428,"nodeType":996},{"target":31425},{"sys":31426},{"id":31427,"type":1001,"linkType":1002},"7IZDuJ7c2takbu4OaKLsKB",[],{"data":31430,"content":31431,"nodeType":1009},{},[31432],{"data":31433,"marks":31434,"value":31435,"nodeType":864},{},[],"How to apply a user-centric approach in your organization",{"data":31437,"content":31438,"nodeType":860},{},[31439],{"data":31440,"marks":31441,"value":31442,"nodeType":864},{},[],"\nWe’ve found that many companies believe in a user-centric approach to security in theory, but what that looks like in practice is less clear. That’s partly because there’s confusion around how to apply a concept that feels like a design principle to your organization’s security strategy. Most people we talk to like the idea of equipping employees to help secure the apps they’re using, but how to make that work in their environment is a bit scary, since it directly impacts every person in the company. ",{"data":31444,"content":31445,"nodeType":860},{},[31446],{"data":31447,"marks":31448,"value":31449,"nodeType":864},{},[],"Part of the problem is that “user-centric” has become a bit of a buzzword in marketing, with a lot of the vendors saying they’re user-centric when that really means they’ve just built a Slack or Teams integration that can message employees. Turning that feature on without thinking about how it’ll impact all of the employees in the business is a recipe for disaster. ",{"data":31451,"content":31452,"nodeType":860},{},[31453],{"data":31454,"marks":31455,"value":31456,"nodeType":864},{},[],"After speaking with customers and prospects since launch, we’ve discovered how important it is that we clearly explain how employees are going to be contacted and with what information. To adopt a user-centric approach that actually leads to measurable improvements in security, you need a tool that reaches out to employees with the right messaging at the right time and in the right place, whether that’s via ChatOps or in the browser, where they’re working.",{"data":31458,"content":31459,"nodeType":1009},{},[31460,31464,31469],{"data":31461,"marks":31462,"value":31463,"nodeType":864},{},[],"Equipping employees is ",{"data":31465,"marks":31466,"value":31468,"nodeType":864},{},[31467],{"type":2246},"part",{"data":31470,"marks":31471,"value":31472,"nodeType":864},{},[]," of the solution, not the whole solution ",{"data":31474,"content":31475,"nodeType":860},{},[31476,31480,31485],{"data":31477,"marks":31478,"value":31479,"nodeType":864},{},[],"User-centric approaches are a tool in the security team’s toolbox, a practical way to bring employees into the process - not a way to outsource the technical security burden to people with no security expertise. You don’t get to outsource security to employees and employees should ",{"data":31481,"marks":31482,"value":31484,"nodeType":864},{},[31483],{"type":2246},"never ",{"data":31486,"marks":31487,"value":31488,"nodeType":864},{},[],"be making technical security decisions on the company’s behalf. Employees provide context on how they’re using apps so that the security team can make risk-based decisions on which apps employees can use. ",{"data":31490,"content":31491,"nodeType":860},{},[31492,31496,31504,31507,31515],{"data":31493,"marks":31494,"value":31495,"nodeType":864},{},[],"By adopting a user-centric approach alongside centralized visibility and controls, most security teams have found a way to secure employee SaaS accounts and SaaS use at scale. We’re excited to work with our customers and investors to