[{"data":1,"prerenderedAt":41182},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-dlp":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,4943,6198,10088,13289,16478,17234,20769,23553,26646,29284,32370,34878,37700,40292],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1864,"faqTitle":2052,"featured":6,"hashTags":59,"meta":2053,"metaTitle":2054,"ogImage":59,"postType":59,"publishedDate":2055,"relatedBlogPostsCollection":2056,"slug":4882,"stem":4883,"subtitle":4884,"summary":4885,"synopsis":4895,"sys":4896,"tagsCollection":4899,"topicsCollection":4908,"__hash__":4942},"blog/blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps.json","Shadow AI: how to discover, govern, and secure AI apps",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Kelly Davenport","Kelly","Product Team",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"json":855,"links":1710},{"nodeType":856,"data":857,"content":858},"document",{},[859,868,875,926,933,940,995,1004,1008,1017,1024,1036,1042,1054,1060,1072,1078,1081,1089,1096,1115,1126,1133,1140,1143,1151,1158,1183,1189,1196,1212,1228,1234,1250,1266,1273,1280,1287,1293,1296,1304,1311,1319,1326,1342,1349,1374,1380,1387,1393,1405,1412,1418,1424,1427,1435,1442,1461,1468,1476,1483,1495,1511,1517,1529,1563,1570,1586,1592,1608,1615,1622,1625,1633,1640,1647,1654,1661,1668,1675,1678,1685,1692],{"nodeType":860,"data":861,"content":862},"paragraph",{},[863],{"nodeType":864,"value":865,"marks":866,"data":867},"text","Every security team that's blocked an AI tool at the network level has had the same experience three months later: The tool they blocked isn't in use, but a dozen they've never heard of are.",[],{},{"nodeType":860,"data":869,"content":870},{},[871],{"nodeType":864,"value":872,"marks":873,"data":874},"The block didn't stop employees from using AI. It just prevented the security team from seeing what’s actually happening.",[],{},{"nodeType":860,"data":876,"content":877},{},[878,882,891,895,901,905,910,914,922],{"nodeType":864,"value":879,"marks":880,"data":881},"The data backs up this pattern. ",[],{},{"nodeType":883,"data":884,"content":886},"hyperlink",{"uri":885},"https://pushsecurity.com/blog/what-push-data-reveals-about-the-state-of-shadow-ai/",[887],{"nodeType":864,"value":888,"marks":889,"data":890},"Push telemetry",[],{},{"nodeType":864,"value":892,"marks":893,"data":894}," shows that the average organization has ",[],{},{"nodeType":864,"value":896,"marks":897,"data":900},"16 AI apps, 17 AI browser extensions,",[898],{"type":899},"bold",{},{"nodeType":864,"value":902,"marks":903,"data":904}," and ",[],{},{"nodeType":864,"value":906,"marks":907,"data":909},"17 AI OAuth integrations",[908],{"type":899},{},{"nodeType":864,"value":911,"marks":912,"data":913}," in active use during a typical week — most unapproved. Meanwhile, ",[],{},{"nodeType":883,"data":915,"content":917},{"uri":916},"https://www.okta.com/newsroom/articles/ai-agents-at-work-2026-agentic-enterprise-security/",[918],{"nodeType":864,"value":919,"marks":920,"data":921},"Okta found",[],{},{"nodeType":864,"value":923,"marks":924,"data":925}," that 80% of employees who use unapproved AI tools do so because it's easier to use their own accounts, and 57% because the approval process is too slow.",[],{},{"nodeType":860,"data":927,"content":928},{},[929],{"nodeType":864,"value":930,"marks":931,"data":932},"The organizations getting this right have stopped treating AI governance as an access-control problem — which tools to allow, which to block — and started treating it as an invitation to build out an infrastructure to enable appropriate use. Employees are going to use the tools they need to get their work done. The question is whether they'll use them on a path you built and instrumented, or on one they carved themselves.",[],{},{"nodeType":860,"data":934,"content":935},{},[936],{"nodeType":864,"value":937,"marks":938,"data":939},"This guide walks through how to build that paved path. Using Push, you can:",[],{},{"nodeType":941,"data":942,"content":943},"unordered-list",{},[944,955,965,975,985],{"nodeType":945,"data":946,"content":947},"list-item",{},[948],{"nodeType":860,"data":949,"content":950},{},[951],{"nodeType":864,"value":952,"marks":953,"data":954},"Identify shadow AI, including personal accounts on approved corporate apps, AI browser extensions, OAuth integrations into sensitive systems, and AI browser usage.",[],{},{"nodeType":945,"data":956,"content":957},{},[958],{"nodeType":860,"data":959,"content":960},{},[961],{"nodeType":864,"value":962,"marks":963,"data":964},"Enforce policies on data flows into and out of AI apps, including blocking unapproved file uploads, downloads, and clipboard pastes; and monitoring AI chat transcripts.",[],{},{"nodeType":945,"data":966,"content":967},{},[968],{"nodeType":860,"data":969,"content":970},{},[971],{"nodeType":864,"value":972,"marks":973,"data":974},"Use just-in-time guardrails to intercept users accessing unapproved AI tools and point them at approved alternatives.",[],{},{"nodeType":945,"data":976,"content":977},{},[978],{"nodeType":860,"data":979,"content":980},{},[981],{"nodeType":864,"value":982,"marks":983,"data":984},"Prevent unwanted MCP connections with app-agnostic controls.",[],{},{"nodeType":945,"data":986,"content":987},{},[988],{"nodeType":860,"data":989,"content":990},{},[991],{"nodeType":864,"value":992,"marks":993,"data":994},"Automate a lot of the work so you don’t burn out your team as the AI landscape continues to shift.",[],{},{"nodeType":996,"data":997,"content":1003},"embedded-entry-block",{"target":998},{"sys":999},{"id":1000,"type":1001,"linkType":1002},"29N8YH9As3GHypOve3br80","Link","Entry",[],{"nodeType":1005,"data":1006,"content":1007},"hr",{},[],{"nodeType":1009,"data":1010,"content":1011},"heading-1",{},[1012],{"nodeType":864,"value":1013,"marks":1014,"data":1016},"What is shadow AI, and why can't you manage it like shadow IT?",[1015],{"type":899},{},{"nodeType":860,"data":1018,"content":1019},{},[1020],{"nodeType":864,"value":1021,"marks":1022,"data":1023},"Shadow AI is any use of AI tools, services, or integrations that happens outside an organization's security governance and visibility. Security teams have been managing shadow SaaS for years, but shadow AI can't be addressed with the same playbook — for three reasons.",[],{},{"nodeType":860,"data":1025,"content":1026},{},[1027,1032],{"nodeType":864,"value":1028,"marks":1029,"data":1031},"First",[1030],{"type":899},{},{"nodeType":864,"value":1033,"marks":1034,"data":1035},", it spans multiple categories that each need different controls: unapproved AI apps, personal accounts on approved corporate AI tools, AI browser extensions, and OAuth integrations into corporate systems. Blocking unapproved apps doesn't address personal accounts on approved ones, and neither solves the extension or OAuth problem. ",[],{},{"nodeType":996,"data":1037,"content":1041},{"target":1038},{"sys":1039},{"id":1040,"type":1001,"linkType":1002},"2hsKQ9DEspflhmtR0bE7QY",[],{"nodeType":860,"data":1043,"content":1044},{},[1045,1050],{"nodeType":864,"value":1046,"marks":1047,"data":1049},"Second",[1048],{"type":899},{},{"nodeType":864,"value":1051,"marks":1052,"data":1053},", the tools most organizations rely on to manage shadow SaaS — SWGs, CASBs, EDR, IdP logs — are structurally blind to shadow AI. An SWG sees that someone visited an AI domain but can't tell you whether they logged in, pasted source code into a prompt, or granted OAuth access to your Google Workspace tenant. EDR doesn't see browser-layer activity at all. IdP logs capture OAuth grants routed through the identity provider but miss tools accessed via direct signup or personal accounts. Instead, the activity security teams need to see happens primarily inside the browser.",[],{},{"nodeType":996,"data":1055,"content":1059},{"target":1056},{"sys":1057},{"id":1058,"type":1001,"linkType":1002},"1vE0dyAKdnTSjyAJ4Xoadd",[],{"nodeType":860,"data":1061,"content":1062},{},[1063,1068],{"nodeType":864,"value":1064,"marks":1065,"data":1067},"Third",[1066],{"type":899},{},{"nodeType":864,"value":1069,"marks":1070,"data":1071},", the risk profile is different. Shadow AI tools increasingly function as hubs — connected via OAuth integrations and MCP to email, cloud storage, code repositories, and other high-value systems. They leak sensitive data outward (employees paste source code, credentials, and internal documents into prompts daily) while simultaneously expanding the attack surface inward (compromise a single AI app and an attacker inherits whatever access the employee granted it, turning one ungoverned tool into a pivot point across the SaaS estate). ",[],{},{"nodeType":996,"data":1073,"content":1077},{"target":1074},{"sys":1075},{"id":1076,"type":1001,"linkType":1002},"3ldZ23OORTu7INBfSnE7R7",[],{"nodeType":1005,"data":1079,"content":1080},{},[],{"nodeType":1009,"data":1082,"content":1083},{},[1084],{"nodeType":864,"value":1085,"marks":1086,"data":1088},"Why blocking AI usage fails",[1087],{"type":899},{},{"nodeType":860,"data":1090,"content":1091},{},[1092],{"nodeType":864,"value":1093,"marks":1094,"data":1095},"The instinct to block AI tools makes sense. Executives are asking about AI risk to the business, a new tool appears every week, and blocking unapproved apps feels like a quick way to stop the bleeding.",[],{},{"nodeType":860,"data":1097,"content":1098},{},[1099,1103,1111],{"nodeType":864,"value":1100,"marks":1101,"data":1102},"Unfortunately, blocking doesn't work for long. The latest security frameworks — including the ",[],{},{"nodeType":883,"data":1104,"content":1106},{"uri":1105},"https://www.sans.org/mlp/2026-ai-security-maturity-model-ebook",[1107],{"nodeType":864,"value":1108,"marks":1109,"data":1110},"SANS AI Security Maturity Model",[],{},{"nodeType":864,"value":1112,"marks":1113,"data":1114}," — all agree: Block-based AI policies drive usage underground rather than preventing it. ",[],{},{"nodeType":1116,"data":1117,"content":1118},"blockquote",{},[1119],{"nodeType":860,"data":1120,"content":1121},{},[1122],{"nodeType":864,"value":1123,"marks":1124,"data":1125},"A block-based AI policy may feel like risk management, but practitioner experience shows that it typically drives AI usage underground rather than preventing it. The goal is not to eliminate AI use; it is to bring it into visibility where it can be governed.",[],{},{"nodeType":860,"data":1127,"content":1128},{},[1129],{"nodeType":864,"value":1130,"marks":1131,"data":1132},"These kinds of barricades also fail for a structural reason: They're built on the network perimeter, and AI usage doesn't cross the perimeter in ways network tools can inspect.",[],{},{"nodeType":860,"data":1134,"content":1135},{},[1136],{"nodeType":864,"value":1137,"marks":1138,"data":1139},"The most damaging consequence of blocking isn't the workarounds themselves — it's the loss of visibility. To begin building a better path for employees, you have to start with seeing what's actually happening.",[],{},{"nodeType":1005,"data":1141,"content":1142},{},[],{"nodeType":1009,"data":1144,"content":1145},{},[1146],{"nodeType":864,"value":1147,"marks":1148,"data":1150},"Using Push to discover, govern, and control shadow AI",[1149],{"type":899},{},{"nodeType":860,"data":1152,"content":1153},{},[1154],{"nodeType":864,"value":1155,"marks":1156,"data":1157},"Push Security is a browser security platform that gets you the vantage point you need to start addressing shadow AI. Push deploys as a lightweight extension to employees' existing browsers rather than requiring a full browser migration, giving security teams visibility into browser-layer activity that network and endpoint tools structurally lack.",[],{},{"nodeType":860,"data":1159,"content":1160},{},[1161,1165,1170,1174,1179],{"nodeType":864,"value":1162,"marks":1163,"data":1164},"Push discovers AI tools through ",[],{},{"nodeType":864,"value":1166,"marks":1167,"data":1169},"automatic",[1168],{"type":899},{},{"nodeType":864,"value":1171,"marks":1172,"data":1173}," ",[],{},{"nodeType":864,"value":1175,"marks":1176,"data":1178},"app discovery",[1177],{"type":899},{},{"nodeType":864,"value":1180,"marks":1181,"data":1182},", allowing you to identify applications from actual browser login events rather than network traffic logs. ",[],{},{"nodeType":996,"data":1184,"content":1188},{"target":1185},{"sys":1186},{"id":1187,"type":1001,"linkType":1002},"4eTkgU2dxhMueHPiwuCWDl",[],{"nodeType":860,"data":1190,"content":1191},{},[1192],{"nodeType":864,"value":1193,"marks":1194,"data":1195},"When an employee signs into a new AI service, Push registers the authentication event, identifies the application, and logs how the employee authenticated — corporate SSO, OIDC, a standalone password, or a personal account. ",[],{},{"nodeType":860,"data":1197,"content":1198},{},[1199,1203,1208],{"nodeType":864,"value":1200,"marks":1201,"data":1202},"Push then applies ",[],{},{"nodeType":864,"value":1204,"marks":1205,"data":1207},"app categories ",[1206],{"type":899},{},{"nodeType":864,"value":1209,"marks":1210,"data":1211},"automatically, classifying the discovered application by type without requiring security teams to build or maintain manual lists.",[],{},{"nodeType":860,"data":1213,"content":1214},{},[1215,1219,1224],{"nodeType":864,"value":1216,"marks":1217,"data":1218},"Push extends the same discovery across the other three shadow AI dimensions. The platform’s ",[],{},{"nodeType":864,"value":1220,"marks":1221,"data":1223},"browser extension discovery ",[1222],{"type":899},{},{"nodeType":864,"value":1225,"marks":1226,"data":1227},"capability catalogs every AI-related extension installed across the workforce, including the specific permissions each extension has requested (access to page content, browsing history, clipboard data), allowing you to review whether those permission combinations could enable data exfiltration or account takeover. ",[],{},{"nodeType":996,"data":1229,"content":1233},{"target":1230},{"sys":1231},{"id":1232,"type":1001,"linkType":1002},"1z56sTWWN9E35dE3HhbRNY",[],{"nodeType":860,"data":1235,"content":1236},{},[1237,1241,1246],{"nodeType":864,"value":1238,"marks":1239,"data":1240},"Push’s ",[],{},{"nodeType":864,"value":1242,"marks":1243,"data":1245},"OAuth integration discovery",[1244],{"type":899},{},{"nodeType":864,"value":1247,"marks":1248,"data":1249}," identifies OAuth connections between AI tools and corporate systems — the grants that create persistent API-level access to platforms like Google Workspace.",[],{},{"nodeType":860,"data":1251,"content":1252},{},[1253,1257,1262],{"nodeType":864,"value":1254,"marks":1255,"data":1256},"For each discovered tool, Push also captures authentication context that points to ",[],{},{"nodeType":864,"value":1258,"marks":1259,"data":1261},"where hidden security risks lie",[1260],{"type":899},{},{"nodeType":864,"value":1263,"marks":1264,"data":1265},": SSO vs. password vs. personal account, MFA status, and password strength. An AI tool accessed via corporate SSO with MFA is a different risk than the same tool accessed through a personal Gmail account with a reused password. Similarly, employees using only a password to access AI tools that they’ve integrated with other sensitive corporate systems introduces another level of downstream risk. That context is what makes the inventory actionable.",[],{},{"nodeType":860,"data":1267,"content":1268},{},[1269],{"nodeType":864,"value":1270,"marks":1271,"data":1272},"Push also detects when employees are adopting agentic browsers — autonomous AI-powered browsers like Comet, Atlas, and Dia that browse the web and interact with applications on behalf of users or automated workflows. ",[],{},{"nodeType":860,"data":1274,"content":1275},{},[1276],{"nodeType":864,"value":1277,"marks":1278,"data":1279},"These represent an emerging category of non-human AI identity. They authenticate to SaaS applications, access corporate data, and make API calls, but they aren't managed through traditional identity infrastructure. Push helps you identify these agentic browsers as they appear in the environment, before they become a blind spot.",[],{},{"nodeType":860,"data":1281,"content":1282},{},[1283],{"nodeType":864,"value":1284,"marks":1285,"data":1286},"Returning to the paved path metaphor, this step is about surveying the site before you figure out where to put in the path. You need to understand who’s already doing what, where, so you can find the risks you need to address.",[],{},{"nodeType":996,"data":1288,"content":1292},{"target":1289},{"sys":1290},{"id":1291,"type":1001,"linkType":1002},"5iXyJbxwWiUt7WoP7FF0Y2",[],{"nodeType":1005,"data":1294,"content":1295},{},[],{"nodeType":1009,"data":1297,"content":1298},{},[1299],{"nodeType":864,"value":1300,"marks":1301,"data":1303},"Step-by-step guide to enforcing AI governance without blocking everything",[1302],{"type":899},{},{"nodeType":860,"data":1305,"content":1306},{},[1307],{"nodeType":864,"value":1308,"marks":1309,"data":1310},"The barricade approach favored by existing solutions like network proxies gives you two options: Allow or block. Enforcing AI policy effectively requires a third approach with a bit more nuance: Guide the user to do the right thing. ",[],{},{"nodeType":1312,"data":1313,"content":1314},"heading-2",{},[1315],{"nodeType":864,"value":1316,"marks":1317,"data":1318},"Building the \"paved path\" with Push",[],{},{"nodeType":860,"data":1320,"content":1321},{},[1322],{"nodeType":864,"value":1323,"marks":1324,"data":1325},"Push provides all three options as configurable enforcement modes for a variety of readymade controls. Progressing between them is how organizations can move from \"we don't know what people are doing with AI\" to evidence-based governance.",[],{},{"nodeType":860,"data":1327,"content":1328},{},[1329,1333,1338],{"nodeType":864,"value":1330,"marks":1331,"data":1332},"Push can be deployed silently and begin observing AI usage with no employee-facing intervention. This is effectively Push in ",[],{},{"nodeType":864,"value":1334,"marks":1335,"data":1337},"Monitor",[1336],{"type":899},{},{"nodeType":864,"value":1339,"marks":1340,"data":1341}," mode.",[],{},{"nodeType":860,"data":1343,"content":1344},{},[1345],{"nodeType":864,"value":1346,"marks":1347,"data":1348},"The platform records which tools are in use, how employees authenticated, and what usage patterns are emerging. Most organizations should start here to generate a baseline. Telemetry can be streamed to your SIEM or other downstream system to get alerted to newly adopted apps and extensions, and to surface security risks like insecure accounts.",[],{},{"nodeType":860,"data":1350,"content":1351},{},[1352,1356,1361,1365,1370],{"nodeType":864,"value":1353,"marks":1354,"data":1355},"Next, most organizations will transition to ",[],{},{"nodeType":864,"value":1357,"marks":1358,"data":1360},"Acknowledge",[1359],{"type":899},{},{"nodeType":864,"value":1362,"marks":1363,"data":1364}," mode for controls like in-browser ",[],{},{"nodeType":864,"value":1366,"marks":1367,"data":1369},"App banners",[1368],{"type":899},{},{"nodeType":864,"value":1371,"marks":1372,"data":1373},". With this control, you can warn employees when they attempt to use an unapproved AI tool and point them to approved alternatives.",[],{},{"nodeType":996,"data":1375,"content":1379},{"target":1376},{"sys":1377},{"id":1378,"type":1001,"linkType":1002},"17nT8JDTyHLExwhb2upb6T",[],{"nodeType":860,"data":1381,"content":1382},{},[1383],{"nodeType":864,"value":1384,"marks":1385,"data":1386},"The employee isn't blocked — they're guided toward the governed path at the moment they're about to step off it. This is more effective than a policy document because it arrives right when they need the reminder. ",[],{},{"nodeType":996,"data":1388,"content":1392},{"target":1389},{"sys":1390},{"id":1391,"type":1001,"linkType":1002},"2lDFCuc48jcGODcwD6nYhK",[],{"nodeType":860,"data":1394,"content":1395},{},[1396,1401],{"nodeType":864,"value":1397,"marks":1398,"data":1400},"Block",[1399],{"type":899},{},{"nodeType":864,"value":1402,"marks":1403,"data":1404}," mode prevents access entirely — Push presents a blocking banner to users who attempt to log in to unapproved apps. ",[],{},{"nodeType":860,"data":1406,"content":1407},{},[1408],{"nodeType":864,"value":1409,"marks":1410,"data":1411},"Push makes the Monitor → Acknowledge → Block progression practical through automatic app categorization. This means that new AI tools inherit whatever governance mode the team has set for that category, without manual blocklist updates. All controls are configurable per user group — the data science team can use AI coding assistants while uploads from finance are restricted — because different teams have different risk profiles.",[],{},{"nodeType":996,"data":1413,"content":1417},{"target":1414},{"sys":1415},{"id":1416,"type":1001,"linkType":1002},"5EBOHy6X6iJfmzJ65txGOv",[],{"nodeType":996,"data":1419,"content":1423},{"target":1420},{"sys":1421},{"id":1422,"type":1001,"linkType":1002},"31JnX2KNCAnlaVS9Qqqh8W",[],{"nodeType":1005,"data":1425,"content":1426},{},[],{"nodeType":1009,"data":1428,"content":1429},{},[1430],{"nodeType":864,"value":1431,"marks":1432,"data":1434},"Guardrails: how to prevent data loss to AI tools",[1433],{"type":899},{},{"nodeType":860,"data":1436,"content":1437},{},[1438],{"nodeType":864,"value":1439,"marks":1440,"data":1441},"Even on the paved path, you need guardrails because preventing data loss to AI tools is a separate problem from controlling which tools employees use. An employee on an approved AI tool can still paste an AWS access key into a prompt, upload a customer spreadsheet, or share confidential documents in a conversation.",[],{},{"nodeType":860,"data":1443,"content":1444},{},[1445,1448,1457],{"nodeType":864,"value":21,"marks":1446,"data":1447},[],{},{"nodeType":883,"data":1449,"content":1450},{"uri":916},[1451],{"nodeType":864,"value":1452,"marks":1453,"data":1456},"Okta's data",[1454],{"type":1455},"underline",{},{"nodeType":864,"value":1458,"marks":1459,"data":1460}," on what employees actually share shows what’s at stake: 54% share internal messages and emails with AI tools, 39% share confidential company documents, and 28% share banking and payment information.",[],{},{"nodeType":860,"data":1462,"content":1463},{},[1464],{"nodeType":864,"value":1465,"marks":1466,"data":1467},"Blocking is too much of a blunt instrument here, as obviously, you want employees to be able to use approved tools. The answer is controlling what data enters them.",[],{},{"nodeType":1312,"data":1469,"content":1470},{},[1471],{"nodeType":864,"value":1472,"marks":1473,"data":1475},"Browser-layer controls for AI data leakage",[1474],{"type":899},{},{"nodeType":860,"data":1477,"content":1478},{},[1479],{"nodeType":864,"value":1480,"marks":1481,"data":1482},"Push addresses this problem with four browser-layer data controls, each targeting a distinct exfiltration path and supporting the same Monitor → Warn → Block enforcement modes:",[],{},{"nodeType":860,"data":1484,"content":1485},{},[1486,1491],{"nodeType":864,"value":1487,"marks":1488,"data":1490},"Clipboard blocking",[1489],{"type":899},{},{"nodeType":864,"value":1492,"marks":1493,"data":1494}," addresses the most common path for sensitive data into AI tools: copy-paste. Push matches clipboard content against preconfigured patterns for AWS access keys, GitHub tokens, API keys, credit card numbers, and personal identifiers, plus custom content rules for organization-specific data like internal project codes. ",[],{},{"nodeType":860,"data":1496,"content":1497},{},[1498,1502,1507],{"nodeType":864,"value":1499,"marks":1500,"data":1501},"In ",[],{},{"nodeType":864,"value":1503,"marks":1504,"data":1506},"Warn",[1505],{"type":899},{},{"nodeType":864,"value":1508,"marks":1509,"data":1510}," mode, Push offers a redacted version of the sensitive data so the employee can continue their work — getting help with their code, for instance — without exposing the actual credential.",[],{},{"nodeType":996,"data":1512,"content":1516},{"target":1513},{"sys":1514},{"id":1515,"type":1001,"linkType":1002},"1JarUdbe8AkJlgB0LjchNR",[],{"nodeType":860,"data":1518,"content":1519},{},[1520,1525],{"nodeType":864,"value":1521,"marks":1522,"data":1524},"File upload blocking",[1523],{"type":899},{},{"nodeType":864,"value":1526,"marks":1527,"data":1528}," prevents files from being uploaded to specific AI apps, configurable by app, user group, and file type (Push provides a list for fast configuration).",[],{},{"nodeType":860,"data":1530,"content":1531},{},[1532,1537,1541,1550,1554,1559],{"nodeType":864,"value":1533,"marks":1534,"data":1536},"File download blocking",[1535],{"type":899},{},{"nodeType":864,"value":1538,"marks":1539,"data":1540}," addresses a different common risk: Employees downloading desktop versions of AI tools, which moves usage outside the browser where Push has visibility. Download blocking also covers files generated inside web applications, such as an AI tool that produces a downloadable asset. (Push’s detection and response capabilities also protect against scenarios in which attackers present users with ",[],{},{"nodeType":883,"data":1542,"content":1544},{"uri":1543},"https://pushsecurity.com/blog/llmshare-malvertising-campaign",[1545],{"nodeType":864,"value":1546,"marks":1547,"data":1549},"faked AI tool download pages",[1548],{"type":1455},{},{"nodeType":864,"value":1551,"marks":1552,"data":1553}," as part of phishing campaigns, a technique we dubbed ",[],{},{"nodeType":864,"value":1555,"marks":1556,"data":1558},"LLMShare",[1557],{"type":899},{},{"nodeType":864,"value":1560,"marks":1561,"data":1562},".)",[],{},{"nodeType":860,"data":1564,"content":1565},{},[1566],{"nodeType":864,"value":1567,"marks":1568,"data":1569},"Push also provides telemetry streams on all file upload and download events in your environment, so you can get a baseline pattern of life and identify anomalies that could indicate insider risk. ",[],{},{"nodeType":860,"data":1571,"content":1572},{},[1573,1577,1582],{"nodeType":864,"value":1574,"marks":1575,"data":1576},"The Push platform also provides the capability to write your own ",[],{},{"nodeType":864,"value":1578,"marks":1579,"data":1581},"custom detections",[1580],{"type":899},{},{"nodeType":864,"value":1583,"marks":1584,"data":1585},", which you can use for other organization-specific use cases, or even to extend your control over GenAI tool usage, such as by blocking unapproved MCP server connections.",[],{},{"nodeType":996,"data":1587,"content":1591},{"target":1588},{"sys":1589},{"id":1590,"type":1001,"linkType":1002},"5XYVgJjgUPUfY1W1Zcgrvm",[],{"nodeType":860,"data":1593,"content":1594},{},[1595,1599,1604],{"nodeType":864,"value":1596,"marks":1597,"data":1598},"Finally, ",[],{},{"nodeType":864,"value":1600,"marks":1601,"data":1603},"AI conversation visibility",[1602],{"type":899},{},{"nodeType":864,"value":1605,"marks":1606,"data":1607}," gives you a window into what is being shared in AI chats, consumable as a stream of events to your SIEM or SOAR. Over time, you can build up a picture of what’s normal or what violates company policy, and create a queryable history to identify potential data loss during an incident response process.",[],{},{"nodeType":860,"data":1609,"content":1610},{},[1611],{"nodeType":864,"value":1612,"marks":1613,"data":1614},"Traditional DLP at the endpoint or network layer misses these paths. Network DLP and SWGs can't inspect clipboard pastes into AI prompts — there's no network event to intercept. Endpoint DLP sees file-system operations but not in-browser activity. ",[],{},{"nodeType":860,"data":1616,"content":1617},{},[1618],{"nodeType":864,"value":1619,"marks":1620,"data":1621},"Push's controls operate where the data is flowing — inside the browser session.",[],{},{"nodeType":1005,"data":1623,"content":1624},{},[],{"nodeType":1312,"data":1626,"content":1627},{},[1628],{"nodeType":864,"value":1629,"marks":1630,"data":1632},"How to keep up with AI tool sprawl",[1631],{"type":899},{},{"nodeType":860,"data":1634,"content":1635},{},[1636],{"nodeType":864,"value":1637,"marks":1638,"data":1639},"Pragmatically, the hardest part of generative AI security isn't the initial steps you take — it's keeping up with the sprawl. Point-in-time audits quickly become outdated when the landscape changes so quickly.",[],{},{"nodeType":860,"data":1641,"content":1642},{},[1643],{"nodeType":864,"value":1644,"marks":1645,"data":1646},"Push addresses this with continuous discovery, telemetry streams for the most important points of user interaction with AI apps, and controls that allow you to adapt quickly with simple configuration changes.",[],{},{"nodeType":860,"data":1648,"content":1649},{},[1650],{"nodeType":864,"value":1651,"marks":1652,"data":1653},"With automatic app categorization, if an employee starts using a new AI code assistant that didn't exist last quarter, Push discovers it, classifies it, and applies your governance rules — no manual intervention required.",[],{},{"nodeType":860,"data":1655,"content":1656},{},[1657],{"nodeType":864,"value":1658,"marks":1659,"data":1660},"All AI-related telemetry — app logins, file uploads and downloads, clipboard events, browser extensions, AI chat transcripts — can be sent as structured data to your SIEM.",[],{},{"nodeType":860,"data":1662,"content":1663},{},[1664],{"nodeType":864,"value":1665,"marks":1666,"data":1667},"This gives you all the information you need to track your progress, check your compliance status, and identify trends in AI usage and risk across your business as you make progress toward your goal, armed with the right data you didn't have before.",[],{},{"nodeType":860,"data":1669,"content":1670},{},[1671],{"nodeType":864,"value":1672,"marks":1673,"data":1674},"The goal isn't perfect control over every AI interaction. It's having enough visibility to make informed decisions and enough control to enforce them, without intensifying the shadow AI usage problem you set out to solve. Push can help you get there.",[],{},{"nodeType":1005,"data":1676,"content":1677},{},[],{"nodeType":860,"data":1679,"content":1680},{},[1681],{"nodeType":864,"value":1682,"marks":1683,"data":1684},"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",[],{},{"nodeType":860,"data":1686,"content":1687},{},[1688],{"nodeType":864,"value":1689,"marks":1690,"data":1691},"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",[],{},{"nodeType":860,"data":1693,"content":1694},{},[1695,1698,1707],{"nodeType":864,"value":21,"marks":1696,"data":1697},[],{},{"nodeType":883,"data":1699,"content":1701},{"uri":1700},"https://pushsecurity.com/demo",[1702],{"nodeType":864,"value":1703,"marks":1704,"data":1706},"Book a live demo to learn more.",[1705],{"type":1455},{},{"nodeType":864,"value":21,"marks":1708,"data":1709},[],{},{"entries":1711},{"hyperlink":1712,"inline":1713,"block":1714},[],[],[1715,1722,1731,1738,1776,1783,1790,1796,1803,1830,1838,1852,1858],{"sys":1716,"__typename":1717,"type":1718,"ctaText":1719,"buttonLabel":1720,"buttonColour":1721,"buttonUrl":58},{"id":1000},"CtaWidget","Custom","Don't miss our upcoming webinar on Shadow AI and how to manage it in your organization.","Register Now","sunny orange",{"sys":1723,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":1727},{"id":1040},"Image","ai-sprawl-infographic","AI sprawl is worse than most organizations realize. ",{"url":1728,"width":1729,"height":1730},"https://images.ctfassets.net/y1cdw1ablpvd/7vCbQdyRkjLs5EmsjBBAQp/3bfb13e7ec19be76325cdc69297c48c3/ai-sprawl-infographic_2x__3_.png",1800,1192,{"sys":1732,"__typename":1724,"title":1733,"caption":1733,"layoutMode":59,"file":1734},{"id":1058},"Shadow AI visibility gaps using traditional tools",{"url":1735,"width":1736,"height":1737},"https://images.ctfassets.net/y1cdw1ablpvd/7HQl2qfsTiCwa2pRzCVqDE/d87180dd96358326097565d8a60e8591/image9.png",1999,1125,{"sys":1739,"__typename":1740,"content":1741,"name":1775,"title":59},{"id":1076},"InsightTextBlockComponent",{"json":1742},{"data":1743,"content":1744,"nodeType":856},{},[1745],{"data":1746,"content":1747,"nodeType":860},{},[1748,1752,1759,1763,1771],{"data":1749,"marks":1750,"value":1751,"nodeType":864},{},[],"Attackers are already exploiting this interconnectivity — from ",{"data":1753,"content":1754,"nodeType":883},{"uri":1543},[1755],{"data":1756,"marks":1757,"value":1758,"nodeType":864},{},[],"malvertising campaigns that impersonate AI tools",{"data":1760,"marks":1761,"value":1762,"nodeType":864},{},[]," to steal credentials, to ",{"data":1764,"content":1766,"nodeType":883},{"uri":1765},"https://pushsecurity.com/blog/analyzing-the-instructure-breach",[1767],{"data":1768,"marks":1769,"value":1770,"nodeType":864},{},[],"leveraging OAuth consent grants in supply chain attacks",{"data":1772,"marks":1773,"value":1774,"nodeType":864},{},[],". ","Shadow AI guide IB3",{"sys":1777,"__typename":1724,"title":1778,"caption":1778,"layoutMode":59,"file":1779},{"id":1187},"Push automatically discovers and inventories AI apps from browser login events.",{"url":1780,"width":1781,"height":1782},"https://images.ctfassets.net/y1cdw1ablpvd/5krEecjMxIJgVCa74A79xa/3bb94ca3b496e9486f94526d708e34d5/image8.png",1469,850,{"sys":1784,"__typename":1724,"title":1785,"caption":1785,"layoutMode":59,"file":1786},{"id":1232},"Push discovers AI browser extensions used by your users, across every browser.",{"url":1787,"width":1788,"height":1789},"https://images.ctfassets.net/y1cdw1ablpvd/14lMFifCBB9RwQpt101tNd/dabe2713e58e787175701ec0d35076ca/image2.png",1470,851,{"sys":1791,"__typename":1724,"title":1792,"caption":1792,"layoutMode":59,"file":1793},{"id":1291},"Push's four-step path to secure AI adoption",{"url":1794,"width":1736,"height":1795},"https://images.ctfassets.net/y1cdw1ablpvd/E1wuJW4EzmjeLTpnHHM9f/895569f4b215b1b7b82e697c40462cbc/image3.png",1013,{"sys":1797,"__typename":1724,"title":1798,"caption":1798,"layoutMode":59,"file":1799},{"id":1378},"Push in-browser warning screen guiding the user toward the preferred AI app",{"url":1800,"width":1801,"height":1802},"https://images.ctfassets.net/y1cdw1ablpvd/3ouLBkKhiEcBmY8V2XAaUz/71a3cb221adba7d2744ff8b02bab3891/image4.png",1435,738,{"sys":1804,"__typename":1740,"content":1805,"name":1829,"title":59},{"id":1391},{"json":1806},{"data":1807,"content":1808,"nodeType":856},{},[1809],{"data":1810,"content":1811,"nodeType":860},{},[1812,1816,1825],{"data":1813,"marks":1814,"value":1815,"nodeType":864},{},[],"“A published policy is not the same thing as people actually doing that,” explains Push customer Stephen Shkardoon, cybersecurity manager at Te Herenga Waka — Victoria University of Wellington in New Zealand, on one of the drivers for their ",{"data":1817,"content":1819,"nodeType":883},{"uri":1818},"https://pushsecurity.com/customer-stories/te-herenga-waka-victoria-university-of-wellington",[1820],{"data":1821,"marks":1822,"value":1824,"nodeType":864},{},[1823],{"type":1455},"selection of Push Security",{"data":1826,"marks":1827,"value":1828,"nodeType":864},{},[]," to get control of AI usage at their organization.","Shadow AI guide IB1",{"sys":1831,"__typename":1724,"title":1832,"caption":1833,"layoutMode":59,"file":1834},{"id":1416},"Rules for AI app controls can be configured on a variety of conditions, including user groups, app attributes, and what mode of enforcement you wish to use.","Rules for AI app controls can be configured on a variety of conditions, including user groups, app attributes, and the mode of enforcement.",{"url":1835,"width":1836,"height":1837},"https://images.ctfassets.net/y1cdw1ablpvd/7czh28QGwm0ZStUmeWXBaq/667ee2441911fa4006a2ec75ebf727ea/image6.png",692,830,{"sys":1839,"__typename":1740,"content":1840,"name":1851,"title":59},{"id":1422},{"json":1841},{"data":1842,"content":1843,"nodeType":856},{},[1844],{"data":1845,"content":1846,"nodeType":860},{},[1847],{"data":1848,"marks":1849,"value":1850,"nodeType":864},{},[],"Push customers love the flexibility of this control compared to an SWG or CASB, which often rely on binary enforcement at the domain level only. ","Shadow AI guide IB2",{"sys":1853,"__typename":1724,"title":1854,"caption":1854,"layoutMode":59,"file":1855},{"id":1515},"Push blocks clipboard copy events that violate your policy.",{"url":1856,"width":1736,"height":1857},"https://images.ctfassets.net/y1cdw1ablpvd/jjUt4bChHcCWQJXqNzyQ8/c16974d72ef2bbc65689bf46bcb59e6f/image5.png",1295,{"sys":1859,"__typename":1724,"title":1860,"caption":1860,"layoutMode":59,"file":1861},{"id":1590},"Push can block unapproved MCP connection requests in real time.",{"url":1862,"width":1736,"height":1863},"https://images.ctfassets.net/y1cdw1ablpvd/wTAwk90bIA1B3XSkRf4M4/e4d3630af83501e6b4b05217fdf2e600/image1.png",1203,{"items":1865},[1866,1879,1892,1912,1932,1952,1972,1992,2012,2032],{"answer":1867,"question":1878},{"json":1868},{"nodeType":856,"data":1869,"content":1870},{},[1871],{"nodeType":860,"data":1872,"content":1873},{},[1874],{"nodeType":864,"value":1875,"marks":1876,"data":1877},"Network monitoring tools see domain-level traffic but can't tell you what's actually happening inside an AI session — whether an employee is browsing a tool's marketing page or pasting source code into a prompt. IdP logs capture OAuth grants routed through the identity provider but miss AI tools accessed via direct signup or personal accounts. Browser-based security tools like Push Security monitor AI activity where it actually happens: inside the browser session. Push captures login events, clipboard pastes, file uploads, extension installations, and OAuth grants, providing structured telemetry on what data is moving into which AI tools, through which accounts, and whether those accounts are corporate or personal.",[],{},"How do you monitor what employees are doing with AI tools?",{"answer":1880,"question":1891},{"json":1881},{"nodeType":856,"data":1882,"content":1883},{},[1884],{"nodeType":860,"data":1885,"content":1886},{},[1887],{"nodeType":864,"value":1888,"marks":1889,"data":1890},"Binary allow/block decisions — whether enforced through a SWG, CASB, or enterprise browser — treat every AI interaction as equivalent, which pushes employees toward tools you can't see at all. Graduated enforcement offers a middle path. Push Security lets teams start with monitoring to build an accurate picture of AI usage, then introduce in-browser prompts that explain why a tool hasn't been approved and direct employees toward sanctioned alternatives, before applying hard blocks only where the data sensitivity or tool risk justifies it. Controls are configurable per user group, and new AI tools automatically inherit governance rules through automatic categorization — so enforcement keeps pace with the landscape without manual blocklist updates.",[],{},"How do you restrict AI usage without blocking everything?",{"answer":1893,"question":1911},{"json":1894},{"nodeType":856,"data":1895,"content":1896},{},[1897,1904],{"nodeType":860,"data":1898,"content":1899},{},[1900],{"nodeType":864,"value":1901,"marks":1902,"data":1903},"Network monitoring tools, IdP logs, and endpoint agents each catch a slice of shadow AI but miss entire categories. SWGs see domain traffic but can't confirm whether someone authenticated or what they did after login. IdPs capture OAuth grants routed through the identity provider but miss AI tools accessed via direct signup or personal accounts. EDR is blind to browser-layer activity entirely. ",[],{},{"nodeType":860,"data":1905,"content":1906},{},[1907],{"nodeType":864,"value":1908,"marks":1909,"data":1910},"Browser-based security tools like Push Security identify AI tools from actual login events, catching the four categories other tools miss: unapproved AI apps, personal accounts on approved tools, AI browser extensions with broad permissions, and OAuth integrations granting persistent API access to corporate systems. Each discovered app is automatically categorized and enriched with authentication context — SSO vs. password, MFA status, corporate vs. personal account — so security teams can assess actual risk rather than treating every AI tool as equivalent.",[],{},"How do you discover what AI tools employees are using?",{"answer":1913,"question":1931},{"json":1914},{"nodeType":856,"data":1915,"content":1916},{},[1917,1924],{"nodeType":860,"data":1918,"content":1919},{},[1920],{"nodeType":864,"value":1921,"marks":1922,"data":1923},"This is a gap that traditional DLP architectures weren't designed for. Network DLP and SWGs can't intercept clipboard pastes into AI prompts because there's no network event to inspect — the data moves from the clipboard to the browser DOM without crossing the wire. Endpoint DLP sees file-system operations but not in-browser activity. Browser-based controls operate where the paste actually happens. ",[],{},{"nodeType":860,"data":1925,"content":1926},{},[1927],{"nodeType":864,"value":1928,"marks":1929,"data":1930},"Push Security matches clipboard content against patterns for credentials, API keys, credit card numbers, and custom content rules, then offers the employee a redacted version so they can continue working without exposing the actual sensitive data. The same approach extends to file uploads and downloads, covering the exfiltration paths that network and endpoint DLP leave open.",[],{},"How do you prevent sensitive data from being pasted into AI tools?",{"answer":1933,"question":1951},{"json":1934},{"nodeType":856,"data":1935,"content":1936},{},[1937,1944],{"nodeType":860,"data":1938,"content":1939},{},[1940],{"nodeType":864,"value":1941,"marks":1942,"data":1943},"Policy documents distributed during onboarding don't change behavior at the moment someone reaches for an unapproved AI tool. SWGs can block a domain, but they can't explain why or point to an approved alternative — the employee sees an error page. ",[],{},{"nodeType":860,"data":1945,"content":1946},{},[1947],{"nodeType":864,"value":1948,"marks":1949,"data":1950},"Enterprise browsers like Push Security can deliver policy enforcement at the point of decision: when an employee navigates to an unsanctioned AI tool, an in-browser message explains why the tool hasn't been approved and directs them to approved alternatives. Controls are configurable per user group — and new AI tools automatically inherit governance rules through automatic categorization, without manual blocklist updates.",[],{},"How do you enforce an AI acceptable use policy in real time?",{"answer":1953,"question":1971},{"json":1954},{"nodeType":856,"data":1955,"content":1956},{},[1957,1964],{"nodeType":860,"data":1958,"content":1959},{},[1960],{"nodeType":864,"value":1961,"marks":1962,"data":1963},"No single traditional tool covers all aspects of shadow AI (apps, tenants, integrations, extensions) and the user interaction with those categories of tool. SWGs and CASBs see domain-level traffic but can't identify personal account usage, extension activity, or clipboard pastes into AI prompts. IdPs capture federated logins but miss direct signups and personal accounts entirely. EDR doesn't see browser-layer activity. DSPM monitors data at rest in cloud storage but not data in motion through browser sessions. ",[],{},{"nodeType":860,"data":1965,"content":1966},{},[1967],{"nodeType":864,"value":1968,"marks":1969,"data":1970},"Most organizations will need browser-layer visibility alongside their existing stack — not as a replacement, but to close the gaps those tools weren't designed to address. Tools like Push Security operate at the layer where AI activity actually happens, covering all shadow AI categories with graduated enforcement (monitor, warn, block), per-user-group policies, and telemetry on authentication methods, clipboard events, file uploads, and OAuth grants. ",[],{},"What tools do you need to manage shadow AI?",{"answer":1973,"question":1991},{"json":1974},{"nodeType":856,"data":1975,"content":1976},{},[1977,1984],{"nodeType":860,"data":1978,"content":1979},{},[1980],{"nodeType":864,"value":1981,"marks":1982,"data":1983},"AI browser extensions are a blind spot for most security stacks. Endpoint management tools may detect that an extension is installed but typically can't evaluate what permissions it has requested or whether those permissions create data exfiltration risk. SWGs and CASBs don't see extension activity at all — extensions operate within the browser, not over the network. ",[],{},{"nodeType":860,"data":1985,"content":1986},{},[1987],{"nodeType":864,"value":1988,"marks":1989,"data":1990},"Push Security inventories every AI-related extension installed across the workforce, surfaces the specific permissions each extension has requested (access to page content, browsing history, clipboard data), and identifies permission combinations that could enable account takeover or data exfiltration. Security teams can then apply monitor, warn, or block enforcement to extension categories — and new extensions automatically inherit governance rules without maintaining manual allowlists that go stale as new AI extensions appear daily.",[],{},"How do I stop employees installing AI browser extensions?",{"answer":1993,"question":2011},{"json":1994},{"nodeType":856,"data":1995,"content":1996},{},[1997,2004],{"nodeType":860,"data":1998,"content":1999},{},[2000],{"nodeType":864,"value":2001,"marks":2002,"data":2003},"Point-in-time audits — whether run through an IdP, a CASB, or manual surveys — tell you what was true when you ran them. AI tool adoption changes weekly; Gartner projects 150,000 AI agents per Fortune 500 enterprise by 2028. SWGs can log new domains but can't classify them or apply governance rules automatically. ",[],{},{"nodeType":860,"data":2005,"content":2006},{},[2007],{"nodeType":864,"value":2008,"marks":2009,"data":2010},"Push Security discovers new AI tools as employees start using them: when someone logs in to a new AI app, Push identifies it from the login event, automatically categorizes it, and applies the organization's existing governance rules without manual intervention. All AI-related telemetry — app access, file uploads, clipboard events, extension activity — streams as structured data to the customer's SIEM, providing the material for governance dashboards and compliance reporting that stays current as the landscape shifts.",[],{},"How do you get visibility into AI tool sprawl?",{"answer":2013,"question":2031},{"json":2014},{"nodeType":856,"data":2015,"content":2016},{},[2017,2024],{"nodeType":860,"data":2018,"content":2019},{},[2020],{"nodeType":864,"value":2021,"marks":2022,"data":2023},"AI visibility means knowing which AI tools employees are using, how they're accessing them, and what data flows into those tools. AI control is the ability to enforce rules on that usage — blocking unapproved tools, restricting data flows, requiring approved accounts. AI governance is the broader program that encompasses both: defining acceptable use policies, establishing risk frameworks for evaluating new tools, and building the organizational processes that turn visibility and control into sustained security outcomes. ",[],{},{"nodeType":860,"data":2025,"content":2026},{},[2027],{"nodeType":864,"value":2028,"marks":2029,"data":2030},"Most organizations that struggle with AI governance have a visibility problem first — they're trying to write policies for tools they don't know their employees are using. But visibility without control is just watching the problem happen. Push Security provides both: discovery and monitoring across all four categories of shadow AI, plus graduated enforcement controls that let you apply different responses based on the risk profile of each tool, account, and data flow, at the point of interaction in the browser for real-time enforcement.",[],{},"What is the difference between AI governance, AI visibility, and AI control?",{"answer":2033,"question":2051},{"json":2034},{"nodeType":856,"data":2035,"content":2036},{},[2037,2044],{"nodeType":860,"data":2038,"content":2039},{},[2040],{"nodeType":864,"value":2041,"marks":2042,"data":2043},"Data Security Posture Management (DSPM) tools monitor data at rest in cloud storage and SaaS applications, identifying misconfigurations, overly permissive access, and sensitive data exposure. They don't monitor data in motion through browser sessions — which is the primary path for shadow AI risk. ",[],{},{"nodeType":860,"data":2045,"content":2046},{},[2047],{"nodeType":864,"value":2048,"marks":2049,"data":2050},"When an employee pastes source code into an AI prompt or uploads a customer spreadsheet to an unapproved AI tool, that data movement happens entirely inside the browser and never touches the cloud storage layer that DSPM tools monitor. DSPM and browser security are complementary: DSPM secures data where it is stored, while browser-layer tools like Push Security secure data where it moves.",[],{},"Does Data Security Posture Management (DSPM) prevent shadow AI?","Shadow AI discovery and governance: Frequently asked questions",{},"How to discover AI, enforce policies, and prevent data loss","2026-08-13T00:00:00.000Z",{"items":2057},[2058,2741,3626],{"__typename":2059,"sys":2060,"content":2062,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":2724,"authorsCollection":2733},"BlogPosts",{"id":2061},"4NY2NbkAPucFOJY45yrrrE",{"json":2063},{"data":2064,"content":2065,"nodeType":856},{},[2066,2073,2080,2087,2093,2096,2104,2111,2144,2151,2176,2182,2185,2193,2200,2208,2252,2258,2265,2270,2273,2281,2288,2296,2303,2310,2326,2334,2359,2366,2372,2379,2387,2402,2430,2436,2454,2460,2468,2475,2500,2507,2514,2521,2527,2530,2538,2545,2552,2571,2579,2586,2594,2617,2629,2635,2638,2646,2653,2660,2667,2686,2689,2695,2701],{"data":2067,"content":2068,"nodeType":860},{},[2069],{"data":2070,"marks":2071,"value":2072,"nodeType":864},{},[],"Employees have been self-adopting apps, creating unmanaged accounts, and introducing third-party software dependencies into their organizations for years, and the core problem hasn't changed: unmanaged software expanding your attack surface without your knowledge.",{"data":2074,"content":2075,"nodeType":860},{},[2076],{"data":2077,"marks":2078,"value":2079,"nodeType":864},{},[],"But the rate at which employees are signing up for AI tools is unprecedented, and the depth of interconnectivity those tools demand is fundamentally different from traditional shadow SaaS. ",{"data":2081,"content":2082,"nodeType":860},{},[2083],{"data":2084,"marks":2085,"value":2086,"nodeType":864},{},[],"AI tools aren't just standalone apps that employees sign into — they're increasingly used as agents that drive other applications, pulling data from one platform, acting on another — they are becoming a core that other apps are integrating to, and that users are integrating with their wider SaaS stack. It’s becoming a focal integration point for app access and functionality in a way that's more comparable to an enterprise cloud platform than a typical SaaS tool. ",{"data":2088,"content":2092,"nodeType":996},{"target":2089},{"sys":2090},{"id":2091,"type":1001,"linkType":1002},"2Vxb48M5JN9Jdy8BG6nbUJ",[],{"data":2094,"content":2095,"nodeType":1005},{},[],{"data":2097,"content":2098,"nodeType":1009},{},[2099],{"data":2100,"marks":2101,"value":2103,"nodeType":864},{},[2102],{"type":899},"What is shadow AI? A quick 101",{"data":2105,"content":2106,"nodeType":860},{},[2107],{"data":2108,"marks":2109,"value":2110,"nodeType":864},{},[],"Shadow AI is any use of AI tools, services, or integrations that happens outside an organization's security governance and visibility. Shadow AI risks cut in two directions:",{"data":2112,"content":2113,"nodeType":941},{},[2114,2129],{"data":2115,"content":2116,"nodeType":945},{},[2117],{"data":2118,"content":2119,"nodeType":860},{},[2120,2125],{"data":2121,"marks":2122,"value":2124,"nodeType":864},{},[2123],{"type":899},"Data exposure:",{"data":2126,"marks":2127,"value":2128,"nodeType":864},{},[]," source code, credentials, internal documents, and customer data routinely get pasted into AI prompts or uploaded as context, and once shared, that data is outside the organization's control. ",{"data":2130,"content":2131,"nodeType":945},{},[2132],{"data":2133,"content":2134,"nodeType":860},{},[2135,2140],{"data":2136,"marks":2137,"value":2139,"nodeType":864},{},[2138],{"type":899},"Attack surface:",{"data":2141,"marks":2142,"value":2143,"nodeType":864},{},[]," Every shadow AI app is an unmanaged identity with credentials that can be phished or stuffed, OAuth grants that give persistent API access to corporate systems, and browser extensions that can be compromised in supply chain attacks. ",{"data":2145,"content":2146,"nodeType":860},{},[2147],{"data":2148,"marks":2149,"value":2150,"nodeType":864},{},[],"AI tools increasingly function as hubs, connected via OAuth and MCP to email, cloud storage, code repositories, and other high-value systems. Every app connection an employee grants turns that AI tool into a node in a web of interconnected services, which means the more you hook in, the larger the attack surface across all the connected apps — and the greater the blast radius if the account used to access the AI tool is compromised.",{"data":2152,"content":2153,"nodeType":860},{},[2154,2158,2164,2167,2173],{"data":2155,"marks":2156,"value":2157,"nodeType":864},{},[],"Each integration creates a persistent trust relationship that survives password resets and MFA changes. Compromise a single AI app and an attacker inherits whatever access the employee granted it, turning one ungoverned tool into a pivot point across the SaaS estate. Attackers are already exploiting this interconnectivity — from ",{"data":2159,"content":2160,"nodeType":883},{"uri":1543},[2161],{"data":2162,"marks":2163,"value":1758,"nodeType":864},{},[],{"data":2165,"marks":2166,"value":1762,"nodeType":864},{},[],{"data":2168,"content":2169,"nodeType":883},{"uri":1765},[2170],{"data":2171,"marks":2172,"value":1770,"nodeType":864},{},[],{"data":2174,"marks":2175,"value":1774,"nodeType":864},{},[],{"data":2177,"content":2181,"nodeType":996},{"target":2178},{"sys":2179},{"id":2180,"type":1001,"linkType":1002},"1BWCa7AHCMlYw7XgPLx3h7",[],{"data":2183,"content":2184,"nodeType":1005},{},[],{"data":2186,"content":2187,"nodeType":1009},{},[2188],{"data":2189,"marks":2190,"value":2192,"nodeType":864},{},[2191],{"type":899},"The state of shadow AI, using Push data",{"data":2194,"content":2195,"nodeType":860},{},[2196],{"data":2197,"marks":2198,"value":2199,"nodeType":864},{},[],"We analyzed a snapshot of AI activity across Push customers during an average week in April 2026. We wanted to make sure it captured actual activity, not just historical data on apps that were added once and no longer used.",{"data":2201,"content":2202,"nodeType":860},{},[2203],{"data":2204,"marks":2205,"value":2207,"nodeType":864},{},[2206],{"type":899},"The numbers paint a picture that most security teams will find uncomfortable.",{"data":2209,"content":2210,"nodeType":860},{},[2211,2215,2220,2224,2229,2233,2238,2242,2248],{"data":2212,"marks":2213,"value":2214,"nodeType":864},{},[],"The average organization has ",{"data":2216,"marks":2217,"value":2219,"nodeType":864},{},[2218],{"type":899},"16 unique AI apps",{"data":2221,"marks":2222,"value":2223,"nodeType":864},{},[]," in active use, ",{"data":2225,"marks":2226,"value":2228,"nodeType":864},{},[2227],{"type":899},"17 unique AI browser extensions",{"data":2230,"marks":2231,"value":2232,"nodeType":864},{},[],", and ",{"data":2234,"marks":2235,"value":2237,"nodeType":864},{},[2236],{"type":899},"17 unique AI OAuth integrations",{"data":2239,"marks":2240,"value":2241,"nodeType":864},{},[]," connected into just Google Workspace and Microsoft 365 — with some organizations reaching as high as 40 unique AI apps, 163 AI extensions, and 55 OAuth connections to AI apps respectively. At the other end, the smallest organization with the ",{"data":2243,"marks":2244,"value":2247,"nodeType":864},{},[2245],{"type":2246},"italic","lowest",{"data":2249,"marks":2250,"value":2251,"nodeType":864},{},[]," adoption level is actively using two. ",{"data":2253,"content":2257,"nodeType":996},{"target":2254},{"sys":2255},{"id":2256,"type":1001,"linkType":1002},"2AfeiHub5kyZN8wuf6CJch",[],{"data":2259,"content":2260,"nodeType":860},{},[2261],{"data":2262,"marks":2263,"value":2264,"nodeType":864},{},[],"If most organizations have sanctioned one or two core AI assistants/platforms for business use, the gap between what's approved and what's actually happening is significant.",{"data":2266,"content":2269,"nodeType":996},{"target":2267},{"sys":2268},{"id":1040,"type":1001,"linkType":1002},[],{"data":2271,"content":2272,"nodeType":1005},{},[],{"data":2274,"content":2275,"nodeType":1009},{},[2276],{"data":2277,"marks":2278,"value":2280,"nodeType":864},{},[2279],{"type":899},"Understanding the four categories of shadow AI",{"data":2282,"content":2283,"nodeType":860},{},[2284],{"data":2285,"marks":2286,"value":2287,"nodeType":864},{},[],"Shadow SaaS has always been a problem, but in the context of AI apps there are four categories of shadow IT that security teams need to understand, because each one introduces a different kind of risk and requires a different approach to tackling it.",{"data":2289,"content":2290,"nodeType":1312},{},[2291],{"data":2292,"marks":2293,"value":2295,"nodeType":864},{},[2294],{"type":899},"Shadow AI apps",{"data":2297,"content":2298,"nodeType":860},{},[2299],{"data":2300,"marks":2301,"value":2302,"nodeType":864},{},[],"Shadow apps are AI tools that employees have signed up to and are using for business purposes without approval. This is the most visible dimension of the problem, and the one most people think of when they hear \"shadow AI\" — an employee pastes sensitive internal documents into ChatGPT, uploads confidential files to an AI assistant, or uses an unapproved coding tool to generate production code.",{"data":2304,"content":2305,"nodeType":860},{},[2306],{"data":2307,"marks":2308,"value":2309,"nodeType":864},{},[],"All of that is sensitive data leaving the organization through channels the security team can't see - and often accessible using personal accounts that can be compromised on personal devices or workstations. ",{"data":2311,"content":2312,"nodeType":860},{},[2313,2317,2322],{"data":2314,"marks":2315,"value":2316,"nodeType":864},{},[],"The 2026 DBIR's data loss prevention analysis underscores the scale — shadow AI is now the ",{"data":2318,"marks":2319,"value":2321,"nodeType":864},{},[2320],{"type":899},"third most common non-malicious insider action",{"data":2323,"marks":2324,"value":2325,"nodeType":864},{},[]," in DLP data, a 4x increase year-over-year. Across 858,000+ DLP events targeting GenAI tools, the most common data types being submitted were source code (28%), images (16%), structured data (14%), documents (13%), and PDFs (10%). That's not employees asking ChatGPT to fix their grammar — it's core intellectual property, production code, and internal documentation flowing into platforms the security team has no visibility into. But shadow apps themselves are only the most obvious part of the problem.",{"data":2327,"content":2328,"nodeType":1312},{},[2329],{"data":2330,"marks":2331,"value":2333,"nodeType":864},{},[2332],{"type":899},"Shadow tenants",{"data":2335,"content":2336,"nodeType":860},{},[2337,2341,2346,2350,2355],{"data":2338,"marks":2339,"value":2340,"nodeType":864},{},[],"Even when an organization has approved an AI tool — say, an enterprise ChatGPT deployment — employees frequently access the same app with personal accounts, creating shadow tenants that sit entirely outside organizational control. The DBIR found that ",{"data":2342,"marks":2343,"value":2345,"nodeType":864},{},[2344],{"type":899},"67% of GenAI users on corporate devices are using non-corporate accounts",{"data":2347,"marks":2348,"value":2349,"nodeType":864},{},[],", and our own data shows that ",{"data":2351,"marks":2352,"value":2354,"nodeType":864},{},[2353],{"type":899},"38% of file uploads to AI tools are made from shadow accounts",{"data":2356,"marks":2357,"value":2358,"nodeType":864},{},[]," rather than approved organizational ones.",{"data":2360,"content":2361,"nodeType":860},{},[2362],{"data":2363,"marks":2364,"value":2365,"nodeType":864},{},[],"When an organization approves Claude, ChatGPT, or another core AI platform, you typically also approve the OAuth integration and browser extension for core apps (e.g. M365, Google Workspace, and so on). When that integration is approved, it is approved for all tenants — not just your corporate tenant. ",{"data":2367,"content":2371,"nodeType":996},{"target":2368},{"sys":2369},{"id":2370,"type":1001,"linkType":1002},"3Rvw0n28AYIM3FQXtHyafD",[],{"data":2373,"content":2374,"nodeType":860},{},[2375],{"data":2376,"marks":2377,"value":2378,"nodeType":864},{},[],"This means that even if you've deployed enterprise controls around your sanctioned AI tools — DLP policies, retention settings, admin oversight — more than a third of the file uploads hitting AI tools are bypassing those controls entirely because they're happening through personal accounts on corporate devices.",{"data":2380,"content":2381,"nodeType":1312},{},[2382],{"data":2383,"marks":2384,"value":2386,"nodeType":864},{},[2385],{"type":899},"Shadow extensions",{"data":2388,"content":2389,"nodeType":860},{},[2390,2394,2398],{"data":2391,"marks":2392,"value":2393,"nodeType":864},{},[],"Many AI tools come with a browser extension counterpart, and there's a large ecosystem of third-party AI extensions that offer everything from writing assistance to automated data extraction. The average organization in our dataset has ",{"data":2395,"marks":2396,"value":2228,"nodeType":864},{},[2397],{"type":899},{"data":2399,"marks":2400,"value":2401,"nodeType":864},{},[]," deployed across its workforce, with the highest we observed reaching 163 — and since each of those average 17 different extensions may be installed by multiple employees, the actual number of individual extension installs across the organization is much higher still.",{"data":2403,"content":2404,"nodeType":860},{},[2405,2409,2417,2421,2426],{"data":2406,"marks":2407,"value":2408,"nodeType":864},{},[],"The extension dimension is particularly concerning because most extensions operate with significant privilege inside the browser — they can read and modify page content, access cookies and session tokens, and interact with virtually every web application an employee uses. As we detailed in our recent analysis of ",{"data":2410,"content":2412,"nodeType":883},{"uri":2411},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[2413],{"data":2414,"marks":2415,"value":2416,"nodeType":864},{},[],"browser extension risk scoring",{"data":2418,"marks":2419,"value":2420,"nodeType":864},{},[],", at least ",{"data":2422,"marks":2423,"value":2425,"nodeType":864},{},[2424],{"type":899},"46.76% of all extensions across Push customers have the permission combinations needed to perform account takeover with no user interaction",{"data":2427,"marks":2428,"value":2429,"nodeType":864},{},[],", and the extensions involved in every major supply chain breach of the past 18 months scored as normal or low-risk beforehand.",{"data":2431,"content":2435,"nodeType":996},{"target":2432},{"sys":2433},{"id":2434,"type":1001,"linkType":1002},"3z4JOMALI52xoOXZkzPHLD",[],{"data":2437,"content":2438,"nodeType":860},{},[2439,2443,2450],{"data":2440,"marks":2441,"value":2442,"nodeType":864},{},[],"AI extensions add a specific wrinkle to this problem: many are branded to look like official companions to well-known AI tools but are actually third-party creations with no affiliation to the original vendor. They're not necessarily malicious at the point of installation, but they're exactly the kind of extension that's likely to be ",{"data":2444,"content":2445,"nodeType":883},{"uri":2411},[2446],{"data":2447,"marks":2448,"value":2449,"nodeType":864},{},[],"acquired and weaponized",{"data":2451,"marks":2452,"value":2453,"nodeType":864},{},[]," down the line — and in the meantime, they're collecting data that their permissions entitle them to (which, in most cases, means everything the user can see in their browser).",{"data":2455,"content":2459,"nodeType":996},{"target":2456},{"sys":2457},{"id":2458,"type":1001,"linkType":1002},"6K3z67rohss6H3lCsSn12B",[],{"data":2461,"content":2462,"nodeType":1312},{},[2463],{"data":2464,"marks":2465,"value":2467,"nodeType":864},{},[2466],{"type":899},"Shadow integrations",{"data":2469,"content":2470,"nodeType":860},{},[2471],{"data":2472,"marks":2473,"value":2474,"nodeType":864},{},[],"The fourth dimension — and arguably the most dangerous — is shadow integrations: OAuth connections between AI tools and core enterprise apps that aren't known or approved by the security team. Even if an organization has approved an AI tool for standalone use, plugging that tool directly into Google Workspace, Microsoft 365, Salesforce, or any other one of the dozen or so SaaS apps in a typical user’s work stack is a fundamentally different risk decision, because it creates a persistent, programmatic bridge between your environment and a third party.",{"data":2476,"content":2477,"nodeType":860},{},[2478,2482,2487,2491,2496],{"data":2479,"marks":2480,"value":2481,"nodeType":864},{},[],"On average, we see ",{"data":2483,"marks":2484,"value":2486,"nodeType":864},{},[2485],{"type":899},"17 unique AI app OAuth integrations per organization",{"data":2488,"marks":2489,"value":2490,"nodeType":864},{},[]," in ",{"data":2492,"marks":2493,"value":2495,"nodeType":864},{},[2494],{"type":2246},"just",{"data":2497,"marks":2498,"value":2499,"nodeType":864},{},[]," Google Workspace and Microsoft 365 (to be clear: this number excludes the dozens of downstream apps the AI assistants are integrated with as well), with the highest reaching 55. Each of those represents a unique AI product that has been granted OAuth access — the total number of individual consent grants across users is larger, because popular integrations get authorized by multiple employees independently.",{"data":2501,"content":2502,"nodeType":860},{},[2503],{"data":2504,"marks":2505,"value":2506,"nodeType":864},{},[],"The actual number of AI-related OAuth connections across the full SaaS estate is considerably higher again, because AI tools that automate workflows need to be connected to be useful — pulling data from one app, analyzing it in another, presenting results in a third.",{"data":2508,"content":2509,"nodeType":860},{},[2510],{"data":2511,"marks":2512,"value":2513,"nodeType":864},{},[],"MCP connections use OAuth to achieve this interconnectivity in the same way, and AI coding agents create a particularly concentrated version of the risk: a single agent configuration can hold OAuth tokens for Jira, Confluence, Salesforce, GitHub, and more, meaning that compromising one agent — whether through prompt injection, a malicious repository config, or a supply chain attack on an MCP server — yields persistent, broadly scoped tokens for every service it was connected to, tokens that survive session restarts and generate audit log entries indistinguishable from legitimate user activity.",{"data":2515,"content":2516,"nodeType":860},{},[2517],{"data":2518,"marks":2519,"value":2520,"nodeType":864},{},[],"It's also worth noting that OAuth blast radius is almost always larger than organizations expect. A single well-permissioned user can expose secrets, dashboards, and internal tooling without tenant-wide admin access. And every new AI tool an employee connects makes the web of abusable permissions a little wider.",{"data":2522,"content":2526,"nodeType":996},{"target":2523},{"sys":2524},{"id":2525,"type":1001,"linkType":1002},"4SnzJ9T93gHzFIUASx7Yb3",[],{"data":2528,"content":2529,"nodeType":1005},{},[],{"data":2531,"content":2532,"nodeType":1009},{},[2533],{"data":2534,"marks":2535,"value":2537,"nodeType":864},{},[2536],{"type":899},"Why shadow AI needs a different solution to shadow SaaS",{"data":2539,"content":2540,"nodeType":860},{},[2541],{"data":2542,"marks":2543,"value":2544,"nodeType":864},{},[],"The reason it's worth distinguishing between these four dimensions isn't academic. Each one requires a different control, and addressing one doesn't solve the others.",{"data":2546,"content":2547,"nodeType":860},{},[2548],{"data":2549,"marks":2550,"value":2551,"nodeType":864},{},[],"Blocking unsanctioned AI apps does nothing for the personal accounts accessing approved ones, and neither addresses the average 17 different AI extensions running with broad browser permissions, let alone the dozens of OAuth integrations that have already been granted persistent access to core enterprise apps — and even auditing OAuth in Google Workspace and Microsoft 365, where the controls are relatively mature, leaves the broader SaaS estate unaddressed, where admin tooling is inconsistent and visibility is limited.",{"data":2553,"content":2554,"nodeType":860},{},[2555,2559,2567],{"data":2556,"marks":2557,"value":2558,"nodeType":864},{},[],"The tooling gap compounds the policy gap. ",{"data":2560,"content":2562,"nodeType":883},{"uri":2561},"https://pushsecurity.com/blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market/",[2563],{"data":2564,"marks":2565,"value":2566,"nodeType":864},{},[],"Omdia found",{"data":2568,"marks":2569,"value":2570,"nodeType":864},{},[]," that 58% of organizations rely on secure web gateways to secure GenAI usage — but an SWG can tell you that a user visited ChatGPT, not whether they pasted your source code into the prompt. That link between knowing where data went and knowing what the user actually did is the fundamental visibility gap that makes GenAI policies unenforceable without browser-layer tooling.",{"data":2572,"content":2573,"nodeType":1312},{},[2574],{"data":2575,"marks":2576,"value":2578,"nodeType":864},{},[2577],{"type":899},"Advice for security teams",{"data":2580,"content":2581,"nodeType":860},{},[2582],{"data":2583,"marks":2584,"value":2585,"nodeType":864},{},[],"The principles behind managing shadow AI are the same ones that have governed shadow SaaS and software supply chain management for years: default-deny where feasible, comprehensive inventory where it isn't, and continuous monitoring for changes that signal increased risk. But it's vital that teams act fast to stop the snowball.",{"data":2587,"content":2588,"nodeType":860},{},[2589],{"data":2590,"marks":2591,"value":2593,"nodeType":864},{},[2592],{"type":899},"That starts with visibility into which AI tools employees are actually using and which accounts they're using to access them — without that baseline, every other control is built on assumptions.",{"data":2595,"content":2596,"nodeType":860},{},[2597,2602,2606,2613],{"data":2598,"marks":2599,"value":2601,"nodeType":864},{},[2600],{"type":899},"Extensions",{"data":2603,"marks":2604,"value":2605,"nodeType":864},{},[]," need the same ",{"data":2607,"content":2608,"nodeType":883},{"uri":2411},[2609],{"data":2610,"marks":2611,"value":2612,"nodeType":864},{},[],"default-deny allowlisting approach",{"data":2614,"marks":2615,"value":2616,"nodeType":864},{},[]," that has been best practice for software management elsewhere: build a complete inventory, allowlist what's vetted, block everything else, and monitor the approved set for changes that precede weaponization.",{"data":2618,"content":2619,"nodeType":860},{},[2620,2625],{"data":2621,"marks":2622,"value":2624,"nodeType":864},{},[2623],{"type":899},"OAuth",{"data":2626,"marks":2627,"value":2628,"nodeType":864},{},[]," demands the most urgency, because each unmanaged integration is a persistent trust relationship that survives password resets and MFA changes — adopt default-deny for consent grants in your primary enterprise apps, routinely audit what's already connected, and critically extend that visibility beyond Google and Microsoft to the broader SaaS estate where the controls are weaker and the sprawl is harder to track.",{"data":2630,"content":2634,"nodeType":996},{"target":2631},{"sys":2632},{"id":2633,"type":1001,"linkType":1002},"3RFLFtJtDXvhTz1mVztfV9",[],{"data":2636,"content":2637,"nodeType":1005},{},[],{"data":2639,"content":2640,"nodeType":1009},{},[2641],{"data":2642,"marks":2643,"value":2645,"nodeType":864},{},[2644],{"type":899},"Browser visibility and control is key to de-risking AI adoption",{"data":2647,"content":2648,"nodeType":860},{},[2649],{"data":2650,"marks":2651,"value":2652,"nodeType":864},{},[],"AI usage is fundamentally browser-based activity — every LLM interaction, every prompt containing sensitive data, every AI agent authorization, every OAuth consent grant happens inside a browser session — which makes the browser the natural control point for AI governance across the workforce. ",{"data":2654,"content":2655,"nodeType":860},{},[2656],{"data":2657,"marks":2658,"value":2659,"nodeType":864},{},[],"Push tracks AI app usage and login security across the workforce, inventories and controls AI browser extensions, monitors and blocks OAuth consent flows across any app (not just the primary enterprise platforms), and gives security teams a single view of the full shadow AI picture across all four dimensions.",{"data":2661,"content":2662,"nodeType":860},{},[2663],{"data":2664,"marks":2665,"value":2666,"nodeType":864},{},[],"Shadow AI isn't a problem that will age well if ignored. Every week that passes without visibility adds more apps, more extensions, more integrations, and more potential breach paths into the environment — and as the Vercel breach demonstrated, it only takes one forgotten OAuth grant to turn an employee's idle curiosity into an organization-wide incident.",{"data":2668,"content":2669,"nodeType":860},{},[2670,2674,2682],{"data":2671,"marks":2672,"value":2673,"nodeType":864},{},[],"Learn more about how you can tackle ",{"data":2675,"content":2677,"nodeType":883},{"uri":2676},"https://pushsecurity.com/uc/shadow-ai",[2678],{"data":2679,"marks":2680,"value":580,"nodeType":864},{},[2681],{"type":1455},{"data":2683,"marks":2684,"value":2685,"nodeType":864},{},[]," with Push. ",{"data":2687,"content":2688,"nodeType":1005},{},[],{"data":2690,"content":2691,"nodeType":860},{},[2692],{"data":2693,"marks":2694,"value":1682,"nodeType":864},{},[],{"data":2696,"content":2697,"nodeType":860},{},[2698],{"data":2699,"marks":2700,"value":1689,"nodeType":864},{},[],{"data":2702,"content":2703,"nodeType":860},{},[2704,2708,2716],{"data":2705,"marks":2706,"value":2707,"nodeType":864},{},[],"Book a ",{"data":2709,"content":2710,"nodeType":883},{"uri":1700},[2711],{"data":2712,"marks":2713,"value":2715,"nodeType":864},{},[2714],{"type":1455},"live demo",{"data":2717,"marks":2718,"value":2719,"nodeType":864},{},[]," to learn more.","Shadow AI: what Push data reveals about the scale of the problem","Push telemetry shows the average organization has 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in use. Here's what it means for security.","2026-05-28T00:00:00.000Z","what-push-data-reveals-about-the-state-of-shadow-ai",{"items":2725},[2726,2730],{"sys":2727,"name":2729},{"id":2728},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"sys":2731,"name":297},{"id":2732},"3pjES4THCIfSAwhGdNwBcy",{"items":2734},[2735],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":2739},"Dan Green","Dan","Threat Research",{"url":2740},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":2059,"sys":2742,"content":2744,"title":3608,"synopsis":3609,"hashTags":59,"publishedDate":3610,"slug":3611,"tagsCollection":3612,"authorsCollection":3618},{"id":2743},"6Xn377JQfbDz49Np74cbGl",{"json":2745},{"data":2746,"content":2747,"nodeType":856},{},[2748,2755,2786,2804,2809,2816,2832,2835,2843,2861,2925,2932,2938,2945,3028,3035,3042,3058,3061,3069,3076,3083,3091,3098,3110,3116,3123,3130,3137,3140,3148,3164,3180,3187,3194,3201,3222,3308,3315,3322,3325,3333,3349,3356,3363,3371,3374,3382,3400,3407,3414,3447,3454,3461,3464,3472,3479,3491,3497,3509,3521,3527,3539,3561,3568,3571,3579,3586,3592],{"data":2749,"content":2750,"nodeType":860},{},[2751],{"data":2752,"marks":2753,"value":2754,"nodeType":864},{},[],"Most security leaders I talk to know they have an AI problem. They've seen the board questions, read the reports, maybe even drafted a policy. But when they start measuring where they stand — not plans or roadmaps, but actual current state — the gap between awareness and operational capability comes into focus.",{"data":2756,"content":2757,"nodeType":860},{},[2758,2762,2770,2774,2782],{"data":2759,"marks":2760,"value":2761,"nodeType":864},{},[],"The ",{"data":2763,"content":2765,"nodeType":883},{"uri":2764},"https://pushsecurity.com/blog/verizon-dbir-2026-review",[2766],{"data":2767,"marks":2768,"value":2769,"nodeType":864},{},[],"2026 Verizon DBIR",{"data":2771,"marks":2772,"value":2773,"nodeType":864},{},[]," quantifies the scale: 45% of employees are now regular AI users on corporate devices (up from 15% the prior year), with 67% using personal accounts. ",{"data":2775,"content":2777,"nodeType":883},{"uri":2776},"https://pushsecurity.com/blog/what-push-data-reveals-about-the-state-of-shadow-ai",[2778],{"data":2779,"marks":2780,"value":2781,"nodeType":864},{},[],"Push data",{"data":2783,"marks":2784,"value":2785,"nodeType":864},{},[]," further shows that 38% of file uploads to AI tools come from those shadow accounts rather than approved organizational ones — and the DBIR shows what's going into them: of 858,000+ DLP events targeting GenAI applications, the most common data types were source code (28%), structured data (14%), and documents and PDFs (23% combined).",{"data":2787,"content":2788,"nodeType":860},{},[2789,2793,2800],{"data":2790,"marks":2791,"value":2792,"nodeType":864},{},[],"The average organization now has ",{"data":2794,"content":2795,"nodeType":883},{"uri":2776},[2796],{"data":2797,"marks":2798,"value":2799,"nodeType":864},{},[],"16 unique AI apps, 17 AI browser extensions, and 17 AI OAuth integrations",{"data":2801,"marks":2802,"value":2803,"nodeType":864},{},[]," in active use, most unapproved. Shadow AI was the third most common non-malicious insider action in the DBIR, up 4x year over year.",{"data":2805,"content":2808,"nodeType":996},{"target":2806},{"sys":2807},{"id":1040,"type":1001,"linkType":1002},[],{"data":2810,"content":2811,"nodeType":860},{},[2812],{"data":2813,"marks":2814,"value":2815,"nodeType":864},{},[],"These statistics expose an attack surface and unmanaged risks at a high level. But the real problem is that most organizations can't produce a basic inventory of which AI tools are in use, let alone demonstrate controls around any of them. ",{"data":2817,"content":2818,"nodeType":860},{},[2819,2823,2828],{"data":2820,"marks":2821,"value":2822,"nodeType":864},{},[],"That gap between awareness and capability is where most organizations are stuck. And understanding ",{"data":2824,"marks":2825,"value":2827,"nodeType":864},{},[2826],{"type":2246},"why",{"data":2829,"marks":2830,"value":2831,"nodeType":864},{},[]," they're stuck requires a framework for what progress actually looks like.",{"data":2833,"content":2834,"nodeType":1005},{},[],{"data":2836,"content":2837,"nodeType":1009},{},[2838],{"data":2839,"marks":2840,"value":2842,"nodeType":864},{},[2841],{"type":899},"A model for measuring what most organizations already feel",{"data":2844,"content":2845,"nodeType":860},{},[2846,2850,2857],{"data":2847,"marks":2848,"value":2849,"nodeType":864},{},[],"Chris Cochran's ",{"data":2851,"content":2853,"nodeType":883},{"uri":2852},"https://sansorg.egnyte.com/dl/XtgqfjkjBjp8",[2854],{"data":2855,"marks":2856,"value":1108,"nodeType":864},{},[],{"data":2858,"marks":2859,"value":2860,"nodeType":864},{},[],", published earlier this year, provides a framework for addressing this gap. It defines five stages of AI security maturity across three pillars:",{"data":2862,"content":2863,"nodeType":941},{},[2864,2880,2896],{"data":2865,"content":2866,"nodeType":945},{},[2867],{"data":2868,"content":2869,"nodeType":860},{},[2870,2876],{"data":2871,"marks":2872,"value":2875,"nodeType":864},{},[2873,2874],{"type":899},{"type":1455},"Protect AI:",{"data":2877,"marks":2878,"value":2879,"nodeType":864},{},[]," Defending against AI-enabled threats like adversarial attacks, prompt injection, compromised browser extensions, and AI agents operating with unchecked permissions.",{"data":2881,"content":2882,"nodeType":945},{},[2883],{"data":2884,"content":2885,"nodeType":860},{},[2886,2892],{"data":2887,"marks":2888,"value":2891,"nodeType":864},{},[2889,2890],{"type":899},{"type":1455},"Utilize AI:",{"data":2893,"marks":2894,"value":2895,"nodeType":864},{},[]," Using AI to strengthen security operations by using AI-powered detection and triage, behavioral analytics, and automated response playbooks.",{"data":2897,"content":2898,"nodeType":945},{},[2899],{"data":2900,"content":2901,"nodeType":860},{},[2902,2908,2912,2921],{"data":2903,"marks":2904,"value":2907,"nodeType":864},{},[2905,2906],{"type":899},{"type":1455},"Govern AI:",{"data":2909,"marks":2910,"value":2911,"nodeType":864},{},[]," Managing how the organization adopts and uses AI tools. Things like acceptable use policies, shadow AI discovery, data classification, access controls, and risk assessment. This is the pillar that gets the most attention in boardroom conversations today, driven in part by ",{"data":2913,"content":2915,"nodeType":883},{"uri":2914},"https://pushsecurity.com/blog/browser-visibility-and-control-can-achieve-ai-compliance",[2916],{"data":2917,"marks":2918,"value":2920,"nodeType":864},{},[2919],{"type":1455},"regulatory pressure",{"data":2922,"marks":2923,"value":2924,"nodeType":864},{},[],".",{"data":2926,"content":2927,"nodeType":860},{},[2928],{"data":2929,"marks":2930,"value":2931,"nodeType":864},{},[],"How an organization invests across these three pillars, and whether it invests across all of them, determines whether it advances toward maturity in this area or stalls out at the early steps.",{"data":2933,"content":2937,"nodeType":996},{"target":2934},{"sys":2935},{"id":2936,"type":1001,"linkType":1002},"1JV3KG97JQNFKwODnMCMq2",[],{"data":2939,"content":2940,"nodeType":860},{},[2941],{"data":2942,"marks":2943,"value":2944,"nodeType":864},{},[],"The SANS AI maturity model outlines 5 stages that organizations must progress through in order to reach an optimal security posture:",{"data":2946,"content":2947,"nodeType":941},{},[2948,2964,2980,2996,3012],{"data":2949,"content":2950,"nodeType":945},{},[2951],{"data":2952,"content":2953,"nodeType":860},{},[2954,2960],{"data":2955,"marks":2956,"value":2959,"nodeType":864},{},[2957,2958],{"type":899},{"type":1455},"Stage 1 (Unaware / Ad Hoc)",{"data":2961,"marks":2962,"value":2963,"nodeType":864},{},[]," is where employees are freely using AI tools with no oversight, no inventory exists, and leadership may not even know how much AI is in use. There's no policy to violate, so technically it's not even shadow AI yet; it's just unmanaged adoption.",{"data":2965,"content":2966,"nodeType":945},{},[2967],{"data":2968,"content":2969,"nodeType":860},{},[2970,2976],{"data":2971,"marks":2972,"value":2975,"nodeType":864},{},[2973,2974],{"type":899},{"type":1455},"Stage 2 (Reactive / Policy-Emerging)",{"data":2977,"marks":2978,"value":2979,"nodeType":864},{},[]," means a policy exists, but it's course-grained: \"Don't use AI\" or \"use with caution.\" Known AI tools may be blocked at the network level. Security teams are learning about AI-specific threats but don't have dedicated expertise or tooling.",{"data":2981,"content":2982,"nodeType":945},{},[2983],{"data":2984,"content":2985,"nodeType":860},{},[2986,2992],{"data":2987,"marks":2988,"value":2991,"nodeType":864},{},[2989,2990],{"type":899},{"type":1455},"Stage 3 (Defined / Risk-Informed)",{"data":2993,"marks":2994,"value":2995,"nodeType":864},{},[]," is where things get intentional. AI usage is governed through enterprise tools rather than outright bans. AI systems are included in security assessments. The organization can demonstrate mature governance to regulators and partners. For many organizations, this is a strong and defensible operating position.",{"data":2997,"content":2998,"nodeType":945},{},[2999],{"data":3000,"content":3001,"nodeType":860},{},[3002,3008],{"data":3003,"marks":3004,"value":3007,"nodeType":864},{},[3005,3006],{"type":899},{"type":1455},"Stage 4 (Managed / Integrated)",{"data":3009,"marks":3010,"value":3011,"nodeType":864},{},[]," means AI is deeply embedded in security operations with measurable outcomes. AI systems are secured by design. Risk is quantified, not estimated. Decisions are data-driven. This is where organizations can handle AI-specific threats and operate at the tempo that AI-augmented adversaries demand.",{"data":3013,"content":3014,"nodeType":945},{},[3015],{"data":3016,"content":3017,"nodeType":860},{},[3018,3024],{"data":3019,"marks":3020,"value":3023,"nodeType":864},{},[3021,3022],{"type":899},{"type":1455},"Stage 5 (Optimizing / Adaptive)",{"data":3025,"marks":3026,"value":3027,"nodeType":864},{},[]," is the frontier of AI-native security with self-improving defenses. Elements of this stage exist primarily in large technology companies, defense contractors, and AI-native firms. For most organizations, this is a multi-year journey.",{"data":3029,"content":3030,"nodeType":860},{},[3031],{"data":3032,"marks":3033,"value":3034,"nodeType":864},{},[],"Most of the security leaders I talk to land between Stage 1 and Stage 2. They have awareness, maybe a policy, but not the tooling or telemetry to demonstrate much beyond that. ",{"data":3036,"content":3037,"nodeType":860},{},[3038],{"data":3039,"marks":3040,"value":3041,"nodeType":864},{},[],"The model is pragmatic about these challenges. It doesn't expect every organization to reach Stage 5, and it adjusts maturity targets by sector. ",{"data":3043,"content":3044,"nodeType":860},{},[3045,3049,3054],{"data":3046,"marks":3047,"value":3048,"nodeType":864},{},[],"But it ",{"data":3050,"marks":3051,"value":3053,"nodeType":864},{},[3052],{"type":2246},"does",{"data":3055,"marks":3056,"value":3057,"nodeType":864},{},[]," require evidence of progress, not just intent. And for the majority sitting at Stage 2, the hard part is identifying the right steps to move from being merely reactive to a posture of operational readiness. That’s the chasm to cross.",{"data":3059,"content":3060,"nodeType":1005},{},[],{"data":3062,"content":3063,"nodeType":1009},{},[3064],{"data":3065,"marks":3066,"value":3068,"nodeType":864},{},[3067],{"type":899},"The chasm",{"data":3070,"content":3071,"nodeType":860},{},[3072],{"data":3073,"marks":3074,"value":3075,"nodeType":864},{},[],"For the organizations sitting at Stage 2, current state often looks like this: They've written an AI acceptable use policy, and maybe they've blocked known AI apps at the network level. They've trained employees on what's allowed and what isn't. ",{"data":3077,"content":3078,"nodeType":860},{},[3079],{"data":3080,"marks":3081,"value":3082,"nodeType":864},{},[],"To be sure, blocking is the fastest lever a security team can pull, and it represents visible progress to the business. The problem is that it rarely stays effective. ",{"data":3084,"content":3085,"nodeType":860},{},[3086],{"data":3087,"marks":3088,"value":3090,"nodeType":864},{},[3089],{"type":899},"SANS calls the pattern that traps most organizations at Stage 2 the \"Framework of No.\" ",{"data":3092,"content":3093,"nodeType":860},{},[3094],{"data":3095,"marks":3096,"value":3097,"nodeType":864},{},[],"\"A block-based AI policy may feel like risk management, but practitioner experience shows it typically drives AI usage underground rather than preventing it,” the report notes. “This is the pattern SANS has documented as the 'Framework of No,' and it is why the Stage 2 to Stage 3 transition is so critical.