solve new problems in this emerging space. Follow us on ",{"data":31497,"content":31498,"nodeType":883},{"uri":30528},[31499],{"data":31500,"marks":31501,"value":31503,"nodeType":864},{},[31502],{"type":1455},"Twitter",{"data":31505,"marks":31506,"value":902,"nodeType":864},{},[],{"data":31508,"content":31510,"nodeType":883},{"uri":31509},"https://www.linkedin.com/company/push-security/",[31511],{"data":31512,"marks":31513,"value":30544,"nodeType":864},{},[31514],{"type":1455},{"data":31516,"marks":31517,"value":31518,"nodeType":864},{},[]," and sign up to our mailing list to come along for the ride!","We’re proud to announce our $15M Series A round, led by GV. Here's what we've learned about what our customers need since we launched in July 2022. ","2023-03-28T00:00:00.000Z",{"items":31522},[31523,31527],{"sys":31524,"name":31526},{"id":31525},"4EtskIWlj3SOH3UHbFR8uG","Company news",{"sys":31528,"name":4904},{"id":4903},{"items":31530},[31531],{"fullName":31532,"firstName":31533,"jobTitle":31534,"profilePicture":31535},"Adam Bateman","Adam","Co-founder / CEO",{"url":31536},"https://images.ctfassets.net/y1cdw1ablpvd/3Bt9feB72kxdWlS0hvpldi/904bdb8b20d98e53c574f8be2f60996b/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-20.jpg","push-it-real-good-why-im-excited-to-join-pushs-board","blog/push-it-real-good-why-im-excited-to-join-pushs-board",{"json":31540},{"data":31541,"content":31542,"nodeType":856},{},[31543],{"data":31544,"content":31545,"nodeType":860},{},[31546],{"data":31547,"marks":31548,"value":31549,"nodeType":864},{},[],"SaaS sprawl is not just a raw increase of apps in-use, but also due to employees self-adopting new apps. Orgs need sensible guardrails for employees.",{"id":31551,"publishedAt":31552},"1bkW8uoCL6lLeHbAkndZUM","2026-08-12T11:56:25.446Z",{"items":31554},[31555],{"sys":31556,"name":31526},{"id":31525},{"items":31558},[31559,31561,31563,31565,31567,31569,31571,31573],{"sys":31560,"name":297,"slug":298,"tier":31},{"id":294},{"sys":31562,"name":545,"slug":546,"tier":31},{"id":542},{"sys":31564,"name":413,"slug":414,"tier":31},{"id":410},{"sys":31566,"name":589,"slug":590,"tier":45},{"id":586},{"sys":31568,"name":484,"slug":485,"tier":45},{"id":481},{"sys":31570,"name":333,"slug":334,"tier":45},{"id":330},{"sys":31572,"name":306,"slug":307,"tier":45},{"id":303},{"sys":31574,"name":633,"slug":634,"tier":45},{"id":630},"Yqryz97Zl2J0KSWKcRxdBHG0atnR0UZy3p6lme6REFY",{"id":31577,"title":29295,"authorsCollection":31578,"content":31583,"extension":228,"faqItemsCollection":31872,"faqTitle":59,"featured":6,"hashTags":59,"meta":31874,"metaTitle":31875,"ogImage":59,"postType":23649,"publishedDate":29297,"relatedBlogPostsCollection":31876,"slug":29298,"stem":32371,"subtitle":59,"summary":32372,"synopsis":29296,"sys":32389,"tagsCollection":32391,"topicsCollection":32397,"__hash__":32409},"blog/blog/how-to-find-the-right-saas-security-solution-for-your-organization.json",{"items":31579},[31580],{"fullName":21905,"firstName":21906,"jobTitle":21907,"socialLinks":31581,"profilePicture":31582},[21954],{"url":21909},{"json":31584,"links":31865},{"data":31585,"content":31586,"nodeType":856},{},[31587,31593,31610,31616,31622,31628,31634,31640,31646,31652,31658,31664,31670,31676,31682,31695,31701,31707,31713,31719,31725,31731,31746,31752,31758,31764,31770,31776,31783,31813,31820,31850],{"data":31588,"content":31589,"nodeType":860},{},[31590],{"data":31591,"marks":31592,"value":28979,"nodeType":864},{},[],{"data":31594,"content":31595,"nodeType":860},{},[31596,31599