\"",{"data":3099,"content":3100,"nodeType":860},{},[3101,3106],{"data":3102,"marks":3103,"value":3105,"nodeType":864},{},[3104],{"type":2246},"This",{"data":3107,"marks":3108,"value":3109,"nodeType":864},{},[]," is the chasm. On one side: awareness and policy. On the other: operational capability - the tooling, telemetry, and controls that let a security team see what's happening and respond to it. Most organizations are standing on the awareness side, looking across, not sure how to get over.",{"data":3111,"content":3115,"nodeType":996},{"target":3112},{"sys":3113},{"id":3114,"type":1001,"linkType":1002},"187mKPZV8tVbsw17L2cWIU",[],{"data":3117,"content":3118,"nodeType":860},{},[3119],{"data":3120,"marks":3121,"value":3122,"nodeType":864},{},[],"The model is specific about what crossing requires. The steps from Stage 2 to Stage 3 include technical BYOAI discovery (not a survey, but automated discovery), AI-specific data classification, AI-aware controls, and a cross-functional governance body. Data classification is a critical prerequisite: \"You cannot write an effective AI policy without knowing where sensitive data lives,\" the report emphasizes.",{"data":3124,"content":3125,"nodeType":860},{},[3126],{"data":3127,"marks":3128,"value":3129,"nodeType":864},{},[],"These are visibility and measurement problems before they're policy problems. You can't govern what you can't see. You can't classify risk you can't measure. And a blocklist that pushes usage underground doesn't give you either: it just makes the gap between your policy and your reality harder to detect.",{"data":3131,"content":3132,"nodeType":860},{},[3133],{"data":3134,"marks":3135,"value":3136,"nodeType":864},{},[],"Getting this visibility right is necessary for crossing the chasm. But it’s not the only step organizations must undertake if they want to address their AI risk.",{"data":3138,"content":3139,"nodeType":1005},{},[],{"data":3141,"content":3142,"nodeType":1009},{},[3143],{"data":3144,"marks":3145,"value":3147,"nodeType":864},{},[3146],{"type":899},"Governance is key, but don't forget about protection",{"data":3149,"content":3150,"nodeType":860},{},[3151,3155,3160],{"data":3152,"marks":3153,"value":3154,"nodeType":864},{},[],"Most AI security conversations today - the vendor pitches, board decks, and compliance checklists - are about the ",{"data":3156,"marks":3157,"value":3159,"nodeType":864},{},[3158],{"type":899},"Govern",{"data":3161,"marks":3162,"value":3163,"nodeType":864},{},[]," pillar. Shadow AI discovery. Usage policies. Data classification. Controls around what employees paste into AI prompts or upload to AI tools. It's important work.",{"data":3165,"content":3166,"nodeType":860},{},[3167,3171,3176],{"data":3168,"marks":3169,"value":3170,"nodeType":864},{},[],"But the SANS model gives roughly equal weight to a second pillar that gets almost no attention: ",{"data":3172,"marks":3173,"value":3175,"nodeType":864},{},[3174],{"type":899},"Protect",{"data":3177,"marks":3178,"value":3179,"nodeType":864},{},[]," - defending against AI-enabled attacks.",{"data":3181,"content":3182,"nodeType":860},{},[3183],{"data":3184,"marks":3185,"value":3186,"nodeType":864},{},[],"The Protect pillar starts from a stark baseline. At Stage 1, most organizations have no visibility into which AI agents or browser extensions have access to their corporate environment, let alone a framework for understanding how those could be attacked. ",{"data":3188,"content":3189,"nodeType":860},{},[3190],{"data":3191,"marks":3192,"value":3193,"nodeType":864},{},[],"By Stage 3, the model expects runtime validation of AI tools and plugins, detection capabilities mapped to AI-specific attack frameworks, and controls that cover the growing surface area of agentic AI. ",{"data":3195,"content":3196,"nodeType":860},{},[3197],{"data":3198,"marks":3199,"value":3200,"nodeType":864},{},[],"By Stage 4, organizations need real-time monitoring of AI agent behavior and defenses against attacks that exploit trust relationships between AI systems — capabilities most security teams haven't started scoping, much less building or procuring.",{"data":3202,"content":3203,"nodeType":860},{},[3204,3208,3218],{"data":3205,"marks":3206,"value":3207,"nodeType":864},{},[],"These are detection and response capabilities, not governance exercises — and the attacks they address are already well underway. ",{"data":3209,"content":3211,"nodeType":883},{"uri":3210},"https://pushsecurity.com/blog/the-cisos-data-problem-and-how-browser-telemetry-can-help/",[3212],{"data":3213,"marks":3214,"value":3217,"nodeType":864},{},[3215,3216],{"type":1455},{"type":899},"One in three phishing payloads",{"data":3219,"marks":3220,"value":3221,"nodeType":864},{},[]," intercepted by Push arrive outside of email, through channels where most security controls don't exist. Evidence of the growth of browser-based attack methods enabled by AI tooling abounds:",{"data":3223,"content":3224,"nodeType":941},{},[3225,3247,3269],{"data":3226,"content":3227,"nodeType":945},{},[3228],{"data":3229,"content":3230,"nodeType":860},{},[3231,3235,3243],{"data":3232,"marks":3233,"value":3234,"nodeType":864},{},[],"CrowdStrike's 2026 Global Threat Report documented a ",{"data":3236,"content":3238,"nodeType":883},{"uri":3237},"https://www.crowdstrike.com/explore/2026-global-threat-report",[3239],{"data":3240,"marks":3241,"value":3242,"nodeType":864},{},[],"563% increase in ClickFix lures",{"data":3244,"marks":3245,"value":3246,"nodeType":864},{},[]," — fake CAPTCHA pages that trick users into executing malicious commands on their own machines.",{"data":3248,"content":3249,"nodeType":945},{},[3250],{"data":3251,"content":3252,"nodeType":860},{},[3253,3257,3265],{"data":3254,"marks":3255,"value":3256,"nodeType":864},{},[],"Push has tracked a ",{"data":3258,"content":3260,"nodeType":883},{"uri":3259},"https://pushsecurity.com/blog/device-code-phishing/",[3261],{"data":3262,"marks":3263,"value":3264,"nodeType":864},{},[],"37x increase in device code phishing",{"data":3266,"marks":3267,"value":3268,"nodeType":864},{},[]," since the start of 2026, with 18+ distinct kits now offering the technique.",{"data":3270,"content":3271,"nodeType":945},{},[3272],{"data":3273,"content":3274,"nodeType":860},{},[3275,3278,3287,3291,3296,3300,3305],{"data":3276,"marks":3277,"value":21,"nodeType":864},{},[],{"data":3279,"content":3281,"nodeType":883},{"uri":3280},"https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack",[3282],{"data":3283,"marks":3284,"value":3286,"nodeType":864},{},[3285],{"type":1455},"Anthropic",{"data":3288,"marks":3289,"value":3290,"nodeType":864},{},[]," identified ",{"data":3292,"marks":3293,"value":3295,"nodeType":864},{},[3294],{"type":899},"793 threat actors using AI",{"data":3297,"marks":3298,"value":3299,"nodeType":864},{},[]," for malicious cybersecurity purposes between March 2025 and February 2026, with the 2026 Verizon DBIR finding that ",{"data":3301,"marks":3302,"value":3304,"nodeType":864},{},[3303],{"type":899},"44% of AI-assisted initial access was phishing-related",{"data":3306,"marks":3307,"value":2924,"nodeType":864},{},[],{"data":3309,"content":3310,"nodeType":860},{},[3311],{"data":3312,"marks":3313,"value":3314,"nodeType":864},{},[],"Attackers are already vibecoding phishing kits, rotating infrastructure daily, and exploiting identity flows that traditional endpoint and network tools can't see.",{"data":3316,"content":3317,"nodeType":860},{},[3318],{"data":3319,"marks":3320,"value":3321,"nodeType":864},{},[],"The SANS model makes the speed argument a central focus at Stage 4: Detection built for human-pace adversaries is increasingly insufficient when threats operate at machine speed. For organizations investing exclusively in AI governance, AI-enabled threats represent an entire category of risk that is not being addressed.",{"data":3323,"content":3324,"nodeType":1005},{},[],{"data":3326,"content":3327,"nodeType":1312},{},[3328],{"data":3329,"marks":3330,"value":3332,"nodeType":864},{},[3331],{"type":899},"Why governance alone can't close the gap",{"data":3334,"content":3335,"nodeType":860},{},[3336,3340,3345],{"data":3337,"marks":3338,"value":3339,"nodeType":864},{},[],"An organization can have an AI policy, shadow AI discovery, data classification, and usage controls, and ",{"data":3341,"marks":3342,"value":3344,"nodeType":864},{},[3343],{"type":2246},"still",{"data":3346,"marks":3347,"value":3348,"nodeType":864},{},[]," be exposed. When an employee hits a device code phishing page or a ClickFix lure, the governance program documented the risk perfectly. It just couldn't stop the attack. The policy existed but the detection (and ideally, mitigation) didn't.",{"data":3350,"content":3351,"nodeType":860},{},[3352],{"data":3353,"marks":3354,"value":3355,"nodeType":864},{},[],"The reverse is equally true, and it's why the SANS model treats the pillars as interdependent rather than sequential. Detection capabilities that fire into a void with no policy to act on findings, no classification to assess exposure, and no governance body to shape proactive policy just create alerts, not security. ",{"data":3357,"content":3358,"nodeType":860},{},[3359],{"data":3360,"marks":3361,"value":3362,"nodeType":864},{},[],"Yet most organizations are only investing heavily in one side of the solution, which is almost always Govern. The maturity model is explicit about the risks of this approach: Governance with no attack detection leaves a critical gap. ",{"data":3364,"content":3365,"nodeType":860},{},[3366],{"data":3367,"marks":3368,"value":3370,"nodeType":864},{},[3369],{"type":899},"Closing the gap requires a control point where both problems are visible and addressable.",{"data":3372,"content":3373,"nodeType":1005},{},[],{"data":3375,"content":3376,"nodeType":1009},{},[3377],{"data":3378,"marks":3379,"value":3381,"nodeType":864},{},[3380],{"type":899},"Crossing the chasm requires addressing both pillars at once",{"data":3383,"content":3384,"nodeType":860},{},[3385,3389,3396],{"data":3386,"marks":3387,"value":3388,"nodeType":864},{},[],"The bottleneck for most security programs ",{"data":3390,"content":3391,"nodeType":883},{"uri":3210},[3392],{"data":3393,"marks":3394,"value":3395,"nodeType":864},{},[],"isn't frameworks or strategy — it's data quality",{"data":3397,"marks":3398,"value":3399,"nodeType":864},{},[],". For teams taking on the dual problems of shadow AI and AI-enabled attacks, browser telemetry is the foundation to any meaningful solution. That’s because both problems converge in the same place.",{"data":3401,"content":3402,"nodeType":860},{},[3403],{"data":3404,"marks":3405,"value":3406,"nodeType":864},{},[],"AI-enabled phishing attacks, credential theft, malicious browser extensions, and OAuth exploitation happen in the browser. So do shadow AI adoption, sensitive data pasted into AI prompts, file uploads to unapproved tools, and unauthorized integrations. The browser is where external attacks and internal misuse are both visible and stoppable.",{"data":3408,"content":3409,"nodeType":860},{},[3410],{"data":3411,"marks":3412,"value":3413,"nodeType":864},{},[],"For the security team trying to advance past the Framework of No, browser telemetry replaces the blunt instrument of network-level blocking with actual visibility:",{"data":3415,"content":3416,"nodeType":941},{},[3417,3427,3437],{"data":3418,"content":3419,"nodeType":945},{},[3420],{"data":3421,"content":3422,"nodeType":860},{},[3423],{"data":3424,"marks":3425,"value":3426,"nodeType":864},{},[],"which AI apps are in use (including personal account usage)",{"data":3428,"content":3429,"nodeType":945},{},[3430],{"data":3431,"content":3432,"nodeType":860},{},[3433],{"data":3434,"marks":3435,"value":3436,"nodeType":864},{},[],"what data is moving into them (file uploads, clipboard activity)",{"data":3438,"content":3439,"nodeType":945},{},[3440],{"data":3441,"content":3442,"nodeType":860},{},[3443],{"data":3444,"marks":3445,"value":3446,"nodeType":864},{},[],"graduated controls - per-app, per-user group, per-content pattern - that can monitor, warn, or block based on context rather than allow/deny",{"data":3448,"content":3449,"nodeType":860},{},[3450],{"data":3451,"marks":3452,"value":3453,"nodeType":864},{},[],"The same browser-layer instrumentation can also provide real-time detection of credential phishing, ClickFix, adversary-in-the-middle attacks, and device code phishing. And it can detect and disable malicious browser extensions based on confirmed threat intelligence, monitor OAuth integrations, and generate the identity attack surface data (login behaviors, MFA gaps, SSO coverage) that the Protect pillar requires at Stage 3 maturity and beyond.",{"data":3455,"content":3456,"nodeType":860},{},[3457],{"data":3458,"marks":3459,"value":3460,"nodeType":864},{},[],"We built Push around this insight: that the browser is where both problems converge, and a single deployment can advance AI security maturity in both areas simultaneously. The SANS model makes the same argument.",{"data":3462,"content":3463,"nodeType":1005},{},[],{"data":3465,"content":3466,"nodeType":1009},{},[3467],{"data":3468,"marks":3469,"value":3471,"nodeType":864},{},[3470],{"type":899},"Where to start: 5 steps to maturity with Push",{"data":3473,"content":3474,"nodeType":860},{},[3475],{"data":3476,"marks":3477,"value":3478,"nodeType":864},{},[],"The chasm closes when organizations make meaningful strides forward in both AI governance and proactive defense against AI-enabled attacks. Here's the starting plan that I'd recommend, and Push can provide the tooling to automate these steps:",{"data":3480,"content":3481,"nodeType":860},{},[3482,3487],{"data":3483,"marks":3484,"value":3486,"nodeType":864},{},[3485],{"type":899},"1. Build an AI inventory automatically.",{"data":3488,"marks":3489,"value":3490,"nodeType":864},{},[]," Every stage transition in the SANS model starts with knowing what's in your environment. A manual survey won't cut it; employees won't self-report the tools they're not sure they're allowed to use, and may overlook apps where AI is a feature but not the core function (AI-enabled apps). Instead, organizations should deploy automated discovery for AI apps, browser extensions, and OAuth integrations across the workforce - including the ones using personal accounts. Until this inventory exists, every policy decision is based on incomplete information.",{"data":3492,"content":3496,"nodeType":996},{"target":3493},{"sys":3494},{"id":3495,"type":1001,"linkType":1002},"2t3u0NydllImv6NzvAY058",[],{"data":3498,"content":3499,"nodeType":860},{},[3500,3505],{"data":3501,"marks":3502,"value":3504,"nodeType":864},{},[3503],{"type":899},"2. Classify what you find.",{"data":3506,"marks":3507,"value":3508,"nodeType":864},{},[]," Not all AI usage carries the same risk. A developer pasting code into ChatGPT and a salesperson using an AI notetaker are different problems. Once you can see the tools, categorize them by data sensitivity, authorization status, and access scope. The SANS model calls out data classification as a critical prerequisite; you can't write an effective AI policy without knowing where sensitive data lives.",{"data":3510,"content":3511,"nodeType":860},{},[3512,3517],{"data":3513,"marks":3514,"value":3516,"nodeType":864},{},[3515],{"type":899},"3. Turn on browser-layer detection.",{"data":3518,"marks":3519,"value":3520,"nodeType":864},{},[]," This is the step most organizations skip, and it's why addressing only the Protect pillar will keep you at Stage 1. AI-enabled phishing, ClickFix attacks, device code phishing, malicious extension updates, and OAuth exploitation all execute in the browser. Without detection in that layer, there's no visibility into the fastest-growing attack category, and no path to advancing beyond basic AI usage awareness.",{"data":3522,"content":3526,"nodeType":996},{"target":3523},{"sys":3524},{"id":3525,"type":1001,"linkType":1002},"1fzuGjA6VSbVl1p7vM1mt7",[],{"data":3528,"content":3529,"nodeType":860},{},[3530,3535],{"data":3531,"marks":3532,"value":3534,"nodeType":864},{},[3533],{"type":899},"4. Move from blocking to graduated controls.",{"data":3536,"marks":3537,"value":3538,"nodeType":864},{},[]," The Framework of No fails because it's binary: allow or deny, with nothing in between. Organizations that cross the chasm adopt monitor, warn, and block modes — per app, per user group, per content pattern. Monitor first to see what's happening, warn to change behavior without disrupting workflows, and block only where the risk justifies it. This is the operational difference between Stage 2 and Stage 3.",{"data":3540,"content":3541,"nodeType":860},{},[3542,3547,3551,3557],{"data":3543,"marks":3544,"value":3546,"nodeType":864},{},[3545],{"type":899},"5. Assess yourself honestly against evidence, not aspiration.",{"data":3548,"marks":3549,"value":3550,"nodeType":864},{},[]," The ",{"data":3552,"content":3553,"nodeType":883},{"uri":2852},[3554],{"data":3555,"marks":3556,"value":1108,"nodeType":864},{},[],{"data":3558,"marks":3559,"value":3560,"nodeType":864},{},[]," includes a self-assessment and industry-specific weighting profiles. The value isn't in the score, but in identifying which pillar is keeping you from advancing.",{"data":3562,"content":3563,"nodeType":860},{},[3564],{"data":3565,"marks":3566,"value":3567,"nodeType":864},{},[],"The organizations that cross the AI security chasm will be the ones that recognize early that AI security isn't one problem with one solution. It's two problems that happen to share a control point. The most efficient path forward is a platform that addresses both.",{"data":3569,"content":3570,"nodeType":1005},{},[],{"data":3572,"content":3573,"nodeType":1009},{},[3574],{"data":3575,"marks":3576,"value":3578,"nodeType":864},{},[3577],{"type":899},"Learn more about Push",{"data":3580,"content":3581,"nodeType":860},{},[3582],{"data":3583,"marks":3584,"value":3585,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser - high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":3587,"content":3588,"nodeType":860},{},[3589],{"data":3590,"marks":3591,"value":1689,"nodeType":864},{},[],{"data":3593,"content":3594,"nodeType":860},{},[3595,3598,3605],{"data":3596,"marks":3597,"value":2707,"nodeType":864},{},[],{"data":3599,"content":3600,"nodeType":883},{"uri":1700},[3601],{"data":3602,"marks":3603,"value":2715,"nodeType":864},{},[3604],{"type":1455},{"data":3606,"marks":3607,"value":2719,"nodeType":864},{},[],"Crossing the AI security chasm with the SANS AI security maturity model","Most organizations know they have an AI security problem. A new SANS framework shows why so few are making progress - and what it actually takes to get unstuck.","2026-06-24T00:00:00.000Z","crossing-the-ai-security-chasm-sans-security-maturity-model",{"items":3613},[3614,3616],{"sys":3615,"name":297},{"id":2732},{"sys":3617,"name":2729},{"id":2728},{"items":3619},[3620],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":3624},"Mark Orlando","Mark","Field CTO",{"url":3625},"https://images.ctfassets.net/y1cdw1ablpvd/592PMwIQQFaa24k5SKBEKF/a33090d0ad95d1e3081f5d16a46ba826/image__68_.png",{"__typename":2059,"sys":3627,"content":3629,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":4869,"authorsCollection":4875},{"id":3628},"6MoHWfQlVildcFYKSbfMcE",{"json":3630},{"data":3631,"content":3632,"nodeType":856},{},[3633,3649,3655,3662,3669,3675,3678,3686,3694,3713,3761,3767,3782,3785,3793,3800,3828,3869,3876,3879,3887,3895,3902,3908,3915,3918,3926,3933,3975,4011,4018,4021,4029,4036,4061,4068,4113,4120,4123,4131,4139,4184,4191,4197,4200,4208,4216,4248,4255,4261,4268,4271,4279,4287,4316,4323,4330,4337,4340,4348,4356,4363,4369,4376,4399,4428,4431,4439,4447,4454,4461,4464,4472,4534,4537,4545,4552,4846,4849],{"data":3634,"content":3635,"nodeType":860},{},[3636,3640,3645],{"data":3637,"marks":3638,"value":3639,"nodeType":864},{},[],"Browser security solutions are one of the most significant additions to the enterprise security stack in recent years — and the data shows it. The browser is where ",{"data":3641,"marks":3642,"value":3644,"nodeType":864},{},[3643],{"type":899},"85% of work now happens",{"data":3646,"marks":3647,"value":3648,"nodeType":864},{},[],", where AI tools are accessed, and where attackers increasingly choose to strike.",{"data":3650,"content":3654,"nodeType":996},{"target":3651},{"sys":3652},{"id":3653,"type":1001,"linkType":1002},"5P6PyFbn4EakRNlIWtNzyL",[],{"data":3656,"content":3657,"nodeType":860},{},[3658],{"data":3659,"marks":3660,"value":3661,"nodeType":864},{},[],"But browser security is a nascent category. Getting a clear picture of which solution is right for your team, and how to get the most out of it, isn't straightforward. Current solutions on the market serve a wide range of IT and security use cases, with varying degrees of depth and differentiation across them. Not all use cases are equal in terms of their security value, and not all of them are best addressed in the browser.",{"data":3663,"content":3664,"nodeType":860},{},[3665],{"data":3666,"marks":3667,"value":3668,"nodeType":864},{},[],"This article ranks the security problems that browser security solutions can address by the value they deliver: a combination of the risk reduction on offer, and the degree to which the browser is genuinely the best (or only) layer to solve the problem. ",{"data":3670,"content":3674,"nodeType":996},{"target":3671},{"sys":3672},{"id":3673,"type":1001,"linkType":1002},"6SJPvEHizSYk29lEvVVNj",[],{"data":3676,"content":3677,"nodeType":1005},{},[],{"data":3679,"content":3680,"nodeType":1009},{},[3681],{"data":3682,"marks":3683,"value":3685,"nodeType":864},{},[3684],{"type":899},"#1 — Account takeover prevention: detecting credential attacks across all vectors",{"data":3687,"content":3688,"nodeType":860},{},[3689],{"data":3690,"marks":3691,"value":3693,"nodeType":864},{},[3692],{"type":899},"Security value: Very high | Browser fit: Uniquely suited",{"data":3695,"content":3696,"nodeType":860},{},[3697,3701,3709],{"data":3698,"marks":3699,"value":3700,"nodeType":864},{},[],"Account takeover (ATO) is the dominant entry point for enterprise breaches: ",{"data":3702,"content":3704,"nodeType":883},{"uri":3703},"https://www.crowdstrike.com/en-gb/resources/infographics/identity-security-risk-review/",[3705],{"data":3706,"marks":3707,"value":3708,"nodeType":864},{},[],"80% of all modern breaches involve compromised or stolen identities",{"data":3710,"marks":3711,"value":3712,"nodeType":864},{},[],". The attack surface is far wider than most identity tooling can see: credential stuffing, password spraying, ghost logins (password-based fallback authentication that persists after SSO is configured), weak or reused credentials on shadow SaaS apps, and accounts where MFA was never enforced.",{"data":3714,"content":3715,"nodeType":860},{},[3716,3720,3728,3732,3737,3740,3745,3749,3757],{"data":3717,"marks":3718,"value":3719,"nodeType":864},{},[],"According to ",{"data":3721,"content":3723,"nodeType":883},{"uri":3722},"https://cf-assets.www.cloudflare.com/slt3lc6tev37/sWDBUMNVtEJB9ZFLt1dUU/8d69e92de2edfb3bf59e7d21d57e7e1a/Cloudflare-2026-threat-report.pdf",[3724],{"data":3725,"marks":3726,"value":3727,"nodeType":864},{},[],"Cloudflare's 2026 Threat Report",{"data":3729,"marks":3730,"value":3731,"nodeType":864},{},[],", ",{"data":3733,"marks":3734,"value":3736,"nodeType":864},{},[3735],{"type":899},"63% of all human logins involve credentials already compromised elsewhere",{"data":3738,"marks":3739,"value":2232,"nodeType":864},{},[],{"data":3741,"marks":3742,"value":3744,"nodeType":864},{},[3743],{"type":899},"94% of all login attempts originate from bots",{"data":3746,"marks":3747,"value":3748,"nodeType":864},{},[],". The ",{"data":3750,"content":3752,"nodeType":883},{"uri":3751},"https://pushsecurity.com/blog/snowflake-retro/",[3753],{"data":3754,"marks":3755,"value":3756,"nodeType":864},{},[],"Snowflake breach",{"data":3758,"marks":3759,"value":3760,"nodeType":864},{},[]," — 165+ organizations compromised, 1 billion+ records stolen — was powered almost entirely by ghost logins: accounts missing MFA that were susceptible to credential stuffing. It's particularly telling that 80% of the accounts impacted had prior breach exposure.",{"data":3762,"content":3766,"nodeType":996},{"target":3763},{"sys":3764},{"id":3765,"type":1001,"linkType":1002},"HbZ66kp5DiAZtwNGFJK7d",[],{"data":3768,"content":3769,"nodeType":860},{},[3770,3774,3779],{"data":3771,"marks":3772,"value":3773,"nodeType":864},{},[],"For organizations with contractors and BYOD users, the browser extension is also the only enterprise control deployable on devices that can't be MDM-enrolled — extending ATO detection to exactly the place where, per Verizon DBIR 2025, ",{"data":3775,"marks":3776,"value":3778,"nodeType":864},{},[3777],{"type":899},"46% of infostealer infections originate",{"data":3780,"marks":3781,"value":2924,"nodeType":864},{},[],{"data":3783,"content":3784,"nodeType":1005},{},[],{"data":3786,"content":3787,"nodeType":1009},{},[3788],{"data":3789,"marks":3790,"value":3792,"nodeType":864},{},[3791],{"type":899},"#2 — Detecting and stopping advanced phishing: AiTM, multi-channel delivery, and zero-day lures",{"data":3794,"content":3795,"nodeType":860},{},[3796],{"data":3797,"marks":3798,"value":3693,"nodeType":864},{},[3799],{"type":899},{"data":3801,"content":3802,"nodeType":860},{},[3803,3807,3815,3819,3824],{"data":3804,"marks":3805,"value":3806,"nodeType":864},{},[],"Adversary-in-the-Middle (AiTM) phishing — where an attacker's reverse proxy intercepts credentials and session tokens in real time — has become the standard technique for bypassing MFA at scale. ",{"data":3808,"content":3810,"nodeType":883},{"uri":3809},"https://www.esentire.com/resources/library/2026-threat-report",[3811],{"data":3812,"marks":3813,"value":3814,"nodeType":864},{},[],"eSentire's 2026 Threat Report",{"data":3816,"marks":3817,"value":3818,"nodeType":864},{},[]," attributes ",{"data":3820,"marks":3821,"value":3823,"nodeType":864},{},[3822],{"type":899},"63% of account compromise incidents to PhaaS kits",{"data":3825,"marks":3826,"value":3827,"nodeType":864},{},[],", with account compromise surging 389% year-over-year.",{"data":3829,"content":3830,"nodeType":860},{},[3831,3835,3843,3847,3852,3856,3865],{"data":3832,"marks":3833,"value":3834,"nodeType":864},{},[],"Traditional phishing controls are also no longer in the right place to intercept these attacks. The delivery channel has shifted decisively away from email: ",{"data":3836,"content":3838,"nodeType":883},{"uri":3837},"https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026",[3839],{"data":3840,"marks":3841,"value":3842,"nodeType":864},{},[],"Mandiant M-Trends 2026",{"data":3844,"marks":3845,"value":3846,"nodeType":864},{},[]," found email phishing dropped from 14% to 6% as an infection vector, and Push data shows ",{"data":3848,"marks":3849,"value":3851,"nodeType":864},{},[3850],{"type":899},"roughly 1 in 3 phishing payloads intercepted were delivered outside email entirely",{"data":3853,"marks":3854,"value":3855,"nodeType":864},{},[]," — via search engine malvertising, social platforms, and compromised websites. Meanwhile, ",{"data":3857,"content":3859,"nodeType":883},{"uri":3858},"https://www.spamhaus.com/resource-center/supporting-researchers-with-passive-dns/",[3860],{"data":3861,"marks":3862,"value":3864,"nodeType":864},{},[3863],{"type":899},"89% of phishing domains are active for less than two days",{"data":3866,"marks":3867,"value":3868,"nodeType":864},{},[],", making blocklist-based detection structurally too slow — attackers can spin up, tear down, and move on before blocklists can catch up.",{"data":3870,"content":3871,"nodeType":860},{},[3872],{"data":3873,"marks":3874,"value":3875,"nodeType":864},{},[],"Modern phishing plays out entirely inside the browser session. The only detection layer that can see the phishing page structure, the credential entry, and the anomalous token context is the browser itself. Browser-native detection analyses page behavior rather than matching known-bad domains, which means it fires on zero-day kits regardless of how recently the infrastructure was stood up. Controls like credential entry guardrails add an additional layer — blocking corporate passwords from being submitted to unauthorized domains independently of content and behavior-based detections.",{"data":3877,"content":3878,"nodeType":1005},{},[],{"data":3880,"content":3881,"nodeType":1009},{},[3882],{"data":3883,"marks":3884,"value":3886,"nodeType":864},{},[3885],{"type":899},"#3 — Identity posture hardening: enforcing security across the apps your IdP doesn't manage",{"data":3888,"content":3889,"nodeType":860},{},[3890],{"data":3891,"marks":3892,"value":3894,"nodeType":864},{},[3893],{"type":899},"Security value: High | Browser fit: Uniquely suited",{"data":3896,"content":3897,"nodeType":860},{},[3898],{"data":3899,"marks":3900,"value":3901,"nodeType":864},{},[],"The first challenge is knowing what you're protecting. Every identity an employee creates — every app they sign up to, every password they set, every login that bypasses SSO — is an authentication event that happens inside a browser session. The browser is the only layer that observes all of these events regardless of whether the app is sanctioned, managed, or even known to IT. Solutions that rely on API-level integrations with known apps, network traffic inspection, or email sign-up notifications can only ever build a partial picture, because they can only see apps they already know about. The browser sees the login itself, which means it discovers the identity at the moment it's created or used — authentication method, password strength, MFA status, and all.",{"data":3903,"content":3907,"nodeType":996},{"target":3904},{"sys":3905},{"id":3906,"type":1001,"linkType":1002},"HETvBCPsKGkqLVtaasXH0",[],{"data":3909,"content":3910,"nodeType":860},{},[3911],{"data":3912,"marks":3913,"value":3914,"nodeType":864},{},[],"But discovery without enforcement is just an inventory problem. Being in the browser means that you're in a great position to act on what it finds at the moment of authentication. Browser-native guardrails that prompt MFA enrollment, guide users toward stronger credentials, and redirect to SSO login paths close the gap at scale, on every app, including those the IdP has never seen. They also produce the continuous, auditable evidence of MFA coverage and credential hygiene across the full application estate that regulators, insurers, and auditors increasingly require — evidence that no IdP-centric tool can provide for apps outside its scope.",{"data":3916,"content":3917,"nodeType":1005},{},[],{"data":3919,"content":3920,"nodeType":1009},{},[3921],{"data":3922,"marks":3923,"value":3925,"nodeType":864},{},[3924],{"type":899},"#4 — Browser extension security",{"data":3927,"content":3928,"nodeType":860},{},[3929],{"data":3930,"marks":3931,"value":3894,"nodeType":864},{},[3932],{"type":899},{"data":3934,"content":3935,"nodeType":860},{},[3936,3940,3949,3952,3960,3963,3971],{"data":3937,"marks":3938,"value":3939,"nodeType":864},{},[],"Browser extensions have become one of the most talked-about attack surfaces in security over the past 18 months, and understandably so — a string of high-profile supply chain compromises have collectively impacted tens of millions of users since late 2024 (",{"data":3941,"content":3943,"nodeType":883},{"uri":3942},"https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it",[3944],{"data":3945,"marks":3946,"value":3948,"nodeType":864},{},[3947],{"type":1455},"Cyberhaven",{"data":3950,"marks":3951,"value":3731,"nodeType":864},{},[],{"data":3953,"content":3955,"nodeType":883},{"uri":3954},"https://thehackernews.com/2025/12/darkspectre-browser-extension-campaigns.html",[3956],{"data":3957,"marks":3958,"value":3959,"nodeType":864},{},[],"DarkSpectre",{"data":3961,"marks":3962,"value":3731,"nodeType":864},{},[],{"data":3964,"content":3966,"nodeType":883},{"uri":3965},"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html",[3967],{"data":3968,"marks":3969,"value":3970,"nodeType":864},{},[],"Trust Wallet",{"data":3972,"marks":3973,"value":3974,"nodeType":864},{},[],", among many others).",{"data":3976,"content":3977,"nodeType":860},{},[3978,3981,3989,3993,3998,4002,4007],{"data":3979,"marks":3980,"value":21,"nodeType":864},{},[],{"data":3982,"content":3983,"nodeType":883},{"uri":2411},[3984],{"data":3985,"marks":3986,"value":3988,"nodeType":864},{},[3987],{"type":1455},"Analysis of 20,000+ extensions across Push customers",{"data":3990,"marks":3991,"value":3992,"nodeType":864},{},[]," found ",{"data":3994,"marks":3995,"value":3997,"nodeType":864},{},[3996],{"type":899},"46.76% have the permission combinations needed to perform account takeover with no user interaction",{"data":3999,"marks":4000,"value":4001,"nodeType":864},{},[],", making permissions-based risk scoring effectively useless as a triage tool. The real threat model is not malicious extensions at install time — it's legitimate extensions that ",{"data":4003,"marks":4004,"value":4006,"nodeType":864},{},[4005],{"type":2246},"become",{"data":4008,"marks":4009,"value":4010,"nodeType":864},{},[]," malicious after an ownership transfer, developer account compromise, or silent update push. Every major extension supply chain breach of the past 18 months scored as low-risk immediately before compromise.",{"data":4012,"content":4013,"nodeType":860},{},[4014],{"data":4015,"marks":4016,"value":4017,"nodeType":864},{},[],"SWGs and network tools are structurally blind to this attack surface: a malicious extension exfiltrating session tokens generates no anomalous network signal — its traffic is indistinguishable from normal browsing. Endpoint agents have no visibility into extension behavior at the session level. Extension inventory, supply chain change monitoring — ownership transfers, permission escalations, developer contact changes — and enforcement all require browser-layer access by definition.",{"data":4019,"content":4020,"nodeType":1005},{},[],{"data":4022,"content":4023,"nodeType":1009},{},[4024],{"data":4025,"marks":4026,"value":4028,"nodeType":864},{},[4027],{"type":899},"#5 — Shadow SaaS discovery and OAuth integration governance",{"data":4030,"content":4031,"nodeType":860},{},[4032],{"data":4033,"marks":4034,"value":3894,"nodeType":864},{},[4035],{"type":899},{"data":4037,"content":4038,"nodeType":860},{},[4039,4043,4048,4052,4057],{"data":4040,"marks":4041,"value":4042,"nodeType":864},{},[],"Shadow SaaS discovery shares DNA with identity posture hardening (#3) — both start with the same browser-native visibility into login events that no other layer can replicate. Where identity posture focuses on hardening ",{"data":4044,"marks":4045,"value":4047,"nodeType":864},{},[4046],{"type":2246},"how",{"data":4049,"marks":4050,"value":4051,"nodeType":864},{},[]," employees authenticate, shadow SaaS discovery focuses on ",{"data":4053,"marks":4054,"value":4056,"nodeType":864},{},[4055],{"type":2246},"what",{"data":4058,"marks":4059,"value":4060,"nodeType":864},{},[]," they authenticate to: surfacing the full estate of applications in use across the organization, including those that IT has never sanctioned or even heard of.",{"data":4062,"content":4063,"nodeType":860},{},[4064],{"data":4065,"marks":4066,"value":4067,"nodeType":864},{},[],"OAuth integration governance is the component of shadow SaaS that is both the most potentially damaging and the hardest to surface through other means. The SaaS-to-SaaS OAuth pivot is now an industrialized attack pattern.",{"data":4069,"content":4070,"nodeType":941},{},[4071,4092],{"data":4072,"content":4073,"nodeType":945},{},[4074],{"data":4075,"content":4076,"nodeType":860},{},[4077,4080,4088],{"data":4078,"marks":4079,"value":2761,"nodeType":864},{},[],{"data":4081,"content":4083,"nodeType":883},{"uri":4082},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[4084],{"data":4085,"marks":4086,"value":4087,"nodeType":864},{},[],"ShinyHunters",{"data":4089,"marks":4090,"value":4091,"nodeType":864},{},[]," Salesforce campaign — which compromised 1,000+ organizations and 1.5 billion records — demonstrated the full chain: the attacker didn't stop at stealing customer data but harvested OAuth tokens, AWS access keys, and Snowflake tokens from breached tenants and pivoted through connected services like Salesloft, Drift, and Gainsight to reach hundreds more organizations.",{"data":4093,"content":4094,"nodeType":945},{},[4095],{"data":4096,"content":4097,"nodeType":860},{},[4098,4101,4109],{"data":4099,"marks":4100,"value":2761,"nodeType":864},{},[],{"data":4102,"content":4104,"nodeType":883},{"uri":4103},"https://pushsecurity.com/blog/unpacking-the-vercel-breach/",[4105],{"data":4106,"marks":4107,"value":4108,"nodeType":864},{},[],"Context.ai → Vercel",{"data":4110,"marks":4111,"value":4112,"nodeType":864},{},[]," chain followed the same logic — stored OAuth tokens from a forgotten AI app trial provided the bridge into Google Workspace, internal dashboards, and API keys. These are not isolated incidents; they are the repeatable playbook for extracting maximum value from a single compromise through the trust relationships that OAuth connections encode.",{"data":4114,"content":4115,"nodeType":860},{},[4116],{"data":4117,"marks":4118,"value":4119,"nodeType":864},{},[],"Every OAuth consent grant transits the browser — the authorization prompt, the scope disclosure, the user's approval click, and the redirect that completes the grant all happen inside a browser session — which makes the browser the only layer where an unwanted grant can be intercepted before the token is issued and the persistent access path is created. Once a token exists, the damage is done: it survives password resets, MFA changes, and session revocations, and revoking it after the fact requires first knowing it was granted, which most organizations do not.",{"data":4121,"content":4122,"nodeType":1005},{},[],{"data":4124,"content":4125,"nodeType":1009},{},[4126],{"data":4127,"marks":4128,"value":4130,"nodeType":864},{},[4129],{"type":899},"#6 — Blocking ClickFix and social engineering-based malware delivery",{"data":4132,"content":4133,"nodeType":860},{},[4134],{"data":4135,"marks":4136,"value":4138,"nodeType":864},{},[4137],{"type":899},"Security value: High | Browser fit: Strong for interception — shared with endpoint security for execution. ConsentFix is a browser-native exception that is T1-aligned.",{"data":4140,"content":4141,"nodeType":860},{},[4142,4146,4151,4155,4162,4166,4171,4175,4180],{"data":4143,"marks":4144,"value":4145,"nodeType":864},{},[],"ClickFix was the most common initial access vector reported by Microsoft in 2025, accounting for ",{"data":4147,"marks":4148,"value":4150,"nodeType":864},{},[4149],{"type":899},"47% of observed attacks",{"data":4152,"marks":4153,"value":4154,"nodeType":864},{},[],". CrowdStrike's ",{"data":4156,"content":4157,"nodeType":883},{"uri":3237},[4158],{"data":4159,"marks":4160,"value":4161,"nodeType":864},{},[],"2026 Global Threat Report",{"data":4163,"marks":4164,"value":4165,"nodeType":864},{},[]," identified fake CAPTCHA lures as the most common malware download type, increasing ",{"data":4167,"marks":4168,"value":4170,"nodeType":864},{},[4169],{"type":899},"563% year-over-year",{"data":4172,"marks":4173,"value":4174,"nodeType":864},{},[],". The technique writes a malicious command to the victim's clipboard and social-engineers them into executing it. It is fileless (bypassing download scanning), user-executed (bypassing endpoint behavioral detections), and ",{"data":4176,"marks":4177,"value":4179,"nodeType":864},{},[4178],{"type":899},"4 in 5 ClickFix payloads intercepted by Push arrived via search engines",{"data":4181,"marks":4182,"value":4183,"nodeType":864},{},[]," — not email (bypassing email anti-phishing controls).",{"data":4185,"content":4186,"nodeType":860},{},[4187],{"data":4188,"marks":4189,"value":4190,"nodeType":864},{},[],"The browser is the earliest and most effective intervention point — detecting the clipboard injection and social engineering lure before anything reaches the endpoint in executable form. But the problem doesn't end at the browser boundary: once the command has been pasted and run, detection and remediation become endpoint problems, and a mature defense requires both layers. The broader *Fix family — FileFix, InstallFix, and similar derivatives — follows the same pattern, with the browser providing the critical early-warning layer within a defense that spans browser and endpoint.",{"data":4192,"content":4196,"nodeType":996},{"target":4193},{"sys":4194},{"id":4195,"type":1001,"linkType":1002},"39alMHtw9FPHbQINqbAgBN",[],{"data":4198,"content":4199,"nodeType":1005},{},[],{"data":4201,"content":4202,"nodeType":1009},{},[4203],{"data":4204,"marks":4205,"value":4207,"nodeType":864},{},[4206],{"type":899},"#7 — AI visibility and control: enforcing which AI tools employees can use and how",{"data":4209,"content":4210,"nodeType":860},{},[4211],{"data":4212,"marks":4213,"value":4215,"nodeType":864},{},[4214],{"type":899},"Security value: High | Browser fit: Strong for access enforcement — but AI governance is not a new security problem so much as a force multiplier on existing ones",{"data":4217,"content":4218,"nodeType":860},{},[4219,4223,4231,4235,4244],{"data":4220,"marks":4221,"value":4222,"nodeType":864},{},[],"AI adoption is outpacing security governance at nearly every organization, and ",{"data":4224,"content":4225,"nodeType":883},{"uri":2561},[4226],{"data":4227,"marks":4228,"value":4230,"nodeType":864},{},[4229],{"type":899},"71% of organizations are concerned about data leakage via unsanctioned AI apps",{"data":4232,"marks":4233,"value":4234,"nodeType":864},{},[],". But the security problems that AI creates are not, for the most part, novel — they are existing Tier 1 problems amplified by a new category of tooling. Shadow AI apps are shadow SaaS (#5). AI OAuth integrations are OAuth governance (#5). AI browser extensions are extension security (#4). The risk of employees using personal AI accounts — ",{"data":4236,"content":4238,"nodeType":883},{"uri":4237},"https://keepaware.com/blog/46-of-sensitive-data-bypasses-your-dlp",[4239],{"data":4240,"marks":4241,"value":4243,"nodeType":864},{},[4242],{"type":899},"46% of sensitive inputs to AI tools are sent via personal accounts",{"data":4245,"marks":4246,"value":4247,"nodeType":864},{},[]," — is an identity posture problem (#3).",{"data":4249,"content":4250,"nodeType":860},{},[4251],{"data":4252,"marks":4253,"value":4254,"nodeType":864},{},[],"The component parts that allow you to govern AI are individually Tier 1 capabilities, and the browser is the best single layer for gaining visibility and control over AI usage — it sees the apps, the OAuth grants, the extensions, and the account context. But a complete end-to-end solution also requires a presence on the endpoint layer (for local AI tools, IDE-integrated agents, and API-level usage that never touches the browser), and prompt-level DLP on sanctioned tools is better handled by platform-native controls than by browser-layer observation.",{"data":4256,"content":4260,"nodeType":996},{"target":4257},{"sys":4258},{"id":4259,"type":1001,"linkType":1002},"6Py3z9VgjhKrchmYvhmbsq",[],{"data":4262,"content":4263,"nodeType":860},{},[4264],{"data":4265,"marks":4266,"value":4267,"nodeType":864},{},[],"The browser is what makes platform controls effective — if employees are using personal accounts, there are no enterprise audit logs to inspect. And for the growing category of AI agents, agentic browsers, and MCP-connected tools that operate through OAuth grants rather than direct user interaction, the browser is where the consent decisions that authorize those agents are made.",{"data":4269,"content":4270,"nodeType":1005},{},[],{"data":4272,"content":4273,"nodeType":1009},{},[4274],{"data":4275,"marks":4276,"value":4278,"nodeType":864},{},[4277],{"type":899},"#8 — Investigation acceleration and incident response: closing the missing middle",{"data":4280,"content":4281,"nodeType":860},{},[4282],{"data":4283,"marks":4284,"value":4286,"nodeType":864},{},[4285],{"type":899},"Security value: High | Browser fit: Strong — fills a structural gap complementary to endpoint, network, and identity telemetry",{"data":4288,"content":4289,"nodeType":860},{},[4290,4294,4299,4303,4312],{"data":4291,"marks":4292,"value":4293,"nodeType":864},{},[],"Endpoint logs show what processes executed. Network logs show traffic destinations. IdP logs show authentication events. None of them show what happened ",{"data":4295,"marks":4296,"value":4298,"nodeType":864},{},[4297],{"type":2246},"inside the browser session",{"data":4300,"marks":4301,"value":4302,"nodeType":864},{},[]," — the phishing page the user saw, the credentials they entered, the malicious OAuth consent grant, the data uploaded or pasted to an unsanctioned service. This is the missing middle of modern incident investigations, and for the ",{"data":4304,"content":4306,"nodeType":883},{"uri":4305},"https://www.paloaltonetworks.co.uk/resources/research/unit-42-incident-response-report",[4307],{"data":4308,"marks":4309,"value":4311,"nodeType":864},{},[4310],{"type":899},"48% of intrusions involving browser-based activity",{"data":4313,"marks":4314,"value":4315,"nodeType":864},{},[],", the absence of browser telemetry is a significant investigative gap.",{"data":4317,"content":4318,"nodeType":860},{},[4319],{"data":4320,"marks":4321,"value":4322,"nodeType":864},{},[],"Browser-layer telemetry fills that gap with a fundamentally different quality of signal: what users actually clicked, what pages loaded and how they behaved, what credentials were entered, what session activity followed — structured, high-fidelity data from inside the session where the attack played out. That's the difference between inferring what happened and seeing it directly, and it determines scope, drives containment decisions, and provides the direct evidential record that neither endpoint DLP nor network monitoring can supply for browser-native attacks.",{"data":4324,"content":4325,"nodeType":860},{},[4326],{"data":4327,"marks":4328,"value":4329,"nodeType":864},{},[],"Browser telemetry is a key addition to the investigative picture. Investigations are inherently multi-source — without browser data, reconstructing an incident from EDR, network, and IdP logs won't tell you the full picture (particularly when attacks are increasingly delivered outside of email, intercepting users as they browse the internet normally).",{"data":4331,"content":4332,"nodeType":860},{},[4333],{"data":4334,"marks":4335,"value":4336,"nodeType":864},{},[],"The browser provides the causal link that other sources miss: the bridge between \"a user visited a URL\" and \"credentials were submitted to a phishing page that issued a session token now being replayed from an attacker-controlled browser.