,31607],{"data":31597,"marks":31598,"value":28986,"nodeType":864},{},[],{"data":31600,"content":31603,"nodeType":17737},{"target":31601},{"sys":31602},{"id":23052,"type":1001,"linkType":1002},[31604],{"data":31605,"marks":31606,"value":28995,"nodeType":864},{},[],{"data":31608,"marks":31609,"value":28999,"nodeType":864},{},[],{"data":31611,"content":31612,"nodeType":860},{},[31613],{"data":31614,"marks":31615,"value":29006,"nodeType":864},{},[],{"data":31617,"content":31618,"nodeType":860},{},[31619],{"data":31620,"marks":31621,"value":29013,"nodeType":864},{},[],{"data":31623,"content":31624,"nodeType":860},{},[31625],{"data":31626,"marks":31627,"value":29020,"nodeType":864},{},[],{"data":31629,"content":31630,"nodeType":860},{},[31631],{"data":31632,"marks":31633,"value":29027,"nodeType":864},{},[],{"data":31635,"content":31636,"nodeType":1312},{},[31637],{"data":31638,"marks":31639,"value":29034,"nodeType":864},{},[],{"data":31641,"content":31642,"nodeType":860},{},[31643],{"data":31644,"marks":31645,"value":29041,"nodeType":864},{},[],{"data":31647,"content":31648,"nodeType":860},{},[31649],{"data":31650,"marks":31651,"value":29048,"nodeType":864},{},[],{"data":31653,"content":31654,"nodeType":860},{},[31655],{"data":31656,"marks":31657,"value":29055,"nodeType":864},{},[],{"data":31659,"content":31660,"nodeType":860},{},[31661],{"data":31662,"marks":31663,"value":29062,"nodeType":864},{},[],{"data":31665,"content":31666,"nodeType":1312},{},[31667],{"data":31668,"marks":31669,"value":29069,"nodeType":864},{},[],{"data":31671,"content":31672,"nodeType":860},{},[31673],{"data":31674,"marks":31675,"value":29076,"nodeType":864},{},[],{"data":31677,"content":31678,"nodeType":860},{},[31679],{"data":31680,"marks":31681,"value":29083,"nodeType":864},{},[],{"data":31683,"content":31684,"nodeType":860},{},[31685,31688,31692],{"data":31686,"marks":31687,"value":29090,"nodeType":864},{},[],{"data":31689,"marks":31690,"value":29095,"nodeType":864},{},[31691],{"type":2246},{"data":31693,"marks":31694,"value":29099,"nodeType":864},{},[],{"data":31696,"content":31697,"nodeType":860},{},[31698],{"data":31699,"marks":31700,"value":29106,"nodeType":864},{},[],{"data":31702,"content":31703,"nodeType":1312},{},[31704],{"data":31705,"marks":31706,"value":29113,"nodeType":864},{},[],{"data":31708,"content":31709,"nodeType":860},{},[31710],{"data":31711,"marks":31712,"value":29120,"nodeType":864},{},[],{"data":31714,"content":31715,"nodeType":860},{},[31716],{"data":31717,"marks":31718,"value":29127,"nodeType":864},{},[],{"data":31720,"content":31721,"nodeType":860},{},[31722],{"data":31723,"marks":31724,"value":29134,"nodeType":864},{},[],{"data":31726,"content":31727,"nodeType":860},{},[31728],{"data":31729,"marks":31730,"value":29141,"nodeType":864},{},[],{"data":31732,"content":31733,"nodeType":860},{},[31734,31737,31743],{"data":31735,"marks":31736,"value":29148,"nodeType":864},{},[],{"data":31738,"content":31739,"nodeType":883},{"uri":29151},[31740],{"data":31741,"marks":31742,"value":29156,"nodeType":864},{},[],{"data":31744,"marks":31745,"value":6570,"nodeType":864},{},[],{"data":31747,"content":31748,"nodeType":1312},{},[31749],{"data":31750,"marks":31751,"value":29166,"nodeType":864},{},[],{"data":31753,"content":31754,"nodeType":860},{},[31755],{"data":31756,"marks":31757,"value":29173,"nodeType":864},{},[],{"data":31759,"content":31760,"nodeType":860},{},[31761],{"data":31762,"marks":31763,"value":29180,"nodeType":864},{},[],{"data":31765,"content":31766,"nodeType":1312},{},[31767],{"data":31768,"marks":31769,"value":19795,"nodeType":864},{},[],{"data":31771,"content":31772,"nodeType":860},{},[31773],{"data":31774,"marks":31775,"value":29193,"nodeType":864},{},[],{"data":31777,"content":31778,"nodeType":860},{},[31779],{"data":31780,"marks":31781,"value":29201,"nodeType":864},{},[31782],{"type":899},{"data":31784,"content":31785,"nodeType":941},{},[31786,31795,31804],{"data":31787,"content":31788,"nodeType":945},{},[31789],{"data":31790,"content":31791,"nodeType":860},{},[31792],{"data":31793,"marks":31794,"value":29214,"nodeType":864},{},[],{"data":31796,"content":31797,"nodeType":945},{},[31798],{"data":31799,"content":31800,"nodeType":860},{},[31801],{"data":31802,"marks":31803,"value":29224,"nodeType":864},{},[],{"data":31805,"content":31806,"nodeType":945},{},[31807],{"data":31808,"content":31809,"nodeType":860},{},[31810],{"data":31811,"marks":31812,"value":29234,"nodeType":864},{},[],{"data":31814,"content":31815,"nodeType":860},{},[31816],{"data":31817,"marks":31818,"value":29242,"nodeType":864},{},[31819],{"type":899},{"data":31821,"content":31822,"nodeType":941},{},[31823,31832,31841],{"data":31824,"content":31825,"nodeType":945},{},[31826],{"data":31827,"content":31828,"nodeType":860},{},[31829],{"data":31830,"marks":31831,"value":29255,"nodeType":864},{},[],{"data":31833,"content":31834,"nodeType":945},{},[31835],{"data":31836,"content":31837,"nodeType":860},{},[31838],{"data":31839,"marks":31840,"value":29265,"nodeType":864},{},[],{"data":31842,"content":31843,"nodeType":945},{},[31844],{"data":31845,"content":31846,"nodeType":860},{},[31847],{"data":31848,"marks":31849,"value":29275,"nodeType":864},{},[],{"data":31851,"content":31852,"nodeType":860},{},[31853,31856,31862],{"data":31854,"marks":31855,"value":29282,"nodeType":864},{},[],{"data":31857,"content":31858,"nodeType":883},{"uri":29285},[31859],{"data":31860,"marks":31861,"value":29290,"nodeType":864},{},[],{"data":31863,"marks":31864,"value":29294,"nodeType":864},{},[],{"entries":31866},{"block":31867,"inline":31868,"hyperlink":31869},[],[],[31870],{"sys":31871,"__typename":2059,"title":23525,"slug":23526},{"id":23052},{"items":31873},[],{},"How to evaluate SaaS security solutions for your company",{"items":31877},[31878],{"__typename":2059,"sys":31879,"content":31880,"title":23525,"synopsis":30549,"hashTags":32360,"publishedDate":30556,"slug":23526,"tagsCollection":32361,"authorsCollection":32367},{"id":23052},{"json":31881},{"data":31882,"content":31883,"nodeType":856},{},[31884,31890,31896,31902,31908,31914,31934,31940,31946,31952,31958,31968,31974,32008,32028,32034,32040,32054,32060,32066,32079,32085,32092,32105,32111,32117,32123,32130,32136,32142,32148,32170,32227,32233,32239,32245,32258,32264,32277,32283,32293,32299,32316,32321,32336],{"data":31885,"content":31886,"nodeType":860},{},[31887],{"data":31888,"marks":31889,"value":29995,"nodeType":864},{},[],{"data":31891,"content":31892,"nodeType":860},{},[31893],{"data":31894,"marks":31895,"value":30002,"nodeType":864},{},[],{"data":31897,"content":31898,"nodeType":1009},{},[31899],{"data":31900,"marks":31901,"value":30009,"nodeType":864},{},[],{"data":31903,"content":31904,"nodeType":860},{},[31905],{"data":31906,"marks":31907,"value":30016,"nodeType":864},{},[],{"data":31909,"content":31910,"nodeType":860},{},[31911],{"data":31912,"marks":31913,"value":30023,"nodeType":864},{},[],{"data":31915,"content":31916,"nodeType":860},{},[31917,31920,31924,31927,31931],{"data":31918,"marks":31919,"value":30030,"nodeType