\" Integrated with SIEM and SOAR platforms, that signal enables automated response workflows to execute on high-confidence detections without waiting for manual triage.",{"data":4338,"content":4339,"nodeType":1005},{},[],{"data":4341,"content":4342,"nodeType":1009},{},[4343],{"data":4344,"marks":4345,"value":4347,"nodeType":864},{},[4346],{"type":899},"#9 — Infostealer defense: detecting exposure and blocking delivery",{"data":4349,"content":4350,"nodeType":860},{},[4351],{"data":4352,"marks":4353,"value":4355,"nodeType":864},{},[4354],{"type":899},"Security value: High | Browser fit: Strong for delivery interception and stolen factor detection — complementary to endpoint security for execution",{"data":4357,"content":4358,"nodeType":860},{},[4359],{"data":4360,"marks":4361,"value":4362,"nodeType":864},{},[],"Infostealers are the upstream supply chain for a disproportionate share of the most damaging enterprise attacks — harvesting credentials, session cookies, and browser profile data en masse from infected devices, then selling the outputs on infostealer markets for use in credential stuffing, ATO, and ransomware campaigns.",{"data":4364,"content":4368,"nodeType":996},{"target":4365},{"sys":4366},{"id":4367,"type":1001,"linkType":1002},"5NF1afwu3zFGThZTtStVQA",[],{"data":4370,"content":4371,"nodeType":860},{},[4372],{"data":4373,"marks":4374,"value":4375,"nodeType":864},{},[],"The browser is relevant at two points in the infostealer kill chain. First, delivery interception: ClickFix (covered in #6) is now the primary infostealer delivery mechanism, and the browser is the only layer that can intercept it before execution. Second, detecting stolen factors when attackers attempt to use them — and infostealers produce two categories of stolen factor that the browser can guard against.",{"data":4377,"content":4378,"nodeType":941},{},[4379,4389],{"data":4380,"content":4381,"nodeType":945},{},[4382],{"data":4383,"content":4384,"nodeType":860},{},[4385],{"data":4386,"marks":4387,"value":4388,"nodeType":864},{},[],"Stolen credentials can be identified at the point of login: browser-layer detection flags credentials that appear in known breach datasets, catching infostealer-harvested passwords being replayed in credential stuffing campaigns before the account is compromised.",{"data":4390,"content":4391,"nodeType":945},{},[4392],{"data":4393,"content":4394,"nodeType":860},{},[4395],{"data":4396,"marks":4397,"value":4398,"nodeType":864},{},[],"Stolen session tokens are caught through a different mechanism: sessions originating in instrumented browsers carry a marker, and when a token subsequently appears in an un-instrumented browser it is a confirmed stolen session — catching infostealer-harvested cookies being replayed regardless of how or where the token was originally harvested.",{"data":4400,"content":4401,"nodeType":860},{},[4402,4406,4415,4419,4424],{"data":4403,"marks":4404,"value":4405,"nodeType":864},{},[],"This is particularly critical for the ",{"data":4407,"content":4409,"nodeType":883},{"uri":4408},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[4410],{"data":4411,"marks":4412,"value":4414,"nodeType":864},{},[4413],{"type":899},"46% of infected devices that are unmanaged",{"data":4416,"marks":4417,"value":4418,"nodeType":864},{},[]," where EDR is absent and the stolen credentials and session tokens will never be detected at the endpoint. Infostealer ",{"data":4420,"marks":4421,"value":4423,"nodeType":864},{},[4422],{"type":2246},"execution",{"data":4425,"marks":4426,"value":4427,"nodeType":864},{},[]," remains an endpoint problem; the browser closes the delivery and replay gaps that endpoint tools miss.",{"data":4429,"content":4430,"nodeType":1005},{},[],{"data":4432,"content":4433,"nodeType":1009},{},[4434],{"data":4435,"marks":4436,"value":4438,"nodeType":864},{},[4437],{"type":899},"#10 — Data loss prevention: a key component of effective DLP, but not the full picture",{"data":4440,"content":4441,"nodeType":860},{},[4442],{"data":4443,"marks":4444,"value":4446,"nodeType":864},{},[4445],{"type":899},"Security value: Medium-high | Browser fit: Partial — complementary to dedicated DLP",{"data":4448,"content":4449,"nodeType":860},{},[4450],{"data":4451,"marks":4452,"value":4453,"nodeType":864},{},[],"File uploads to unsanctioned services, sensitive data pasted into AI tools, and exfiltration through personal accounts are genuine and growing risks that traditional email and endpoint-centric DLP tools were not designed to catch. Browser-layer controls provide real value here — particularly for BYOD users and contractors, where endpoint DLP agents cannot be deployed and the browser is the only available data loss visibility.",{"data":4455,"content":4456,"nodeType":860},{},[4457],{"data":4458,"marks":4459,"value":4460,"nodeType":864},{},[],"The honest scope: browser-layer DLP does not cover email-based loss, endpoint-to-endpoint transfers, or cloud API exfiltration. It closes specific and important gaps within a broader DLP strategy, not a replacement for one. A further distinction for organizations evaluating browser DLP for secure third-party access: full-stack enterprise browsers can enforce deeper output controls — watermarking, obfuscation, screenshot and print restrictions — at the OS rendering level that browser extensions cannot reliably replicate. Extension-based browser DLP is strongest for upload, input, and access control use cases rather than OS-level output restriction.",{"data":4462,"content":4463,"nodeType":1005},{},[],{"data":4465,"content":4466,"nodeType":1009},{},[4467],{"data":4468,"marks":4469,"value":4471,"nodeType":864},{},[4470],{"type":899},"Tier 3 — Lower Value: A problem best addressed outside of the browser",{"data":4473,"content":4474,"nodeType":941},{},[4475,4490,4505,4520],{"data":4476,"content":4477,"nodeType":945},{},[4478],{"data":4479,"content":4480,"nodeType":860},{},[4481,4486],{"data":4482,"marks":4483,"value":4485,"nodeType":864},{},[4484],{"type":899},"Browser exploit protection",{"data":4487,"marks":4488,"value":4489,"nodeType":864},{},[]," (narrow RCE/sandbox sense) ranks lower because browser zero-days represent just 9% of all zero-days reported to Google, and 82% of attack detections are now malware-free (CrowdStrike 2026). This is a problem for browser vendors to solve, and it's not a big enough problem to warrant enterprises investing in additional mitigating controls.",{"data":4491,"content":4492,"nodeType":945},{},[4493],{"data":4494,"content":4495,"nodeType":860},{},[4496,4501],{"data":4497,"marks":4498,"value":4500,"nodeType":864},{},[4499],{"type":899},"Domain and URL category controls",{"data":4502,"marks":4503,"value":4504,"nodeType":864},{},[]," offer genuine browser-layer value but are commoditized by SWG and DNS filtering tools most organizations already operate. This can be provided in the browser, sure (and it's something we do at Push) but offers limited security value in terms of making a difference against modern attacks that quickly rotate these kinds of indicators and are designed to blend in.",{"data":4506,"content":4507,"nodeType":945},{},[4508],{"data":4509,"content":4510,"nodeType":860},{},[4511,4516],{"data":4512,"marks":4513,"value":4515,"nodeType":864},{},[4514],{"type":899},"Access management",{"data":4517,"marks":4518,"value":4519,"nodeType":864},{},[]," — ZTNA, VPN replacement, PAM, BYOD access control — is an IT infrastructure and access architecture problem, not a security operations problem, and belongs to a different buyer with a different evaluation frame. There are numerous (typically full-stack) Enterprise Browser solutions on the market that address IT use cases like this well.",{"data":4521,"content":4522,"nodeType":945},{},[4523],{"data":4524,"content":4525,"nodeType":860},{},[4526,4530],{"data":4527,"marks":4528,"value":781,"nodeType":864},{},[4529],{"type":899},{"data":4531,"marks":4532,"value":4533,"nodeType":864},{},[]," addresses browser exploit risk rather than the identity-first attacks that represent the majority of current enterprise browser risk, and introduces UX friction that limits deployment at scale. When it triggers, it introduces latency but still fails to detect and stop browser-native attacks.",{"data":4535,"content":4536,"nodeType":1005},{},[],{"data":4538,"content":4539,"nodeType":1009},{},[4540],{"data":4541,"marks":4542,"value":4544,"nodeType":864},{},[4543],{"type":899},"How Push Security maps to the highest-value security use cases",{"data":4546,"content":4547,"nodeType":860},{},[4548],{"data":4549,"marks":4550,"value":4551,"nodeType":864},{},[],"Push is purpose-built to address all of these problems using a flexible browser extension — plug into any browser with no migration, no host agent deployment, and no IT overhead — that delivers telemetry and control from day one, and extends coverage to every enrolled browser regardless of device ownership.",{"data":4553,"content":4554,"nodeType":4845},{},[4555,4582,4606,4630,4654,4678,4702,4726,4750,4774,4798,4822],{"data":4556,"content":4557,"nodeType":4581},{},[4558,4570],{"data":4559,"content":4560,"nodeType":4569},{},[4561],{"data":4562,"content":4563,"nodeType":860},{},[4564],{"data":4565,"marks":4566,"value":4568,"nodeType":864},{},[4567],{"type":899},"Security use case","table-cell",{"data":4571,"content":4572,"nodeType":4569},{},[4573],{"data":4574,"content":4575,"nodeType":860},{},[4576],{"data":4577,"marks":4578,"value":4580,"nodeType":864},{},[4579],{"type":899},"How Push addresses it","table-row",{"data":4583,"content":4584,"nodeType":4581},{},[4585,4596],{"data":4586,"content":4587,"nodeType":4569},{},[4588],{"data":4589,"content":4590,"nodeType":860},{},[4591],{"data":4592,"marks":4593,"value":4595,"nodeType":864},{},[4594],{"type":899},"Account takeover prevention",{"data":4597,"content":4598,"nodeType":4569},{},[4599],{"data":4600,"content":4601,"nodeType":860},{},[4602],{"data":4603,"marks":4604,"value":4605,"nodeType":864},{},[],"Surfaces and fixes ghost logins, weak and breached credentials and missing MFA controls across every app and device — including shadow SaaS and unmanaged devices invisible to the IdP. Push also detects and stops the attack techniques that typically lead to ATO early in the kill chain and before an account can be compromised.",{"data":4607,"content":4608,"nodeType":4581},{},[4609,4620],{"data":4610,"content":4611,"nodeType":4569},{},[4612],{"data":4613,"content":4614,"nodeType":860},{},[4615],{"data":4616,"marks":4617,"value":4619,"nodeType":864},{},[4618],{"type":899},"Advanced phishing detection",{"data":4621,"content":4622,"nodeType":4569},{},[4623],{"data":4624,"content":4625,"nodeType":860},{},[4626],{"data":4627,"marks":4628,"value":4629,"nodeType":864},{},[],"Behavioral page analysis detects phishing kits regardless of whether the domain is known-bad. Credential entry guardrails block corporate passwords from being submitted to unauthorized domains. TTP-based detection remains effective as attacker infrastructure rotates.",{"data":4631,"content":4632,"nodeType":4581},{},[4633,4644],{"data":4634,"content":4635,"nodeType":4569},{},[4636],{"data":4637,"content":4638,"nodeType":860},{},[4639],{"data":4640,"marks":4641,"value":4643,"nodeType":864},{},[4642],{"type":899},"Identity posture hardening",{"data":4645,"content":4646,"nodeType":4569},{},[4647],{"data":4648,"content":4649,"nodeType":860},{},[4650],{"data":4651,"marks":4652,"value":4653,"nodeType":864},{},[],"Enforces MFA, strong credentials, and SSO adoption across every app the IdP doesn't manage. Produces continuous, auditable MFA coverage and credential hygiene evidence across the full application and device estate.",{"data":4655,"content":4656,"nodeType":4581},{},[4657,4668],{"data":4658,"content":4659,"nodeType":4569},{},[4660],{"data":4661,"content":4662,"nodeType":860},{},[4663],{"data":4664,"marks":4665,"value":4667,"nodeType":864},{},[4666],{"type":899},"Browser extension security",{"data":4669,"content":4670,"nodeType":4569},{},[4671],{"data":4672,"content":4673,"nodeType":860},{},[4674],{"data":4675,"marks":4676,"value":4677,"nodeType":864},{},[],"Live extension inventory with supply chain change event monitoring — ownership transfers, permission escalations, developer contact changes — rather than static risk scoring. Supports default-deny allowlisting and remote extension removal. Blocks known-bad malicious extensions automatically.",{"data":4679,"content":4680,"nodeType":4581},{},[4681,4692],{"data":4682,"content":4683,"nodeType":4569},{},[4684],{"data":4685,"content":4686,"nodeType":860},{},[4687],{"data":4688,"marks":4689,"value":4691,"nodeType":864},{},[4690],{"type":899},"Shadow SaaS and OAuth governance",{"data":4693,"content":4694,"nodeType":4569},{},[4695],{"data":4696,"content":4697,"nodeType":860},{},[4698],{"data":4699,"marks":4700,"value":4701,"nodeType":864},{},[],"Discovers shadow SaaS from actual login events with full authentication context. Monitors and blocks OAuth consent flows — including AI and MCP integrations — in real time before persistent access paths are created.",{"data":4703,"content":4704,"nodeType":4581},{},[4705,4716],{"data":4706,"content":4707,"nodeType":4569},{},[4708],{"data":4709,"content":4710,"nodeType":860},{},[4711],{"data":4712,"marks":4713,"value":4715,"nodeType":864},{},[4714],{"type":899},"ClickFix and the *Fix family",{"data":4717,"content":4718,"nodeType":4569},{},[4719],{"data":4720,"content":4721,"nodeType":860},{},[4722],{"data":4723,"marks":4724,"value":4725,"nodeType":864},{},[],"Detects and blocks ClickFix lures, clipboard injection, and browser-native variants like ConsentFix in real time — before the payload executes or OAuth key material is captured.",{"data":4727,"content":4728,"nodeType":4581},{},[4729,4740],{"data":4730,"content":4731,"nodeType":4569},{},[4732],{"data":4733,"content":4734,"nodeType":860},{},[4735],{"data":4736,"marks":4737,"value":4739,"nodeType":864},{},[4738],{"type":899},"AI visibility & control",{"data":4741,"content":4742,"nodeType":4569},{},[4743],{"data":4744,"content":4745,"nodeType":860},{},[4746],{"data":4747,"marks":4748,"value":4749,"nodeType":864},{},[],"Enforces which AI tools employees can access and routes usage to corporate tenants. Governs AI browser extensions and blocks OAuth consent grants to unapproved AI applications — drawing on the same Tier 1 capabilities (OAuth governance, extension security, shadow SaaS discovery) that make this possible.",{"data":4751,"content":4752,"nodeType":4581},{},[4753,4764],{"data":4754,"content":4755,"nodeType":4569},{},[4756],{"data":4757,"content":4758,"nodeType":860},{},[4759],{"data":4760,"marks":4761,"value":4763,"nodeType":864},{},[4762],{"type":899},"Security investigations & incident response",{"data":4765,"content":4766,"nodeType":4569},{},[4767],{"data":4768,"content":4769,"nodeType":860},{},[4770],{"data":4771,"marks":4772,"value":4773,"nodeType":864},{},[],"High-fidelity session telemetry — page loads, credential entries, DOM changes, OAuth grants — fills the missing middle that endpoint, network, and IdP logs leave open. Feeds directly into SIEM and SOAR for automated response.",{"data":4775,"content":4776,"nodeType":4581},{},[4777,4788],{"data":4778,"content":4779,"nodeType":4569},{},[4780],{"data":4781,"content":4782,"nodeType":860},{},[4783],{"data":4784,"marks":4785,"value":4787,"nodeType":864},{},[4786],{"type":899},"Infostealer defense",{"data":4789,"content":4790,"nodeType":4569},{},[4791],{"data":4792,"content":4793,"nodeType":860},{},[4794],{"data":4795,"marks":4796,"value":4797,"nodeType":864},{},[],"Intercepts ClickFix-based infostealer delivery before execution. Detects token replay in unenrolled browser contexts — catching post-theft abuse from AiTM-sourced tokens and infostealer-harvested cookies, including from unmanaged devices.",{"data":4799,"content":4800,"nodeType":4581},{},[4801,4812],{"data":4802,"content":4803,"nodeType":4569},{},[4804],{"data":4805,"content":4806,"nodeType":860},{},[4807],{"data":4808,"marks":4809,"value":4811,"nodeType":864},{},[4810],{"type":899},"Data loss prevention",{"data":4813,"content":4814,"nodeType":4569},{},[4815],{"data":4816,"content":4817,"nodeType":860},{},[4818],{"data":4819,"marks":4820,"value":4821,"nodeType":864},{},[],"Observes file uploads, downloads, and sensitive data inputs across all applications. Extends data loss visibility to BYOD and contractor devices where endpoint DLP cannot reach.",{"data":4823,"content":4824,"nodeType":4581},{},[4825,4835],{"data":4826,"content":4827,"nodeType":4569},{},[4828],{"data":4829,"content":4830,"nodeType":860},{},[4831],{"data":4832,"marks":4833,"value":4500,"nodeType":864},{},[4834],{"type":899},{"data":4836,"content":4837,"nodeType":4569},{},[4838],{"data":4839,"content":4840,"nodeType":860},{},[4841],{"data":4842,"marks":4843,"value":4844,"nodeType":864},{},[],"Custom URL blocklists with wildcard support and REST API management for threat intelligence feed sync. Application category blocking restricts access to classes of apps (file-sharing, unsanctioned AI tools) configurable by user group. Domain categorization bringing SWG-style category blocking natively to the browser without a network proxy.","table",{"data":4847,"content":4848,"nodeType":1005},{},[],{"data":4850,"content":4851,"nodeType":860},{},[4852,4856,4862],{"data":4853,"marks":4854,"value":4855,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":4857,"content":4858,"nodeType":883},{"uri":1700},[4859],{"data":4860,"marks":4861,"value":1703,"nodeType":864},{},[],{"data":4863,"marks":4864,"value":21,"nodeType":864},{},[],"The top 10 security problems you can solve in the browser — ranked by value","Ranking the security problems you can solve in the browser by security value and browser fit.","2026-05-14T00:00:00.000Z","the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value",{"items":4870},[4871,4873],{"sys":4872,"name":297},{"id":2732},{"sys":4874,"name":2729},{"id":2728},{"items":4876},[4877],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":4880},"Alex Henshall","Alex",{"url":4881},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg","shadow-ai-how-to-discover-govern-and-secure-ai-apps","blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps","Why you need paved paths, not barricades, for secure AI adoption",{"json":4886},{"data":4887,"content":4888,"nodeType":856},{},[4889],{"data":4890,"content":4891,"nodeType":860},{},[4892],{"data":4893,"marks":4894,"value":4895,"nodeType":864},{},[],"Blocking AI tools doesn't stop employees from using AI — it stops you seeing how they use it. The solution: make the governed path easier than the workaround.",{"id":4897,"publishedAt":4898},"7MB9tEe6mrdNXbkYVhgyWn","2026-08-13T13:06:46.644Z",{"items":4900},[4901,4905],{"sys":4902,"name":4904},{"id":4903},"3SA5H01UkKauuiTdt0KC6q","Shadow IT",{"sys":4906,"name":545},{"id":4907},"7ohk9lIkxMvJMwnp2Lhuad",{"items":4909},[4910,4912,4914,4916,4918,4920,4922,4924,4926,4928,4930,4932,4934,4936,4938,4940],{"sys":4911,"name":580,"slug":581,"tier":45},{"id":577},{"sys":4913,"name":589,"slug":590,"tier":45},{"id":586},{"sys":4915,"name":633,"slug":634,"tier":45},{"id":630},{"sys":4917,"name":624,"slug":625,"tier":45},{"id":621},{"sys":4919,"name":545,"slug":546,"tier":31},{"id":542},{"sys":4921,"name":484,"slug":485,"tier":45},{"id":481},{"sys":4923,"name":431,"slug":432,"tier":45},{"id":428},{"sys":4925,"name":413,"slug":414,"tier":31},{"id":410},{"sys":4927,"name":368,"slug":369,"tier":45},{"id":365},{"sys":4929,"name":351,"slug":352,"tier":45},{"id":348},{"sys":4931,"name":306,"slug":307,"tier":45},{"id":303},{"sys":4933,"name":288,"slug":289,"tier":45},{"id":285},{"sys":4935,"name":297,"slug":298,"tier":31},{"id":294},{"sys":4937,"name":252,"slug":253,"tier":45},{"id":249},{"sys":4939,"name":235,"slug":236,"tier":31},{"id":232},{"sys":4941,"name":244,"slug":245,"tier":45},{"id":241},"Zx6fn8UdirkncRHJf51fcJD_Tl5wsbmvST1BUx0fsQ8",{"id":4944,"title":4945,"authorsCollection":4946,"content":4954,"extension":228,"faqItemsCollection":5352,"faqTitle":59,"featured":6,"hashTags":59,"meta":5354,"metaTitle":5355,"ogImage":59,"postType":5356,"publishedDate":5357,"relatedBlogPostsCollection":5358,"slug":6166,"stem":6167,"subtitle":59,"summary":6168,"synopsis":6179,"sys":6180,"tagsCollection":6183,"topicsCollection":6187,"__hash__":6197},"blog/blog/product-release-july-2026.json","Product release: July 2026",{"items":4947},[4948],{"fullName":4949,"firstName":4950,"jobTitle":4951,"socialLinks":59,"profilePicture":4952},"Andy Waugh","Andy","VP Product",{"url":4953},"https://images.ctfassets.net/y1cdw1ablpvd/3Rf76rJn6S9inMb4dUnAIJ/0a787f8141d05b95300e2fe77c4493fa/DSC_6868.jpg",{"json":4955,"links":5285},{"data":4956,"content":4957,"nodeType":856},{},[4958,4965,5006,5013,5028,5035,5041,5048,5068,5075,5090,5097,5103,5125,5143,5150,5173,5180,5186,5207,5225,5232,5239,5245,5266],{"data":4959,"content":4960,"nodeType":1009},{},[4961],{"data":4962,"marks":4963,"value":4964,"nodeType":864},{},[],"What’s new this month",{"data":4966,"content":4967,"nodeType":941},{},[4968,4977,4986,4996],{"data":4969,"content":4970,"nodeType":945},{},[4971],{"data":4972,"content":4973,"nodeType":860},{},[4974],{"data":4975,"marks":4976,"value":1487,"nodeType":864},{},[],{"data":4978,"content":4979,"nodeType":945},{},[4980],{"data":4981,"content":4982,"nodeType":860},{},[4983],{"data":4984,"marks":4985,"value":1533,"nodeType":864},{},[],{"data":4987,"content":4988,"nodeType":945},{},[4989],{"data":4990,"content":4991,"nodeType":860},{},[4992],{"data":4993,"marks":4994,"value":4995,"nodeType":864},{},[],"File upload blocking & telemetry",{"data":4997,"content":4998,"nodeType":945},{},[4999],{"data":5000,"content":5001,"nodeType":860},{},[5002],{"data":5003,"marks":5004,"value":5005,"nodeType":864},{},[],"App categorization",{"data":5007,"content":5008,"nodeType":1009},{},[5009],{"data":5010,"marks":5011,"value":5012,"nodeType":864},{},[],"Prevent sensitive data from being copied and pasted",{"data":5014,"content":5015,"nodeType":860},{},[5016,5020,5024],{"data":5017,"marks":5018,"value":5019,"nodeType":864},{},[],"You can now block clipboard copy and paste operations containing content that is unauthorized, sensitive, or that doesn’t conform to your security policies using Push’s new ",{"data":5021,"marks":5022,"value":1487,"nodeType":864},{},[5023],{"type":899},{"data":5025,"marks":5026,"value":5027,"nodeType":864},{},[]," control.",{"data":5029,"content":5030,"nodeType":860},{},[5031],{"data":5032,"marks":5033,"value":5034,"nodeType":864},{},[],"Push provides content patterns for common data types like API keys, personal access tokens, PII, and other sensitive information you may wish to monitor, warn, or block on. You can also define your own content patterns, or warn or block all clipboard actions for a given URL pattern.",{"data":5036,"content":5040,"nodeType":996},{"target":5037},{"sys":5038},{"id":5039,"type":1001,"linkType":1002},"7aIWluJBmyEwqbyJIyj4yc",[],{"data":5042,"content":5043,"nodeType":860},{},[5044],{"data":5045,"marks":5046,"value":5047,"nodeType":864},{},[],"Clipboard events matching your configured rules can be sent to your SIEM or other downstream tool using custom webhook.",{"data":5049,"content":5050,"nodeType":860},{},[5051,5054,5065],{"data":5052,"marks":5053,"value":21,"nodeType":864},{},[],{"data":5055,"content":5059,"nodeType":5064},{"target":5056},{"sys":5057},{"id":5058,"type":1001,"linkType":1002},"1uLNsRZsrUu6zAIs1fKjAg",[5060],{"data":5061,"marks":5062,"value":5063,"nodeType":864},{},[],"Learn more","entry-hyperlink",{"data":5066,"marks":5067,"value":21,"nodeType":864},{},[],{"data":5069,"content":5070,"nodeType":1009},{},[5071],{"data":5072,"marks":5073,"value":5074,"nodeType":864},{},[],"Block unauthorized or risky file downloads",{"data":5076,"content":5077,"nodeType":860},{},[5078,5082,5086],{"data":5079,"marks":5080,"value":5081,"nodeType":864},{},[],"Push can now block unpermitted or risky file downloads. Configure the ",{"data":5083,"marks":5084,"value":1533,"nodeType":864},{},[5085],{"type":899},{"data":5087,"marks":5088,"value":5089,"nodeType":864},{},[]," control to enforce your security policy around when users are permitted to download specific file types or from specific destinations.",{"data":5091,"content":5092,"nodeType":860},{},[5093],{"data":5094,"marks":5095,"value":5096,"nodeType":864},{},[],"You can also use this capability to block downloads of unwanted AI tools.",{"data":5098,"content":5102,"nodeType":996},{"target":5099},{"sys":5100},{"id":5101,"type":1001,"linkType":1002},"6CiB7JH42atcn7yQ6c3g6W",[],{"data":5104,"content":5105,"nodeType":860},{},[5106,5110,5121],{"data":5107,"marks":5108,"value":5109,"nodeType":864},{},[],"This feature complements the ",{"data":5111,"content":5115,"nodeType":5064},{"target":5112},{"sys":5113},{"id":5114,"type":1001,"linkType":1002},"2gzIJQtEn6hEzpGlpyVg2m",[5116],{"data":5117,"marks":5118,"value":5120,"nodeType":864},{},[5119],{"type":899},"File download telemetry",{"data":5122,"marks":5123,"value":5124,"nodeType":864},{},[]," feed, which allows you to capture all file download events in your environment.",{"data":5126,"content":5127,"nodeType":860},{},[5128,5131,5140],{"data":5129,"marks":5130,"value":21,"nodeType":864},{},[],{"data":5132,"content":5136,"nodeType":5064},{"target":5133},{"sys":5134},{"id":5135,"type":1001,"linkType":1002},"4mYt4biAhBS6uEBoinYoQf",[5137],{"data":5138,"marks":5139,"value":5063,"nodeType":864},{},[],{"data":5141,"marks":5142,"value":21,"nodeType":864},{},[],{"data":5144,"content":5145,"nodeType":1009},{},[5146],{"data":5147,"marks":5148,"value":5149,"nodeType":864},{},[],"Block file uploads and alert on file upload activity",{"data":5151,"content":5152,"nodeType":860},{},[5153,5157,5161,5165,5170],{"data":5154,"marks":5155,"value":5156,"nodeType":864},{},[],"You can also block file uploads using the new ",{"data":5158,"marks":5159,"value":1521,"nodeType":864},{},[5160],{"type":899},{"data":5162,"marks":5163,"value":5164,"nodeType":864},{},[]," control, and consume a telemetry feed of all file upload events in your environment using ",{"data":5166,"marks":5167,"value":5169,"nodeType":864},{},[5168],{"type":899},"File upload telemetry",{"data":5171,"marks":5172,"value":2924,"nodeType":864},{},[],{"data":5174,"content":5175,"nodeType":860},{},[5176],{"data":5177,"marks":5178,"value":5179,"nodeType":864},{},[],"For example, you may wish to block or warn users when they attempt to upload files that could contain sensitive information, or stop them from uploading files to AI apps that pose a risk for data loss or security incidents.",{"data":5181,"content":5185,"nodeType":996},{"target":5182},{"sys":5183},{"id":5184,"type":1001,"linkType":1002},"7Ep9Jpd9eYkIXMjA4CDRpC",[],{"data":5187,"content":5188,"nodeType":860},{},[5189,5193,5203],{"data":5190,"marks":5191,"value":5192,"nodeType":864},{},[],"The complementary telemetry stream for this control allows you to consume events for ",{"data":5194,"content":5198,"nodeType":5064},{"target":5195},{"sys":5196},{"id":5197,"type":1001,"linkType":1002},"11Rc2WDooPUQzLR3gYz2KY",[5199],{"data":5200,"marks":5201,"value":5202,"nodeType":864},{},[],"all file uploads",{"data":5204,"marks":5205,"value":5206,"nodeType":864},{},[]," in your environment.",{"data":5208,"content":5209,"nodeType":860},{},[5210,5213,5222],{"data":5211,"marks":5212,"value":21,"nodeType":864},{},[],{"data":5214,"content":5218,"nodeType":5064},{"target":5215},{"sys":5216},{"id":5217,"type":1001,"linkType":1002},"5J29qC6WfSUOPwzTLmwiF5",[5219],{"data":5220,"marks":5221,"value":5063,"nodeType":864},{},[],{"data":5223,"marks":5224,"value":21,"nodeType":864},{},[],{"data":5226,"content":5227,"nodeType":1009},{},[5228],{"data":5229,"marks":5230,"value":5231,"nodeType":864},{},[],"App categories now automatically applied",{"data":5233,"content":5234,"nodeType":860},{},[5235],{"data":5236,"marks":5237,"value":5238,"nodeType":864},{},[],"Push now automatically categorizes the apps in your inventory and new apps it observes. ",{"data":5240,"content":5244,"nodeType":996},{"target":5241},{"sys":5242},{"id":5243,"type":1001,"linkType":1002},"5jebrzsn65MokK2rBst80",[],{"data":5246,"content":5247,"nodeType":860},{},[5248,5252,5262],{"data":5249,"marks":5250,"value":5251,"nodeType":864},{},[],"You can also use these categories to power ",{"data":5253,"content":5257,"nodeType":5064},{"target":5254},{"sys":5255},{"id":5256,"type":1001,"linkType":1002},"2ti5f4Eh4teqnVkKDgztcm",[5258],{"data":5259,"marks":5260,"value":5261,"nodeType":864},{},[],"App banner rules",{"data":5263,"marks":5264,"value":5265,"nodeType":864},{},[],". For example, you may wish to block all file-sharing or AI apps except the ones you allow. ",{"data":5267,"content":5268,"nodeType":860},{},[5269,5272,5281],{"data":5270,"marks":5271,"value":21,"nodeType":864},{},[],{"data":5273,"content":5277,"nodeType":5064},{"target":5274},{"sys":5275},{"id":5276,"type":1001,"linkType":1002},"2fdBRTkqFvlnmN5RnaBUj6",[5278],{"data":5279,"marks":5280,"value":5063,"nodeType":864},{},[],{"data":5282,"marks":5283,"value":5284,"nodeType":864},{},[],"\n\n\n\n",{"entries":5286},{"inline":5287,"hyperlink":5288,"block":5325},[],[5289,5295,5300,5305,5310,5315,5320],{"sys":5290,"__typename":5291,"title":5292,"slug":5293,"articleId":5294},{"id":5058},"HelpArticle","Can Push block clipboard actions?","can-push-block-clipboard-actions",10157,{"sys":5296,"__typename":5291,"title":5297,"slug":5298,"articleId":5299},{"id":5114},"Can Push detect and alert on file downloads?","can-push-detect-and-alert-on-file-downloads",10153,{"sys":5301,"__typename":5291,"title":5302,"slug":5303,"articleId":5304},{"id":5135},"Can Push block file downloads?","can-push-block-file-downloads",10158,{"sys":5306,"__typename":5291,"title":5307,"slug":5308,"articleId":5309},{"id":5197},"Can Push detect and alert on file uploads?","can-push-detect-and-alert-on-file-uploads",10154,{"sys":5311,"__typename":5291,"title":5312,"slug":5313,"articleId":5314},{"id":5217},"Can Push block file uploads?","can-push-block-file-uploads",10159,{"sys":5316,"__typename":5291,"title":5317,"slug":5318,"articleId":5319},{"id":5256},"How to create a rule for app banners","how-to-create-a-configuration-rule-for-app-banners",10125,{"sys":5321,"__typename":5291,"title":5322,"slug":5323,"articleId":5324},{"id":5276},"Does Push automatically categorize apps it discovers?","does-push-automatically-categorize-apps-it-discovers",10160,[5326,5333,5339,5345],{"sys":5327,"__typename":1724,"title":5328,"caption":59,"layoutMode":59,"file":5329},{"id":5039},"Clipboard warn example - release notes - July 2026",{"url":5330,"width":5331,"height":5332},"https://images.ctfassets.net/y1cdw1ablpvd/4NoWZp6WCmn6Zu6WNzcxxb/c723babb880e180adc67a0321738ea95/clipboard_warn_example.png",3420,2214,{"sys":5334,"__typename":1724,"title":5335,"caption":59,"layoutMode":59,"file":5336},{"id":5101},"File download blocked banner - KB 10158",{"url":5337,"width":1736,"height":5338},"https://images.ctfassets.net/y1cdw1ablpvd/D8ah4yuOUEGg0Oye7ty96/4d4cec338176fc2b0cfd63f4c6fa7b74/file_download_block_banner_20260609.png",1096,{"sys":5340,"__typename":1724,"title":5341,"caption":59,"layoutMode":59,"file":5342},{"id":5184},"File upload blocking example - KB 10159",{"url":5343,"width":1736,"height":5344},"https://images.ctfassets.net/y1cdw1ablpvd/6LLIBdYQ5D7bG7X6btlr27/38f407c82af9d6c113f609a1f0a5e151/file_upload_block_example_20260610.png",1072,{"sys":5346,"__typename":1724,"title":5347,"caption":59,"layoutMode":59,"file":5348},{"id":5243},"App inventory - app categories - KB 10160",{"url":5349,"width":5350,"height":5351},"https://images.ctfassets.net/y1cdw1ablpvd/2PGW4nGLQvuz6HMakwp36p/3f98e6964577f3abc8e624736d44a6e4/app_categories_20260604.png",3012,1714,{"items":5353},[],{},"Push Security new product features for July 2026","release-notes","2026-07-20T00:00:00.000Z",{"items":5359},[5360,5653],{"__typename":2059,"sys":5361,"content":5363,"title":5639,"synopsis":5640,"hashTags":59,"publishedDate":5641,"slug":5642,"tagsCollection":5643,"authorsCollection":5649},{"id":5362},"4CnX1gLNvcwsbed1q4kTEj",{"json":5364},{"data":5365,"content":5366,"nodeType":856},{},[5367,5373,5415,5422,5429,5436,5443,5486,5502,5509,5516,5523,5539,5546,5563,5569,5576,5594,5600,5618,5625,5632],{"data":5368,"content":5369,"nodeType":1009},{},[5370],{"data":5371,"marks":5372,"value":4964,"nodeType":864},{},[],{"data":5374,"content":5375,"nodeType":941},{},[5376,5386,5395,5405],{"data":5377,"content":5378,"nodeType":945},{},[5379],{"data":5380,"content":5381,"nodeType":860},{},[5382],{"data":5383,"marks":5384,"value":5385,"nodeType":864},{},[],"Custom detections",{"data":5387,"content":5388,"nodeType":945},{},[5389],{"data":5390,"content":5391,"nodeType":860},{},[5392],{"data":5393,"marks":5394,"value":5120,"nodeType":864},{},[],{"data":5396,"content":5397,"nodeType":945},{},[5398],{"data":5399,"content":5400,"nodeType":860},{},[5401],{"data":5402,"marks":5403,"value":5404,"nodeType":864},{},[],"Prevent password entry into non-password fields",{"data":5406,"content":5407,"nodeType":945},{},[5408],{"data":5409,"content":5410,"nodeType":860},{},[5411],{"data":5412,"marks":5413,"value":5414,"nodeType":864},{},[],"Expansion of Events window to 30 days",{"data":5416,"content":5417,"nodeType":1009},{},[5418],{"data":5419,"marks":5420,"value":5421,"nodeType":864},{},[],"Create your own custom detections",{"data":5423,"content":5424,"nodeType":860},{},[5425],{"data":5426,"marks":5427,"value":5428,"nodeType":864},{},[],"You can now write your own detections using Push’s real-time detection engine to target specific elements of the page DOM, web requests and responses, HTTP headers such as cookies, and a lot more.",{"data":5430,"content":5431,"nodeType":860},{},[5432],{"data":5433,"marks":5434,"value":5435,"nodeType":864},{},[],"Rules are written in YAML in the Push admin console. You can define a response action (e.g. Warn or Block) and customize the end-user message, similar to other Push controls.",{"data":5437,"content":5438,"nodeType":860},{},[5439],{"data":5440,"marks":5441,"value":5442,"nodeType":864},{},[],"Example use cases:",{"data":5444,"content":5445,"nodeType":941},{},[5446,5456,5466,5476],{"data":5447,"content":5448,"nodeType":945},{},[5449],{"data":5450,"content":5451,"nodeType":860},{},[5452],{"data":5453,"marks":5454,"value":5455,"nodeType":864},{},[],"Detect a specific IOC or TTP for campaigns targeting your organization.",{"data":5457,"content":5458,"nodeType":945},{},[5459],{"data":5460,"content":5461,"nodeType":860},{},[5462],{"data":5463,"marks":5464,"value":5465,"nodeType":864},{},[],"Partner with your red team to detect custom tooling during pen testing.",{"data":5467,"content":5468,"nodeType":945},{},[5469],{"data":5470,"content":5471,"nodeType":860},{},[5472],{"data":5473,"marks":5474,"value":5475,"nodeType":864},{},[],"Alert on specific user behaviors on webpages that point to risk or violate policy.",{"data":5477,"content":5478,"nodeType":945},{},[5479],{"data":5480,"content":5481,"nodeType":860},{},[5482],{"data":5483,"marks":5484,"value":5485,"nodeType":864},{},[],"Block unauthorized MCP connections.",{"data":5487,"content":5488,"nodeType":860},{},[5489,5492,5499],{"data":5490,"marks":5491,"value":21,"nodeType":864},{},[],{"data":5493,"content":5495,"nodeType":883},{"uri":5494},"https://pushsecurity.com/help/audience/engineering/resources/custom-detections",[5496],{"data":5497,"marks":5498,"value":5063,"nodeType":864},{},[],{"data":5500,"marks":5501,"value":21,"nodeType":864},{},[],{"data":5503,"content":5504,"nodeType":1009},{},[5505],{"data":5506,"marks":5507,"value":5508,"nodeType":864},{},[],"Stream telemetry on file download events",{"data":5510,"content":5511,"nodeType":860},{},[5512],{"data":5513,"marks":5514,"value":5515,"nodeType":864},{},[],"You can now consume a feed of file download events into your SIEM or SOAR. These events report file metadata, such as file name, download URLs, and MIME type, as well as whether the download was considered unsafe.",{"data":5517,"content":5518,"nodeType":860},{},[5519],{"data":5520,"marks":5521,"value":5522,"nodeType":864},{},[],"Events are generated for traditional network-based downloads, but also downloads of files constructed in the browser, such as those via blob or data URLs.",{"data":5524,"content":5525,"nodeType":860},{},[5526,5530,5535],{"data":5527,"marks":5528,"value":5529,"nodeType":864},{},[],"You can enable this feed for all employees, employee groups, or specific individuals; and for all profiles, profiles logged in with a company domain, or profiles logged in with a non-company domain. Go to ",{"data":5531,"marks":5532,"value":5534,"nodeType":864},{},[5533],{"type":899},"Settings > Telemetry > File downloads",{"data":5536,"marks":5537,"value":5538,"nodeType":864},{},[]," to configure it.",{"data":5540,"content":5541,"nodeType":860},{},[5542],{"data":5543,"marks":5544,"value":5545,"nodeType":864},{},[],"Next, we’ll be adding a control that allows you implement a policy around which downloads are permitted from where, so you can block unwanted or potentially malicious files directly at the point of download.",{"data":5547,"content":5548,"nodeType":860},{},[5549,5552,5560],{"data":5550,"marks":5551,"value":21,"nodeType":864},{},[],{"data":5553,"content":5556,"nodeType":5064},{"target":5554},{"sys":5555},{"id":5114,"type":1001,"linkType":1002},[5557],{"data":5558,"marks":5559,"value":5063,"nodeType":864},{},[],{"data":5561,"marks":5562,"value":21,"nodeType":864},{},[],{"data":5564,"content":5565,"nodeType":1009},{},[5566],{"data":5567,"marks":5568,"value":5404,"nodeType":864},{},[],{"data":5570,"content":5571,"nodeType":860},{},[5572],{"data":5573,"marks":5574,"value":5575,"nodeType":864},{},[],"You can prevent users from mistakenly entering their password into non-password fields such as username or email fields when they’re signing in to the app that password is associated with.",{"data":5577,"content":5578,"nodeType":860},{},[5579,5583,5591],{"data":5580,"marks":5581,"value":5582,"nodeType":864},{},[],"You may wish to prevent the entry of passwords into non-password fields particularly for core applications like your identity provider. By blocking incorrect password entry, you can avoid inadvertently recording passwords in your app logs, which can ",{"data":5584,"content":5586,"nodeType":883},{"uri":5585},"https://attack.mitre.org/techniques/T1552/001/",[5587],{"data":5588,"marks":5589,"value":5590,"nodeType":864},{},[],"introduce security risk",{"data":5592,"marks":5593,"value":2924,"nodeType":864},{},[],{"data":5595,"content":5599,"nodeType":996},{"target":5596},{"sys":5597},{"id":5598,"type":1001,"linkType":1002},"1utNf3bb143PvfGS0BvDUK",[],{"data":5601,"content":5602,"nodeType":860},{},[5603,5606,5615],{"data":5604,"marks":5605,"value":21,"nodeType":864},{},[],{"data":5607,"content":5611,"nodeType":5064},{"target":5608},{"sys":5609},{"id":5610,"type":1001,"linkType":1002},"2h2EfKDrmw2ZsXFQuBZmS4",[5612],{"data":5613,"marks":5614,"value":5063,"nodeType":864},{},[],{"data":5616,"marks":5617,"value":21,"nodeType":864},{},[],{"data":5619,"content":5620,"nodeType":1009},{},[5621],{"data":5622,"marks":5623,"value":5624,"nodeType":864},{},[],"Events page now displays up to 30 days of data",{"data":5626,"content":5627,"nodeType":860},{},[5628],{"data":5629,"marks":5630,"value":5631,"nodeType":864},{},[],"We’ve expanded the storage window for events viewable on the Push admin console Events page to assist with quick triage. It is now 30 days, instead of 7.",{"data":5633,"content":5634,"nodeType":860},{},[5635],{"data":5636,"marks":5637,"value":5638,"nodeType":864},{},[],"As before, we recommend ingesting Push events into your SIEM for longer-term storage, querying, and correlation.\n","Product release: May 2026","Here’s what’s new on the Push platform for May 2026.","2026-05-29T00:00:00.000Z","product-release-may-2026",{"items":5644},[5645],{"sys":5646,"name":5648},{"id":5647},"5jk0kqjSdSK2L0YiistQjY","Release notes",{"items":5650},[5651],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":5652},{"url":4953},{"__typename":2059,"sys":5654,"content":5656,"title":6154,"synopsis":6155,"hashTags":59,"publishedDate":6156,"slug":6157,"tagsCollection":6158,"authorsCollection":6162},{"id":5655},"3Yw48rVLntipUijLR0CYf2",{"json":5657},{"data":5658,"content":5659,"nodeType":856},{},[5660,5667,5730,5737,5744,5760,5776,5782,5800,5806,5821,5828,5834,5852,5858,5879,5912,5930,5936,5943,5958,5964,5982,5988,5995,6018,6043,6061,6068,6075,6148],{"data":5661,"content":5662,"nodeType":1009},{},[5663],{"data":5664,"marks":5665,"value":5666,"nodeType":864},{},[],"What's new this month:",{"data":5668,"content":5669,"nodeType":941},{},[5670,5680,5690,5700,5710,5720],{"data":5671,"content":5672,"nodeType":945},{},[5673],{"data":5674,"content":5675,"nodeType":860},{},[5676],{"data":5677,"marks":5678,"value":5679,"nodeType":864},{},[],"Detect malicious browser extensions",{"data":5681,"content":5682,"nodeType":945},{},[5683],{"data":5684,"content":5685,"nodeType":860},{},[5686],{"data":5687,"marks":5688,"value":5689,"nodeType":864},{},[],"Create a blocklist or allowlist for browser extensions",{"data":5691,"content":5692,"nodeType":945},{},[5693],{"data":5694,"content":5695,"nodeType":860},{},[5696],{"data":5697,"marks":5698,"value":5699,"nodeType":864},{},[],"Block ClickFix-style attacks and collect payloads for investigation",{"data":5701,"content":5702,"nodeType":945},{},[5703],{"data":5704,"content":5705,"nodeType":860},{},[5706],{"data":5707,"marks":5708,"value":5709,"nodeType":864},{},[],"Custom branding for employee-facing banners and block pages",{"data":5711,"content":5712,"nodeType":945},{},[5713],{"data":5714,"content":5715,"nodeType":860},{},[5716],{"data":5717,"marks":5718,"value":5719,"nodeType":864},{},[],"Collect additional metadata to support threat detection",{"data":5721,"content":5722,"nodeType":945},{},[5723],{"data":5724,"content":5725,"nodeType":860},{},[5726],{"data":5727,"marks":5728,"value":5729,"nodeType":864},{},[],"And a few other things … ",{"data":5731,"content":5732,"nodeType":1009},{},[5733],{"data":5734,"marks":5735,"value":5736,"nodeType":864},{},[],"Detect malicious extensions",{"data":5738,"content":5739,"nodeType":860},{},[5740],{"data":5741,"marks":5742,"value":5743,"nodeType":864},{},[],"Push can now detect and block malicious browser extensions found in your environment. ",{"data":5745,"content":5746,"nodeType":860},{},[5747,5751,5756],{"data":5748,"marks":5749,"value":5750,"nodeType":864},{},[],"Push maintains a global list of malicious extensions based on our own threat research and publicly available threat intelligence. When an extension in your environment matches a malicious extension ID, Push will raise a detection on the ",{"data":5752,"marks":5753,"value":5755,"nodeType":864},{},[5754],{"type":899},"Detections",{"data":5757,"marks":5758,"value":5759,"nodeType":864},{},[]," page of the Push admin console. You can also configure the control to warn or block users automatically.",{"data":5761,"content":5762,"nodeType":860},{},[5763,5767,5772],{"data":5764,"marks":5765,"value":5766,"nodeType":864},{},[],"To enable malicious extension detection, go to the ",{"data":5768,"marks":5769,"value":5771,"nodeType":864},{},[5770],{"type":899},"Controls",{"data":5773,"marks":5774,"value":5775,"nodeType":864},{},[]," page in the Push admin console. ",{"data":5777,"content":5781,"nodeType":996},{"target":5778},{"sys":5779},{"id":5780,"type":1001,"linkType":1002},"1QV5UQ04MYLpWY7jTocvO4",[],{"data":5783,"content":5784,"nodeType":860},{},[5785,5788,5797],{"data":5786,"marks":5787,"value":21,"nodeType":864},{},[],{"data":5789,"content":5793,"nodeType":5064},{"target":5790},{"sys":5791},{"id":5792,"type":1001,"linkType":1002},"5NyiWgjMDwk16XZ0S681JK",[5794],{"data":5795,"marks":5796,"value":5063,"nodeType":864},{},[],{"data":5798,"marks":5799,"value":21,"nodeType":864},{},[],{"data":5801,"content":5802,"nodeType":1009},{},[5803],{"data":5804,"marks":5805,"value":5689,"nodeType":864},{},[],{"data":5807,"content":5808,"nodeType":860},{},[5809,5813,5818],{"data":5810,"marks":5811,"value":5812,"nodeType":864},{},[],"You can also block unwanted extensions or allowlist only the extensions you want in your environment, using Push’s ",{"data":5814,"marks":5815,"value":5817,"nodeType":864},{},[5816],{"type":899},"Browser extension blocking",{"data":5819,"marks":5820,"value":5027,"nodeType":864},{},[],{"data":5822,"content":5823,"nodeType":860},{},[5824],{"data":5825,"marks":5826,"value":5827,"nodeType":864},{},[],"End-users will see a block page if they attempt to enable a blocked extension or install one via the Chrome or Microsoft extension stores.",{"data":5829,"content":5833,"nodeType":996},{"target":5830},{"sys":5831},{"id":5832,"type":1001,"linkType":1002},"3OCdGfsyNTLXQx77dwzY9L",[],{"data":5835,"content":5836,"nodeType":860},{},[5837,5840,5849],{"data":5838,"marks":5839,"value":21,"nodeType":864},{},[],{"data":5841,"content":5845,"nodeType":5064},{"target":5842},{"sys":5843},{"id":5844,"type":1001,"linkType":1002},"3ibVBa6u0XfcXXDVtON5th",[5846],{"data":5847,"marks":5848,"value":5063,"nodeType":864},{},[],{"data":5850,"marks":5851,"value":21,"nodeType":864},{},[],{"data":5853,"content":5854,"nodeType":1009},{},[5855],{"data":5856,"marks":5857,"value":5699,"nodeType":864},{},[],{"data":5859,"content":5860,"nodeType":860},{},[5861,5865,5875],{"data":5862,"marks":5863,"value":5864,"nodeType":864},{},[],"You can now block ClickFix-style malicious copy and paste attacks using Push. These are one of the ",{"data":5866,"content":5870,"nodeType":5064},{"target":5867},{"sys":5868},{"id":5869,"type":1001,"linkType":1002},"1u8RJxC00HbBhCBVxcDnkK",[5871],{"data":5872,"marks":5873,"value":5874,"nodeType":864},{},[],"fastest-growing",{"data":5876,"marks":5877,"value":5878,"nodeType":864},{},[]," browser-based attacks. You can also choose to collect the payload for your security team to investigate.",{"data":5880,"content":5881,"nodeType":860},{},[5882,5886,5891,5895,5900,5903,5908],{"data":5883,"marks":5884,"value":5885,"nodeType":864},{},[],"From the Push admin console, go to ",{"data":5887,"marks":5888,"value":5890,"nodeType":864},{},[5889],{"type":899},"Controls > Malicious copy and paste detection",{"data":5892,"marks":5893,"value":5894,"nodeType":864},{},[],". Then create a configuration rule to select the ",{"data":5896,"marks":5897,"value":5899,"nodeType":864},{},[5898],{"type":899},"Mode",{"data":5901,"marks":5902,"value":902,"nodeType":864},{},[],{"data":5904,"marks":5905,"value":5907,"nodeType":864},{},[5906],{"type":899},"Scope",{"data":5909,"marks":5910,"value":5911,"nodeType":864},{},[],". If you’ve enabled payload collection, Push will collect the malicious payload and include it in the detection event.",{"data":5913,"content":5914,"nodeType":860},{},[5915,5918,5927],{"data":5916,"marks":5917,"value":21,"nodeType":864},{},[],{"data":5919,"content":5923,"nodeType":5064},{"target":5920},{"sys":5921},{"id":5922,"type":1001,"linkType":1002},"7jygmadjoz0asAHv7e5PuK",[5924],{"data":5925,"marks":5926,"value":5063,"nodeType":864},{},[],{"data":5928,"marks":5929,"value":21,"nodeType":864},{},[],{"data":5931,"content":5932,"nodeType":1009},{},[5933],{"data":5934,"marks":5935,"value":5709,"nodeType":864},{},[],{"data":5937,"content":5938,"nodeType":860},{},[5939],{"data":5940,"marks":5941,"value":5942,"nodeType":864},{},[],"Customize