":864},{},[],{"data":31921,"marks":31922,"value":30035,"nodeType":864},{},[31923],{"type":2246},{"data":31925,"marks":31926,"value":30039,"nodeType":864},{},[],{"data":31928,"marks":31929,"value":30044,"nodeType":864},{},[31930],{"type":2246},{"data":31932,"marks":31933,"value":30048,"nodeType":864},{},[],{"data":31935,"content":31936,"nodeType":860},{},[31937],{"data":31938,"marks":31939,"value":30055,"nodeType":864},{},[],{"data":31941,"content":31942,"nodeType":1009},{},[31943],{"data":31944,"marks":31945,"value":30062,"nodeType":864},{},[],{"data":31947,"content":31948,"nodeType":860},{},[31949],{"data":31950,"marks":31951,"value":30069,"nodeType":864},{},[],{"data":31953,"content":31954,"nodeType":1009},{},[31955],{"data":31956,"marks":31957,"value":30076,"nodeType":864},{},[],{"data":31959,"content":31960,"nodeType":860},{},[31961,31964],{"data":31962,"marks":31963,"value":30083,"nodeType":864},{},[],{"data":31965,"marks":31966,"value":30088,"nodeType":864},{},[31967],{"type":2246},{"data":31969,"content":31970,"nodeType":860},{},[31971],{"data":31972,"marks":31973,"value":30095,"nodeType":864},{},[],{"data":31975,"content":31976,"nodeType":860},{},[31977,31980,31984,31987,31991,31994,31998,32001,32005],{"data":31978,"marks":31979,"value":30102,"nodeType":864},{},[],{"data":31981,"marks":31982,"value":30035,"nodeType":864},{},[31983],{"type":2246},{"data":31985,"marks":31986,"value":30110,"nodeType":864},{},[],{"data":31988,"marks":31989,"value":30115,"nodeType":864},{},[31990],{"type":2246},{"data":31992,"marks":31993,"value":30119,"nodeType":864},{},[],{"data":31995,"marks":31996,"value":30035,"nodeType":864},{},[31997],{"type":2246},{"data":31999,"marks":32000,"value":30127,"nodeType":864},{},[],{"data":32002,"marks":32003,"value":30044,"nodeType":864},{},[32004],{"type":2246},{"data":32006,"marks":32007,"value":2924,"nodeType":864},{},[],{"data":32009,"content":32010,"nodeType":860},{},[32011,32014,32018,32021,32025],{"data":32012,"marks":32013,"value":30141,"nodeType":864},{},[],{"data":32015,"marks":32016,"value":30146,"nodeType":864},{},[32017],{"type":2246},{"data":32019,"marks":32020,"value":30150,"nodeType":864},{},[],{"data":32022,"marks":32023,"value":30155,"nodeType":864},{},[32024],{"type":2246},{"data":32026,"marks":32027,"value":30159,"nodeType":864},{},[],{"data":32029,"content":32030,"nodeType":860},{},[32031],{"data":32032,"marks":32033,"value":30166,"nodeType":864},{},[],{"data":32035,"content":32036,"nodeType":1009},{},[32037],{"data":32038,"marks":32039,"value":30173,"nodeType":864},{},[],{"data":32041,"content":32042,"nodeType":860},{},[32043,32047,32050],{"data":32044,"marks":32045,"value":30181,"nodeType":864},{},[32046],{"type":2246},{"data":32048,"marks":32049,"value":1171,"nodeType":864},{},[],{"data":32051,"marks":32052,"value":30189,"nodeType":864},{},[32053],{"type":2246},{"data":32055,"content":32056,"nodeType":860},{},[32057],{"data":32058,"marks":32059,"value":30196,"nodeType":864},{},[],{"data":32061,"content":32062,"nodeType":860},{},[32063],{"data":32064,"marks":32065,"value":30203,"nodeType":864},{},[],{"data":32067,"content":32068,"nodeType":860},{},[32069,32072,32076],{"data":32070,"marks":32071,"value":30210,"nodeType":864},{},[],{"data":32073,"marks":32074,"value":30215,"nodeType":864},{},[32075],{"type":2246},{"data":32077,"marks":32078,"value":30219,"nodeType":864},{},[],{"data":32080,"content":32081,"nodeType":1009},{},[32082],{"data":32083,"marks":32084,"value":30226,"nodeType":864},{},[],{"data":32086,"content":32