the look and feel of employee-facing banners and warn or block pages by adding your company logo, accent color, and choice of light or dark mode themes. ",{"data":5944,"content":5945,"nodeType":860},{},[5946,5950,5955],{"data":5947,"marks":5948,"value":5949,"nodeType":864},{},[],"To add your brand elements, go to ",{"data":5951,"marks":5952,"value":5954,"nodeType":864},{},[5953],{"type":899},"Settings > Branding",{"data":5956,"marks":5957,"value":2924,"nodeType":864},{},[],{"data":5959,"content":5963,"nodeType":996},{"target":5960},{"sys":5961},{"id":5962,"type":1001,"linkType":1002},"3Jawd7IBSA3GF2XBHARsn",[],{"data":5965,"content":5966,"nodeType":860},{},[5967,5970,5979],{"data":5968,"marks":5969,"value":21,"nodeType":864},{},[],{"data":5971,"content":5975,"nodeType":5064},{"target":5972},{"sys":5973},{"id":5974,"type":1001,"linkType":1002},"4i1KWgBfYqtFYlUFRYiGdW",[5976],{"data":5977,"marks":5978,"value":5063,"nodeType":864},{},[],{"data":5980,"marks":5981,"value":21,"nodeType":864},{},[],{"data":5983,"content":5984,"nodeType":1009},{},[5985],{"data":5986,"marks":5987,"value":5719,"nodeType":864},{},[],{"data":5989,"content":5990,"nodeType":860},{},[5991],{"data":5992,"marks":5993,"value":5994,"nodeType":864},{},[],"The Push browser extension can now collect additional metadata and store it locally for up to 30 days, powering more diverse and precise detections, including for emerging threats. ",{"data":5996,"content":5997,"nodeType":860},{},[5998,6002,6006,6010,6014],{"data":5999,"marks":6000,"value":6001,"nodeType":864},{},[],"Detections informed by this metadata will be raised on the ",{"data":6003,"marks":6004,"value":5755,"nodeType":864},{},[6005],{"type":899},{"data":6007,"marks":6008,"value":6009,"nodeType":864},{},[]," page. Note that these detections do not block end-user activity and are ",{"data":6011,"marks":6012,"value":1334,"nodeType":864},{},[6013],{"type":899},{"data":6015,"marks":6016,"value":6017,"nodeType":864},{},[]," mode only.",{"data":6019,"content":6020,"nodeType":860},{},[6021,6025,6030,6034,6039],{"data":6022,"marks":6023,"value":6024,"nodeType":864},{},[],"We recommend you enable ",{"data":6026,"marks":6027,"value":6029,"nodeType":864},{},[6028],{"type":899},"Browser event storage",{"data":6031,"marks":6032,"value":6033,"nodeType":864},{},[]," to take advantage of this capability. Go to ",{"data":6035,"marks":6036,"value":6038,"nodeType":864},{},[6037],{"type":899},"Settings > Telemetry > Browser event storage",{"data":6040,"marks":6041,"value":6042,"nodeType":864},{},[]," in the admin console.",{"data":6044,"content":6045,"nodeType":860},{},[6046,6049,6058],{"data":6047,"marks":6048,"value":21,"nodeType":864},{},[],{"data":6050,"content":6054,"nodeType":5064},{"target":6051},{"sys":6052},{"id":6053,"type":1001,"linkType":1002},"1x69JxXcDWEDIzYXUM8nGb",[6055],{"data":6056,"marks":6057,"value":5063,"nodeType":864},{},[],{"data":6059,"marks":6060,"value":21,"nodeType":864},{},[],{"data":6062,"content":6063,"nodeType":1009},{},[6064],{"data":6065,"marks":6066,"value":6067,"nodeType":864},{},[],"And a few other things ...",{"data":6069,"content":6070,"nodeType":860},{},[6071],{"data":6072,"marks":6073,"value":6074,"nodeType":864},{},[],"Other new features or improvements to the platform include:",{"data":6076,"content":6077,"nodeType":941},{},[6078,6098,6108,6128],{"data":6079,"content":6080,"nodeType":945},{},[6081],{"data":6082,"content":6083,"nodeType":860},{},[6084,6088,6095],{"data":6085,"marks":6086,"value":6087,"nodeType":864},{},[],"You can now configure the frequency with which app banners will be displayed: either per-tab or per-browser. ",{"data":6089,"content":6091,"nodeType":883},{"uri":6090},"/help/10125#frequency",[6092],{"data":6093,"marks":6094,"value":5063,"nodeType":864},{},[],{"data":6096,"marks":6097,"value":21,"nodeType":864},{},[],{"data":6099,"content":6100,"nodeType":945},{},[6101],{"data":6102,"content":6103,"nodeType":860},{},[6104],{"data":6105,"marks":6106,"value":6107,"nodeType":864},{},[],"You can now define an Owner role as part of Push’s RBAC options. Only Owners can edit roles, delete your team (e.g. tenant), change default SAML roles, or update your team name.",{"data":6109,"content":6110,"nodeType":945},{},[6111],{"data":6112,"content":6113,"nodeType":860},{},[6114,6118,6125],{"data":6115,"marks":6116,"value":6117,"nodeType":864},{},[],"Webhook events now include detection details, for greater context. ",{"data":6119,"content":6121,"nodeType":883},{"uri":6120},"https://pushsecurity.com/help/audience/engineering/webhooks-v1/detections",[6122],{"data":6123,"marks":6124,"value":5063,"nodeType":864},{},[],{"data":6126,"marks":6127,"value":21,"nodeType":864},{},[],{"data":6129,"content":6130,"nodeType":945},{},[6131],{"data":6132,"content":6133,"nodeType":860},{},[6134,6138,6145],{"data":6135,"marks":6136,"value":6137,"nodeType":864},{},[],"Push now uses static IP addresses to emit webhook events. These IP addresses are in the same range we previously used, but if you wish to update your network filtering to these new, narrower IP addresses, you can. ",{"data":6139,"content":6141,"nodeType":883},{"uri":6140},"https://pushsecurity.com/help/audience/engineering/webhooks-v1/section/ip-addresses",[6142],{"data":6143,"marks":6144,"value":5063,"nodeType":864},{},[],{"data":6146,"marks":6147,"value":21,"nodeType":864},{},[],{"data":6149,"content":6150,"nodeType":860},{},[6151],{"data":6152,"marks":6153,"value":21,"nodeType":864},{},[],"Product release: March 2026","Here’s what’s new on the Push platform for March 2026.","2026-03-10T00:00:00.000Z","product-release-march-2026",{"items":6159},[6160],{"sys":6161,"name":5648},{"id":5647},{"items":6163},[6164],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":6165},{"url":4953},"product-release-july-2026","blog/product-release-july-2026",{"json":6169},{"data":6170,"content":6171,"nodeType":856},{},[6172],{"data":6173,"content":6174,"nodeType":860},{},[6175],{"data":6176,"marks":6177,"value":6178,"nodeType":864},{},[],"Clipboard blocking, file download blocking, app categorization, and more","Here’s what’s new on the Push platform for July 2026.",{"id":6181,"publishedAt":6182},"76c5Oo3kktjFa1oUQoCYSu","2026-08-12T11:52:39.380Z",{"items":6184},[6185],{"sys":6186,"name":5648},{"id":5647},{"items":6188},[6189,6191,6193,6195],{"sys":6190,"name":297,"slug":298,"tier":31},{"id":294},{"sys":6192,"name":368,"slug":369,"tier":45},{"id":365},{"sys":6194,"name":589,"slug":590,"tier":45},{"id":586},{"sys":6196,"name":580,"slug":581,"tier":45},{"id":577},"KqgkacUcUOlS0kauLuxOpwFUea0oLkCATd3yAMW2cVs",{"id":6199,"title":3608,"authorsCollection":6200,"content":6204,"extension":228,"faqItemsCollection":6977,"faqTitle":59,"featured":6,"hashTags":59,"meta":6979,"metaTitle":6980,"ogImage":59,"postType":6981,"publishedDate":3610,"relatedBlogPostsCollection":6982,"slug":3611,"stem":10039,"subtitle":59,"summary":10040,"synopsis":3609,"sys":10051,"tagsCollection":10053,"topicsCollection":10059,"__hash__":10087},"blog/blog/crossing-the-ai-security-chasm-sans-security-maturity-model.json",{"items":6201},[6202],{"fullName":3621,"firstName":3622,"jobTitle":3623,"socialLinks":59,"profilePicture":6203},{"url":3625},{"json":6205,"links":6945},{"data":6206,"content":6207,"nodeType":856},{},[6208,6214,6238,6253,6258,6264,6277,6280,6287,6302,6357,6363,6368,6374,6447,6453,6459,6472,6475,6482,6488,6494,6501,6507,6517,6522,6528,6534,6540,6543,6550,6563,6576,6582,6588,6594,6611,6683,6689,6695,6698,6705,6718,6724,6730,6737,6740,6747,6762,6768,6774,6804,6810,6816,6819,6826,6832,6842,6847,6857,6867,6872,6882,6901,6907,6910,6917,6923,6929],{"data":6209,"content":6210,"nodeType":860},{},[6211],{"data":6212,"marks":6213,"value":2754,"nodeType":864},{},[],{"data":6215,"content":6216,"nodeType":860},{},[6217,6220,6226,6229,6235],{"data":6218,"marks":6219,"value":2761,"nodeType":864},{},[],{"data":6221,"content":6222,"nodeType":883},{"uri":2764},[6223],{"data":6224,"marks":6225,"value":2769,"nodeType":864},{},[],{"data":6227,"marks":6228,"value":2773,"nodeType":864},{},[],{"data":6230,"content":6231,"nodeType":883},{"uri":2776},[6232],{"data":6233,"marks":6234,"value":2781,"nodeType":864},{},[],{"data":6236,"marks":6237,"value":2785,"nodeType":864},{},[],{"data":6239,"content":6240,"nodeType":860},{},[6241,6244,6250],{"data":6242,"marks":6243,"value":2792,"nodeType":864},{},[],{"data":6245,"content":6246,"nodeType":883},{"uri":2776},[6247],{"data":6248,"marks":6249,"value":2799,"nodeType":864},{},[],{"data":6251,"marks":6252,"value":2803,"nodeType":864},{},[],{"data":6254,"content":6257,"nodeType":996},{"target":6255},{"sys":6256},{"id":1040,"type":1001,"linkType":1002},[],{"data":6259,"content":6260,"nodeType":860},{},[6261],{"data":6262,"marks":6263,"value":2815,"nodeType":864},{},[],{"data":6265,"content":6266,"nodeType":860},{},[6267,6270,6274],{"data":6268,"marks":6269,"value":2822,"nodeType":864},{},[],{"data":6271,"marks":6272,"value":2827,"nodeType":864},{},[6273],{"type":2246},{"data":6275,"marks":6276,"value":2831,"nodeType":864},{},[],{"data":6278,"content":6279,"nodeType":1005},{},[],{"data":6281,"content":6282,"nodeType":1009},{},[6283],{"data":6284,"marks":6285,"value":2842,"nodeType":864},{},[6286],{"type":899},{"data":6288,"content":6289,"nodeType":860},{},[6290,6293,6299],{"data":6291,"marks":6292,"value":2849,"nodeType":864},{},[],{"data":6294,"content":6295,"nodeType":883},{"uri":2852},[6296],{"data":6297,"marks":6298,"value":1108,"nodeType":864},{},[],{"data":6300,"marks":6301,"value":2860,"nodeType":864},{},[],{"data":6303,"content":6304,"nodeType":941},{},[6305,6319,6333],{"data":6306,"content":6307,"nodeType":945},{},[6308],{"data":6309,"content":6310,"nodeType":860},{},[6311,6316],{"data":6312,"marks":6313,"value":2875,"nodeType":864},{},[6314,6315],{"type":899},{"type":1455},{"data":6317,"marks":6318,"value":2879,"nodeType":864},{},[],{"data":6320,"content":6321,"nodeType":945},{},[6322],{"data":6323,"content":6324,"nodeType":860},{},[6325,6330],{"data":6326,"marks":6327,"value":2891,"nodeType":864},{},[6328,6329],{"type":899},{"type":1455},{"data":6331,"marks":6332,"value":2895,"nodeType":864},{},[],{"data":6334,"content":6335,"nodeType":945},{},[6336],{"data":6337,"content":6338,"nodeType":860},{},[6339,6344,6347,6354],{"data":6340,"marks":6341,"value":2907,"nodeType":864},{},[6342,6343],{"type":899},{"type":1455},{"data":6345,"marks":6346,"value":2911,"nodeType":864},{},[],{"data":6348,"content":6349,"nodeType":883},{"uri":2914},[6350],{"data":6351,"marks":6352,"value":2920,"nodeType":864},{},[6353],{"type":1455},{"data":6355,"marks":6356,"value":2924,"nodeType":864},{},[],{"data":6358,"content":6359,"nodeType":860},{},[6360],{"data":6361,"marks":6362,"value":2931,"nodeType":864},{},[],{"data":6364,"content":6367,"nodeType":996},{"target":6365},{"sys":6366},{"id":2936,"type":1001,"linkType":1002},[],{"data":6369,"content":6370,"nodeType":860},{},[6371],{"data":6372,"marks":6373,"value":2944,"nodeType":864},{},[],{"data":6375,"content":6376,"nodeType":941},{},[6377,6391,6405,6419,6433],{"data":6378,"content":6379,"nodeType":945},{},[6380],{"data":6381,"content":6382,"nodeType":860},{},[6383,6388],{"data":6384,"marks":6385,"value":2959,"nodeType":864},{},[6386,6387],{"type":899},{"type":1455},{"data":6389,"marks":6390,"value":2963,"nodeType":864},{},[],{"data":6392,"content":6393,"nodeType":945},{},[6394],{"data":6395,"content":6396,"nodeType":860},{},[6397,6402],{"data":6398,"marks":6399,"value":2975,"nodeType":864},{},[6400,6401],{"type":899},{"type":1455},{"data":6403,"marks":6404,"value":2979,"nodeType":864},{},[],{"data":6406,"content":6407,"nodeType":945},{},[6408],{"data":6409,"content":6410,"nodeType":860},{},[6411,6416],{"data":6412,"marks":6413,"value":2991,"nodeType":864},{},[6414,6415],{"type":899},{"type":1455},{"data":6417,"marks":6418,"value":2995,"nodeType":864},{},[],{"data":6420,"content":6421,"nodeType":945},{},[6422],{"data":6423,"content":6424,"nodeType":860},{},[6425,6430],{"data":6426,"marks":6427,"value":3007,"nodeType":864},{},[6428,6429],{"type":899},{"type":1455},{"data":6431,"marks":6432,"value":3011,"nodeType":864},{},[],{"data":6434,"content":6435,"nodeType":945},{},[6436],{"data":6437,"content":6438,"nodeType":860},{},[6439,6444],{"data":6440,"marks":6441,"value":3023,"nodeType":864},{},[6442,6443],{"type":899},{"type":1455},{"data":6445,"marks":6446,"value":3027,"nodeType":864},{},[],{"data":6448,"content":6449,"nodeType":860},{},[6450],{"data":6451,"marks":6452,"value":3034,"nodeType":864},{},[],{"data":6454,"content":6455,"nodeType":860},{},[6456],{"data":6457,"marks":6458,"value":3041,"nodeType":864},{},[],{"data":6460,"content":6461,"nodeType":860},{},[6462,6465,6469],{"data":6463,"marks":6464,"value":3048,"nodeType":864},{},[],{"data":6466,"marks":6467,"value":3053,"nodeType":864},{},[6468],{"type":2246},{"data":6470,"marks":6471,"value":3057,"nodeType":864},{},[],{"data":6473,"content":6474,"nodeType":1005},{},[],{"data":6476,"content":6477,"nodeType":1009},{},[6478],{"data":6479,"marks":6480,"value":3068,"nodeType":864},{},[6481],{"type":899},{"data":6483,"content":6484,"nodeType":860},{},[6485],{"data":6486,"marks":6487,"value":3075,"nodeType":864},{},[],{"data":6489,"content":6490,"nodeType":860},{},[6491],{"data":6492,"marks":6493,"value":3082,"nodeType":864},{},[],{"data":6495,"content":6496,"nodeType":860},{},[6497],{"data":6498,"marks":6499,"value":3090,"nodeType":864},{},[6500],{"type":899},{"data":6502,"content":6503,"nodeType":860},{},[6504],{"data":6505,"marks":6506,"value":3097,"nodeType":864},{},[],{"data":6508,"content":6509,"nodeType":860},{},[6510,6514],{"data":6511,"marks":6512,"value":3105,"nodeType":864},{},[6513],{"type":2246},{"data":6515,"marks":6516,"value":3109,"nodeType":864},{},[],{"data":6518,"content":6521,"nodeType":996},{"target":6519},{"sys":6520},{"id":3114,"type":1001,"linkType":1002},[],{"data":6523,"content":6524,"nodeType":860},{},[6525],{"data":6526,"marks":6527,"value":3122,"nodeType":864},{},[],{"data":6529,"content":6530,"nodeType":860},{},[6531],{"data":6532,"marks":6533,"value":3129,"nodeType":864},{},[],{"data":6535,"content":6536,"nodeType":860},{},[6537],{"data":6538,"marks":6539,"value":3136,"nodeType":864},{},[],{"data":6541,"content":6542,"nodeType":1005},{},[],{"data":6544,"content":6545,"nodeType":1009},{},[6546],{"data":6547,"marks":6548,"value":3147,"nodeType":864},{},[6549],{"type":899},{"data":6551,"content":6552,"nodeType":860},{},[6553,6556,6560],{"data":6554,"marks":6555,"value":3154,"nodeType":864},{},[],{"data":6557,"marks":6558,"value":3159,"nodeType":864},{},[6559],{"type":899},{"data":6561,"marks":6562,"value":3163,"nodeType":864},{},[],{"data":6564,"content":6565,"nodeType":860},{},[6566,6569,6573],{"data":6567,"marks":6568,"value":3170,"nodeType":864},{},[],{"data":6570,"marks":6571,"value":3175,"nodeType":864},{},[6572],{"type":899},{"data":6574,"marks":6575,"value":3179,"nodeType":864},{},[],{"data":6577,"content":6578,"nodeType":860},{},[6579],{"data":6580,"marks":6581,"value":3186,"nodeType":864},{},[],{"data":6583,"content":6584,"nodeType":860},{},[6585],{"data":6586,"marks":6587,"value":3193,"nodeType":864},{},[],{"data":6589,"content":6590,"nodeType":860},{},[6591],{"data":6592,"marks":6593,"value":3200,"nodeType":864},{},[],{"data":6595,"content":6596,"nodeType":860},{},[6597,6600,6608],{"data":6598,"marks":6599,"value":3207,"nodeType":864},{},[],{"data":6601,"content":6602,"nodeType":883},{"uri":3210},[6603],{"data":6604,"marks":6605,"value":3217,"nodeType":864},{},[6606,6607],{"type":1455},{"type":899},{"data":6609,"marks":6610,"value":3221,"nodeType":864},{},[],{"data":6612,"content":6613,"nodeType":941},{},[6614,6632,6650],{"data":6615,"content":6616,"nodeType":945},{},[6617],{"data":6618,"content":6619,"nodeType":860},{},[6620,6623,6629],{"data":6621,"marks":6622,"value":3234,"nodeType":864},{},[],{"data":6624,"content":6625,"nodeType":883},{"uri":3237},[6626],{"data":6627,"marks":6628,"value":3242,"nodeType":864},{},[],{"data":6630,"marks":6631,"value":3246,"nodeType":864},{},[],{"data":6633,"content":6634,"nodeType":945},{},[6635],{"data":6636,"content":6637,"nodeType":860},{},[6638,6641,6647],{"data":6639,"marks":6640,"value":3256,"nodeType":864},{},[],{"data":6642,"content":6643,"nodeType":883},{"uri":3259},[6644],{"data":6645,"marks":6646,"value":3264,"nodeType":864},{},[],{"data":6648,"marks":6649,"value":3268,"nodeType":864},{},[],{"data":6651,"content":6652,"nodeType":945},{},[6653],{"data":6654,"content":6655,"nodeType":860},{},[6656,6659,6666,6669,6673,6676,6680],{"data":6657,"marks":6658,"value":21,"nodeType":864},{},[],{"data":6660,"content":6661,"nodeType":883},{"uri":3280},[6662],{"data":6663,"marks":6664,"value":3286,"nodeType":864},{},[6665],{"type":1455},{"data":6667,"marks":6668,"value":3290,"nodeType":864},{},[],{"data":6670,"marks":6671,"value":3295,"nodeType":864},{},[6672],{"type":899},{"data":6674,"marks":6675,"value":3299,"nodeType":864},{},[],{"data":6677,"marks":6678,"value":3304,"nodeType":864},{},[6679],{"type":899},{"data":6681,"marks":6682,"value":2924,"nodeType":864},{},[],{"data":6684,"content":6685,"nodeType":860},{},[6686],{"data":6687,"marks":6688,"value":3314,"nodeType":864},{},[],{"data":6690,"content":6691,"nodeType":860},{},[6692],{"data":6693,"marks":6694,"value":3321,"nodeType":864},{},[],{"data":6696,"content":6697,"nodeType":1005},{},[],{"data":6699,"content":6700,"nodeType":1312},{},[6701],{"data":6702,"marks":6703,"value":3332,"nodeType":864},{},[6704],{"type":899},{"data":6706,"content":6707,"nodeType":860},{},[6708,6711,6715],{"data":6709,"marks":6710,"value":3339,"nodeType":864},{},[],{"data":6712,"marks":6713,"value":3344,"nodeType":864},{},[6714],{"type":2246},{"data":6716,"marks":6717,"value":3348,"nodeType":864},{},[],{"data":6719,"content":6720,"nodeType":860},{},[6721],{"data":6722,"marks":6723,"value":3355,"nodeType":864},{},[],{"data":6725,"content":6726,"nodeType":860},{},[6727],{"data":6728,"marks":6729,"value":3362,"nodeType":864},{},[],{"data":6731,"content":6732,"nodeType":860},{},[6733],{"data":6734,"marks":6735,"value":3370,"nodeType":864},{},[6736],{"type":899},{"data":6738,"content":6739,"nodeType":1005},{},[],{"data":6741,"content":6742,"nodeType":1009},{},[6743],{"data":6744,"marks":6745,"value":3381,"nodeType":864},{},[6746],{"type":899},{"data":6748,"content":6749,"nodeType":860},{},[6750,6753,6759],{"data":6751,"marks":6752,"value":3388,"nodeType":864},{},[],{"data":6754,"content":6755,"nodeType":883},{"uri":3210},[6756],{"data":6757,"marks":6758,"value":3395,"nodeType":864},{},[],{"data":6760,"marks":6761,"value":3399,"nodeType":864},{},[],{"data":6763,"content":6764,"nodeType":860},{},[6765],{"data":6766,"marks":6767,"value":3406,"nodeType":864},{},[],{"data":6769,"content":6770,"nodeType":860},{},[6771],{"data":6772,"marks":6773,"value":3413,"nodeType":864},{},[],{"data":6775,"content":6776,"nodeType":941},{},[6777,6786,6795],{"data":6778,"content":6779,"nodeType":945},{},[6780],{"data":6781,"content":6782,"nodeType":860},{},[6783],{"data":6784,"marks":6785,"value":3426,"nodeType":864},{},[],{"data":6787,"content":6788,"nodeType":945},{},[6789],{"data":6790,"content":6791,"nodeType":860},{},[6792],{"data":6793,"marks":6794,"value":3436,"nodeType":864},{},[],{"data":6796,"content":6797,"nodeType":945},{},[6798],{"data":6799,"content":6800,"nodeType":860},{},[6801],{"data":6802,"marks":6803,"value":3446,"nodeType":864},{},[],{"data":6805,"content":6806,"nodeType":860},{},[6807],{"data":6808,"marks":6809,"value":3453,"nodeType":864},{},[],{"data":6811,"content":6812,"nodeType":860},{},[6813],{"data":6814,"marks":6815,"value":3460,"nodeType":864},{},[],{"data":6817,"content":6818,"nodeType":1005},{},[],{"data":6820,"content":6821,"nodeType":1009},{},[6822],{"data":6823,"marks":6824,"value":3471,"nodeType":864},{},[6825],{"type":899},{"data":6827,"content":6828,"nodeType":860},{},[6829],{"data":6830,"marks":6831,"value":3478,"nodeType":864},{},[],{"data":6833,"content":6834,"nodeType":860},{},[6835,6839],{"data":6836,"marks":6837,"value":3486,"nodeType":864},{},[6838],{"type":899},{"data":6840,"marks":6841,"value":3490,"nodeType":864},{},[],{"data":6843,"content":6846,"nodeType":996},{"target":6844},{"sys":6845},{"id":3495,"type":1001,"linkType":1002},[],{"data":6848,"content":6849,"nodeType":860},{},[6850,6854],{"data":6851,"marks":6852,"value":3504,"nodeType":864},{},[6853],{"type":899},{"data":6855,"marks":6856,"value":3508,"nodeType":864},{},[],{"data":6858,"content":6859,"nodeType":860},{},[6860,6864],{"data":6861,"marks":6862,"value":3516,"nodeType":864},{},[6863],{"type":899},{"data":6865,"marks":6866,"value":3520,"nodeType":864},{},[],{"data":6868,"content":6871,"nodeType":996},{"target":6869},{"sys":6870},{"id":3525,"type":1001,"linkType":1002},[],{"data":6873,"content":6874,"nodeType":860},{},[6875,6879],{"data":6876,"marks":6877,"value":3534,"nodeType":864},{},[6878],{"type":899},{"data":6880,"marks":6881,"value":3538,"nodeType":864},{},[],{"data":6883,"content":6884,"nodeType":860},{},[6885,6889,6892,6898],{"data":6886,"marks":6887,"value":3546,"nodeType":864},{},[6888],{"type":899},{"data":6890,"marks":6891,"value":3550,"nodeType":864},{},[],{"data":6893,"content":6894,"nodeType":883},{"uri":2852},[6895],{"data":6896,"marks":6897,"value":1108,"nodeType":864},{},[],{"data":6899,"marks":6900,"value":3560,"nodeType":864},{},[],{"data":6902,"content":6903,"nodeType":860},{},[6904],{"data":6905,"marks":6906,"value":3567,"nodeType":864},{},[],{"data":6908,"content":6909,"nodeType":1005},{},[],{"data":6911,"content":6912,"nodeType":1009},{},[6913],{"data":6914,"marks":6915,"value":3578,"nodeType":864},{},[6916],{"type":899},{"data":6918,"content":6919,"nodeType":860},{},[6920],{"data":6921,"marks":6922,"value":3585,"nodeType":864},{},[],{"data":6924,"content":6925,"nodeType":860},{},[6926],{"data":6927,"marks":6928,"value":1689,"nodeType":864},{},[],{"data":6930,"content":6931,"nodeType":860},{},[6932,6935,6942],{"data":6933,"marks":6934,"value":2707,"nodeType":864},{},[],{"data":6936,"content":6937,"nodeType":883},{"uri":1700},[6938],{"data":6939,"marks":6940,"value":2715,"nodeType":864},{},[6941],{"type":1455},{"data":6943,"marks":6944,"value":2719,"nodeType":864},{},[],{"entries":6946},{"hyperlink":6947,"inline":6948,"block":6949},[],[],[6950,6953,6959,6965,6971],{"sys":6951,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":6952},{"id":1040},{"url":1728,"width":1729,"height":1730},{"sys":6954,"__typename":1724,"title":6955,"caption":6955,"layoutMode":59,"file":6956},{"id":2936},"SANS AI Security Maturity Model. Credit: SANS Institute",{"url":6957,"width":1736,"height":6958},"https://images.ctfassets.net/y1cdw1ablpvd/7a9wgGdzZdS8c0nAzrlJqk/85657448d9d1bb34e126ba85e79ce27c/image2.png",1489,{"sys":6960,"__typename":1724,"title":6961,"caption":6961,"layoutMode":59,"file":6962},{"id":3114},"Crossing the AI security chasm requires focusing both on AI governance, and protection against AI-enabled attacks.",{"url":6963,"width":1736,"height":6964},"https://images.ctfassets.net/y1cdw1ablpvd/749gGzgSPy9n58LU9WFZ02/7c1327e38b1be213013f102f0dccc306/image4.png",1106,{"sys":6966,"__typename":1724,"title":6967,"caption":6967,"layoutMode":59,"file":6968},{"id":3495},"Push automatically inventories apps accessed by your employees and categorizes them.",{"url":6969,"width":1736,"height":6970},"https://images.ctfassets.net/y1cdw1ablpvd/6HZ0uOS63oeT1KmnRu0rWB/db9a27ff0a230237d3e5bfda56386592/image5.png",1138,{"sys":6972,"__typename":1724,"title":6973,"caption":6973,"layoutMode":59,"file":6974},{"id":3525},"Sample detection details in the Push admin console for a blocked phishing event",{"url":6975,"width":1736,"height":6976},"https://images.ctfassets.net/y1cdw1ablpvd/vIFT3CvEkR3MPQdI5DIoa/4f59424365c3c90c232e287dac85bf2c/image3.png",766,{"items":6978},[],{},"Crossing the chasm with the SANS AI security maturity model","thought-leadership",{"items":6983},[6984,8023,8958],{"__typename":2059,"sys":6985,"content":6987,"title":8005,"synopsis":8006,"hashTags":59,"publishedDate":8007,"slug":8008,"tagsCollection":8009,"authorsCollection":8015},{"id":6986},"19QvRR4NcSe3PHQEhID42Q",{"json":6988},{"data":6989,"content":6990,"nodeType":856},{},[6991,6999,7006,7014,7588,7594,7601,7608,7611,7619,7626,7634,7641,7647,7652,7660,7676,7684,7691,7699,7706,7712,7720,7727,7733,7736,7744,7763,7783,7802,7809,7812,7820,7827,7838,7845,7856,7863,7869,7880,7887,7898,7905,7912,7918,7929,7936,7939,7947,7954,7961,7968,7974,7977,7983,7989],{"data":6992,"content":6993,"nodeType":1009},{},[6994],{"data":6995,"marks":6996,"value":6998,"nodeType":864},{},[6997],{"type":899},"The AI regulatory landscape is moving fast",{"data":7000,"content":7001,"nodeType":860},{},[7002],{"data":7003,"marks":7004,"value":7005,"nodeType":864},{},[],"The regulatory landscape around AI has shifted from theoretical to operational faster than most compliance teams expected. Several regulations are already in force, presenting not just a legal but also significant operational challenge to organizations covered by these regulations. ",{"data":7007,"content":7008,"nodeType":860},{},[7009],{"data":7010,"marks":7011,"value":7013,"nodeType":864},{},[7012],{"type":899},"First, here's a summary of the key frameworks and what they require:",{"data":7015,"content":7016,"nodeType":4845},{},[7017,7064,7154,7220,7275,7399,7454,7521],{"data":7018,"content":7019,"nodeType":4581},{},[7020,7031,7042,7053],{"data":7021,"content":7022,"nodeType":4569},{},[7023],{"data":7024,"content":7025,"nodeType":860},{},[7026],{"data":7027,"marks":7028,"value":7030,"nodeType":864},{},[7029],{"type":899},"Regulation",{"data":7032,"content":7033,"nodeType":4569},{},[7034],{"data":7035,"content":7036,"nodeType":860},{},[7037],{"data":7038,"marks":7039,"value":7041,"nodeType":864},{},[7040],{"type":899},"Jurisdiction",{"data":7043,"content":7044,"nodeType":4569},{},[7045],{"data":7046,"content":7047,"nodeType":860},{},[7048],{"data":7049,"marks":7050,"value":7052,"nodeType":864},{},[7051],{"type":899},"What it requires for AI",{"data":7054,"content":7055,"nodeType":4569},{},[7056],{"data":7057,"content":7058,"nodeType":860},{},[7059],{"data":7060,"marks":7061,"value":7063,"nodeType":864},{},[7062],{"type":899},"Status",{"data":7065,"content":7066,"nodeType":4581},{},[7067,7089,7099,7133],{"data":7068,"content":7069,"nodeType":4569},{},[7070],{"data":7071,"content":7072,"nodeType":860},{},[7073,7076,7086],{"data":7074,"marks":7075,"value":21,"nodeType":864},{},[],{"data":7077,"content":7079,"nodeType":883},{"uri":7078},"https://artificialintelligenceact.eu/",[7080],{"data":7081,"marks":7082,"value":7085,"nodeType":864},{},[7083,7084],{"type":1455},{"type":899},"EU AI Act",{"data":7087,"marks":7088,"value":21,"nodeType":864},{},[],{"data":7090,"content":7091,"nodeType":4569},{},[7092],{"data":7093,"content":7094,"nodeType":860},{},[7095],{"data":7096,"marks":7097,"value":7098,"nodeType":864},{},[],"EU",{"data":7100,"content":7101,"nodeType":4569},{},[7102],{"data":7103,"content":7104,"nodeType":860},{},[7105,7109,7117,7121,7129],{"data":7106,"marks":7107,"value":7108,"nodeType":864},{},[],"AI system inventory and risk classification; ",{"data":7110,"content":7112,"nodeType":883},{"uri":7111},"https://artificialintelligenceact.eu/article/4/",[7113],{"data":7114,"marks":7115,"value":7116,"nodeType":864},{},[],"AI literacy",{"data":7118,"marks":7119,"value":7120,"nodeType":864},{},[]," for all staff; ",{"data":7122,"content":7124,"nodeType":883},{"uri":7123},"https://artificialintelligenceact.eu/article/15/",[7125],{"data":7126,"marks":7127,"value":7128,"nodeType":864},{},[],"cybersecurity resilience",{"data":7130,"marks":7131,"value":7132,"nodeType":864},{},[]," for high-risk AI; transparency and human oversight",{"data":7134,"content":7135,"nodeType":4569},{},[7136],{"data":7137,"content":7138,"nodeType":860},{},[7139,7142,7150],{"data":7140,"marks":7141,"value":21,"nodeType":864},{},[],{"data":7143,"content":7144,"nodeType":883},{"uri":7111},[7145],{"data":7146,"marks":7147,"value":7149,"nodeType":864},{},[7148],{"type":1455},"Art. 4",{"data":7151,"marks":7152,"value":7153,"nodeType":864},{},[]," (literacy) in force Feb 2025; high-risk obligations Aug 2026",{"data":7155,"content":7156,"nodeType":4581},{},[7157,7179,7189,7210],{"data":7158,"content":7159,"nodeType":4569},{},[7160],{"data":7161,"content":7162,"nodeType":860},{},[7163,7166,7176],{"data":7164,"marks":7165,"value":21,"nodeType":864},{},[],{"data":7167,"content":7169,"nodeType":883},{"uri":7168},"https://eur-lex.europa.eu/eli/reg/2022/2554/oj",[7170],{"data":7171,"marks":7172,"value":7175,"nodeType":864},{},[7173,7174],{"type":1455},{"type":899},"DORA",{"data":7177,"marks":7178,"value":21,"nodeType":864},{},[],{"data":7180,"content":7181,"nodeType":4569},{},[7182],{"data":7183,"content":7184,"nodeType":860},{},[7185],{"data":7186,"marks":7187,"value":7188,"nodeType":864},{},[],"EU financial services",{"data":7190,"content":7191,"nodeType":4569},{},[7192],{"data":7193,"content":7194,"nodeType":860},{},[7195,7199,7206],{"data":7196,"marks":7197,"value":7198,"nodeType":864},{},[],"AI tools in ICT risk framework; AI providers in ",{"data":7200,"content":7201,"nodeType":883},{"uri":7168},[7202],{"data":7203,"marks":7204,"value":7205,"nodeType":864},{},[],"third-party risk registers",{"data":7207,"marks":7208,"value":7209,"nodeType":864},{},[],"; resilience testing covering AI-enhanced attacks",{"data":7211,"content":7212,"nodeType":4569},{},[7213],{"data":7214,"content":7215,"nodeType":860},{},[7216],{"data":7217,"marks":7218,"value":7219,"nodeType":864},{},[],"In force Jan 2025",{"data":7221,"content":7222,"nodeType":4581},{},[7223,7245,7255,7265],{"data":7224,"content":7225,"nodeType":4569},{},[7226],{"data":7227,"content":7228,"nodeType":860},{},[7229,7232,7242],{"data":7230,"marks":7231,"value":21,"nodeType":864},{},[],{"data":7233,"content":7235,"nodeType":883},{"uri":7234},"https://eur-lex.europa.eu/eli/reg/2024/2847/oj",[7236],{"data":7237,"marks":7238,"value":7241,"nodeType":864},{},[7239,7240],{"type":1455},{"type":899},"EU Cyber Resilience Act",{"data":7243,"marks":7244,"value":21,"nodeType":864},{},[],{"data":7246,"content":7247,"nodeType":4569},{},[7248],{"data":7249,"content":7250,"nodeType":860},{},[7251],{"data":7252,"marks":7253,"value":7254,"nodeType":864},{},[],"EU digital products",{"data":7256,"content":7257,"nodeType":4569},{},[7258],{"data":7259,"content":7260,"nodeType":860},{},[7261],{"data":7262,"marks":7263,"value":7264,"nodeType":864},{},[],"AI-enabled software must meet essential cybersecurity requirements; vulnerability management and incident reporting",{"data":7266,"content":7267,"nodeType":4569},{},[7268],{"data":7269,"content":7270,"nodeType":860},{},[7271],{"data":7272,"marks":7273,"value":7274,"nodeType":864},{},[],"Reporting Sep 2026; full compliance Dec 2027",{"data":7276,"content":7277,"nodeType":4581},{},[7278,7300,7310,7359],{"data":7279,"content":7280,"nodeType":4569},{},[7281],{"data":7282,"content":7283,"nodeType":860},{},[7284,7287,7297],{"data":7285,"marks":7286,"value":21,"nodeType":864},{},[],{"data":7288,"content":7290,"nodeType":883},{"uri":7289},"https://www.dfs.ny.gov/industry_guidance/cybersecurity",[7291],{"data":7292,"marks":7293,"value":7296,"nodeType":864},{},[7294,7295],{"type":1455},{"type":899},"NYDFS 23 NYCRR 500",{"data":7298,"marks":7299,"value":21,"nodeType":864},{},[],{"data":7301,"content":7302,"nodeType":4569},{},[7303],{"data":7304,"content":7305,"nodeType":860},{},[7306],{"data":7307,"marks":7308,"value":7309,"nodeType":864},{},[],"US (NY financial services)",{"data":7311,"content":7312,"nodeType":4569},{},[7313],{"data":7314,"content":7315,"nodeType":860},{},[7316,7319,7328,7332,7340,7344,7356],{"data":7317,"marks":7318,"value":21,"nodeType":864},{},[],{"data":7320,"content":7322,"nodeType":883},{"uri":7321},"https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks",[7323],{"data":7324,"marks":7325,"value":7327,"nodeType":864},{},[7326],{"type":1455},"AI-resistant MFA",{"data":7329,"marks":7330,"value":7331,"nodeType":864},{},[],"; employee training on AI threats; ",{"data":7333,"content":7335,"nodeType":883},{"uri":7334},"https://www.dfs.ny.gov/industry-guidance/industry-letters/il20251021-guidance-managing-risks-third-party",[7336],{"data":7337,"marks":7338,"value":7339,"nodeType":864},{},[],"third-party AI risk assessment",{"data":7341,"marks":7342,"value":7343,"nodeType":864},{},[],";",{"data":7345,"content":7347,"nodeType":883},{"uri":7346},"https://www.dfs.ny.gov/industry-guidance/industry-letters/20260521-heightened-cybersecurity-risks-assoc-with-frontier-ai-models",[7348,7351],{"data":7349,"marks":7350,"value":1171,"nodeType":864},{},[],{"data":7352,"marks":7353,"value":7355,"nodeType":864},{},[7354],{"type":1455},"frontier AI model defenses",{"data":7357,"marks":7358,"value":21,"nodeType":864},{},[],{"data":7360,"content":7361,"nodeType":4569},{},[7362],{"data":7363,"content":7364,"nodeType":860},{},[7365,7369,7376,7379,7386,7389,7396],{"data":7366,"marks":7367,"value":7368,"nodeType":864},{},[],"Phased 2023–2025; AI-specific guidance issued ",{"data":7370,"content":7371,"nodeType":883},{"uri":7321},[7372],{"data":7373,"marks":7374,"value":7375,"nodeType":864},{},[],"Oct 2024",{"data":7377,"marks":7378,"value":3731,"nodeType":864},{},[],{"data":7380,"content":7381,"nodeType":883},{"uri":7334},[7382],{"data":7383,"marks":7384,"value":7385,"nodeType":864},{},[],"Oct 2025",{"data":7387,"marks":7388,"value":3731,"nodeType":864},{},[],{"data":7390,"content":7391,"nodeType":883},{"uri":7346},[7392],{"data":7393,"marks":7394,"value":7395,"nodeType":864},{},[],"May 2026",{"data":7397,"marks":7398,"value":21,"nodeType":864},{},[],{"data":7400,"content":7401,"nodeType":4581},{},[7402,7424,7434,7444],{"data":7403,"content":7404,"nodeType":4569},{},[7405],{"data":7406,"content":7407,"nodeType":860},{},[7408,7411,7421],{"data":7409,"marks":7410,"value":21,"nodeType":864},{},[],{"data":7412,"content":7414,"nodeType":883},{"uri":7413},"https://www.ncsl.org/technology-and-communication/2025-state-privacy-legislation-tracker",[7415],{"data":7416,"marks":7417,"value":7420,"nodeType":864},{},[7418,7419],{"type":1455},{"type":899},"US State Privacy laws",{"data":7422,"marks":7423,"value":21,"nodeType":864},{},[],{"data":7425,"content":7426,"nodeType":4569},{},[7427],{"data":7428,"content":7429,"nodeType":860},{},[7430],{"data":7431,"marks":7432,"value":7433,"nodeType":864},{},[],"US (20+ states)",{"data":7435,"content":7436,"nodeType":4569},{},[7437],{"data":7438,"content":7439,"nodeType":860},{},[7440],{"data":7441,"marks":7442,"value":7443,"nodeType":864},{},[],"Automated decision-making transparency, opt-out rights, and impact assessments; AI and children's data protections",{"data":7445,"content":7446,"nodeType":4569},{},[7447],{"data":7448,"content":7449,"nodeType":860},{},[7450],{"data":7451,"marks":7452,"value":7453,"nodeType":864},{},[],"Rolling 2024–2027 (CA, CO, CT leading)",{"data":7455,"content":7456,"nodeType":4581},{},[7457,7479,7489,7499],{"data":7458,"content":7459,"nodeType":4569},{},[7460],{"data":7461,"content":7462,"nodeType":860},{},[7463,7466,7476],{"data":7464,"marks":7465,"value":21,"nodeType":864},{},[],{"data":7467,"content":7469,"nodeType":883},{"uri":7468},"https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html",[7470],{"data":7471,"marks":7472,"value":7475,"nodeType":864},{},[7473,7474],{"type":1455},{"type":899},"HIPAA Security Rule",{"data":7477,"marks":7478,"value":21,"nodeType":864},{},[],{"data":7480,"content":7481,"nodeType":4569},{},[7482],{"data":7483,"content":7484,"nodeType":860},{},[7485],{"data":7486,"marks":7487,"value":7488,"nodeType":864},{},[],"US healthcare",{"data":7490,"content":7491,"nodeType":4569},{},[7492],{"data":7493,"content":7494,"nodeType":860},{},[7495],{"data":7496,"marks":7497,"value":7498,"nodeType":864},{},[],"AI tools in mandatory technology asset inventory; mandatory encryption covering AI; AI-enhanced attack preparedness",{"data":7500,"content":7501,"nodeType":4569},{},[7502],{"data":7503,"content":7504,"nodeType":860},{},[7505,7508,7517],{"data":7506,"marks":7507,"value":21,"nodeType":864},{},[],{"data":7509,"content":7511,"nodeType":883},{"uri":7510},"https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html",[7512],{"data":7513,"marks":7514,"value":7516,"nodeType":864},{},[7515],{"type":1455},"Final rule",{"data":7518,"marks":7519,"value":7520,"nodeType":864},{},[]," expected 2026",{"data":7522,"content":7523,"nodeType":4581},{},[7524,7546,7556,7578],{"data":7525,"content":7526,"nodeType":4569},{},[7527],{"data":7528,"content":7529,"nodeType":860},{},[7530,7533,7543],{"data":7531,"marks":7532,"value":21,"nodeType":864},{},[],{"data":7534,"content":7536,"nodeType":883},{"uri":7535},"https://www.legislation.gov.uk/ukpga/2025/18",[7537],{"data":7538,"marks":7539,"value":7542,"nodeType":864},{},[7540,7541],{"type":1455},{"type":899},"UK Data (Use and Access) Act",{"data":7544,"marks":7545,"value":21,"nodeType":864},{},[],{"data":7547,"content":7548,"nodeType":4569},{},[7549],{"data":7550,"content":7551,"nodeType":860},{},[7552],{"data":7553,"marks":7554,"value":7555,"nodeType":864},{},[],"UK",{"data":7557,"content":7558,"nodeType":4569},{},[7559],{"data":7560,"content":7561,"nodeType":860},{},[7562,7566,7574],{"data":7563,"marks":7564,"value":7565,"nodeType":864},{},[],"Reformed ",{"data":7567,"content":7569,"nodeType":883},{"uri":7568},"https://www.legislation.gov.uk/ukpga/2025/18/section/80",[7570],{"data":7571,"marks":7572,"value":7573,"nodeType":864},{},[],"automated decision-making rules",{"data":7575,"marks":7576,"value":7577,"nodeType":864},{},[]," (new Arts. 22A-22D UK GDPR): meaningful information about decisions, right to make representations, human intervention and contestation rights; stricter controls for special category data; new complaints-handling duty with 30-day response clock (from June 2026)",{"data":7579,"content":7580,"nodeType":4569},{},[7581],{"data":7582,"content":7583,"nodeType":860},{},[7584],{"data":7585,"marks":7586,"value":7587,"nodeType":864},{},[],"Main provisions Feb 2026; complaints duty June 2026",{"data":7589,"content":7593,"nodeType":996},{"target":7590},{"sys":7591},{"id":7592,"type":1001,"linkType":1002},"1J7nJKJ5XDLLiicX9cD4H1",[],{"data":7595,"content":7596,"nodeType":860},{},[7597],{"data":7598,"marks":7599,"value":7600,"nodeType":864},{},[],"Even if your organization isn't yet subject to these specific regulations, the direction of travel matters. The EU has a track record of setting global regulatory standards: GDPR reshaped data privacy practices worldwide, and the Digital Markets Act is influencing antitrust enforcement well beyond European borders.",{"data":7602,"content":7603,"nodeType":860},{},[7604],{"data":7605,"marks":7606,"value":7607,"nodeType":864},{},[],"The EU AI Act is the world's first comprehensive AI law, and the pattern of obligation categories it establishes is already visible in NYDFS guidance, US state privacy legislation, and the UK's reformed automated decision-making framework. Organizations that build the operational foundations to meet these obligations now will be ahead of whatever comes next, regardless of jurisdiction.",{"data":7609,"content":7610,"nodeType":1005},{},[],{"data":7612,"content":7613,"nodeType":1009},{},[7614],{"data":7615,"marks":7616,"value":7618,"nodeType":864},{},[7617],{"type":899},"Five obligation categories appear across frameworks",{"data":7620,"content":7621,"nodeType":860},{},[7622],{"data":7623,"marks":7624,"value":7625,"nodeType":864},{},[],"Across these frameworks, the AI-specific obligations cluster into five categories. Individual regulations word them differently and scope them to different sectors, but the compliance actions they require are largely the same.",{"data":7627,"content":7628,"nodeType":1312},{},[7629],{"data":7630,"marks":7631,"value":7633,"nodeType":864},{},[7632],{"type":899},"1. AI inventory and classification",{"data":7635,"content":7636,"nodeType":860},{},[7637],{"data":7638,"marks":7639,"value":7640,"nodeType":864},{},[],"You can't classify AI systems by risk level if you don't know which ones your employees are using. Multiple regulations now require organizations to maintain a complete inventory of AI tools in their environment — whether as part of risk classification, asset management, or third-party risk registers.",{"data":7642,"content":7646,"nodeType":996},{"target":7643},{"sys":7644},{"id":7645,"type":1001,"linkType":1002},"6MEapKaazFTulp7Ql0m7H1",[],{"data":7648,"content":7651,"nodeType":996},{"target":7649},{"sys":7650},{"id":1040,"type":1001,"linkType":1002},[],{"data":7653,"content":7654,"nodeType":1312},{},[7655],{"data":7656,"marks":7657,"value":7659,"nodeType":864},{},[7658],{"type":899},"2. AI literacy and employee guidance",{"data":7661,"content":7662,"nodeType":860},{},[7663,7667,7672],{"data":7664,"marks":7665,"value":7666,"nodeType":864},{},[],"Regulators increasingly expect organizations to demonstrate that employees understand the AI tools they use — not through annual training alone, but through continuous, contextual guidance at the point of interaction. Several frameworks now require auditable evidence that staff have been educated about AI risks and acceptable use policies. The common thread is the need for ",{"data":7668,"marks":7669,"value":7671,"nodeType":864},{},[7670],{"type":899},"ongoing",{"data":7673,"marks":7674,"value":7675,"nodeType":864},{},[]," education, not as a one-off compliance exercise, but continuously at the point of interaction.",{"data":7677,"content":7678,"nodeType":1312},{},[7679],{"data":7680,"marks":7681,"value":7683,"nodeType":864},{},[7682],{"type":899},"3. AI data governance and exposure control",{"data":7685,"content":7686,"nodeType":860},{},[7687],{"data":7688,"marks":7689,"value":7690,"nodeType":864},{},[],"Regulations are converging on the requirement for controls over what data enters AI tools. This includes sensitive personal data, health data, and data subject to automated decision-making. Organizations need to know where personal data is being processed by AI and have mechanisms to prevent unauthorized exposure.",{"data":7692,"content":7693,"nodeType":1312},{},[7694],{"data":7695,"marks":7696,"value":7698,"nodeType":864},{},[7697],{"type":899},"4. AI-resistant authentication and phishing defense",{"data":7700,"content":7701,"nodeType":860},{},[7702],{"data":7703,"marks":7704,"value":7705,"nodeType":864},{},[],"AI is making phishing attacks more convincing and harder to detect through traditional means. Several frameworks now require authentication methods that can withstand AI-enhanced attacks, specifically naming phishing-resistant options like digital certificates and security keys over SMS or voice-based authentication. Beyond authentication, organizations need defenses against AI-powered phishing that bypasses the lure-quality signals users were trained to spot.",{"data":7707,"content":7711,"nodeType":996},{"target":7708},{"sys":7709},{"id":7710,"type":1001,"linkType":1002},"6v3l0lGH6twfYi2JaM5fKt",[],{"data":7713,"content":7714,"nodeType":1312},{},[7715],{"data":7716,"marks":7717,"value":7719,"nodeType":864},{},[7718],{"type":899},"5. Third-party AI risk and supply chain governance",{"data":7721,"content":7722,"nodeType":860},{},[7723],{"data":7724,"marks":7725,"value":7726,"nodeType":864},{},[],"Employees adopt AI tools faster than procurement can track them, and each one that connects to corporate systems via OAuth creates a persistent trust relationship. Regulators now require organizations to know which third-party AI services they depend on, what permissions those services hold, and whether they introduce concentration risk. ",{"data":7728,"content":7732,"nodeType":996},{"target":7729},{"sys":7730},{"id":7731,"type":1001,"linkType":1002},"7xx2yYRJXBY55qTqBTTZcp",[],{"data":7734,"content":7735,"nodeType":1005},{},[],{"data":7737,"content":7738,"nodeType":1009},{},[7739],{"data":7740,"marks":7741,"value":7743,"nodeType":864},{},[7742],{"type":899},"How the regulations will be enforced",{"data":7745,"content":7746,"nodeType":860},{},[7747,7751,7759],{"data":7748,"marks":7749,"value":7750,"nodeType":864},{},[],"The consequences extend well beyond fines. EU AI Act penalties reach ",{"data":7752,"content":7754,"nodeType":883},{"uri":7753},"https://artificialintelligenceact.eu/article/99/",[7755],{"data":7756,"marks":7757,"value":7758,"nodeType":864},{},[],"€35 million or 7% of global turnover",{"data":7760,"marks":7761,"value":7762,"nodeType":864},{},[]," for prohibited practices, but the operational impact may bite harder: non-compliant AI systems cannot be placed on the EU market, and providers bear direct responsibility for conformity under Articles 16 and 26 — meaning the CISO who signed off on an AI deployment that turns out to be non-compliant has personal exposure, not just a budget line item.",{"data":7764,"content":7765,"nodeType":860},{},[7766,7770,7779],{"data":7767,"marks":7768,"value":7769,"nodeType":864},{},[],"Italy's implementation law (",{"data":7771,"content":7773,"nodeType":883},{"uri":7772},"https://www.nortonrosefulbright.com/en/knowledge/publications/9bfedfea/italy-enacts-law-no-132-2025-on-artificial-intelligence-sector-rules-and-next-steps",[7774],{"data":7775,"marks":7776,"value":7778,"nodeType":864},{},[7777],{"type":1455},"Law No. 132/2025",{"data":7780,"marks":7781,"value":7782,"nodeType":864},{},[],") goes further, introducing criminal penalties including imprisonment for AI-related offenses like deepfake dissemination.",{"data":7784,"content":7785,"nodeType":860},{},[7786,7790,7798],{"data":7787,"marks":7788,"value":7789,"nodeType":864},{},[],"NYDFS penalties accumulate at $2,500 per day per violation, and the regulator has been aggressive: it levied ",{"data":7791,"content":7793,"nodeType":883},{"uri":7792},"https://pushsecurity.com/blog/what-the-expansion-of-nydfs-nycrr-part-500-means-for-mfa-compliance/",[7794],{"data":7795,"marks":7796,"value":7797,"nodeType":864},{},[],"$14 million in fines",{"data":7799,"marks":7800,"value":7801,"nodeType":864},{},[]," from companies with inadequate MFA. CISOs sign annual compliance certifications under §500.17 where false certification carries personal liability.",{"data":7803,"content":7804,"nodeType":860},{},[7805],{"data":7806,"marks":7807,"value":7808,"nodeType":864},{},[],"The UK's Data (Use and Access) Act preserves ICO enforcement powers with fines up to £17.5 million or 4% of global turnover, and introduces a new statutory right for individuals to complain directly to controllers about automated decisions, with a 30-day response clock.",{"data":7810,"content":7811,"nodeType":1005},{},[],{"data":7813,"content":7814,"nodeType":1009},{},[7815],{"data":7816,"marks":7817,"value":7819,"nodeType":864},{},[7818],{"type":899},"Where Push maps to these obligations",{"data":7821,"content":7822,"nodeType":860},{},[7823],{"data":7824,"marks":7825,"value":7826,"nodeType":864},{},[],"The five obligation categories above map to specific Push capabilities, some directly, others as supporting evidence. Push's relevance to AI regulation isn't a new product direction. The same capabilities that security teams already use for shadow SaaS discovery, phishing defense, and identity posture hardening are what compliance teams need to demonstrate AI governance.",{"data":7828,"content":7829,"nodeType":1312},{},[7830,7835],{"data":7831,"marks":7832,"value":7834,"nodeType":864},{},[7833],{"type":899},"AI inventory and shadow AI discovery.",{"data":7836,"marks":7837,"value":1171,"nodeType":864},{},[],{"data":7839,"content":7840,"nodeType":860},{},[7841],{"data":7842,"marks":7843,"value":7844,"nodeType":864},{},[],"Push identifies every AI app, AI browser extension, and AI OAuth integration in use across the organization, not from network traffic patterns or procurement records, but from actual observed usage in the browser.",{"data":7846,"content":7847,"nodeType":1312},{},[7848,7853],{"data":7849,"marks":7850,"value":7852,"nodeType":864},{},[7851],{"type":899},"AI usage policy enforcement and literacy evidence.",{"data":7854,"marks":7855,"value":1171,"nodeType":864},{},[],{"data":7857,"content":7858,"nodeType":860},{},[7859],{"data":7860,"marks":7861,"value":7862,"nodeType":864},{},[],"Push's custom app banners deliver contextual policy guidance the moment an employee accesses an AI tool: linking to approved usage policies, data handling guidelines, or approved alternatives. Banners are fully customizable: they can include specific instructions, link to AI policy documents or approved alternatives, and messages from the security team tailored to the tool or user group. ",{"data":7864,"content":7868,"nodeType":996},{"target":7865},{"sys":7866},{"id":7867,"type":1001,"linkType":1002},"4bt65QXDiyTi1eq7wnbHUh",[],{"data":7870,"content":7871,"nodeType":1312},{},[7872,7877],{"data":7873,"marks":7874,"value":7876,"nodeType":864},{},[7875],{"type":899},"AI data exposure controls.",{"data":7878,"marks":7879,"value":1171,"nodeType":864},{},[],{"data":7881,"content":7882,"nodeType":860},{},[7883],{"data":7884,"marks":7885,"value":7886,"nodeType":864},{},[],"Push observes what users type, paste, and upload into AI tools, and can apply real-time controls, warning or blocking when sensitive patterns are detected. This is browser-layer DLP scoped to the AI interaction surface: it won't replace a dedicated DLP platform, but it closes the specific gap that most DLP tools miss because they lack visibility into browser-based AI interactions. Push provides the detection and enforcement layer at the point where the data actually leaves the organization.",{"data":7888,"content":7889,"nodeType":1312},{},[7890,7895],{"data":7891,"marks":7892,"value":7894,"nodeType":864},{},[7893],{"type":899},"MFA verification and phishing defense.",{"data":7896,"marks":7897,"value":1171,"nodeType":864},{},[],{"data":7899,"content":7900,"nodeType":860},{},[7901],{"data":7902,"marks":7903,"value":7904,"nodeType":864},{},[],"Push detects where MFA is missing and identifies the type of MFA in use, directly supporting the push toward phishing-resistant authentication methods.",{"data":7906,"content":7907,"nodeType":860},{},[7908],{"data":7909,"marks":7910,"value":7911,"nodeType":864},{},[],"Push's behavioral phishing detection stops AiTM phishing, credential harvesting, device code phishing, and ClickFix attacks because Push detects malicious behavior in the browser, making it effective against even AI-powered phishing attacks, or those that are delivered over traditionally unmonitored channels such as search engines, social media, or even via phone call.",{"data":7913,"content":7917,"nodeType":996},{"target":7914},{"sys":7915},{"id":7916,"type":1001,"linkType":1002},"3hqv1nql8FvB8j7uRiddqB",[],{"data":7919,"content":7920,"nodeType":1312},{},[7921,7926],{"data":7922,"marks":7923,"value":7925,"nodeType":864},{},[7924],{"type":899},"Third-party AI risk visibility.",{"data":7927,"marks":7928,"value":1171,"nodeType":864},{},[],{"data":7930,"content":7931,"nodeType":860},{},[7932],{"data":7933,"marks":7934,"value":7935,"nodeType":864},{},[],"Push maps exactly which AI services employees have accessed and used, connected to other business apps via OAuth, what permissions those integrations hold, and who authorized them. This surfaces the AI providers that procurement never approved but employees adopted anyway, before they become a compliance finding or a breach vector.",{"data":7937,"content":7938,"nodeType":1005},{},[],{"data":7940,"content":7941,"nodeType":1009},{},[7942],{"data":7943,"marks":7944,"value":7946,"nodeType":864},{},[7945],{"type":899},"The compliance gap is an observability gap",{"data":7948,"content":7949,"nodeType":860},{},[7950],{"data":7951,"marks":7952,"value":7953,"nodeType":864},{},[],"The common failure mode across all five obligation categories is the same: the organization has a policy but can't demonstrate enforcement, because the tooling that would provide evidence operates at the wrong layer. IdP logs show managed authentication but not shadow AI logins. Network tools see traffic to AI domains but not the OAuth consent grants or the data in the clipboard. Annual training records exist but can't prove that an employee received guidance at the point of AI interaction.",{"data":7955,"content":7956,"nodeType":860},{},[7957],{"data":7958,"marks":7959,"value":7960,"nodeType":864},{},[],"Browser-layer telemetry closes each of these gaps because it's where the regulated activity actually happens, and where (with Push) you can observe and control it too.",{"data":7962,"content":7963,"nodeType":860},{},[7964],{"data":7965,"marks":7966,"value":7967,"nodeType":864},{},[],"The regulations covered here are the current landscape, but they aren't the final one. AI governance requirements are accelerating: NIST's AI cybersecurity framework profile is expected this summer, CISA's Five Eyes agentic AI guidance landed in May, and EU member states are still building out their national enforcement regimes.",{"data":7969,"content":7973,"nodeType":996},{"target":7970},{"sys":7971},{"id":7972,"type":1001,"linkType":1002},"OThPeKuFnpoo1e1FAGsFP",[],{"data":7975,"content":7976,"nodeType":1005},{},[],{"data":7978,"content":7979,"nodeType":860},{},[7980],{"data":7981,"marks":7982,"value":1682,"nodeType":864},{},[],{"data":7984,"content":7985,"nodeType":860},{},[7986],{"data":7987,"marks":7988,"value":1689,"nodeType":864},{},[],{"data":7990,"content":7991,"nodeType":860},{},[7992,7995,8002],{"data":7993,"marks":7994,"value":21,"nodeType":864},{},[],{"data":7996,"content":7997,"nodeType":883},{"uri":1700},[7998],{"data":7999,"marks":8000,"value":1703,"nodeType":864},{},[8001],{"type":1455},{"data":8003,"marks":8004,"value":21,"nodeType":864},{},[],"AI regulation is here: how browser visibility and control can achieve compliance","AI regulations across the US, EU, and UK are converging on obligations that most organizations can't meet without browser visibility into AI tool use.","2026-06-02T00:00:00.000Z","browser-visibility-and-control-can-achieve-ai-compliance",{"items":8010},[8011,8013],{"sys":8012,"name":2729},{"id":2728},{"sys":8014,"name":297},{"id":2732},{"items":8016},[8017],{"fullName":8018,"firstName":8019,"jobTitle":8020,"profilePicture":8021},"John Creaton","John","Head of Legal",{"url":8022},"https://images.ctfassets.net/y1cdw1ablpvd/ykgZqhGCFFxufznVsqTiM/6bd977c68dd504642f0064bdb90ebdee/1774636973277.jpeg",{"__typename":2059,"sys":8024,"content":8026,"title":8945,"synopsis":8946,"hashTags":59,"publishedDate":8007,"slug":8947,"tagsCollection":8948,"authorsCollection":8954},{"id":8025},"I5SoVIYsYVgutpLIzZRpC",{"json":8027},{"data":8028,"content":8029,"nodeType":856},{},[8030,8037,8044,8065,8072,8079,8082,8090,8097,8104,8127,8134,8141,8147,8150,8158,8165,8171,8178,8186,8218,8237,8243,8251,8258,8264,8284,8292,8299,8330,8336,8351,8354,8362,8369,8374,8390,8397,8404,8416,8436,8443,8450,8458,8465,8483,8489,8496,8502,8508,8511,8519,8526,8533,8596,8603,8610,8617,8624,8640,8647,8654,8661,8668,8675,8682,8689,8696,8703,8710,8717,8724,8731,8734,8742,8749,8761,8768,8775,8782,8789,8912,8918,8924,8927],{"data":8031,"content":8032,"nodeType":860},{},[8033],{"data":8034,"marks":8035,"value":8036,"nodeType":864},{},[],"When is a fork not a fork? When it's a browser security platform built to solve both problems of the AI era.",{"data":8038,"content":8039,"nodeType":860},{},[8040],{"data":8041,"marks":8042,"value":8043,"nodeType":864},{},[],"Many security leaders are rightly worried about two big problems in the age of AI: AI-enabled attacks targeting their employees via the browser; and employees introducing the risk of data loss through their use of AI tools.",{"data":8045,"content":8046,"nodeType":860},{},[8047,8052,8056,8061],{"data":8048,"marks":8049,"value":8051,"nodeType":864},{},[8050],{"type":899},"For security teams researching browser-based solutions to these challenges, the decision at first looks like a fork in the road: ",{"data":8053,"marks":8054,"value":8055,"nodeType":864},{},[],"Choose a solution that's purpose-built to detect and respond to modern browser-based attacks like AI-enabled phish kits, ClickFix and other *Fix-style attacks, malicious browser extensions, device code phishing, and others; ",{"data":8057,"marks":8058,"value":8060,"nodeType":864},{},[8059],{"type":2246},"or",{"data":8062,"marks":8063,"value":8064,"nodeType":864},{},[]," select an AI governance tool to enforce sensible policies for sensitive data in the browser.",{"data":8066,"content":8067,"nodeType":860},{},[8068],{"data":8069,"marks":8070,"value":8071,"nodeType":864},{},[],"Push solves both of these problems. One platform, one SKU.",{"data":8073,"content":8074,"nodeType":860},{},[8075],{"data":8076,"marks":8077,"value":8078,"nodeType":864},{},[],"In this article, we'll take a look at the two big AI security and data governance problems that security teams are facing and outline how Push solves them in a single solution. We’ll cover what questions to ask as you evaluate browser security solutions, and describe Push's focus on providing foundational telemetry, detections, and controls that allow you to answer the question “What actually happened here?” not just “What policy was violated?”",{"data":8080,"content":8081,"nodeType":1005},{},[],{"data":8083,"content":8084,"nodeType":1009},{},[8085],{"data":8086,"marks":8087,"value":8089,"nodeType":864},{},[8088],{"type":899},"The AI risks every security team is now responsible for",{"data":8091,"content":8092,"nodeType":860},{},[8093],{"data":8094,"marks":8095,"value":8096,"nodeType":864},{},[],"AI is an amplifier, for adversaries and for your employees. Whatever they could do before, they can now do faster, more powerfully, and at scale.",{"data":8098,"content":8099,"nodeType":860},{},[8100],{"data":8101,"marks":8102,"value":8103,"nodeType":864},{},[],"The two risks that every security team now must manage: ",{"data":8105,"content":8106,"nodeType":941},{},[8107,8117],{"data":8108,"content":8109,"nodeType":945},{},[8110],{"data":8111,"content":8112,"nodeType":860},{},[8113],{"data":8114,"marks":8115,"value":8116,"nodeType":864},{},[],"AI is making browser-based attacks faster, cheaper, and harder to detect.",{"data":8118,"content":8119,"nodeType":945},{},[8120],{"data":8121,"content":8122,"nodeType":860},{},[8123],{"data":8124,"marks":8125,"value":8126,"nodeType":864},{},[],"Employee AI adoption is creating data exposure faster than security teams can respond.",{"data":8128,"content":8129,"nodeType":860},{},[8130],{"data":8131,"marks":8132,"value":8133,"nodeType":864},{},[],"Both of these challenges intersect in the same place: The browser. It's the place where adversaries target employees with modern attacks designed to accomplish account takeover and data exfiltration. It's also the place where workers discover and use new AI-enabled apps and introduce risk into the business in the form of data loss, shadow apps, risky browser extensions, and shadow integrations.",{"data":8135,"content":8136,"nodeType":860},{},[8137],{"data":8138,"marks":8139,"value":8140,"nodeType":864},{},[],"To address both problems, security teams need visibility and control in the browser.",{"data":8142,"content":8146,"nodeType":996},{"target":8143},{"sys":8144},{"id":8145,"type":1001,"linkType":1002},"1U2Hmn4XrFpdcxyjxY3aCc",[],{"data":8148,"content":8149,"nodeType":1005},{},[],{"data":8151,"content":8152,"nodeType":1009},{},[8153],{"data":8154,"marks":8155,"value":8157,"nodeType":864},{},[8156],{"type":899},"How AI is transforming attacks",{"data":8159,"content":8160,"nodeType":860},{},[8161],{"data":8162,"marks":8163,"value":8164,"nodeType":864},{},[],"On the adversary side of the equation, adversaries are using AI tooling to rapidly iterate on new attack types or new iterations of existing browser-based TTPs that target employees to achieve account or endpoint compromise — usually with the end goal of harvesting valuable corporate identities in order to exfiltrate data or hold it for ransom.",{"data":8166,"content":8170,"nodeType":996},{"target":8167},{"sys":8168},{"id":8169,"type":1001,"linkType":1002},"G8xv1seFz1wJnY5HpfV6z",[],{"data":8172,"content":8173,"nodeType":860},{},[8174],{"data":8175,"marks":8176,"value":8177,"nodeType":864},{},[],"AI is changing attacks in three key ways.",{"data":8179,"content":8180,"nodeType":1312},{},[8181],{"data":8182,"marks":8183,"value":8185,"nodeType":864},{},[8184],{"type":899},"AI has supercharged the iteration and evolution of adversary tools and techniques",{"data":8187,"content":8188,"nodeType":860},{},[8189,8193,8202,8206,8214],{"data":8190,"marks":8191,"value":8192,"nodeType":864},{},[],"Attackers are using the same AI capabilities as any other engineer who wants to multiply their output. That translates to an array of new attack techniques: multiple increasingly sophisticated variations of the ",{"data":8194,"content":8196,"nodeType":883},{"uri":8195},"https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/",[8197],{"data":8198,"marks":8199,"value":8201,"nodeType":864},{},[8200],{"type":1455},"ClickFix-style attacks",{"data":8203,"marks":8204,"value":8205,"nodeType":864},{},[]," that use social engineering techniques to get users to unknowingly install malware via malicious scripts; as well as creative ",{"data":8207,"content":8208,"nodeType":883},{"uri":3259},[8209],{"data":8210,"marks":8211,"value":8213,"nodeType":864},{},[8212],{"type":1455},"exploitation of device codes",{"data":8215,"marks":8216,"value":8217,"nodeType":864},{},[],", a legitimate authentication mechanism, that allows attackers to phish access post-authentication.",{"data":8219,"content":8220,"nodeType":860},{},[8221,8225,8233],{"data":8222,"marks":8223,"value":8224,"nodeType":864},{},[],"Device code phishing in particular demonstrates the rapid growth of new techniques, with early documented appearances of the TTP occurring in 2024, and by early the next year, the method had been packaged as a PhaaS offering with GPT-enhanced spear-phishing and customized landing pages. The ",{"data":8226,"content":8228,"nodeType":883},{"uri":8227},"https://www.huntress.com/blog/device-code-phishing-ai-mfa-bypass",[8229],{"data":8230,"marks":8231,"value":8232,"nodeType":864},{},[],"campaign",{"data":8234,"marks":8235,"value":8236,"nodeType":864},{},[]," targeted more than 340 organizations across five countries in March 2026, using personalized AI-generated lures at a scale that would have been impractical to produce manually.",{"data":8238,"content":8242,"nodeType":996},{"target":8239},{"sys":8240},{"id":8241,"type":1001,"linkType":1002},"eNUpU2GtGOcXRrHBKHnLN",[],{"data":8244,"content":8245,"nodeType":1312},{},[8246],{"data":8247,"marks":8248,"value":8250,"nodeType":864},{},[8249],{"type":899},"Infrastructure-based detections are increasingly degraded by AI-enabled approaches",{"data":8252,"content":8253,"nodeType":860},{},[8254],{"data":8255,"marks":8256,"value":8257,"nodeType":864},{},[],"AI has also collapsed the cost and time it takes to build convincing phishing infrastructure: Attackers can vibecode a convincing phishing page in minutes, burn the domain, and regenerate another one before any blocklist updates. ",{"data":8259,"content":8263,"nodeType":996},{"target":8260},{"sys":8261},{"id":8262,"type":1001,"linkType":1002},"2obvOhMWjy64h94tEIbx04",[],{"data":8265,"content":8266,"nodeType":860},{},[8267,8271,8280],{"data":8268,"marks":8269,"value":8270,"nodeType":864},{},[],"The impact on IOC-based detections that rely on infrastructure elements is severe: When elements constantly change, every phishing attack is essentially a zero-day. Complicating the picture further is the increasing use of legitimate cloud platforms like ",{"data":8272,"content":8274,"nodeType":883},{"uri":8273},"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign",[8275],{"data":8276,"marks":8277,"value":8279,"nodeType":864},{},[8278],{"type":1455},"Railway",{"data":8281,"marks":8282,"value":8283,"nodeType":864},{},[],", Cloudflare Workers, and Vercel, which attackers use to host and dynamically rotate attack infrastructure.",{"data":8285,"content":8286,"nodeType":1312},{},[8287],{"data":8288,"marks":8289,"value":8291,"nodeType":864},{},[8290],{"type":899},"AI is making it easier to build and run omni-channel campaigns",{"data":8293,"content":8294,"nodeType":860},{},[8295],{"data":8296,"marks":8297,"value":8298,"nodeType":864},{},[],"Push researchers have written extensively over the last year about malvertising campaigns that serve malicious pages to users via search engine results, enticing them to visit sites designed to steal credentials or deliver malware. ",{"data":8300,"content":8301,"nodeType":860},{},[8302,8306,8315,8319,8326],{"data":8303,"marks":8304,"value":8305,"nodeType":864},{},[],"We've tracked ",{"data":8307,"content":8309,"nodeType":883},{"uri":8308},"https://pushsecurity.com/blog/cyber-criminal-ecosystem-analysis/",[8310],{"data":8311,"marks":8312,"value":8314,"nodeType":864},{},[8313],{"type":1455},"sustained campaigns",{"data":8316,"marks":8317,"value":8318,"nodeType":864},{},[]," impersonating Onfido, TradingView, Ahrefs, Semrush, and others. These campaigns are part of a self-reinforcing criminal ecosystem: Malvertising campaigns paid for by stolen ad accounts, with credential theft that funds the next round of credential theft. And the recent ",{"data":8320,"content":8322,"nodeType":883},{"uri":8321},"https://pushsecurity.com/blog/llmshare-malvertising-campaign/",[8323],{"data":8324,"marks":8325,"value":1555,"nodeType":864},{},[],{"data":8327,"marks":8328,"value":8329,"nodeType":864},{},[]," campaign identified by Push shows how attackers are combining their abuse of AI tools of AI-assisted phishing page creation with malvertising, helping them to spin up lookalike pages quickly and cheaply to serve as convincing lures.",{"data":8331,"content":8335,"nodeType":996},{"target":8332},{"sys":8333},{"id":8334,"type":1001,"linkType":1002},"2Gwj25KBjClQ5u8uiEYuYR",[],{"data":8337,"content":8338,"nodeType":860},{},[8339,8343,8348],{"data":8340,"marks":8341,"value":8342,"nodeType":864},{},[],"These are just a few examples of how phishing has moved beyond the inbox, targeting users through malvertising, SEO poisoning, and social media DMs. Over the last year, Push researchers found that ",{"data":8344,"marks":8345,"value":8347,"nodeType":864},{},[8346],{"type":899},"1 in 3 payloads intercepted by the platform were sent outside of email",{"data":8349,"marks":8350,"value":2924,"nodeType":864},{},[],{"data":8352,"content":8353,"nodeType":1005},{},[],{"data":8355,"content":8356,"nodeType":1009},{},[8357],{"data":8358,"marks":8359,"value":8361,"nodeType":864},{},[8360],{"type":899},"How AI is creating risky employee behaviors ",{"data":8363,"content":8364,"nodeType":860},{},[8365],{"data":8366,"marks":8367,"value":8368,"nodeType":864},{},[],"Meanwhile, on the employee side of the equation, there are three other key concerns that security teams should be paying attention to when it comes to the risks associated with AI use.",{"data":8370,"content":8373,"nodeType":996},{"target":8371},{"sys":8372},{"id":1040,"type":1001,"linkType":1002},[],{"data":8375,"content":8376,"nodeType":1312},{},[8377,8382,8385],{"data":8378,"marks":8379,"value":8381,"nodeType":864},{},[8380],{"type":899},"Data leaving the business via shadow AI",{"data":8383,"marks":8384,"value":1171,"nodeType":864},{},[],{"data":8386,"marks":8387,"value":8389,"nodeType":864},{},[8388],{"type":899},"and AI extensions",{"data":8391,"content":8392,"nodeType":860},{},[8393],{"data":8394,"marks":8395,"value":8396,"nodeType":864},{},[],"Employees are signing up to AI tools directly, beyond the bounds of procurement or security review. That means security teams can't see sensitive data going into LLMs — clipboard pastes of API keys, file uploads to coding assistants, customer data in uploaded spreadsheets, etc.",{"data":8398,"content":8399,"nodeType":860},{},[8400],{"data":8401,"marks":8402,"value":8403,"nodeType":864},{},[],"Most teams also don't have visibility of AI browser extensions, another avenue for data to leave the business. Extensions are also an attack surface in their own right, as previously benign extensions can be compromised by threat actors through account takeover of the extension developer.",{"data":8405,"content":8406,"nodeType":1312},{},[8407,8412],{"data":8408,"marks":8409,"value":8411,"nodeType":864},{},[8410],{"type":899},"Employees using personal accounts on corporate AI app tenants",{"data":8413,"marks":8414,"value":8415,"nodeType":864},{},[]," ",{"data":8417,"content":8418,"nodeType":860},{},[8419,8423,8432],{"data":8420,"marks":8421,"value":8422,"nodeType":864},{},[],"The 2026 ",{"data":8424,"content":8426,"nodeType":883},{"uri":8425},"https://www.verizon.com/business/resources/reports/dbir/",[8427],{"data":8428,"marks":8429,"value":8431,"nodeType":864},{},[8430],{"type":1455},"Verizon DBIR",{"data":8433,"marks":8434,"value":8435,"nodeType":864},{},[]," found that 67% of GenAI users on corporate devices are using non-corporate accounts, and our own data shows that 38% of file uploads to AI tools are made from shadow accounts rather than approved organizational ones.",{"data":8437,"content":8438,"nodeType":860},{},[8439],{"data":8440,"marks":8441,"value":8442,"nodeType":864},{},[],"That means a large number of employees in most organizations are using AI apps with personal accounts, outside of organizational data governance, retention policies, access controls, or basic security oversight. ",{"data":8444,"content":8445,"nodeType":860},{},[8446],{"data":8447,"marks":8448,"value":8449,"nodeType":864},{},[],"The compounding risk is that personal accounts are typically protected by weaker passwords, inconsistent MFA, and credential reuse from other personal services — meaning a compromise of the personal account could give an attacker access to corporate data and tools.",{"data":8451,"content":8452,"nodeType":1312},{},[8453],{"data":8454,"marks":8455,"value":8457,"nodeType":864},{},[8456],{"type":899},"Shadow integrations between AI tools and corporate systems",{"data":8459,"content":8460,"nodeType":860},{},[8461],{"data":8462,"marks":8463,"value":8464,"nodeType":864},{},[],"App-to-app connections accomplished through OAuth are also proliferating faster than most teams can observe and review them. For the average organization, Push sees 17 unique AI app OAuth integrations connected just to Microsoft and Google corporate tenants.",{"data":8466,"content":8467,"nodeType":860},{},[8468,8471,8479],{"data":8469,"marks":8470,"value":2761,"nodeType":864},{},[],{"data":8472,"content":8473,"nodeType":883},{"uri":4103},[8474],{"data":8475,"marks":8476,"value":8478,"nodeType":864},{},[8477],{"type":1455},"recent Vercel breach",{"data":8480,"marks":8481,"value":8482,"nodeType":864},{},[]," illustrates the risks of even a single OAuth connection from a compromised third-party AI SaaS provider. This isn't really a new AI threat so much as a shadow SaaS problem that's accelerating alongside AI adoption, given that AI apps are specifically designed to pull data from one system, analyze it in another, and present it in a third — with MCP connections now creating the same kind of persistent, permissioned access through an authentication protocol (OAuth) that most organizations have no process to review.",{"data":8484,"content":8488,"nodeType":996},{"target":8485},{"sys":8486},{"id":8487,"type":1001,"linkType":1002},"1t2jn4fLxMlH0adMyQqkXk",[],{"data":8490,"content":8491,"nodeType":860},{},[8492],{"data":8493,"marks":8494,"value":8495,"nodeType":864},{},[],"This is the same web of OAuth-connected apps that is being exposed at scale through AI tool integrations. For many organizations, AI tools are now the hub of modern activity that orchestrates and automates across the mesh of cloud apps, which adds a useful perspective on what's changed. ",{"data":8497,"content":8501,"nodeType":996},{"target":8498},{"sys":8499},{"id":8500,"type":1001,"linkType":1002},"6cRnPkGdwWXRWcct6LfMzo",[],{"data":8503,"content":8507,"nodeType":996},{"target":8504},{"sys":8505},{"id":8506,"type":1001,"linkType":1002},"5WQZNpnPETWeys1VqubVW",[],{"data":8509,"content":8510,"nodeType":1005},{},[],{"data":8512,"content":8513,"nodeType":1009},{},[8514],{"data":8515,"marks":8516,"value":8518,"nodeType":864},{},[8517],{"type":899},"What to ask when evaluating browser-based AI visibility and control solutions",{"data":8520,"content":8521,"nodeType":860},{},[8522],{"data":8523,"marks":8524,"value":8525,"nodeType":864},{},[],"When you're evaluating AI visibility and control platforms that operate in the browser, there are two lines of questioning that can be useful to unpack.",{"data":8527,"content":8528,"nodeType":860},{},[8529],{"data":8530,"marks":8531,"value":8532,"nodeType":864},{},[],"The first is the tactical basics: What use cases does the product cover, and how quickly will you see value? In this category, you'll likely be looking for:",{"data":8534,"content":8535,"nodeType":941},{},[8536,8551,8566,8581],{"data":8537,"content":8538,"nodeType":945},{},[8539],{"data":8540,"content":8541,"nodeType":860},{},[8542,8547],{"data":8543,"marks":8544,"value":8546,"nodeType":864},{},[8545],{"type":899},"Depth of visibility:",{"data":8548,"marks":8549,"value":8550,"nodeType":864},{},[]," Can the solution observe both corporate and personal account usage of AI apps? Does the solution work with all major browsers, including emerging AI browsers? Does the solution automatically classify AI apps and automatically discover shadow AI?",{"data":8552,"content":8553,"nodeType":945},{},[8554],{"data":8555,"content":8556,"nodeType":860},{},[8557,8562],{"data":8558,"marks":8559,"value":8561,"nodeType":864},{},[8560],{"type":899},"Granularity of controls:",{"data":8563,"marks":8564,"value":8565,"nodeType":864},{},[]," Does the solution support visibility and control over clipboard interactions, allowing you to identify sensitive data strings like personal access tokens (PATs) or API keys? Does the solution allow you to set multiple enforcement modes (monitor, warn, block) and carve out exceptions for tools, teams and individuals where necessary? ",{"data":8567,"content":8568,"nodeType":945},{},[8569],{"data":8570,"content":8571,"nodeType":860},{},[8572,8577],{"data":8573,"marks":8574,"value":8576,"nodeType":864},{},[8575],{"type":899},"Ease of deployment:",{"data":8578,"marks":8579,"value":8580,"nodeType":864},{},[]," How is the solution deployed? Browser extension-based solutions like Push can be deployed at scale in an hour. Solutions that require an endpoint agent or a complete browser replacement will be a heavier lift.",{"data":8582,"content":8583,"nodeType":945},{},[8584],{"data":8585,"content":8586,"nodeType":860},{},[8587,8592],{"data":8588,"marks":8589,"value":8591,"nodeType":864},{},[8590],{"type":899},"Scope of coverage:",{"data":8593,"marks":8594,"value":8595,"nodeType":864},{},[]," Does the solution only enforce policy around AI usage, or does it also prevent AI-enabled attacks in the browser? ",{"data":8597,"content":8598,"nodeType":860},{},[8599],{"data":8600,"marks":8601,"value":8602,"nodeType":864},{},[],"The second set of questions is more about the underlying architectural choices a product has made, and how those translate into actionable intelligence for security teams — or where there may be blind spots. In this category, you will want to ask:",{"data":8604,"content":8605,"nodeType":1312},{},[8606],{"data":8607,"marks":8608,"value":8609,"nodeType":864},{},[],"Does the tool capture AI interactions that didn’t trigger a policy violation — or only the ones it blocked?",{"data":8611,"content":8612,"nodeType":860},{},[8613],{"data":8614,"marks":8615,"value":8616,"nodeType":864},{},[],"This is the most useful diagnostic if you're focused on understanding the wider security meaning and impact of an AI interaction, not just whether it violated a policy. ",{"data":8618,"content":8619,"nodeType":860},{},[8620],{"data":8621,"marks":8622,"value":8623,"nodeType":864},{},[],"Enforcement-first tools record what they stopped: blocked uploads, attempted usage of unapproved apps, flagged file names, etc. ",{"data":8625,"content":8626,"nodeType":860},{},[8627,8631,8636],{"data":8628,"marks":8629,"value":8630,"nodeType":864},{},[],"That's useful for compliance reporting but incomplete for security investigation, because ",{"data":8632,"marks":8633,"value":8635,"nodeType":864},{},[8634],{"type":899},"the most significant events are often the ones that looked normal at the time",{"data":8637,"marks":8638,"value":8639,"nodeType":864},{},[],": A user whose behavior shifted gradually over weeks before a resignation. An approved AI browser extension that updates its permissions, putting it in risky territory. An OAuth consent grant that was technically permitted but shouldn't have been.",{"data":8641,"content":8642,"nodeType":860},{},[8643],{"data":8644,"marks":8645,"value":8646,"nodeType":864},{},[],"Ask whether the tool can collect user behavior telemetry, file upload and download activity, and AI usage logs for permitted events — not just policy violations — and whether that telemetry can be forwarded to your SIEM. ",{"data":8648,"content":8649,"nodeType":860},{},[8650],{"data":8651,"marks":8652,"value":8653,"nodeType":864},{},[],"One approach gives you an investigation tool. The other gives you compliance alerts without deeper context.",{"data":8655,"content":8656,"nodeType":1312},{},[8657],{"data":8658,"marks":8659,"value":8660,"nodeType":864},{},[],"When an AI agent requests OAuth permissions to access your organization's data, does the tool capture the consent flow — what scopes were requested on which app, which user initiated the consent, and what was the outcome?",{"data":8662,"content":8663,"nodeType":860},{},[8664],{"data":8665,"marks":8666,"value":8667,"nodeType":864},{},[],"Most enforcement-first tools treat OAuth as a binary: approved app or blocked app. That was a reasonable model when OAuth grants were primarily app-to-app integrations managed by IT. It isn't sufficient for agentic AI.",{"data":8669,"content":8670,"nodeType":860},{},[8671],{"data":8672,"marks":8673,"value":8674,"nodeType":864},{},[],"AI agents request OAuth permissions to access organizational data on behalf of users. These are user-initiated consent grants that happen inside browser sessions, often with broad scopes, and frequently without security team awareness. The right tool needs to capture the consent event itself: what permissions were requested, what scopes were granted, who approved them, and what application received them. ",{"data":8676,"content":8677,"nodeType":860},{},[8678],{"data":8679,"marks":8680,"value":8681,"nodeType":864},{},[],"Ask whether the tool monitors OAuth consent flows across authorization servers, whether it can warn or block consent grants in real time based on policy, and whether that coverage extends to AI-enabled apps and MCP connections.",{"data":8683,"content":8684,"nodeType":1312},{},[8685],{"data":8686,"marks":8687,"value":8688,"nodeType":864},{},[],"When a new browser attack technique emerges that no tool has a signature for, how long does it take the platform to detect it — and can you show a specific example?",{"data":8690,"content":8691,"nodeType":860},{},[8692],{"data":8693,"marks":8694,"value":8695,"nodeType":864},{},[],"Attackers are rotating infrastructure in hours and using AI to generate new lures and phishing pages at scale. A detection model built on blocklists, reputation feeds, and known-bad indicators is architecturally behind any novel technique because by the time the indicator appears on a feed, the attacker has already moved on.",{"data":8697,"content":8698,"nodeType":860},{},[8699],{"data":8700,"marks":8701,"value":8702,"nodeType":864},{},[],"Ask vendors to show you a specific detection that fired on a novel technique before the infrastructure appeared on any threat feed.",{"data":8704,"content":8705,"nodeType":1312},{},[8706],{"data":8707,"marks":8708,"value":8709,"nodeType":864},{},[],"What browser telemetry reaches your SIEM — just alerts, or the underlying session data that makes those alerts investigable?",{"data":8711,"content":8712,"nodeType":860},{},[8713],{"data":8714,"marks":8715,"value":8716,"nodeType":864},{},[],"Ask to see a sample SIEM event from a real detection. Many browser security tools integrate with SIEMs, but the depth of what they forward varies a lot. ",{"data":8718,"content":8719,"nodeType":860},{},[8720],{"data":8721,"marks":8722,"value":8723,"nodeType":864},{},[],"Some send alert metadata that captures policy violations, timestamps, and involved users. Others forward a broader set of telemetry for deeper context — credential reuse, app logins, newly installed extensions, detected phishing kits, file uploads, clipboard activity, OAuth consent flows, file downloads, etc. ",{"data":8725,"content":8726,"nodeType":860},{},[8727],{"data":8728,"marks":8729,"value":8730,"nodeType":864},{},[],"The difference determines whether your SOC team can easily correlate signals from the browser-based tool with other layers of their stack and begin an investigation from the SIEM event itself — or whether they need to pivot back into the vendor's console for the actual evidence.",{"data":8732,"content":8733,"nodeType":1005},{},[],{"data":8735,"content":8736,"nodeType":1009},{},[8737],{"data":8738,"marks":8739,"value":8741,"nodeType":864},{},[8740],{"type":899},"AI visibility and control is a feature of the right browser security platform, not a separate purchase",{"data":8743,"content":8744,"nodeType":860},{},[8745],{"data":8746,"marks":8747,"value":8748,"nodeType":864},{},[],"Ultimately, the choice of browser platform for solving the two big problems of the AI era comes down to whether you need broader attack coverage and telemetry context in order to secure your organization, or whether a policy-based approach is enough. ",{"data":8750,"content":8751,"nodeType":860},{},[8752,8756],{"data":8753,"marks":8754,"value":8755,"nodeType":864},{},[],"Push treats the challenges of stopping AI-enabled attacks and providing visibility and control over AI usage as features that extend naturally from the platform's underlying architectural model: Rich browser-layer telemetry in ",{"data":8757,"marks":8758,"value":8760,"nodeType":864},{},[8759],{"type":899},"a single tool that helps security teams answer the question “What actually happened here?” not just “What policy was violated?”",{"data":8762,"content":8763,"nodeType":860},{},[8764],{"data":8765,"marks":8766,"value":8767,"nodeType":864},{},[],"This unified architecture matters because the AI control problem and the browser threat detection problem share a root cause: Security-relevant activity is happening inside browser sessions that most tools can't see. ",{"data":8769,"content":8770,"nodeType":860},{},[8771],{"data":8772,"marks":8773,"value":8774,"nodeType":864},{},[],"A standalone AI governance tool can tell you which AI apps are in use and whether employees violated a usage policy. It can't tell you whether the OAuth grant an AI agent just received was part of a broader pattern that includes credential entry on an unfamiliar domain, a clipboard paste from an internal document, and a login to a shadow SaaS app — all in the same session, all visible in the same telemetry stream. ",{"data":8776,"content":8777,"nodeType":860},{},[8778],{"data":8779,"marks":8780,"value":8781,"nodeType":864},{},[],"Separating AI governance from browser security means maintaining two tools that each only see half the picture. ",{"data":8783,"content":8784,"nodeType":1312},{},[8785],{"data":8786,"marks":8787,"value":8788,"nodeType":864},{},[],"How Push can help",{"data":8790,"content":8791,"nodeType":941},{},[8792,8815,8838,8860,8870,8880,8890],{"data":8793,"content":8794,"nodeType":945},{},[8795],{"data":8796,"content":8797,"nodeType":860},{},[8798,8802,8811],{"data":8799,"marks":8800,"value":8801,"nodeType":864},{},[],"Block emerging ",{"data":8803,"content":8805,"nodeType":883},{"uri":8804},"https://pushsecurity.com/blog/introducing-the-browser-and-identity-attacks-matrix/",[8806],{"data":8807,"marks":8808,"value":8810,"nodeType":864},{},[8809],{"type":1455},"browser-based attack techniques",{"data":8812,"marks":8813,"value":8814,"nodeType":864},{},[],", including AI-enabled phishing and quickly evolving *Fix-style attacks.",{"data":8816,"content":8817,"nodeType":945},{},[8818],{"data":8819,"content":8820,"nodeType":860},{},[8821,8825,8834],{"data":8822,"marks":8823,"value":8824,"nodeType":864},{},[],"Benefit from Push's ",{"data":8826,"content":8828,"nodeType":883},{"uri":8827},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline/",[8829],{"data":8830,"marks":8831,"value":8833,"nodeType":864},{},[8832],{"type":1455},"agentic detection pipeline",{"data":8835,"marks":8836,"value":8837,"nodeType":864},{},[],", which continuously hunts across customer environments to identify emerging threats and ship new detections.",{"data":8839,"content":8840,"nodeType":945},{},[8841],{"data":8842,"content":8843,"nodeType":860},{},[8844,8847,8856],{"data":8845,"marks":8846,"value":21,"nodeType":864},{},[],{"data":8848,"content":8850,"nodeType":883},{"uri":8849},"https://pushsecurity.com/help/audience/engineering/rest-v1",[8851],{"data":8852,"marks":8853,"value":8855,"nodeType":864},{},[8854],{"type":1455},"Stream telemetry",{"data":8857,"marks":8858,"value":8859,"nodeType":864},{},[]," to your SIEM for a wide variety of events, including attack detections; newly installed browser extensions or newly adopted apps; updates to extension permissions; file uploads and downloads; clipboard pastes; app logins; credential reuse; OAuth consents; and more.",{"data":8861,"content":8862,"nodeType":945},{},[8863],{"data":8864,"content":8865,"nodeType":860},{},[8866],{"data":8867,"marks":8868,"value":8869,"nodeType":864},{},[],"Block file uploads and downloads.",{"data":8871,"content":8872,"nodeType":945},{},[8873],{"data":8874,"content":8875,"nodeType":860},{},[8876],{"data":8877,"marks":8878,"value":8879,"nodeType":864},{},[],"Block clipboard pastes of sensitive data, with regex-based patterns you can define.",{"data":8881,"content":8882,"nodeType":945},{},[8883],{"data":8884,"content":8885,"nodeType":860},{},[8886],{"data":8887,"marks":8888,"value":8889,"nodeType":864},{},[],"Monitor for or block unauthorized MCP connections.",{"data":8891,"content":8892,"nodeType":945},{},[8893],{"data":8894,"content":8895,"nodeType":860},{},[8896,8900,8908],{"data":8897,"marks":8898,"value":8899,"nodeType":864},{},[],"Write your own ",{"data":8901,"content":8902,"nodeType":883},{"uri":5494},[8903],{"data":8904,"marks":8905,"value":8907,"nodeType":864},{},[8906],{"type":1455},"custom YAML rules",{"data":8909,"marks":8910,"value":8911,"nodeType":864},{},[]," targeting specific elements of the page DOM, web requests and responses, HTTP headers such as cookies, and a lot more.",{"data":8913,"content":8914,"nodeType":860},{},[8915],{"data":8916,"marks":8917,"value":21,"nodeType":864},{},[],{"data":8919,"content":8923,"nodeType":996},{"target":8920},{"sys":8921},{"id":8922,"type":1001,"linkType":1002},"7AwQv7bLbARq6mdAgv7uGq",[],{"data":8925,"content":8926,"nodeType":1005},{},[],{"data":8928,"content":8929,"nodeType":860},{},[8930,8934,8942],{"data":8931,"marks":8932,"value":8933,"nodeType":864},{},[],"If you'd like to learn more about Push, ",{"data":8935,"content":8936,"nodeType":883},{"uri":1700},[8937],{"data":8938,"marks":8939,"value":8941,"nodeType":864},{},[8940],{"type":1455},"book a live demo",{"data":8943,"marks":8944,"value":2924,"nodeType":864},{},[],"Why you can't control AI without being in the browser","Why the right browser security tool makes a separate AI visibility and control purchase unnecessary — and how to decide what you actually