087,"nodeType":860},{},[32088],{"data":32089,"marks":32090,"value":30234,"nodeType":864},{},[32091],{"type":2246},{"data":32093,"content":32094,"nodeType":860},{},[32095,32098,32102],{"data":32096,"marks":32097,"value":30241,"nodeType":864},{},[],{"data":32099,"marks":32100,"value":30246,"nodeType":864},{},[32101],{"type":2246},{"data":32103,"marks":32104,"value":30250,"nodeType":864},{},[],{"data":32106,"content":32107,"nodeType":860},{},[32108],{"data":32109,"marks":32110,"value":30257,"nodeType":864},{},[],{"data":32112,"content":32113,"nodeType":860},{},[32114],{"data":32115,"marks":32116,"value":30264,"nodeType":864},{},[],{"data":32118,"content":32119,"nodeType":1009},{},[32120],{"data":32121,"marks":32122,"value":30271,"nodeType":864},{},[],{"data":32124,"content":32125,"nodeType":860},{},[32126],{"data":32127,"marks":32128,"value":30279,"nodeType":864},{},[32129],{"type":2246},{"data":32131,"content":32132,"nodeType":860},{},[32133],{"data":32134,"marks":32135,"value":30286,"nodeType":864},{},[],{"data":32137,"content":32138,"nodeType":860},{},[32139],{"data":32140,"marks":32141,"value":30293,"nodeType":864},{},[],{"data":32143,"content":32144,"nodeType":860},{},[32145],{"data":32146,"marks":32147,"value":30300,"nodeType":864},{},[],{"data":32149,"content":32150,"nodeType":860},{},[32151,32154,32158,32161,32167],{"data":32152,"marks":32153,"value":30307,"nodeType":864},{},[],{"data":32155,"marks":32156,"value":14755,"nodeType":864},{},[32157],{"type":899},{"data":32159,"marks":32160,"value":30315,"nodeType":864},{},[],{"data":32162,"content":32163,"nodeType":883},{"uri":30318},[32164],{"data":32165,"marks":32166,"value":30323,"nodeType":864},{},[],{"data":32168,"marks":32169,"value":30327,"nodeType":864},{},[],{"data":32171,"content":32172,"nodeType":941},{},[32173,32182,32191,32200,32209,32218],{"data":32174,"content":32175,"nodeType":945},{},[32176],{"data":32177,"content":32178,"nodeType":860},{},[32179],{"data":32180,"marks":32181,"value":30340,"nodeType":864},{},[],{"data":32183,"content":32184,"nodeType":945},{},[32185],{"data":32186,"content":32187,"nodeType":860},{},[32188],{"data":32189,"marks":32190,"value":30350,"nodeType":864},{},[],{"data":32192,"content":32193,"nodeType":945},{},[32194],{"data":32195,"content":32196,"nodeType":860},{},[32197],{"data":32198,"marks":32199,"value":30360,"nodeType":864},{},[],{"data":32201,"content":32202,"nodeType":945},{},[32203],{"data":32204,"content":32205,"nodeType":860},{},[32206],{"data":32207,"marks":32208,"value":30370,"nodeType":864},{},[],{"data":32210,"content":32211,"nodeType":945},{},[32212],{"data":32213,"content":32214,"nodeType":860},{},[32215],{"data":32216,"marks":32217,"value":30380,"nodeType":864},{},[],{"data":32219,"content":32220,"nodeType":945},{},[32221],{"data":32222,"content":32223,"nodeType":860},{},[32224],{"data":32225,"marks":32226,"value":30390,"nodeType":864},{},[],{"data":32228,"content":32229,"nodeType":860},{},[32230],{"data":32231,"marks":32232,"value":30397,"nodeType":864},{},[],{"data":32234,"content":32235,"nodeType":860},{},[32236],{"data":32237,"marks":32238,"value":30404,"nodeType":864},{},[],{"data":32240,"content":32241,"nodeType":1009},{},[32242],{"data":32243,"marks":32244,"value":23275,"nodeType":864},{},[],{"data":32246,"content":32247,"nodeType":860},{},[32248,32251,32255],{"data":32249,"marks":32250,"value":30417,"nodeType":864},{},[],{"data":32252,"marks":32253,"value":30422,"nodeType":864},{},[32254],{"type":2246},{"data":32256,"marks":32257,"value":30426,"nodeType":864},{},[],{"data":32259,"content":32260,"nodeType":1312},{},[32261],{"data":32262,"marks":32263,"value":30433,"nodeType":864},{},[],{"data":32265,"content":32266,"nodeType":860},{},[32267,32270,32274],{"data":32268,"marks":32269,"value":30440,"nodeType":864},{},[],{"data":32271,"marks":32272,"value":30445,"nodeType":864},{},[32273],{"type":2246},{"data":32275,"marks":32276,"value":30449,"nodeType":864},{},[],{"data":32278,"content":32279,"nodeType":860},{},[32280],{"data":32281,"marks":32282,"value":30456,"nodeType":864},{},[],{"data":32284,"content":32285,"nodeType":860},{},[32286,32290],{"data":32287,"marks":32288,"value":30464,"nodeType":864},{},[32289],{"type":2246},{"data":32291,"marks":32292,"value":30468,"nodeType":864},{},[],{"data":32294,"content":32295,"nodeType":860},{},[32296],{"data":32297,"marks":32298,"value":30475,"nodeType":864},{},[],{"data":32300,"content":32301,"nodeType":860},{},[32302,32306,32309,32313],{"data":32303,"marks":32304,"value":30483,"nodeType":864},{},[32305],{"type":2246},{"data":32307,"marks":32308,"value":30487,"nodeType":864},{},[],{"data":32310,"marks":32311,"value":30492,"nodeType":864},{},[32312],{"type":2246},{"data":32314,"marks":32315,"value":6408,"nodeType":864},{},[],{"data":32317,"content":32320,"nodeType":996},{"target":32318},{"sys":32319},{"id":30500,"type":1001,"linkType":1002},[],{"data":32322,"content":32323,"nodeType":860},{},[32324,32327,32333],{"data":32325,"marks":32326,"value":30508,"nodeType":864},{},[],{"data":32328,"content":32329,"nodeType":883},{"uri":30318},[32330],{"data":32331,"marks":32332,"value":30515,"nodeType":864},{},[],{"data":32334,"marks":32335,"value":2924,"nodeType":864},{},[],{"data":32337,"content":32338,"nodeType":860},{},[32339,32342,32348,32351,32357],{"data":32340,"marks":32341,"value":30525,"nodeType":864},{},[],{"data":32343,"content":32344,"nodeType":883},{"uri":30528},[32345],{"data":32346,"marks":32347,"value":30533,"nodeType":864},{},[],{"data":32349,"marks":32350,"value":13711,"nodeType":864},{},[],{"data":32352,"content":32353,"nodeType":883},{"uri":30539},[32354],{"data":32355,"marks":32356,"value":30544,"nodeType":864},{},[],{"data":32358,"marks":32359,"value":30548,"nodeType":864},{},[],[30551,30552,30553,30554,30555],{"items":32362},[32363,32365],{"sys":32364,"name":4904},{"id":4903},{"sys":32366,"name":297},{"id":2732},{"items":32368},[32369],{"fullName":21905,"firstName":21906,"jobTitle":21907,"profilePicture":32370},{"url":21909},"blog/how-to-find-the-right-saas-security-solution-for-your-organization",{"json":32373},{"data":32374,"content":32375,"nodeType":856},{},[32376,32383],{"data":32377,"content":32378,"nodeType":860},{},[32379],{"data":32380,"marks":32381,"value":32382,"nodeType":864},{},[],"We break down some major SaaS use cases and match them up with solutions that can address them.\n",{"data":32384,"content":32385,"nodeType":860},{},[32386],{"data":32387,"marks":32388,"value":30083,"nodeType":864},{},[],{"id":28968,"publishedAt":32390},"2026-08-12T11:56:46.440Z",{"items":32392},[32393,32395],{"sys":32394,"name":4904},{"id":4903},{"sys":32396,"name":2729},{"id":2728},{"items":32398},[32399,32401,32403,32405,32407],{"sys":32400,"name":545,"slug":546,"tier":31},{"id":542},{"sys":32402,"name":297,"slug":298,"tier":31},{"id":294},{"sys":32404,"name":589,"slug":590,"tier":45},{"id":586},{"sys":32406,"name":306,"slug":307,"tier":45},{"id":303},{"sys":32408,"name":624,"slug":625,"tier":45},{"id":621},"VWBo9cEVIbQGG-GS8nZGwPakcNUOAQ5NoaLdrlVYEp4",1787040059420]