need.","why-you-cant-control-ai-without-being-in-the-browser",{"items":8949},[8950,8952],{"sys":8951,"name":297},{"id":2732},{"sys":8953,"name":2729},{"id":2728},{"items":8955},[8956],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":8957},{"url":853},{"__typename":2059,"sys":8959,"content":8960,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":10029,"authorsCollection":10035},{"id":3628},{"json":8961},{"data":8962,"content":8963,"nodeType":856},{},[8964,8977,8982,8988,8994,8999,9002,9009,9016,9031,9069,9074,9087,9090,9097,9104,9126,9158,9164,9167,9174,9181,9187,9192,9198,9201,9208,9215,9249,9279,9285,9288,9295,9302,9322,9328,9367,9373,9376,9383,9390,9426,9432,9437,9440,9447,9454,9480,9486,9491,9497,9500,9507,9514,9537,9543,9549,9555,9558,9565,9572,9578,9583,9589,9610,9633,9636,9643,9650,9656,9662,9665,9672,9727,9730,9737,9743,10011,10014],{"data":8965,"content":8966,"nodeType":860},{},[8967,8970,8974],{"data":8968,"marks":8969,"value":3639,"nodeType":864},{},[],{"data":8971,"marks":8972,"value":3644,"nodeType":864},{},[8973],{"type":899},{"data":8975,"marks":8976,"value":3648,"nodeType":864},{},[],{"data":8978,"content":8981,"nodeType":996},{"target":8979},{"sys":8980},{"id":3653,"type":1001,"linkType":1002},[],{"data":8983,"content":8984,"nodeType":860},{},[8985],{"data":8986,"marks":8987,"value":3661,"nodeType":864},{},[],{"data":8989,"content":8990,"nodeType":860},{},[8991],{"data":8992,"marks":8993,"value":3668,"nodeType":864},{},[],{"data":8995,"content":8998,"nodeType":996},{"target":8996},{"sys":8997},{"id":3673,"type":1001,"linkType":1002},[],{"data":9000,"content":9001,"nodeType":1005},{},[],{"data":9003,"content":9004,"nodeType":1009},{},[9005],{"data":9006,"marks":9007,"value":3685,"nodeType":864},{},[9008],{"type":899},{"data":9010,"content":9011,"nodeType":860},{},[9012],{"data":9013,"marks":9014,"value":3693,"nodeType":864},{},[9015],{"type":899},{"data":9017,"content":9018,"nodeType":860},{},[9019,9022,9028],{"data":9020,"marks":9021,"value":3700,"nodeType":864},{},[],{"data":9023,"content":9024,"nodeType":883},{"uri":3703},[9025],{"data":9026,"marks":9027,"value":3708,"nodeType":864},{},[],{"data":9029,"marks":9030,"value":3712,"nodeType":864},{},[],{"data":9032,"content":9033,"nodeType":860},{},[9034,9037,9043,9046,9050,9053,9057,9060,9066],{"data":9035,"marks":9036,"value":3719,"nodeType":864},{},[],{"data":9038,"content":9039,"nodeType":883},{"uri":3722},[9040],{"data":9041,"marks":9042,"value":3727,"nodeType":864},{},[],{"data":9044,"marks":9045,"value":3731,"nodeType":864},{},[],{"data":9047,"marks":9048,"value":3736,"nodeType":864},{},[9049],{"type":899},{"data":9051,"marks":9052,"value":2232,"nodeType":864},{},[],{"data":9054,"marks":9055,"value":3744,"nodeType":864},{},[9056],{"type":899},{"data":9058,"marks":9059,"value":3748,"nodeType":864},{},[],{"data":9061,"content":9062,"nodeType":883},{"uri":3751},[9063],{"data":9064,"marks":9065,"value":3756,"nodeType":864},{},[],{"data":9067,"marks":9068,"value":3760,"nodeType":864},{},[],{"data":9070,"content":9073,"nodeType":996},{"target":9071},{"sys":9072},{"id":3765,"type":1001,"linkType":1002},[],{"data":9075,"content":9076,"nodeType":860},{},[9077,9080,9084],{"data":9078,"marks":9079,"value":3773,"nodeType":864},{},[],{"data":9081,"marks":9082,"value":3778,"nodeType":864},{},[9083],{"type":899},{"data":9085,"marks":9086,"value":2924,"nodeType":864},{},[],{"data":9088,"content":9089,"nodeType":1005},{},[],{"data":9091,"content":9092,"nodeType":1009},{},[9093],{"data":9094,"marks":9095,"value":3792,"nodeType":864},{},[9096],{"type":899},{"data":9098,"content":9099,"nodeType":860},{},[9100],{"data":9101,"marks":9102,"value":3693,"nodeType":864},{},[9103],{"type":899},{"data":9105,"content":9106,"nodeType":860},{},[9107,9110,9116,9119,9123],{"data":9108,"marks":9109,"value":3806,"nodeType":864},{},[],{"data":9111,"content":9112,"nodeType":883},{"uri":3809},[9113],{"data":9114,"marks":9115,"value":3814,"nodeType":864},{},[],{"data":9117,"marks":9118,"value":3818,"nodeType":864},{},[],{"data":9120,"marks":9121,"value":3823,"nodeType":864},{},[9122],{"type":899},{"data":9124,"marks":9125,"value":3827,"nodeType":864},{},[],{"data":9127,"content":9128,"nodeType":860},{},[9129,9132,9138,9141,9145,9148,9155],{"data":9130,"marks":9131,"value":3834,"nodeType":864},{},[],{"data":9133,"content":9134,"nodeType":883},{"uri":3837},[9135],{"data":9136,"marks":9137,"value":3842,"nodeType":864},{},[],{"data":9139,"marks":9140,"value":3846,"nodeType":864},{},[],{"data":9142,"marks":9143,"value":3851,"nodeType":864},{},[9144],{"type":899},{"data":9146,"marks":9147,"value":3855,"nodeType":864},{},[],{"data":9149,"content":9150,"nodeType":883},{"uri":3858},[9151],{"data":9152,"marks":9153,"value":3864,"nodeType":864},{},[9154],{"type":899},{"data":9156,"marks":9157,"value":3868,"nodeType":864},{},[],{"data":9159,"content":9160,"nodeType":860},{},[9161],{"data":9162,"marks":9163,"value":3875,"nodeType":864},{},[],{"data":9165,"content":9166,"nodeType":1005},{},[],{"data":9168,"content":9169,"nodeType":1009},{},[9170],{"data":9171,"marks":9172,"value":3886,"nodeType":864},{},[9173],{"type":899},{"data":9175,"content":9176,"nodeType":860},{},[9177],{"data":9178,"marks":9179,"value":3894,"nodeType":864},{},[9180],{"type":899},{"data":9182,"content":9183,"nodeType":860},{},[9184],{"data":9185,"marks":9186,"value":3901,"nodeType":864},{},[],{"data":9188,"content":9191,"nodeType":996},{"target":9189},{"sys":9190},{"id":3906,"type":1001,"linkType":1002},[],{"data":9193,"content":9194,"nodeType":860},{},[9195],{"data":9196,"marks":9197,"value":3914,"nodeType":864},{},[],{"data":9199,"content":9200,"nodeType":1005},{},[],{"data":9202,"content":9203,"nodeType":1009},{},[9204],{"data":9205,"marks":9206,"value":3925,"nodeType":864},{},[9207],{"type":899},{"data":9209,"content":9210,"nodeType":860},{},[9211],{"data":9212,"marks":9213,"value":3894,"nodeType":864},{},[9214],{"type":899},{"data":9216,"content":9217,"nodeType":860},{},[9218,9221,9228,9231,9237,9240,9246],{"data":9219,"marks":9220,"value":3939,"nodeType":864},{},[],{"data":9222,"content":9223,"nodeType":883},{"uri":3942},[9224],{"data":9225,"marks":9226,"value":3948,"nodeType":864},{},[9227],{"type":1455},{"data":9229,"marks":9230,"value":3731,"nodeType":864},{},[],{"data":9232,"content":9233,"nodeType":883},{"uri":3954},[9234],{"data":9235,"marks":9236,"value":3959,"nodeType":864},{},[],{"data":9238,"marks":9239,"value":3731,"nodeType":864},{},[],{"data":9241,"content":9242,"nodeType":883},{"uri":3965},[9243],{"data":9244,"marks":9245,"value":3970,"nodeType":864},{},[],{"data":9247,"marks":9248,"value":3974,"nodeType":864},{},[],{"data":9250,"content":9251,"nodeType":860},{},[9252,9255,9262,9265,9269,9272,9276],{"data":9253,"marks":9254,"value":21,"nodeType":864},{},[],{"data":9256,"content":9257,"nodeType":883},{"uri":2411},[9258],{"data":9259,"marks":9260,"value":3988,"nodeType":864},{},[9261],{"type":1455},{"data":9263,"marks":9264,"value":3992,"nodeType":864},{},[],{"data":9266,"marks":9267,"value":3997,"nodeType":864},{},[9268],{"type":899},{"data":9270,"marks":9271,"value":4001,"nodeType":864},{},[],{"data":9273,"marks":9274,"value":4006,"nodeType":864},{},[9275],{"type":2246},{"data":9277,"marks":9278,"value":4010,"nodeType":864},{},[],{"data":9280,"content":9281,"nodeType":860},{},[9282],{"data":9283,"marks":9284,"value":4017,"nodeType":864},{},[],{"data":9286,"content":9287,"nodeType":1005},{},[],{"data":9289,"content":9290,"nodeType":1009},{},[9291],{"data":9292,"marks":9293,"value":4028,"nodeType":864},{},[9294],{"type":899},{"data":9296,"content":9297,"nodeType":860},{},[9298],{"data":9299,"marks":9300,"value":3894,"nodeType":864},{},[9301],{"type":899},{"data":9303,"content":9304,"nodeType":860},{},[9305,9308,9312,9315,9319],{"data":9306,"marks":9307,"value":4042,"nodeType":864},{},[],{"data":9309,"marks":9310,"value":4047,"nodeType":864},{},[9311],{"type":2246},{"data":9313,"marks":9314,"value":4051,"nodeType":864},{},[],{"data":9316,"marks":9317,"value":4056,"nodeType":864},{},[9318],{"type":2246},{"data":9320,"marks":9321,"value":4060,"nodeType":864},{},[],{"data":9323,"content":9324,"nodeType":860},{},[9325],{"data":9326,"marks":9327,"value":4067,"nodeType":864},{},[],{"data":9329,"content":9330,"nodeType":941},{},[9331,9349],{"data":9332,"content":9333,"nodeType":945},{},[9334],{"data":9335,"content":9336,"nodeType":860},{},[9337,9340,9346],{"data":9338,"marks":9339,"value":2761,"nodeType":864},{},[],{"data":9341,"content":9342,"nodeType":883},{"uri":4082},[9343],{"data":9344,"marks":9345,"value":4087,"nodeType":864},{},[],{"data":9347,"marks":9348,"value":4091,"nodeType":864},{},[],{"data":9350,"content":9351,"nodeType":945},{},[9352],{"data":9353,"content":9354,"nodeType":860},{},[9355,9358,9364],{"data":9356,"marks":9357,"value":2761,"nodeType":864},{},[],{"data":9359,"content":9360,"nodeType":883},{"uri":4103},[9361],{"data":9362,"marks":9363,"value":4108,"nodeType":864},{},[],{"data":9365,"marks":9366,"value":4112,"nodeType":864},{},[],{"data":9368,"content":9369,"nodeType":860},{},[9370],{"data":9371,"marks":9372,"value":4119,"nodeType":864},{},[],{"data":9374,"content":9375,"nodeType":1005},{},[],{"data":9377,"content":9378,"nodeType":1009},{},[9379],{"data":9380,"marks":9381,"value":4130,"nodeType":864},{},[9382],{"type":899},{"data":9384,"content":9385,"nodeType":860},{},[9386],{"data":9387,"marks":9388,"value":4138,"nodeType":864},{},[9389],{"type":899},{"data":9391,"content":9392,"nodeType":860},{},[9393,9396,9400,9403,9409,9412,9416,9419,9423],{"data":9394,"marks":9395,"value":4145,"nodeType":864},{},[],{"data":9397,"marks":9398,"value":4150,"nodeType":864},{},[9399],{"type":899},{"data":9401,"marks":9402,"value":4154,"nodeType":864},{},[],{"data":9404,"content":9405,"nodeType":883},{"uri":3237},[9406],{"data":9407,"marks":9408,"value":4161,"nodeType":864},{},[],{"data":9410,"marks":9411,"value":4165,"nodeType":864},{},[],{"data":9413,"marks":9414,"value":4170,"nodeType":864},{},[9415],{"type":899},{"data":9417,"marks":9418,"value":4174,"nodeType":864},{},[],{"data":9420,"marks":9421,"value":4179,"nodeType":864},{},[9422],{"type":899},{"data":9424,"marks":9425,"value":4183,"nodeType":864},{},[],{"data":9427,"content":9428,"nodeType":860},{},[9429],{"data":9430,"marks":9431,"value":4190,"nodeType":864},{},[],{"data":9433,"content":9436,"nodeType":996},{"target":9434},{"sys":9435},{"id":4195,"type":1001,"linkType":1002},[],{"data":9438,"content":9439,"nodeType":1005},{},[],{"data":9441,"content":9442,"nodeType":1009},{},[9443],{"data":9444,"marks":9445,"value":4207,"nodeType":864},{},[9446],{"type":899},{"data":9448,"content":9449,"nodeType":860},{},[9450],{"data":9451,"marks":9452,"value":4215,"nodeType":864},{},[9453],{"type":899},{"data":9455,"content":9456,"nodeType":860},{},[9457,9460,9467,9470,9477],{"data":9458,"marks":9459,"value":4222,"nodeType":864},{},[],{"data":9461,"content":9462,"nodeType":883},{"uri":2561},[9463],{"data":9464,"marks":9465,"value":4230,"nodeType":864},{},[9466],{"type":899},{"data":9468,"marks":9469,"value":4234,"nodeType":864},{},[],{"data":9471,"content":9472,"nodeType":883},{"uri":4237},[9473],{"data":9474,"marks":9475,"value":4243,"nodeType":864},{},[9476],{"type":899},{"data":9478,"marks":9479,"value":4247,"nodeType":864},{},[],{"data":9481,"content":9482,"nodeType":860},{},[9483],{"data":9484,"marks":9485,"value":4254,"nodeType":864},{},[],{"data":9487,"content":9490,"nodeType":996},{"target":9488},{"sys":9489},{"id":4259,"type":1001,"linkType":1002},[],{"data":9492,"content":9493,"nodeType":860},{},[9494],{"data":9495,"marks":9496,"value":4267,"nodeType":864},{},[],{"data":9498,"content":9499,"nodeType":1005},{},[],{"data":9501,"content":9502,"nodeType":1009},{},[9503],{"data":9504,"marks":9505,"value":4278,"nodeType":864},{},[9506],{"type":899},{"data":9508,"content":9509,"nodeType":860},{},[9510],{"data":9511,"marks":9512,"value":4286,"nodeType":864},{},[9513],{"type":899},{"data":9515,"content":9516,"nodeType":860},{},[9517,9520,9524,9527,9534],{"data":9518,"marks":9519,"value":4293,"nodeType":864},{},[],{"data":9521,"marks":9522,"value":4298,"nodeType":864},{},[9523],{"type":2246},{"data":9525,"marks":9526,"value":4302,"nodeType":864},{},[],{"data":9528,"content":9529,"nodeType":883},{"uri":4305},[9530],{"data":9531,"marks":9532,"value":4311,"nodeType":864},{},[9533],{"type":899},{"data":9535,"marks":9536,"value":4315,"nodeType":864},{},[],{"data":9538,"content":9539,"nodeType":860},{},[9540],{"data":9541,"marks":9542,"value":4322,"nodeType":864},{},[],{"data":9544,"content":9545,"nodeType":860},{},[9546],{"data":9547,"marks":9548,"value":4329,"nodeType":864},{},[],{"data":9550,"content":9551,"nodeType":860},{},[9552],{"data":9553,"marks":9554,"value":4336,"nodeType":864},{},[],{"data":9556,"content":9557,"nodeType":1005},{},[],{"data":9559,"content":9560,"nodeType":1009},{},[9561],{"data":9562,"marks":9563,"value":4347,"nodeType":864},{},[9564],{"type":899},{"data":9566,"content":9567,"nodeType":860},{},[9568],{"data":9569,"marks":9570,"value":4355,"nodeType":864},{},[9571],{"type":899},{"data":9573,"content":9574,"nodeType":860},{},[9575],{"data":9576,"marks":9577,"value":4362,"nodeType":864},{},[],{"data":9579,"content":9582,"nodeType":996},{"target":9580},{"sys":9581},{"id":4367,"type":1001,"linkType":1002},[],{"data":9584,"content":9585,"nodeType":860},{},[9586],{"data":9587,"marks":9588,"value":4375,"nodeType":864},{},[],{"data":9590,"content":9591,"nodeType":941},{},[9592,9601],{"data":9593,"content":9594,"nodeType":945},{},[9595],{"data":9596,"content":9597,"nodeType":860},{},[9598],{"data":9599,"marks":9600,"value":4388,"nodeType":864},{},[],{"data":9602,"content":9603,"nodeType":945},{},[9604],{"data":9605,"content":9606,"nodeType":860},{},[9607],{"data":9608,"marks":9609,"value":4398,"nodeType":864},{},[],{"data":9611,"content":9612,"nodeType":860},{},[9613,9616,9623,9626,9630],{"data":9614,"marks":9615,"value":4405,"nodeType":864},{},[],{"data":9617,"content":9618,"nodeType":883},{"uri":4408},[9619],{"data":9620,"marks":9621,"value":4414,"nodeType":864},{},[9622],{"type":899},{"data":9624,"marks":9625,"value":4418,"nodeType":864},{},[],{"data":9627,"marks":9628,"value":4423,"nodeType":864},{},[9629],{"type":2246},{"data":9631,"marks":9632,"value":4427,"nodeType":864},{},[],{"data":9634,"content":9635,"nodeType":1005},{},[],{"data":9637,"content":9638,"nodeType":1009},{},[9639],{"data":9640,"marks":9641,"value":4438,"nodeType":864},{},[9642],{"type":899},{"data":9644,"content":9645,"nodeType":860},{},[9646],{"data":9647,"marks":9648,"value":4446,"nodeType":864},{},[9649],{"type":899},{"data":9651,"content":9652,"nodeType":860},{},[9653],{"data":9654,"marks":9655,"value":4453,"nodeType":864},{},[],{"data":9657,"content":9658,"nodeType":860},{},[9659],{"data":9660,"marks":9661,"value":4460,"nodeType":864},{},[],{"data":9663,"content":9664,"nodeType":1005},{},[],{"data":9666,"content":9667,"nodeType":1009},{},[9668],{"data":9669,"marks":9670,"value":4471,"nodeType":864},{},[9671],{"type":899},{"data":9673,"content":9674,"nodeType":941},{},[9675,9688,9701,9714],{"data":9676,"content":9677,"nodeType":945},{},[9678],{"data":9679,"content":9680,"nodeType":860},{},[9681,9685],{"data":9682,"marks":9683,"value":4485,"nodeType":864},{},[9684],{"type":899},{"data":9686,"marks":9687,"value":4489,"nodeType":864},{},[],{"data":9689,"content":9690,"nodeType":945},{},[9691],{"data":9692,"content":9693,"nodeType":860},{},[9694,9698],{"data":9695,"marks":9696,"value":4500,"nodeType":864},{},[9697],{"type":899},{"data":9699,"marks":9700,"value":4504,"nodeType":864},{},[],{"data":9702,"content":9703,"nodeType":945},{},[9704],{"data":9705,"content":9706,"nodeType":860},{},[9707,9711],{"data":9708,"marks":9709,"value":4515,"nodeType":864},{},[9710],{"type":899},{"data":9712,"marks":9713,"value":4519,"nodeType":864},{},[],{"data":9715,"content":9716,"nodeType":945},{},[9717],{"data":9718,"content":9719,"nodeType":860},{},[9720,9724],{"data":9721,"marks":9722,"value":781,"nodeType":864},{},[9723],{"type":899},{"data":9725,"marks":9726,"value":4533,"nodeType":864},{},[],{"data":9728,"content":9729,"nodeType":1005},{},[],{"data":9731,"content":9732,"nodeType":1009},{},[9733],{"data":9734,"marks":9735,"value":4544,"nodeType":864},{},[9736],{"type":899},{"data":9738,"content":9739,"nodeType":860},{},[9740],{"data":9741,"marks":9742,"value":4551,"nodeType":864},{},[],{"data":9744,"content":9745,"nodeType":4845},{},[9746,9769,9791,9813,9835,9857,9879,9901,9923,9945,9967,9989],{"data":9747,"content":9748,"nodeType":4581},{},[9749,9759],{"data":9750,"content":9751,"nodeType":4569},{},[9752],{"data":9753,"content":9754,"nodeType":860},{},[9755],{"data":9756,"marks":9757,"value":4568,"nodeType":864},{},[9758],{"type":899},{"data":9760,"content":9761,"nodeType":4569},{},[9762],{"data":9763,"content":9764,"nodeType":860},{},[9765],{"data":9766,"marks":9767,"value":4580,"nodeType":864},{},[9768],{"type":899},{"data":9770,"content":9771,"nodeType":4581},{},[9772,9782],{"data":9773,"content":9774,"nodeType":4569},{},[9775],{"data":9776,"content":9777,"nodeType":860},{},[9778],{"data":9779,"marks":9780,"value":4595,"nodeType":864},{},[9781],{"type":899},{"data":9783,"content":9784,"nodeType":4569},{},[9785],{"data":9786,"content":9787,"nodeType":860},{},[9788],{"data":9789,"marks":9790,"value":4605,"nodeType":864},{},[],{"data":9792,"content":9793,"nodeType":4581},{},[9794,9804],{"data":9795,"content":9796,"nodeType":4569},{},[9797],{"data":9798,"content":9799,"nodeType":860},{},[9800],{"data":9801,"marks":9802,"value":4619,"nodeType":864},{},[9803],{"type":899},{"data":9805,"content":9806,"nodeType":4569},{},[9807],{"data":9808,"content":9809,"nodeType":860},{},[9810],{"data":9811,"marks":9812,"value":4629,"nodeType":864},{},[],{"data":9814,"content":9815,"nodeType":4581},{},[9816,9826],{"data":9817,"content":9818,"nodeType":4569},{},[9819],{"data":9820,"content":9821,"nodeType":860},{},[9822],{"data":9823,"marks":9824,"value":4643,"nodeType":864},{},[9825],{"type":899},{"data":9827,"content":9828,"nodeType":4569},{},[9829],{"data":9830,"content":9831,"nodeType":860},{},[9832],{"data":9833,"marks":9834,"value":4653,"nodeType":864},{},[],{"data":9836,"content":9837,"nodeType":4581},{},[9838,9848],{"data":9839,"content":9840,"nodeType":4569},{},[9841],{"data":9842,"content":9843,"nodeType":860},{},[9844],{"data":9845,"marks":9846,"value":4667,"nodeType":864},{},[9847],{"type":899},{"data":9849,"content":9850,"nodeType":4569},{},[9851],{"data":9852,"content":9853,"nodeType":860},{},[9854],{"data":9855,"marks":9856,"value":4677,"nodeType":864},{},[],{"data":9858,"content":9859,"nodeType":4581},{},[9860,9870],{"data":9861,"content":9862,"nodeType":4569},{},[9863],{"data":9864,"content":9865,"nodeType":860},{},[9866],{"data":9867,"marks":9868,"value":4691,"nodeType":864},{},[9869],{"type":899},{"data":9871,"content":9872,"nodeType":4569},{},[9873],{"data":9874,"content":9875,"nodeType":860},{},[9876],{"data":9877,"marks":9878,"value":4701,"nodeType":864},{},[],{"data":9880,"content":9881,"nodeType":4581},{},[9882,9892],{"data":9883,"content":9884,"nodeType":4569},{},[9885],{"data":9886,"content":9887,"nodeType":860},{},[9888],{"data":9889,"marks":9890,"value":4715,"nodeType":864},{},[9891],{"type":899},{"data":9893,"content":9894,"nodeType":4569},{},[9895],{"data":9896,"content":9897,"nodeType":860},{},[9898],{"data":9899,"marks":9900,"value":4725,"nodeType":864},{},[],{"data":9902,"content":9903,"nodeType":4581},{},[9904,9914],{"data":9905,"content":9906,"nodeType":4569},{},[9907],{"data":9908,"content":9909,"nodeType":860},{},[9910],{"data":9911,"marks":9912,"value":4739,"nodeType":864},{},[9913],{"type":899},{"data":9915,"content":9916,"nodeType":4569},{},[9917],{"data":9918,"content":9919,"nodeType":860},{},[9920],{"data":9921,"marks":9922,"value":4749,"nodeType":864},{},[],{"data":9924,"content":9925,"nodeType":4581},{},[9926,9936],{"data":9927,"content":9928,"nodeType":4569},{},[9929],{"data":9930,"content":9931,"nodeType":860},{},[9932],{"data":9933,"marks":9934,"value":4763,"nodeType":864},{},[9935],{"type":899},{"data":9937,"content":9938,"nodeType":4569},{},[9939],{"data":9940,"content":9941,"nodeType":860},{},[9942],{"data":9943,"marks":9944,"value":4773,"nodeType":864},{},[],{"data":9946,"content":9947,"nodeType":4581},{},[9948,9958],{"data":9949,"content":9950,"nodeType":4569},{},[9951],{"data":9952,"content":9953,"nodeType":860},{},[9954],{"data":9955,"marks":9956,"value":4787,"nodeType":864},{},[9957],{"type":899},{"data":9959,"content":9960,"nodeType":4569},{},[9961],{"data":9962,"content":9963,"nodeType":860},{},[9964],{"data":9965,"marks":9966,"value":4797,"nodeType":864},{},[],{"data":9968,"content":9969,"nodeType":4581},{},[9970,9980],{"data":9971,"content":9972,"nodeType":4569},{},[9973],{"data":9974,"content":9975,"nodeType":860},{},[9976],{"data":9977,"marks":9978,"value":4811,"nodeType":864},{},[9979],{"type":899},{"data":9981,"content":9982,"nodeType":4569},{},[9983],{"data":9984,"content":9985,"nodeType":860},{},[9986],{"data":9987,"marks":9988,"value":4821,"nodeType":864},{},[],{"data":9990,"content":9991,"nodeType":4581},{},[9992,10002],{"data":9993,"content":9994,"nodeType":4569},{},[9995],{"data":9996,"content":9997,"nodeType":860},{},[9998],{"data":9999,"marks":10000,"value":4500,"nodeType":864},{},[10001],{"type":899},{"data":10003,"content":10004,"nodeType":4569},{},[10005],{"data":10006,"content":10007,"nodeType":860},{},[10008],{"data":10009,"marks":10010,"value":4844,"nodeType":864},{},[],{"data":10012,"content":10013,"nodeType":1005},{},[],{"data":10015,"content":10016,"nodeType":860},{},[10017,10020,10026],{"data":10018,"marks":10019,"value":4855,"nodeType":864},{},[],{"data":10021,"content":10022,"nodeType":883},{"uri":1700},[10023],{"data":10024,"marks":10025,"value":1703,"nodeType":864},{},[],{"data":10027,"marks":10028,"value":21,"nodeType":864},{},[],{"items":10030},[10031,10033],{"sys":10032,"name":297},{"id":2732},{"sys":10034,"name":2729},{"id":2728},{"items":10036},[10037],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":10038},{"url":4881},"blog/crossing-the-ai-security-chasm-sans-security-maturity-model",{"json":10041},{"data":10042,"content":10043,"nodeType":856},{},[10044],{"data":10045,"content":10046,"nodeType":860},{},[10047],{"data":10048,"marks":10049,"value":10050,"nodeType":864},{},[],"Most organizations know they have an AI security problem. A new SANS framework shows why so few are making progress – and what it actually takes to get unstuck.",{"id":2743,"publishedAt":10052},"2026-08-12T12:00:43.789Z",{"items":10054},[10055,10057],{"sys":10056,"name":297},{"id":2732},{"sys":10058,"name":2729},{"id":2728},{"items":10060},[10061,10063,10065,10067,10069,10071,10073,10075,10077,10079,10081,10083,10085],{"sys":10062,"name":235,"slug":236,"tier":31},{"id":232},{"sys":10064,"name":297,"slug":298,"tier":31},{"id":294},{"sys":10066,"name":279,"slug":280,"tier":31},{"id":276},{"sys":10068,"name":519,"slug":520,"tier":31},{"id":516},{"sys":10070,"name":580,"slug":581,"tier":45},{"id":577},{"sys":10072,"name":252,"slug":253,"tier":45},{"id":249},{"sys":10074,"name":315,"slug":316,"tier":45},{"id":312},{"sys":10076,"name":360,"slug":361,"tier":45},{"id":357},{"sys":10078,"name":261,"slug":262,"tier":45},{"id":258},{"sys":10080,"name":288,"slug":289,"tier":45},{"id":285},{"sys":10082,"name":484,"slug":485,"tier":45},{"id":481},{"sys":10084,"name":368,"slug":369,"tier":45},{"id":365},{"sys":10086,"name":457,"slug":458,"tier":45},{"id":454},"9MwsjcrxUUVzXns3KGAsw5P2iaR5ftXXtYxjz2_kW4o",{"id":10089,"title":8005,"authorsCollection":10090,"content":10094,"extension":228,"faqItemsCollection":11158,"faqTitle":59,"featured":6,"hashTags":59,"meta":11160,"metaTitle":11161,"ogImage":59,"postType":11162,"publishedDate":8007,"relatedBlogPostsCollection":11163,"slug":8008,"stem":13248,"subtitle":59,"summary":13249,"synopsis":8006,"sys":13260,"tagsCollection":13262,"topicsCollection":13268,"__hash__":13288},"blog/blog/browser-visibility-and-control-can-achieve-ai-compliance.json",{"items":10091},[10092],{"fullName":8018,"firstName":8019,"jobTitle":8020,"socialLinks":59,"profilePicture":10093},{"url":8022},{"json":10095,"links":10992},{"data":10096,"content":10097,"nodeType":856},{},[10098,10105,10111,10118,10629,10634,10640,10646,10649,10656,10662,10669,10675,10680,10685,10692,10705,10712,10718,10725,10731,10736,10743,10749,10754,10757,10764,10779,10795,10810,10816,10819,10826,10832,10842,10848,10858,10864,10869,10879,10885,10895,10901,10907,10912,10922,10928,10931,10938,10944,10950,10956,10961,10964,10970,10976],{"data":10099,"content":10100,"nodeType":1009},{},[10101],{"data":10102,"marks":10103,"value":6998,"nodeType":864},{},[10104],{"type":899},{"data":10106,"content":10107,"nodeType":860},{},[10108],{"data":10109,"marks":10110,"value":7005,"nodeType":864},{},[],{"data":10112,"content":10113,"nodeType":860},{},[10114],{"data":10115,"marks":10116,"value":7013,"nodeType":864},{},[10117],{"type":899},{"data":10119,"content":10120,"nodeType":4845},{},[10121,10164,10242,10301,10351,10460,10510,10570],{"data":10122,"content":10123,"nodeType":4581},{},[10124,10134,10144,10154],{"data":10125,"content":10126,"nodeType":4569},{},[10127],{"data":10128,"content":10129,"nodeType":860},{},[10130],{"data":10131,"marks":10132,"value":7030,"nodeType":864},{},[10133],{"type":899},{"data":10135,"content":10136,"nodeType":4569},{},[10137],{"data":10138,"content":10139,"nodeType":860},{},[10140],{"data":10141,"marks":10142,"value":7041,"nodeType":864},{},[10143],{"type":899},{"data":10145,"content":10146,"nodeType":4569},{},[10147],{"data":10148,"content":10149,"nodeType":860},{},[10150],{"data":10151,"marks":10152,"value":7052,"nodeType":864},{},[10153],{"type":899},{"data":10155,"content":10156,"nodeType":4569},{},[10157],{"data":10158,"content":10159,"nodeType":860},{},[10160],{"data":10161,"marks":10162,"value":7063,"nodeType":864},{},[10163],{"type":899},{"data":10165,"content":10166,"nodeType":4581},{},[10167,10187,10196,10223],{"data":10168,"content":10169,"nodeType":4569},{},[10170],{"data":10171,"content":10172,"nodeType":860},{},[10173,10176,10184],{"data":10174,"marks":10175,"value":21,"nodeType":864},{},[],{"data":10177,"content":10178,"nodeType":883},{"uri":7078},[10179],{"data":10180,"marks":10181,"value":7085,"nodeType":864},{},[10182,10183],{"type":1455},{"type":899},{"data":10185,"marks":10186,"value":21,"nodeType":864},{},[],{"data":10188,"content":10189,"nodeType":4569},{},[10190],{"data":10191,"content":10192,"nodeType":860},{},[10193],{"data":10194,"marks":10195,"value":7098,"nodeType":864},{},[],{"data":10197,"content":10198,"nodeType":4569},{},[10199],{"data":10200,"content":10201,"nodeType":860},{},[10202,10205,10211,10214,10220],{"data":10203,"marks":10204,"value":7108,"nodeType":864},{},[],{"data":10206,"content":10207,"nodeType":883},{"uri":7111},[10208],{"data":10209,"marks":10210,"value":7116,"nodeType":864},{},[],{"data":10212,"marks":10213,"value":7120,"nodeType":864},{},[],{"data":10215,"content":10216,"nodeType":883},{"uri":7123},[10217],{"data":10218,"marks":10219,"value":7128,"nodeType":864},{},[],{"data":10221,"marks":10222,"value":7132,"nodeType":864},{},[],{"data":10224,"content":10225,"nodeType":4569},{},[10226],{"data":10227,"content":10228,"nodeType":860},{},[10229,10232,10239],{"data":10230,"marks":10231,"value":21,"nodeType":864},{},[],{"data":10233,"content":10234,"nodeType":883},{"uri":7111},[10235],{"data":10236,"marks":10237,"value":7149,"nodeType":864},{},[10238],{"type":1455},{"data":10240,"marks":10241,"value":7153,"nodeType":864},{},[],{"data":10243,"content":10244,"nodeType":4581},{},[10245,10265,10274,10292],{"data":10246,"content":10247,"nodeType":4569},{},[10248],{"data":10249,"content":10250,"nodeType":860},{},[10251,10254,10262],{"data":10252,"marks":10253,"value":21,"nodeType":864},{},[],{"data":10255,"content":10256,"nodeType":883},{"uri":7168},[10257],{"data":10258,"marks":10259,"value":7175,"nodeType":864},{},[10260,10261],{"type":1455},{"type":899},{"data":10263,"marks":10264,"value":21,"nodeType":864},{},[],{"data":10266,"content":10267,"nodeType":4569},{},[10268],{"data":10269,"content":10270,"nodeType":860},{},[10271],{"data":10272,"marks":10273,"value":7188,"nodeType":864},{},[],{"data":10275,"content":10276,"nodeType":4569},{},[10277],{"data":10278,"content":10279,"nodeType":860},{},[10280,10283,10289],{"data":10281,"marks":10282,"value":7198,"nodeType":864},{},[],{"data":10284,"content":10285,"nodeType":883},{"uri":7168},[10286],{"data":10287,"marks":10288,"value":7205,"nodeType":864},{},[],{"data":10290,"marks":10291,"value":7209,"nodeType":864},{},[],{"data":10293,"content":10294,"nodeType":4569},{},[10295],{"data":10296,"content":10297,"nodeType":860},{},[10298],{"data":10299,"marks":10300,"value":7219,"nodeType":864},{},[],{"data":10302,"content":10303,"nodeType":4581},{},[10304,10324,10333,10342],{"data":10305,"content":10306,"nodeType":4569},{},[10307],{"data":10308,"content":10309,"nodeType":860},{},[10310,10313,10321],{"data":10311,"marks":10312,"value":21,"nodeType":864},{},[],{"data":10314,"content":10315,"nodeType":883},{"uri":7234},[10316],{"data":10317,"marks":10318,"value":7241,"nodeType":864},{},[10319,10320],{"type":1455},{"type":899},{"data":10322,"marks":10323,"value":21,"nodeType":864},{},[],{"data":10325,"content":10326,"nodeType":4569},{},[10327],{"data":10328,"content":10329,"nodeType":860},{},[10330],{"data":10331,"marks":10332,"value":7254,"nodeType":864},{},[],{"data":10334,"content":10335,"nodeType":4569},{},[10336],{"data":10337,"content":10338,"nodeType":860},{},[10339],{"data":10340,"marks":10341,"value":7264,"nodeType":864},{},[],{"data":10343,"content":10344,"nodeType":4569},{},[10345],{"data":10346,"content":10347,"nodeType":860},{},[10348],{"data":10349,"marks":10350,"value":7274,"nodeType":864},{},[],{"data":10352,"content":10353,"nodeType":4581},{},[10354,10374,10383,10424],{"data":10355,"content":10356,"nodeType":4569},{},[10357],{"data":10358,"content":10359,"nodeType":860},{},[10360,10363,10371],{"data":10361,"marks":10362,"value":21,"nodeType":864},{},[],{"data":10364,"content":10365,"nodeType":883},{"uri":7289},[10366],{"data":10367,"marks":10368,"value":7296,"nodeType":864},{},[10369,10370],{"type":1455},{"type":899},{"data":10372,"marks":10373,"value":21,"nodeType":864},{},[],{"data":10375,"content":10376,"nodeType":4569},{},[10377],{"data":10378,"content":10379,"nodeType":860},{},[10380],{"data":10381,"marks":10382,"value":7309,"nodeType":864},{},[],{"data":10384,"content":10385,"nodeType":4569},{},[10386],{"data":10387,"content":10388,"nodeType":860},{},[10389,10392,10399,10402,10408,10411,10421],{"data":10390,"marks":10391,"value":21,"nodeType":864},{},[],{"data":10393,"content":10394,"nodeType":883},{"uri":7321},[10395],{"data":10396,"marks":10397,"value":7327,"nodeType":864},{},[10398],{"type":1455},{"data":10400,"marks":10401,"value":7331,"nodeType":864},{},[],{"data":10403,"content":10404,"nodeType":883},{"uri":7334},[10405],{"data":10406,"marks":10407,"value":7339,"nodeType":864},{},[],{"data":10409,"marks":10410,"value":7343,"nodeType":864},{},[],{"data":10412,"content":10413,"nodeType":883},{"uri":7346},[10414,10417],{"data":10415,"marks":10416,"value":1171,"nodeType":864},{},[],{"data":10418,"marks":10419,"value":7355,"nodeType":864},{},[10420],{"type":1455},{"data":10422,"marks":10423,"value":21,"nodeType":864},{},[],{"data":10425,"content":10426,"nodeType":4569},{},[10427],{"data":10428,"content":10429,"nodeType":860},{},[10430,10433,10439,10442,10448,10451,10457],{"data":10431,"marks":10432,"value":7368,"nodeType":864},{},[],{"data":10434,"content":10435,"nodeType":883},{"uri":7321},[10436],{"data":10437,"marks":10438,"value":7375,"nodeType":864},{},[],{"data":10440,"marks":10441,"value":3731,"nodeType":864},{},[],{"data":10443,"content":10444,"nodeType":883},{"uri":7334},[10445],{"data":10446,"marks":10447,"value":7385,"nodeType":864},{},[],{"data":10449,"marks":10450,"value":3731,"nodeType":864},{},[],{"data":10452,"content":10453,"nodeType":883},{"uri":7346},[10454],{"data":10455,"marks":10456,"value":7395,"nodeType":864},{},[],{"data":10458,"marks":10459,"value":21,"nodeType":864},{},[],{"data":10461,"content":10462,"nodeType":4581},{},[10463,10483,10492,10501],{"data":10464,"content":10465,"nodeType":4569},{},[10466],{"data":10467,"content":10468,"nodeType":860},{},[10469,10472,10480],{"data":10470,"marks":10471,"value":21,"nodeType":864},{},[],{"data":10473,"content":10474,"nodeType":883},{"uri":7413},[10475],{"data":10476,"marks":10477,"value":7420,"nodeType":864},{},[10478,10479],{"type":1455},{"type":899},{"data":10481,"marks":10482,"value":21,"nodeType":864},{},[],{"data":10484,"content":10485,"nodeType":4569},{},[10486],{"data":10487,"content":10488,"nodeType":860},{},[10489],{"data":10490,"marks":10491,"value":7433,"nodeType":864},{},[],{"data":10493,"content":10494,"nodeType":4569},{},[10495],{"data":10496,"content":10497,"nodeType":860},{},[10498],{"data":10499,"marks":10500,"value":7443,"nodeType":864},{},[],{"data":10502,"content":10503,"nodeType":4569},{},[10504],{"data":10505,"content":10506,"nodeType":860},{},[10507],{"data":10508,"marks":10509,"value":7453,"nodeType":864},{},[],{"data":10511,"content":10512,"nodeType":4581},{},[10513,10533,10542,10551],{"data":10514,"content":10515,"nodeType":4569},{},[10516],{"data":10517,"content":10518,"nodeType":860},{},[10519,10522,10530],{"data":10520,"marks":10521,"value":21,"nodeType":864},{},[],{"data":10523,"content":10524,"nodeType":883},{"uri":7468},[10525],{"data":10526,"marks":10527,"value":7475,"nodeType":864},{},[10528,10529],{"type":1455},{"type":899},{"data":10531,"marks":10532,"value":21,"nodeType":864},{},[],{"data":10534,"content":10535,"nodeType":4569},{},[10536],{"data":10537,"content":10538,"nodeType":860},{},[10539],{"data":10540,"marks":10541,"value":7488,"nodeType":864},{},[],{"data":10543,"content":10544,"nodeType":4569},{},[10545],{"data":10546,"content":10547,"nodeType":860},{},[10548],{"data":10549,"marks":10550,"value":7498,"nodeType":864},{},[],{"data":10552,"content":10553,"nodeType":4569},{},[10554],{"data":10555,"content":10556,"nodeType":860},{},[10557,10560,10567],{"data":10558,"marks":10559,"value":21,"nodeType":864},{},[],{"data":10561,"content":10562,"nodeType":883},{"uri":7510},[10563],{"data":10564,"marks":10565,"value":7516,"nodeType":864},{},[10566],{"type":1455},{"data":10568,"marks":10569,"value":7520,"nodeType":864},{},[],{"data":10571,"content":10572,"nodeType":4581},{},[10573,10593,10602,10620],{"data":10574,"content":10575,"nodeType":4569},{},[10576],{"data":10577,"content":10578,"nodeType":860},{},[10579,10582,10590],{"data":10580,"marks":10581,"value":21,"nodeType":864},{},[],{"data":10583,"content":10584,"nodeType":883},{"uri":7535},[10585],{"data":10586,"marks":10587,"value":7542,"nodeType":864},{},[10588,10589],{"type":1455},{"type":899},{"data":10591,"marks":10592,"value":21,"nodeType":864},{},[],{"data":10594,"content":10595,"nodeType":4569},{},[10596],{"data":10597,"content":10598,"nodeType":860},{},[10599],{"data":10600,"marks":10601,"value":7555,"nodeType":864},{},[],{"data":10603,"content":10604,"nodeType":4569},{},[10605],{"data":10606,"content":10607,"nodeType":860},{},[10608,10611,10617],{"data":10609,"marks":10610,"value":7565,"nodeType":864},{},[],{"data":10612,"content":10613,"nodeType":883},{"uri":7568},[10614],{"data":10615,"marks":10616,"value":7573,"nodeType":864},{},[],{"data":10618,"marks":10619,"value":7577,"nodeType":864},{},[],{"data":10621,"content":10622,"nodeType":4569},{},[10623],{"data":10624,"content":10625,"nodeType":860},{},[10626],{"data":10627,"marks":10628,"value":7587,"nodeType":864},{},[],{"data":10630,"content":10633,"nodeType":996},{"target":10631},{"sys":10632},{"id":7592,"type":1001,"linkType":1002},[],{"data":10635,"content":10636,"nodeType":860},{},[10637],{"data":10638,"marks":10639,"value":7600,"nodeType":864},{},[],{"data":10641,"content":10642,"nodeType":860},{},[10643],{"data":10644,"marks":10645,"value":7607,"nodeType":864},{},[],{"data":10647,"content":10648,"nodeType":1005},{},[],{"data":10650,"content":10651,"nodeType":1009},{},[10652],{"data":10653,"marks":10654,"value":7618,"nodeType":864},{},[10655],{"type":899},{"data":10657,"content":10658,"nodeType":860},{},[10659],{"data":10660,"marks":10661,"value":7625,"nodeType":864},{},[],{"data":10663,"content":10664,"nodeType":1312},{},[10665],{"data":10666,"marks":10667,"value":7633,"nodeType":864},{},[10668],{"type":899},{"data":10670,"content":10671,"nodeType":860},{},[10672],{"data":10673,"marks":10674,"value":7640,"nodeType":864},{},[],{"data":10676,"content":10679,"nodeType":996},{"target":10677},{"sys":10678},{"id":7645,"type":1001,"linkType":1002},[],{"data":10681,"content":10684,"nodeType":996},{"target":10682},{"sys":10683},{"id":1040,"type":1001,"linkType":1002},[],{"data":10686,"content":10687,"nodeType":1312},{},[10688],{"data":10689,"marks":10690,"value":7659,"nodeType":864},{},[10691],{"type":899},{"data":10693,"content":10694,"nodeType":860},{},[10695,10698,10702],{"data":10696,"marks":10697,"value":7666,"nodeType":864},{},[],{"data":10699,"marks":10700,"value":7671,"nodeType":864},{},[10701],{"type":899},{"data":10703,"marks":10704,"value":7675,"nodeType":864},{},[],{"data":10706,"content":10707,"nodeType":1312},{},[10708],{"data":10709,"marks":10710,"value":7683,"nodeType":864},{},[10711],{"type":899},{"data":10713,"content":10714,"nodeType":860},{},[10715],{"data":10716,"marks":10717,"value":7690,"nodeType":864},{},[],{"data":10719,"content":10720,"nodeType":1312},{},[10721],{"data":10722,"marks":10723,"value":7698,"nodeType":864},{},[10724],{"type":899},{"data":10726,"content":10727,"nodeType":860},{},[10728],{"data":10729,"marks":10730,"value":7705,"nodeType":864},{},[],{"data":10732,"content":10735,"nodeType":996},{"target":10733},{"sys":10734},{"id":7710,"type":1001,"linkType":1002},[],{"data":10737,"content":10738,"nodeType":1312},{},[10739],{"data":10740,"marks":10741,"value":7719,"nodeType":864},{},[10742],{"type":899},{"data":10744,"content":10745,"nodeType":860},{},[10746],{"data":10747,"marks":10748,"value":7726,"nodeType":864},{},[],{"data":10750,"content":10753,"nodeType":996},{"target":10751},{"sys":10752},{"id":7731,"type":1001,"linkType":1002},[],{"data":10755,"content":10756,"nodeType":1005},{},[],{"data":10758,"content":10759,"nodeType":1009},{},[10760],{"data":10761,"marks":10762,"value":7743,"nodeType":864},{},[10763],{"type":899},{"data":10765,"content":10766,"nodeType":860},{},[10767,10770,10776],{"data":10768,"marks":10769,"value":7750,"nodeType":864},{},[],{"data":10771,"content":10772,"nodeType":883},{"uri":7753},[10773],{"data":10774,"marks":10775,"value":7758,"nodeType":864},{},[],{"data":10777,"marks":10778,"value":7762,"nodeType":864},{},[],{"data":10780,"content":10781,"nodeType":860},{},[10782,10785,10792],{"data":10783,"marks":10784,"value":7769,"nodeType":864},{},[],{"data":10786,"content":10787,"nodeType":883},{"uri":7772},[10788],{"data":10789,"marks":10790,"value":7778,"nodeType":864},{},[10791],{"type":1455},{"data":10793,"marks":10794,"value":7782,"nodeType":864},{},[],{"data":10796,"content":10797,"nodeType":860},{},[10798,10801,10807],{"data":10799,"marks":10800,"value":7789,"nodeType":864},{},[],{"data":10802,"content":10803,"nodeType":883},{"uri":7792},[10804],{"data":10805,"marks":10806,"value":7797,"nodeType":864},{},[],{"data":10808,"marks":10809,"value":7801,"nodeType":864},{},[],{"data":10811,"content":10812,"nodeType":860},{},[10813],{"data":10814,"marks":10815,"value":7808,"nodeType":864},{},[],{"data":10817,"content":10818,"nodeType":1005},{},[],{"data":10820,"content":10821,"nodeType":1009},{},[10822],{"data":10823,"marks":10824,"value":7819,"nodeType":864},{},[10825],{"type":899},{"data":10827,"content":10828,"nodeType":860},{},[10829],{"data":10830,"marks":10831,"value":7826,"nodeType":864},{},[],{"data":10833,"content":10834,"nodeType":1312},{},[10835,10839],{"data":10836,"marks":10837,"value":7834,"nodeType":864},{},[10838],{"type":899},{"data":10840,"marks":10841,"value":1171,"nodeType":864},{},[],{"data":10843,"content":10844,"nodeType":860},{},[10845],{"data":10846,"marks":10847,"value":7844,"nodeType":864},{},[],{"data":10849,"content":10850,"nodeType":1312},{},[10851,10855],{"data":10852,"marks":10853,"value":7852,"nodeType":864},{},[10854],{"type":899},{"data":10856,"marks":10857,"value":1171,"nodeType":864},{},[],{"data":10859,"content":10860,"nodeType":860},{},[10861],{"data":10862,"marks":10863,"value":7862,"nodeType":864},{},[],{"data":10865,"content":10868,"nodeType":996},{"target":10866},{"sys":10867},{"id":7867,"type":1001,"linkType":1002},[],{"data":10870,"content":10871,"nodeType":1312},{},[10872,10876],{"data":10873,"marks":10874,"value":7876,"nodeType":864},{},[10875],{"type":899},{"data":10877,"marks":10878,"value":1171,"nodeType":864},{},[],{"data":10880,"content":10881,"nodeType":860},{},[10882],{"data":10883,"marks":10884,"value":7886,"nodeType":864},{},[],{"data":10886,"content":10887,"nodeType":1312},{},[10888,10892],{"data":10889,"marks":10890,"value":7894,"nodeType":864},{},[10891],{"type":899},{"data":10893,"marks":10894,"value":1171,"nodeType":864},{},[],{"data":10896,"content":10897,"nodeType":860},{},[10898],{"data":10899,"marks":10900,"value":7904,"nodeType":864},{},[],{"data":10902,"content":10903,"nodeType":860},{},[10904],{"data":10905,"marks":10906,"value":7911,"nodeType":864},{},[],{"data":10908,"content":10911,"nodeType":996},{"target":10909},{"sys":10910},{"id":7916,"type":1001,"linkType":1002},[],{"data":10913,"content":10914,"nodeType":1312},{},[10915,10919],{"data":10916,"marks":10917,"value":7925,"nodeType":864},{},[10918],{"type":899},{"data":10920,"marks":10921,"value":1171,"nodeType":864},{},[],{"data":10923,"content":10924,"nodeType":860},{},[10925],{"data":10926,"marks":10927,"value":7935,"nodeType":864},{},[],{"data":10929,"content":10930,"nodeType":1005},{},[],{"data":10932,"content":10933,"nodeType":1009},{},[10934],{"data":10935,"marks":10936,"value":7946,"nodeType":864},{},[10937],{"type":899},{"data":10939,"content":10940,"nodeType":860},{},[10941],{"data":10942,"marks":10943,"value":7953,"nodeType":864},{},[],{"data":10945,"content":10946,"nodeType":860},{},[10947],{"data":10948,"marks":10949,"value":7960,"nodeType":864},{},[],{"data":10951,"content":10952,"nodeType":860},{},[10953],{"data":10954,"marks":10955,"value":7967,"nodeType":864},{},[],{"data":10957,"content":10960,"nodeType":996},{"target":10958},{"sys":10959},{"id":7972,"type":1001,"linkType":1002},[],{"data":10962,"content":10963,"nodeType":1005},{},[],{"data":10965,"content":10966,"nodeType":860},{},[10967],{"data":10968,"marks":10969,"value":1682,"nodeType":864},{},[],{"data":10971,"content":10972,"nodeType":860},{},[10973],{"data":10974,"marks":10975,"value":1689,"nodeType":864},{},[],{"data":10977,"content":10978,"nodeType":860},{},[10979,10982,10989],{"data":10980,"marks":10981,"value":21,"nodeType":864},{},[],{"data":10983,"content":10984,"nodeType":883},{"uri":1700},[10985],{"data":10986,"marks":10987,"value":1703,"nodeType":864},{},[10988],{"type":1455},{"data":10990,"marks":10991,"value":21,"nodeType":864},{},[],{"entries":10993},{"hyperlink":10994,"inline":10995,"block":10996},[],[],[10997,11005,11030,11033,11060,11086,11100,11144],{"sys":10998,"__typename":1724,"title":10999,"caption":11000,"layoutMode":59,"file":11001},{"id":7592},"ai regulation matrix","Map of how different regulations map to AI control requirements.",{"url":11002,"width":11003,"height":11004},"https://images.ctfassets.net/y1cdw1ablpvd/3rfEWb5FXvXR07jdPdoht6/42f1c515e62fcc58aa0e270a424cfacc/ai_regulation_matrix_3x__4_.png",2550,1806,{"sys":11006,"__typename":1740,"content":11007,"name":11029,"title":59},{"id":7645},{"json":11008},{"nodeType":856,"data":11009,"content":11010},{},[11011],{"nodeType":860,"data":11012,"content":11013},{},[11014,11018,11025],{"nodeType":864,"value":11015,"marks":11016,"data":11017},"Most organizations are dealing with uncontrolled ",[],{},{"nodeType":883,"data":11019,"content":11020},{"uri":885},[11021],{"nodeType":864,"value":11022,"marks":11023,"data":11024},"Shadow AI sprawl",[],{},{"nodeType":864,"value":11026,"marks":11027,"data":11028},". We find that the average organization has 16 unique AI apps in active use, 17 unique AI browser extensions, and 17 unique AI OAuth integrations connected into just Google Workspace and Microsoft 365 — with some organizations reaching as high as 40 unique AI apps, 163 AI extensions, and 55 OAuth connections to AI apps respectively. At the other end, the smallest organization with the lowest adoption level is actively using two. ",[],{},"AI regulation IB1",{"sys":11031,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":11032},{"id":1040},{"url":1728,"width":1729,"height":1730},{"sys":11034,"__typename":1740,"content":11035,"name":11059,"title":59},{"id":7710},{"json":11036},{"data":11037,"content":11038,"nodeType":856},{},[11039],{"data":11040,"content":11041,"nodeType":860},{},[11042,11046,11055],{"data":11043,"marks":11044,"value":11045,"nodeType":864},{},[],"In the UK, ",{"data":11047,"content":11049,"nodeType":883},{"uri":11048},"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/five-steps-to-protect-your-organisation-from-AI-powered-cyber-threats/",[11050],{"data":11051,"marks":11052,"value":11054,"nodeType":864},{},[11053],{"type":1455},"the ICO's May 2026 blog",{"data":11056,"marks":11057,"value":11058,"nodeType":864},{},[]," names AI-generated phishing, deepfake social engineering, and credential stuffing as specific threats organisations must address under UK GDPR Article 32. It calls for multi-factor authentication on all remote access, admin accounts, and email, alongside layered defences that assume foundational controls alone are insufficient against AI-powered attacks.","ai regulation IB2",{"sys":11061,"__typename":1740,"content":11062,"name":11085,"title":59},{"id":7731},{"json":11063},{"nodeType":856,"data":11064,"content":11065},{},[11066],{"nodeType":860,"data":11067,"content":11068},{},[11069,11073,11081],{"nodeType":864,"value":11070,"marks":11071,"data":11072},"In May 2026, ",[],{},{"nodeType":883,"data":11074,"content":11076},{"uri":11075},"https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services",[11077],{"nodeType":864,"value":11078,"marks":11079,"data":11080},"CISA and Five Eyes partners published the first multinational guidance on agentic AI adoption",[],{},{"nodeType":864,"value":11082,"marks":11083,"data":11084},", identifying privilege escalation and accountability gaps as core risks — a signal that AI agent governance will soon move from best practice to regulatory expectation. ",[],{},"ai regulation IB3",{"sys":11087,"__typename":1740,"content":11088,"name":11099,"title":59},{"id":7867},{"json":11089},{"nodeType":856,"data":11090,"content":11091},{},[11092],{"nodeType":860,"data":11093,"content":11094},{},[11095],{"nodeType":864,"value":11096,"marks":11097,"data":11098},"When an employee clicks through or acknowledges the banner, Push generates auditable telemetry, creating a documented, timestamped record that the employee received policy guidance at the exact point of AI interaction (not just in a training session six months prior).",[],{},"ai regulation ib6",{"sys":11101,"__typename":1740,"content":11102,"name":11143,"title":59},{"id":7916},{"json":11103},{"nodeType":856,"data":11104,"content":11105},{},[11106,11125],{"nodeType":860,"data":11107,"content":11108},{},[11109,11113,11121],{"nodeType":864,"value":11110,"marks":11111,"data":11112},"Attackers are ",[],{},{"nodeType":883,"data":11114,"content":11116},{"uri":11115},"https://pushsecurity.com/blog/the-pyramid-of-pain-in-the-ai-era/",[11117],{"nodeType":864,"value":11118,"marks":11119,"data":11120},"increasingly leveraging AI in their phishing campaigns",[],{},{"nodeType":864,"value":11122,"marks":11123,"data":11124},", creating new and derivative phishing kits, adding new capabilities, and finding ways to increase the speed and scale of their operations. But Push's vantage point in the browser means that regardless of the tooling or infrastructure used, Push intercepts the attack at the point of interaction. ",[],{},{"nodeType":860,"data":11126,"content":11127},{},[11128,11132,11139],{"nodeType":864,"value":11129,"marks":11130,"data":11131},"This even applies to AI-powered voice and video faking attacks: since ",[],{},{"nodeType":883,"data":11133,"content":11134},{"uri":4082},[11135],{"nodeType":864,"value":11136,"marks":11137,"data":11138},"most voice-based attacks still result in a user being directed to interact with a browser payload",[],{},{"nodeType":864,"value":11140,"marks":11141,"data":11142},", Push can still intercept them at the point that the caller is lured to a malicious web page or resource.",[],{},"ai regulation IB4",{"sys":11145,"__typename":1740,"content":11146,"name":11157,"title":59},{"id":7972},{"json":11147},{"data":11148,"content":11149,"nodeType":856},{},[11150],{"data":11151,"content":11152,"nodeType":860},{},[11153],{"data":11154,"marks":11155,"value":11156,"nodeType":864},{},[],"The five obligation categories we've identified aren't artifacts of any single regulation; they reflect a durable regulatory consensus about what responsible AI governance requires. Building the operational capability to meet them now — continuous AI inventory, demonstrable employee guidance, data exposure controls, phishing-resistant authentication, and third-party risk visibility — means you're prepared for future frameworks.","ai regulation ib5",{"items":11159},[],{},"How browser visibility and control can achieve AI compliance","regulation-and-compliance",{"items":11164},[11165,11738,12538],{"__typename":2059,"sys":11166,"content":11167,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":11728,"authorsCollection":11734},{"id":2061},{"json":11168},{"data":11169,"content":11170,"nodeType":856},{},[11171,11177,11183,11189,11194,11197,11204,11210,11239,11245,11269,11274,11277,11284,11290,11297,11331,11336,11342,11347,11350,11357,11363,11370,11376,11382,11395,11402,11422,11428,11433,11439,11446,11459,11481,11486,11501,11506,11513,11519,11539,11545,11551,11557,11562,11565,11572,11578,11584,11599,11606,11612,11619,11638,11648,11653,11656,11663,11669,11675,11681,11697,11700,11706,11712],{"data":11172,"content":11173,"nodeType":860},{},[11174],{"data":11175,"marks":11176,"value":2072,"nodeType":864},{},[],{"data":11178,"content":11179,"nodeType":860},{},[11180],{"data":11181,"marks":11182,"value":2079,"nodeType":864},{},[],{"data":11184,"content":11185,"nodeType":860},{},[11186],{"data":11187,"marks":11188,"value":2086,"nodeType":864},{},[],{"data":11190,"content":11193,"nodeType":996},{"target":11191},{"sys":11192},{"id":2091,"type":1001,"linkType":1002},[],{"data":11195,"content":11196,"nodeType":1005},{},[],{"data":11198,"content":11199,"nodeType":1009},{},[11200],{"data":11201,"marks":11202,"value":2103,"nodeType":864},{},[11203],{"type":899},{"data":11205,"content":11206,"nodeType":860},{},[11207],{"data":11208,"marks":11209,"value":2110,"nodeType":864},{},[],{"data":11211,"content":11212,"nodeType":941},{},[11213,11226],{"data":11214,"content":11215,"nodeType":945},{},[11216],{"data":11217,"content":11218,"nodeType":860},{},[11219,11223],{"data":11220,"marks":11221,"value":2124,"nodeType":864},{},[11222],{"type":899},{"data":11224,"marks":11225,"value":2128,"nodeType":864},{},[],{"data":11227,"content":11228,"nodeType":945},{},[11229],{"data":11230,"content":11231,"nodeType":860},{},[11232,11236],{"data":11233,"marks":11234,"value":2139,"nodeType":864},{},[11235],{"type":899},{"data":11237,"marks":11238,"value":2143,"nodeType":864},{},[],{"data":11240,"content":11241,"nodeType":860},{},[11242],{"data":11243,"marks":11244,"value":2150,"nodeType":864},{},[],{"data":11246,"content":11247,"nodeType":860},{},[11248,11251,11257,11260,11266],{"data":11249,"marks":11250,"value":2157,"nodeType":864},{},[],{"data":11252,"content":11253,"nodeType":883},{"uri":1543},[11254],{"data":11255,"marks":11256,"value":1758,"nodeType":864},{},[],{"data":11258,"marks":11259,"value":1762,"nodeType":864},{},[],{"data":11261,"content":11262,"nodeType":883},{"uri":1765},[11263],{"data":11264,"marks":11265,"value":1770,"nodeType":864},{},[],{"data":11267,"marks":11268,"value":1774,"nodeType":864},{},[],{"data":11270,"content":11273,"nodeType":996},{"target":11271},{"sys":11272},{"id":2180,"type":1001,"linkType":1002},[],{"data":11275,"content":11276,"nodeType":1005},{},[],{"data":11278,"content":11279,"nodeType":1009},{},[11280],{"data":11281,"marks":11282,"value":2192,"nodeType":864},{},[11283],{"type":899},{"data":11285,"content":11286,"nodeType":860},{},[11287],{"data":11288,"marks":11289,"value":2199,"nodeType":864},{},[],{"data":11291,"content":11292,"nodeType":860},{},[11293],{"data":11294,"marks":11295,"value":2207,"nodeType":864},{},[11296],{"type":899},{"data":11298,"content":11299,"nodeType":860},{},[11300,11303,11307,11310,11314,11317,11321,11324,11328],{"data":11301,"marks":11302,"value":2214,"nodeType":864},{},[],{"data":11304,"marks":11305,"value":2219,"nodeType":864},{},[11306],{"type":899},{"data":11308,"marks":11309,"value":2223,"nodeType":864},{},[],{"data":11311,"marks":11312,"value":2228,"nodeType":864},{},[11313],{"type":899},{"data":11315,"marks":11316,"value":2232,"nodeType":864},{},[],{"data":11318,"marks":11319,"value":2237,"nodeType":864},{},[11320],{"type":899},{"data":11322,"marks":11323,"value":2241,"nodeType":864},{},[],{"data":11325,"marks":11326,"value":2247,"nodeType":864},{},[11327],{"type":2246},{"data":11329,"marks":11330,"value":2251,"nodeType":864},{},[],{"data":11332,"content":11335,"nodeType":996},{"target":11333},{"sys":11334},{"id":2256,"type":1001,"linkType":1002},[],{"data":11337,"content":11338,"nodeType":860},{},[11339],{"data":11340,"marks":11341,"value":2264,"nodeType":864},{},[],{"data":11343,"content":11346,"nodeType":996},{"target":11344},{"sys":11345},{"id":1040,"type":1001,"linkType":1002},[],{"data":11348,"content":11349,"nodeType":1005},{},[],{"data":11351,"content":11352,"nodeType":1009},{},[11353],{"data":11354,"marks":11355,"value":2280,"nodeType":864},{},[11356],{"type":899},{"data":11358,"content":11359,"nodeType":860},{},[11360],{"data":11361,"marks":11362,"value":2287,"nodeType":864},{},[],{"data":11364,"content":11365,"nodeType":1312},{},[11366],{"data":11367,"marks":11368,"value":2295,"nodeType":864},{},[11369],{"type":899},{"data":11371,"content":11372,"nodeType":860},{},[11373],{"data":11374,"marks":11375,"value":2302,"nodeType":864},{},[],{"data":11377,"content":11378,"nodeType":860},{},[11379],{"data":11380,"marks":11381,"value":2309,"nodeType":864},{},[],{"data":11383,"content":11384,"nodeType":860},{},[11385,11388,11392],{"data":11386,"marks":11387,"value":2316,"nodeType":864},{},[],{"data":11389,"marks":11390,"value":2321,"nodeType":864},{},[11391],{"type":899},{"data":11393,"marks":11394,"value":2325,"nodeType":864},{},[],{"data":11396,"content":11397,"nodeType":1312},{},[11398],{"data":11399,"marks":11400,"value":2333,"nodeType":864},{},[11401],{"type":899},{"data":11403,"content":11404,"nodeType":860},{},[11405,11408,11412,11415,11419],{"data":11406,"marks":11407,"value":2340,"nodeType":864},{},[],{"data":11409,"marks":11410,"value":2345,"nodeType":864},{},[11411],{"type":899},{"data":11413,"marks":11414,"value":2349,"nodeType":864},{},[],{"data":11416,"marks":11417,"value":2354,"nodeType":864},{},[11418],{"type":899},{"data":11420,"marks":11421,"value":2358,"nodeType":864},{},[],{"data":11423,"content":11424,"nodeType":860},{},[11425],{"data":11426,"marks":11427,"value":2365,"nodeType":864},{},[],{"data":11429,"content":11432,"nodeType":996},{"target":11430},{"sys":11431},{"id":2370,"type":1001,"linkType":1002},[],{"data":11434,"content":11435,"nodeType":860},{},[11436],{"data":11437,"marks":11438,"value":2378,"nodeType":864},{},[],{"data":11440,"content":11441,"nodeType":1312},{},[11442],{"data":11443,"marks":11444,"value":2386,"nodeType":864},{},[11445],{"type":899},{"data":11447,"content":11448,"nodeType":860},{},[11449,11452,11456],{"data":11450,"marks":11451,"value":2393,"nodeType":864},{},[],{"data":11453,"marks":11454,"value":2228,"nodeType":864},{},[11455],{"type":899},{"data":11457,"marks":11458,"value":2401,"nodeType":864},{},[],{"data":11460,"content":11461,"nodeType":860},{},[11462,11465,11471,11474,11478],{"data":11463,"marks":11464,"value":2408,"nodeType":864},{},[],{"data":11466,"content":11467,"nodeType":883},{"uri":2411},[11468],{"data":11469,"marks":11470,"value":2416,"nodeType":864},{},[],{"data":11472,"marks":11473,"value":2420,"nodeType":864},{},[],{"data":11475,"marks":11476,"value":2425,"nodeType":864},{},[11477],{"type":899},{"data":11479,"marks":11480,"value":2429,"nodeType":864},{},[],{"data":11482,"content":11485,"nodeType":996},{"target":11483},{"sys":11484},{"id":2434,"type":1001,"linkType":1002},[],{"data":11487,"content":11488,"nodeType":860},{},[11489,11492,11498],{"data":11490,"marks":11491,"value":2442,"nodeType":864},{},[],{"data":11493,"content":11494,"nodeType":883},{"uri":2411},[11495],{"data":11496,"marks":11497,"value":2449,"nodeType":864},{},[],{"data":11499,"marks":11500,"value":2453,"nodeType":864},{},[],{"data":11502,"content":11505,"nodeType":996},{"target":11503},{"sys":11504},{"id":2458,"type":1001,"linkType":1002},[],{"data":11507,"content":11508,"nodeType":1312},{},[11509],{"data":11510,"marks":11511,"value":2467,"nodeType":864},{},[11512],{"type":899},{"data":11514,"content":11515,"nodeType":860},{},[11516],{"data":11517,"marks":11518,"value":2474,"nodeType":864},{},[],{"data":11520,"content":11521,"nodeType":860},{},[11522,11525,11529,11532,11536],{"data":11523,"marks":11524,"value":2481,"nodeType":864},{},[],{"data":11526,"marks":11527,"value":2486,"nodeType":864},{},[11528],{"type":899},{"data":11530,"marks":11531,"value":2490,"nodeType":864},{},[],{"data":11533,"marks":11534,"value":2495,"nodeType":864},{},[11535],{"type":2246},{"data":11537,"marks":11538,"value":2499,"nodeType":864},{},[],{"data":11540,"content":11541,"nodeType":860},{},[11542],{"data":11543,"marks":11544,"value":2506,"nodeType":864},{},[],{"data":11546,"content":11547,"nodeType":860},{},[11548],{"data":11549,"marks":11550,"value":2513,"nodeType":864},{},[],{"data":11552,"content":11553,"nodeType":860},{},[11554],{"data":11555,"marks":11556,"value":2520,"nodeType":864},{},[],{"data":11558,"content":11561,"nodeType":996},{"target":11559},{"sys":11560},{"id":2525,"type":1001,"linkType":1002},[],{"data":11563,"content":11564,"nodeType":1005},{},[],{"data":11566,"content":11567,"nodeType":1009},{},[11568],{"data":11569,"marks":11570,"value":2537,"nodeType":864},{},[11571],{"type":899},{"data":11573,"content":11574,"nodeType":860},{},[11575],{"data":11576,"marks":11577,"value":2544,"nodeType":864},{},[],{"data":11579,"content":11580,"nodeType":860},{},[11581],{"data":11582,"marks":11583,"value":2551,"nodeType":864},{},[],{"data":11585,"content":11586,"nodeType":860},{},[11587,11590,11596],{"data":11588,"marks":11589,"value":2558,"nodeType":864},{},[],{"data":11591,"content":11592,"nodeType":883},{"uri":2561},[11593],{"data":11594,"marks":11595,"value":2566,"nodeType":864},{},[],{"data":11597,"marks":11598,"value":2570,"nodeType":864},{},[],{"data":11600,"content":11601,"nodeType":1312},{},[11602],{"data":11603,"marks":11604,"value":2578,"nodeType":864},{},[11605],{"type":899},{"data":11607,"content":11608,"nodeType":860},{},[11609],{"data":11610,"marks":11611,"value":2585,"nodeType":864},{},[],{"data":11613,"content":11614,"nodeType":860},{},[11615],{"data":11616,"marks":11617,"value":2593,"nodeType":864},{},[11618],{"type":899},{"data":11620,"content":11621,"nodeType":860},{},[11622,11626,11629,11635],{"data":11623,"marks":11624,"value":2601,"nodeType":864},{},[11625],{"type":899},{"data":11627,"marks":11628,"value":2605,"nodeType":864},{},[],{"data":11630,"content":11631,"nodeType":883},{"uri":2411},[11632],{"data":11633,"marks":11634,"value":2612,"nodeType":864},{},[],{"data":11636,"marks":11637,"value":2616,"nodeType":864},{},[],{"data":11639,"content":11640,"nodeType":860},{},[11641,11645],{"data":11642,"marks":11643,"value":2624,"nodeType":864},{},[11644],{"type":899},{"data":11646,"marks":11647,"value":2628,"nodeType":864},{},[],{"data":11649,"content":11652,"nodeType":996},{"target":11650},{"sys":11651},{"id":2633,"type":1001,"linkType":1002},[],{"data":11654,"content":11655,"nodeType":1005},{},[],{"data":11657,"content":11658,"nodeType":1009},{},[11659],{"data":11660,"marks":11661,"value":2645,"nodeType":864},{},[11662],{"type":899},{"data":11664,"content":11665,"nodeType":860},{},[11666],{"data":11667,"marks":11668,"value":2652,"nodeType":864},{},[],{"data":11670,"content":11671,"nodeType":860},{},[11672],{"data":11673,"marks":11674,"value":2659,"nodeType":864},{},[],{"data":11676,"content":11677,"nodeType":860},{},[11678],{"data":11679,"marks":11680,"value":2666,"nodeType":864},{},[],{"data":11682,"content":11683,"nodeType":860},{},[11684,11687,11694],{"data":11685,"marks":11686,"value":2673,"nodeType":864},{},[],{"data":11688,"content":11689,"nodeType":883},{"uri":2676},[11690],{"data":11691,"marks":11692,"value":580,"nodeType":864},{},[11693],{"type":1455},{"data":11695,"marks":11696,"value":2685,"nodeType":864},{},[],{"data":11698,"content":11699,"nodeType":1005},{},[],{"data":11701,"content":11702,"nodeType":860},{},[11703],{"data":11704,"marks":11705,"value":1682,"nodeType":864},{},[],{"data":11707,"content":11708,"nodeType":860},{},[11709],{"data":11710,"marks":11711,"value":1689,"nodeType":864},{},[],{"data":11713,"content":11714,"nodeType":860},{},[11715,11718,11725],{"data":11716,"marks":11717,"value":2707,"nodeType":864},{},[],{"data":11719,"content":11720,"nodeType":883},{"uri":1700},[11721],{"data":11722,"marks":11723,"value":2715,"nodeType":864},{},[11724],{"type":1455},{"data":11726,"marks":11727,"value":2719,"nodeType":864},{},[],{"items":11729},[11730,11732],{"sys":11731,"name":2729},{"id":2728},{"sys":11733,"name":297},{"id":2732},{"items":11735},[11736],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":11737},{"url":2740},{"__typename":2059,"sys":11739,"content":11740,"title":8945,"synopsis":8946,"hashTags":59,"publishedDate":8007,"slug":8947,"tagsCollection":12528,"authorsCollection":12534},{"id":8025},{"json":11741},{"data":11742,"content":11743,"nodeType":856},{},[11744,11750,11756,11773,11779,11785,11788,11795,11801,11807,11828,11834,11840,11845,11848,11855,11861,11866,11872,11879,11905,11920,11925,11932,11938,11943,11959,11966,11972,11997,12002,12015,12018,12025,12031,12036,12050,12056,12062,12072,12088,12094,12100,12107,12113,12129,12134,12140,12145,12150,12153,12160,12166,12172,12227,12233,12239,12245,12251,12264,12270,12276,12282,12288,12294,12300,12306,12312,12318,12324,12330,12336,12342,12345,12352,12358,12368,12374,12380,12386,12392,12498,12504,12509,12512],{"data":11745,"content":11746,"nodeType":860},{},[11747],{"data":11748,"marks":11749,"value":8036,"nodeType":864},{},[],{"data":11751,"content":11752,"nodeType":860},{},[11753],{"data":11754,"marks":11755,"value":8043,"nodeType":864},{},[],{"data":11757,"content":11758,"nodeType":860},{},[11759,11763,11766,11770],{"data":11760,"marks":11761,"value":8051,"nodeType":864},{},[11762],{"type":899},{"data":11764,"marks":11765,"value":8055,"nodeType":864},{},[],{"data":11767,"marks":11768,"value":8060,"nodeType":864},{},[11769],{"type":2246},{"data":11771,"marks":11772,"value":8064,"nodeType":864},{},[],{"data":11774,"content":11775,"nodeType":860},{},[11776],{"data":11777,"marks":11778,"value":8071,"nodeType":864},{},[],{"data":11780,"content":11781,"nodeType":860},{},[11782],{"data":11783,"marks":11784,"value":8078,"nodeType":864},{},[],{"data":11786,"content":11787,"nodeType":1005},{},[],{"data":11789,"content":11790,"nodeType":1009},{},[11791],{"data":11792,"marks":11793,"value":8089,"nodeType":864},{},[11794],{"type":899},{"data":11796,"content":11797,"nodeType":860},{},[11798],{"data":11799,"marks":11800,"value":8096,"nodeType":864},{},[],{"data":11802,"content":11803,"nodeType":860},{},[11804],{"data":11805,"marks":11806,"value":8103,"nodeType":864},{},[],{"data":11808,"content":11809,"nodeType":941},{},[11810,11819],{"data":11811,"content":11812,"nodeType":945},{},[11813],{"data":11814,"content":11815,"nodeType":860},{},[11816],{"data":11817,"marks":11818,"value":8116,"nodeType":864},{},[],{"data":11820,"content":11821,"nodeType":945},{},[11822],{"data":11823,"content":11824,"nodeType":860},{},[11825],{"data":11826,"marks":11827,"value":8126,"nodeType":864},{},[],{"data":11829,"content":11830,"nodeType":860},{},[11831],{"data":11832,"marks":11833,"value":8133,"nodeType":864},{},[],{"data":11835,"content":11836,"nodeType":860},{},[11837],{"data":11838,"marks":11839,"value":8140,"nodeType":864},{},[],{"data":11841,"content":11844,"nodeType":996},{"target":11842},{"sys":11843},{"id":8145,"type":1001,"linkType":1002},[],{"data":11846,"content":11847,"nodeType":1005},{},[],{"data":11849,"content":11850,"nodeType":1009},{},[11851],{"data":11852,"marks":11853,"value":8157,"nodeType":864},{},[11854],{"type":899},{"data":11856,"content":11857,"nodeType":860},{},[11858],{"data":11859,"marks":11860,"value":8164,"nodeType":864},{},[],{"data":11862,"content":11865,"nodeType":996},{"target":11863},{"sys":11864},{"id":8169,"type":1001,"linkType":1002},[],{"data":11867,"content":11868,"nodeType":860},{},[11869],{"data":11870,"marks":11871,"value":8177,"nodeType":864},{},[],{"data":11873,"content":11874,"nodeType":1312},{},[11875],{"data":11876,"marks":11877,"value":8185,"nodeType":864},{},[11878],{"type":899},{"data":11880,"content":11881,"nodeType":860},{},[11882,11885,11892,11895,11902],{"data":11883,"marks":11884,"value":8192,"nodeType":864},{},[],{"data":11886,"content":11887,"nodeType":883},{"uri":8195},[11888],{"data":11889,"marks":11890,"value":8201,"nodeType":864},{},[11891],{"type":1455},{"data":11893,"marks":11894,"value":8205,"nodeType":864},{},[],{"data":11896,"content":11897,"nodeType":883},{"uri":3259},[11898],{"data":11899,"marks":11900,"value":8213,"nodeType":864},{},[11901],{"type":1455},{"data":11903,"marks":11904,"value":8217,"nodeType":864},{},[],{"data":11906,"content":11907,"nodeType":860},{},[11908,11911,11917],{"data":11909,"marks":11910,"value":8224,"nodeType":864},{},[],{"data":11912,"content":11913,"nodeType":883},{"uri":8227},[11914],{"data":11915,"marks":11916,"value":8232,"nodeType":864},{},[],{"data":11918,"marks":11919,"value":8236,"nodeType":864},{},[],{"data":11921,"content":11924,"nodeType":996},{"target":11922},{"sys":11923},{"id":8241,"type":1001,"linkType":1002},[],{"data":11926,"content":11927,"nodeType":1312},{},[11928],{"data":11929,"marks":11930,"value":8250,"nodeType":864},{},[11931],{"type":899},{"data":11933,"content":11934,"nodeType":860},{},[11935],{"data":11936,"marks":11937,"value":8257,"nodeType":864},{},[],{"data":11939,"content":11942,"nodeType":996},{"target":11940},{"sys":11941},{"id":8262,"type":1001,"linkType":1002},[],{"data":11944,"content":11945,"nodeType":860},{},[11946,11949,11956],{"data":11947,"marks":11948,"value":8270,"nodeType":864},{},[],{"data":11950,"content":11951,"nodeType":883},{"uri":8273},[11952],{"data":11953,"marks":11954,"value":8279,"nodeType":864},{},[11955],{"type":1455},{"data":11957,"marks":11958,"value":8283,"nodeType":864},{},[],{"data":11960,"content":11961,"nodeType":1312},{},[11962],{"data":11963,"marks":11964,"value":8291,"nodeType":864},{},[11965],{"type":899},{"data":11967,"content":11968,"nodeType":860},{},[11969],{"data":11970,"marks":11971,"value":8298,"nodeType":864},{},[],{"data":11973,"content":11974,"nodeType":860},{},[11975,11978,11985,11988,11994],{"data":11976,"marks":11977,"value":8305,"nodeType":864},{},[],{"data":11979,"content":11980,"nodeType":883},{"uri":8308},[11981],{"data":11982,"marks":11983,"value":8314,"nodeType":864},{},[11984],{"type":1455},{"data":11986,"marks":11987,"value":8318,"nodeType":864},{},[],{"data":11989,"content":11990,"nodeType":883},{"uri":8321},[11991],{"data":11992,"marks":11993,"value":1555,"nodeType":864},{},[],{"data":11995,"marks":11996,"value":8329,"nodeType":864},{},[],{"data":11998,"content":12001,"nodeType":996},{"target":11999},{"sys":12000},{"id":8334,"type":1001,"linkType":1002},[],{"data":12003,"content":12004,"nodeType":860},{},[12005,12008,12012],{"data":12006,"marks":12007,"value":8342,"nodeType":864},{},[],{"data":12009,"marks":12010,"value":8347,"nodeType":864},{},[12011],{"type":899},{"data":12013,"marks":12014,"value":2924,"nodeType":864},{},[],{"data":12016,"content":12017,"nodeType":1005},{},[],{"data":12019,"content":12020,"nodeType":1009},{},[12021],{"data":12022,"marks":12023,"value":8361,"nodeType":864},{},[12024],{"type":899},{"data":12026,"content":12027,"nodeType":860},{},[12028],{"data":12029,"marks":12030,"value":8368,"nodeType":864},{},[],{"data":12032,"content":12035,"nodeType":996},{"target":12033},{"sys":12034},{"id":1040,"type":1001,"linkType":1002},[],{"data":12037,"content":12038,"nodeType":1312},{},[12039,12043,12046],{"data":12040,"marks":12041,"value":8381,"nodeType":864},{},[12042],{"type":899},{"data":12044,"marks":12045,"value":1171,"nodeType":864},{},[],{"data":12047,"marks":12048,"value":8389,"nodeType":864},{},[12049],{"type":899},{"data":12051,"content":12052,"nodeType":860},{},[12053],{"data":12054,"marks":12055,"value":8396,"nodeType":864},{},[],{"data":12057,"content":12058,"nodeType":860},{},[12059],{"data":12060,"marks":12061,"value":8403,"nodeType":864},{},[],{"data":12063,"content":12064,"nodeType":1312},{},[12065,12069],{"data":12066,"marks":12067,"value":8411,"nodeType":864},{},[12068],{"type":899},{"data":12070,"marks":12071,"value":8415,"nodeType":864},{},[],{"data":12073,"content":12074,"nodeType":860},{},[12075,12078,12085],{"data":12076,"marks":12077,"value":8422,"nodeType":864},{},[],{"data":12079,"content":12080,"nodeType":883},{"uri":8425},[12081],{"data":12082,"marks":12083,"value":8431,"nodeType":864},{},[12084],{"type":1455},{"data":12086,"marks":12087,"value":8435,"nodeType":864},{},[],{"data":12089,"content":12090,"nodeType":860},{},[12091],{"data":12092,"marks":12093,"value":8442,"nodeType":864},{},[],{"data":12095,"content":12096,"nodeType":860},{},[12097],{"data":12098,"marks":12099,"value":8449,"nodeType":864},{},[],{"data":12101,"content":12102,"nodeType":1312},{},[12103],{"data":12104,"marks":12105,"value":8457,"nodeType":864},{},[12106],{"type":899},{"data":12108,"content":12109,"nodeType":860},{},[12110],{"data":12111,"marks":12112,"value":8464,"nodeType":864},{},[],{"data":12114,"content":12115,"nodeType":860},{},[12116,12119,12126],{"data":12117,"marks":12118,"value":2761,"nodeType":864},{},[],{"data":12120,"content":12121,"nodeType":883},{"uri":4103},[12122],{"data":12123,"marks":12124,"value":8478,"nodeType":864},{},[12125],{"type":1455},{"data":12127,"marks":12128,"value":8482,"nodeType":864},{},[],{"data":12130,"content":12133,"nodeType":996},{"target":12131},{"sys":12132},{"id":8487,"type":1001,"linkType":1002},[],{"data":12135,"content":12136,"nodeType":860},{},[12137],{"data":12138,"marks":12139,"value":8495,"nodeType":864},{},[],{"data":12141,"content":12144,"nodeType":996},{"target":12142},{"sys":12143},{"id":8500,"type":1001,"linkType":1002},[],{"data":12146,"content":12149,"nodeType":996},{"target":12147},{"sys":12148},{"id":8506,"type":1001,"linkType":1002},[],{"data":12151,"content":12152,"nodeType":1005},{},[],{"data":12154,"content":12155,"nodeType":1009},{},[12156],{"data":12157,"marks":12158,"value":8518,"nodeType":864},{},[12159],{"type":899},{"data":12161,"content":12162,"nodeType":860},{},[12163],{"data":12164,"marks":12165,"value":8525,"nodeType":864},{},[],{"data":12167,"content":12168,"nodeType":860},{},[12169],{"data":12170,"marks":12171,"value":8532,"nodeType":864},{},[],{"data":12173,"content":12174,"nodeType":941},{},[12175,12188,12201,12214],{"data":12176,"content":12177,"nodeType":945},{},[12178],{"data":12179,"content":12180,"nodeType":860},{},[12181,12185],{"data":12182,"marks":12183,"value":8546,"nodeType":864},{},[12184],{"type":899},{"data":12186,"marks":12187,"value":8550,"nodeType":864},{},[],{"data":12189,"content":12190,"nodeType":945},{},[12191],{"data":12192,"content":12193,"nodeType":860},{},[12194,12198],{"data":12195,"marks":12196,"value":8561,"nodeType":864},{},[12197],{"type":899},{"data":12199,"marks":12200,"value":8565,"nodeType":864},{},[],{"data":12202,"content":12203,"nodeType":945},{},[12204],{"data":12205,"content":12206,"nodeType":860},{},[12207,12211],{"data":12208,"marks":12209,"value":8576,"nodeType":864},{},[12210],{"type":899},{"data":12212,"marks":12213,"value":8580,"nodeType":864},{},[],{"data":12215,"content":12216,"nodeType":945},{},[12217],{"data":12218,"content":12219,"nodeType":860},{},[12220,12224],{"data":12221,"marks":12222,"value":8591,"nodeType":864},{},[12223],{"type":899},{"data":12225,"marks":12226,"value":8595,"nodeType":864},{},[],{"data":12228,"content":12229,"nodeType":860},{},[12230],{"data":12231,"marks":12232,"value":8602,"nodeType":864},{},[],{"data":12234,"content":12235,"nodeType":1312},{},[12236],{"data":12237,"marks":12238,"value":8609,"nodeType":864},{},[],{"data":12240,"content":12241,"nodeType":860},{},[12242],{"data":12243,"marks":12244,"value":8616,"nodeType":864},{},[],{"data":12246,"content":12247,"nodeType":860},{},[12248],{"data":12249,"marks":12250,"value":8623,"nodeType":864},{},[],{"data":12252,"content":12253,"nodeType":860},{},[12254,12257,12261],{"data":12255,"marks":12256,"value":8630,"nodeType":864},{},[],{"data":12258,"marks":12259,"value":8635,"nodeType":864},{},[12260],{"type":899},{"data":12262,"marks":12263,"value":8639,"nodeType":864},{},[],{"data":12265,"content":12266,"nodeType":860},{},[12267],{"data":12268,"marks":12269,"value":8646,"nodeType":864},{},[],{"data":12271,"content":12272,"nodeType":860},{},[12273],{"data":12274,"marks":12275,"value":8653,"nodeType":864},{},[],{"data":12277,"content":12278,"nodeType":1312},{},[12279],{"data":12280,"marks":12281,"value":8660,"nodeType":864},{},[],{"data":12283,"content":12284,"nodeType":860},{},[12285],{"data":12286,"marks":12287,"value":8667,"nodeType":864},{},[],{"data":12289,"content":12290,"nodeType":860},{},[12291],{"data":12292,"marks":12293,"value":8674,"nodeType":864},{},[],{"data":12295,"content":12296,"nodeType":860},{},[12297],{"data":12298,"marks":12299,"value":8681,"nodeType":864},{},[],{"data":12301,"content":12302,"nodeType":1312},{},[12303],{"data":12304,"marks":12305,"value":8688,"nodeType":864},{},[],{"data":12307,"content":12308,"nodeType":860},{},[12309],{"data":12310,"marks":12311,"value":8695,"nodeType":864},{},[],{"data":12313,"content":12314,"nodeType":860},{},[12315],{"data":12316,"marks":12317,"value":8702,"nodeType":864},{},[],{"data":12319,"content":12320,"nodeType":1312},{},[12321],{"data":12322,"marks":12323,"value":8709,"nodeType":864},{},[],{"data":12325,"content":12326,"nodeType":860},{},[12327],{"data":12328,"marks":12329,"value":8716,"nodeType":864},{},[],{"data":12331,"content":12332,"nodeType":860},{},[12333],{"data":12334,"marks":12335,"value":8723,"nodeType":864},{},[],{"data":12337,"content":12338,"nodeType":860},{},[12339],{"data":12340,"marks":12341,"value":8730,"nodeType":864},{},[],{"data":12343,"content":12344,"nodeType":1005},{},[],{"data":12346,"content":12347,"nodeType":1009},{},[12348],{"data":12349,"marks":12350,"value":8741,"nodeType":864},{},[12351],{"type":899},{"data":12353,"content":12354,"nodeType":860},{},[12355],{"data":12356,"marks":12357,"value":8748,"nodeType":864},{},[],{"data":12359,"content":12360,"nodeType":860},{},[12361,12364],{"data":12362,"marks":12363,"value":8755,"nodeType":864},{},[],{"data":12365,"marks":12366,"value":8760,"nodeType":864},{},[12367],{"type":899},{"data":12369,"content":12370,"nodeType":860},{},[12371],{"data":12372,"marks":12373,"value":8767,"nodeType":864},{},[],{"data":12375,"content":12376,"nodeType":860},{},[12377],{"data":12378,"marks":12379,"value":8774,"nodeType":864},{},[],{"data":12381,"content":12382,"nodeType":860},{},[12383],{"data":12384,"marks":12385,"value":8781,"nodeType":864},{},[],{"data":12387,"content":12388,"nodeType":1312},{},[12389],{"data":12390,"marks":12391,"value":8788,"nodeType":864},{},[],{"data":12393,"content":12394,"nodeType":941},{},[12395,12414,12433,12452,12461,12470,12479],{"data":12396,"content":12397,"nodeType":945},{},[12398],{"data":12399,"content":12400,"nodeType":860},{},[12401,12404,12411],{"data":12402,"marks":12403,"value":8801,"nodeType":864},{},[],{"data":12405,"content":12406,"nodeType":883},{"uri":8804},[12407],{"data":12408,"marks":12409,"value":8810,"nodeType":864},{},[12410],{"type":1455},{"data":12412,"marks":12413,"value":8814,"nodeType":864},{},[],{"data":12415,"content":12416,"nodeType":945},{},[12417],{"data":12418,"content":12419,"nodeType":860},{},[12420,12423,12430],{"data":12421,"marks":12422,"value":8824,"nodeType":864},{},[],{"data":12424,"content":12425,"nodeType":883},{"uri":8827},[12426],{"data":12427,"marks":12428,"value":8833,"nodeType":864},{},[12429],{"type":1455},{"data":12431,"marks":12432,"value":8837,"nodeType":864},{},[],{"data":12434,"content":12435,"nodeType":945},{},[12436],{"data":12437,"content":12438,"nodeType":860},{},[12439,12442,12449],{"data":12440,"marks":12441,"value":21,"nodeType":864},{},[],{"data":12443,"content":12444,"nodeType":883},{"uri":8849},[12445],{"data":12446,"marks":12447,"value":8855,"nodeType":864},{},[12448],{"type":1455},{"data":12450,"marks":12451,"value":8859,"nodeType":864},{},[],{"data":12453,"content":12454,"nodeType":945},{},[12455],{"data":12456,"content":12457,"nodeType":860},{},[12458],{"data":12459,"marks":12460,"value":8869,"nodeType":864},{},[],{"data":12462,"content":12463,"nodeType":945},{},[12464],{"data":12465,"content":12466,"nodeType":860},{},[12467],{"data":12468,"marks":12469,"value":8879,"nodeType":864},{},[],{"data":12471,"content":12472,"nodeType":945},{},[12473],{"data":12474,"content":12475,"nodeType":860},{},[12476],{"data":12477,"marks":12478,"value":8889,"nodeType":864},{},[],{"data":12480,"content":12481,"nodeType":945},{},[12482],{"data":12483,"content":12484,"nodeType":860},{},[12485,12488,12495],{"data":12486,"marks":12487,"value":8899,"nodeType":864},{},[],{"data":12489,"content":12490,"nodeType":883},{"uri":5494},[12491],{"data":12492,"marks":12493,"value":8907,"nodeType":864},{},[12494],{"type":1455},{"data":12496,"marks":12497,"value":8911,"nodeType":864},{},[],{"data":12499,"content":12500,"nodeType":860},{},[12501],{"data":12502,"marks":12503,"value":21,"nodeType":864},{},[],{"data":12505,"content":12508,"nodeType":996},{"target":12506},{"sys":12507},{"id":8922,"type":1001,"linkType":1002},[],{"data":12510,"content":12511,"nodeType":1005},{},[],{"data":12513,"content":12514,"nodeType":860},{},[12515,12518,12525],{"data":12516,"marks":12517,"value":8933,"nodeType":864},{},[],{"data":12519,"content":12520,"nodeType":883},{"uri":1700},[12521],{"data":12522,"marks":12523,"value":8941,"nodeType":864},{},[12524],{"type":1455},{"data":12526,"marks":12527,"value":2924,"nodeType":864},{},[],{"items":12529},[12530,12532],{"sys":12531,"name":297},{"id":2732},{"sys":12533,"name":2729},{"id":2728},{"items":12535},[12536],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":12537},{"url":853},{"__typename":2059,"sys":12539,"content":12541,"title":13234,"synopsis":13235,"hashTags":59,"publishedDate":13236,"slug":13237,"tagsCollection":13238,"authorsCollection":13244},{"id":12540},"1ThCW6Cx8Zcq2flramQdoj",{"json":12542},{"data":12543,"content":12544,"nodeType":856},{},[12545,12552,12559,12581,12588,12595,12602,12605,12613,12620,12638,12645,12652,12700,12707,12715,12722,12729,12736,12739,12747,12754,12766,12773,12781,12801,12807,12848,12854,12861,12873,12879,12886,12904,12912,12919,12939,12945,12953,12960,13119,13122,13130,13137,13144,13147,13155,13162,13174,13186,13198,13210,13217],{"data":12546,"content":12547,"nodeType":860},{},[12548],{"data":12549,"marks":12550,"value":12551,"nodeType":864},{},[],"At first, it may seem like an obvious choice, partly because the category name \"Secure Enterprise Browser\" implies the answer is a full-stack browser. Plus, the most visible vendors in the space have spent the past few years marketing that exact choice as the only one. ",{"data":12553,"content":12554,"nodeType":860},{},[12555],{"data":12556,"marks":12557,"value":12558,"nodeType":864},{},[],"But the market tells a different story. The majority of vendors Gartner places in the SEB category are now extensions rather than full browsers, and Gartner explicitly notes that extensions have become the preferred option. ",{"data":12560,"content":12561,"nodeType":1116},{},[12562],{"data":12563,"content":12564,"nodeType":860},{},[12565,12569,12577],{"data":12566,"marks":12567,"value":12568,"nodeType":864},{},[],"The buyer-side data tells the same story: In ",{"data":12570,"content":12571,"nodeType":883},{"uri":2561},[12572],{"data":12573,"marks":12574,"value":12576,"nodeType":864},{},[12575],{"type":1455},"Omdia's 2026 survey of 400 IT and security professionals",{"data":12578,"marks":12579,"value":12580,"nodeType":864},{},[],", 48% of organizations cited the ability to use their existing browsers as an important attribute in a secure browsing solution.",{"data":12582,"content":12583,"nodeType":860},{},[12584],{"data":12585,"marks":12586,"value":12587,"nodeType":864},{},[],"The truth is: Full-stack enterprise browsers and browser security extensions like Push aren’t competing products. They serve different needs for different teams, though they often get evaluated against each other.",{"data":12589,"content":12590,"nodeType":860},{},[12591],{"data":12592,"marks":12593,"value":12594,"nodeType":864},{},[],"Full-stack enterprise browsers serve the IT team's need to control the workspace. Browser security extensions like Push meet the security team's need to protect their users as they work in their browsers — a fundamentally different problem. ",{"data":12596,"content":12597,"nodeType":860},{},[12598],{"data":12599,"marks":12600,"value":12601,"nodeType":864},{},[],"In this article, we’ll cover why a feature-by-feature checklist is the wrong approach when selecting a secure browser platform, and what questions to consider instead. We’ll also discuss what each type of solution excels at, where Push fits in, and how to map your needs to the right solution.",{"data":12603,"content":12604,"nodeType":1005},{},[],{"data":12606,"content":12607,"nodeType":1009},{},[12608],{"data":12609,"marks":12610,"value":12612,"nodeType":864},{},[12611],{"type":899},"Full-stack enterprise browsers meet the IT team's need to control a workspace",{"data":12614,"content":12615,"nodeType":860},{},[12616],{"data":12617,"marks":12618,"value":12619,"nodeType":864},{},[],"Full-stack enterprise browsers like Island, Prisma Browser, and SURF Security are best understood as managed workspace platforms rather than browsers in the conventional sense. ",{"data":12621,"content":12622,"nodeType":1116},{},[12623],{"data":12624,"content":12625,"nodeType":860},{},[12626,12630,12635],{"data":12627,"marks":12628,"value":12629,"nodeType":864},{},[],"Island's own CEO Mike Fey has described the company's strategy as transforming the browser into ",{"data":12631,"marks":12632,"value":12634,"nodeType":864},{},[12633],{"type":2246},"\"a centralized, enterprise-grade platform, eliminating layers of legacy IT infrastructure by building more functionality in the browser.\"",{"data":12636,"marks":12637,"value":8415,"nodeType":864},{},[],{"data":12639,"content":12640,"nodeType":860},{},[12641],{"data":12642,"marks":12643,"value":12644,"nodeType":864},{},[],"Chrome Enterprise and Edge for Business occupy a related space as productivity-suite browsers extended with native security controls, sold as part of the broader Google and Microsoft workplace stacks. Different products with different lineage, but all of them converge on the same owner: an IT organization solving for workspace control.",{"data":12646,"content":12647,"nodeType":860},{},[12648],{"data":12649,"marks":12650,"value":12651,"nodeType":864},{},[],"The IT team is trying to achieve workspace policy compliance and access governance. Their primary use case is typically reducing reliance on legacy IT tools like VDI, VPN, remote browser isolation, DaaS, web filtering, and CASBs. In this world, the use cases look like: ",{"data":12653,"content":12654,"nodeType":941},{},[12655,12670,12685],{"data":12656,"content":12657,"nodeType":945},{},[12658],{"data":12659,"content":12660,"nodeType":860},{},[12661,12666],{"data":12662,"marks":12663,"value":12665,"nodeType":864},{},[12664],{"type":899},"Securing third-party contractors or BYOD",{"data":12667,"marks":12668,"value":12669,"nodeType":864},{},[]," where the workspace itself is the access control. ",{"data":12671,"content":12672,"nodeType":945},{},[12673],{"data":12674,"content":12675,"nodeType":860},{},[12676,12681],{"data":12677,"marks":12678,"value":12680,"nodeType":864},{},[12679],{"type":899},"Regulated populations",{"data":12682,"marks":12683,"value":12684,"nodeType":864},{},[]," like call centers, BPO workforces, finance teams handling sensitive material, where output controls like watermarking, screenshot restriction, and print blocking need to be enforced at the OS rendering layer. ",{"data":12686,"content":12687,"nodeType":945},{},[12688],{"data":12689,"content":12690,"nodeType":860},{},[12691,12696],{"data":12692,"marks":12693,"value":12695,"nodeType":864},{},[12694],{"type":899},"Legacy app support",{"data":12697,"marks":12698,"value":12699,"nodeType":864},{},[]," including IE-mode rendering for applications that have never been modernized. ",{"data":12701,"content":12702,"nodeType":860},{},[12703],{"data":12704,"marks":12705,"value":12706,"nodeType":864},{},[],"For these use cases, the architecture is well-suited, and there are numerous full-stack SEB solutions that address them well. Where the full-stack approach runs into trouble is in getting users to migrate onto a new browser and in justifying the cost of doing so. Both problems scale with the size of the workforce. ",{"data":12708,"content":12709,"nodeType":1312},{},[12710],{"data":12711,"marks":12712,"value":12714,"nodeType":864},{},[12713],{"type":899},"Cost of deployment is a significant blocker for full-stack browsers",{"data":12716,"content":12717,"nodeType":860},{},[12718],{"data":12719,"marks":12720,"value":12721,"nodeType":864},{},[],"The migration costs are easy to predict: deployment and configuration effort, help desk volume and — biggest of all — user resistance. But it’s the license cost that limits deployments in many organizations going from a free consumer browser to a paid replacement for the first time. ",{"data":12723,"content":12724,"nodeType":860},{},[12725],{"data":12726,"marks":12727,"value":12728,"nodeType":864},{},[],"In fact, Gartner notes that most buyers start with a single use case like covering contractors and rarely pursue organization-wide deployment for a full-stack enterprise browser. ",{"data":12730,"content":12731,"nodeType":860},{},[12732],{"data":12733,"marks":12734,"value":12735,"nodeType":864},{},[],"For organizations that do achieve a full-coverage deployment for these full-stack browsers, the need to manage drift in employee behavior over time gets harder. Agentic browsers like Comet, Atlas, and Dia are already starting to pull users toward AI-native workflows that consumer browsers don’t offer and full-stack enterprise browsers don’t currently match.",{"data":12737,"content":12738,"nodeType":1005},{},[],{"data":12740,"content":12741,"nodeType":1009},{},[12742],{"data":12743,"marks":12744,"value":12746,"nodeType":864},{},[12745],{"type":899},"What a browser security extension built for the security team looks like",{"data":12748,"content":12749,"nodeType":860},{},[12750],{"data":12751,"marks":12752,"value":12753,"nodeType":864},{},[],"Most browser security extensions on the market were built to address this migration hurdle. They attempt to take as many of the features of a full-stack browser as possible, but make it possible to deploy into users’ existing browsers, sidestepping a lot of the cost and rollout problems.",{"data":12755,"content":12756,"nodeType":860},{},[12757,12761],{"data":12758,"marks":12759,"value":12760,"nodeType":864},{},[],"LayerX, Seraphic, SquareX, and Keep Aware have all at some point echoed this approach in their product descriptions with the line ",{"data":12762,"marks":12763,"value":12765,"nodeType":864},{},[12764],{"type":2246},"\"make any browser an enterprise browser.\"",{"data":12767,"content":12768,"nodeType":860},{},[12769],{"data":12770,"marks":12771,"value":12772,"nodeType":864},{},[],"Ultimately, that approach is still aimed at solving problems for the IT team more than the security team.",{"data":12774,"content":12775,"nodeType":1312},{},[12776],{"data":12777,"marks":12778,"value":12780,"nodeType":864},{},[12779],{"type":899},"Push is different — we built a browser extension to meet the security team's needs",{"data":12782,"content":12783,"nodeType":860},{},[12784,12788,12797],{"data":12785,"marks":12786,"value":12787,"nodeType":864},{},[],"Push set out to meet a different need. Our team's background has always been in defending organizations against advanced attacks. We spent our careers working in red and blue teams throughout the network and endpoint eras of cyber attacks. The mission we started with in 2022 was to defend organizations against the ",{"data":12789,"content":12791,"nodeType":883},{"uri":12790},"https://pushsecurity.com/thank-you/browser-attacks-report",[12792],{"data":12793,"marks":12794,"value":12796,"nodeType":864},{},[12795],{"type":1455},"new era of damaging cyber attacks that originate in the browser",{"data":12798,"marks":12799,"value":12800,"nodeType":864},{},[],". ",{"data":12802,"content":12806,"nodeType":996},{"target":12803},{"sys":12804},{"id":12805,"type":1001,"linkType":1002},"6BwJl8ZkiMore2o1BKx2w6",[],{"data":12808,"content":12809,"nodeType":860},{},[12810,12814,12823,12827,12832,12836,12845],{"data":12811,"marks":12812,"value":12813,"nodeType":864},{},[],"We chose a browser extension as the approach for our solution, not because we wanted to build an easier-to-deploy enterprise browser, but so we could use it as a security agent to collect high-fidelity telemetry for TTP-based detections, and apply real-time controls to stop attacks at the earliest opportunity in the modern  — ",{"data":12815,"content":12817,"nodeType":883},{"uri":12816},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[12818],{"data":12819,"marks":12820,"value":12822,"nodeType":864},{},[12821],{"type":1455},"browser and identity native",{"data":12824,"marks":12825,"value":12826,"nodeType":864},{},[],"  — kill chain. ",{"data":12828,"marks":12829,"value":12831,"nodeType":864},{},[12830],{"type":899},"In effect, we created EDR, but for the browser. ",{"data":12833,"marks":12834,"value":12835,"nodeType":864},{},[],"This is what gives Push the edge compared to other Secure Enterprise Browser solutions when it comes to tackling the highest priority threats in the browser — ",{"data":12837,"content":12839,"nodeType":883},{"uri":12838},"https://pushsecurity.com/blog/how-to-avoid-the-browser-security-buyers-trap/",[12840],{"data":12841,"marks":12842,"value":12844,"nodeType":864},{},[12843],{"type":1455},"we’re optimized for this problem area",{"data":12846,"marks":12847,"value":12800,"nodeType":864},{},[],{"data":12849,"content":12853,"nodeType":996},{"target":12850},{"sys":12851},{"id":12852,"type":1001,"linkType":1002},"4nGzT9cNG0Yid93uUCCuTt",[],{"data":12855,"content":12856,"nodeType":860},{},[12857],{"data":12858,"marks":12859,"value":12860,"nodeType":864},{},[],"For a security team using Push’s extension, this means attacks get stopped at the earliest opportunity in the kill chain and before they cause harm. ",{"data":12862,"content":12863,"nodeType":860},{},[12864,12868],{"data":12865,"marks":12866,"value":12867,"nodeType":864},{},[],"When a user lands on a phishing page built to harvest their credentials, Push sees the page rendering and the JavaScript executing inside the DOM, and can block the credential submission before the form posts. When a user is being walked through a ClickFix or ConsentFix social engineering flow, Push sees the clipboard writes and the OAuth consent flow parameters being prepared, and can intervene before the user completes the action. When a session token is stolen and replayed against a different device, Push sees the session activity and surfaces the compromise. ",{"data":12869,"marks":12870,"value":12872,"nodeType":864},{},[12871],{"type":899},"Push does all of this from a browser extension, without needing to replace the user's browser. ",{"data":12874,"content":12878,"nodeType":996},{"target":12875},{"sys":12876},{"id":12877,"type":1001,"linkType":1002},"1FZEbn0K80d1jHRRTk7kL7",[],{"data":12880,"content":12881,"nodeType":860},{},[12882],{"data":12883,"marks":12884,"value":12885,"nodeType":864},{},[],"The same underlying technology also addresses other high-value security use cases: Visibility and control over AI usage; hardening identities and surfacing shadow IT; and supporting insider investigations and preventing data loss. ",{"data":12887,"content":12888,"nodeType":860},{},[12889,12892,12900],{"data":12890,"marks":12891,"value":2761,"nodeType":864},{},[],{"data":12893,"content":12895,"nodeType":883},{"uri":12894},"https://pushsecurity.com/blog/the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value/",[12896],{"data":12897,"marks":12898,"value":12899,"nodeType":864},{},[],"highest-value use cases",{"data":12901,"marks":12902,"value":12903,"nodeType":864},{},[]," the browser can address are all powered by the same underlying technical capability, which is why Push's single extension can address four major security use cases rather than four separate tools needing four separate deployments. The success metric for security teams using Push is attacks averted or stopped, cyber risk reduced, and security posture and resilience strengthened — not workspace policy compliance.",{"data":12905,"content":12906,"nodeType":1312},{},[12907],{"data":12908,"marks":12909,"value":12911,"nodeType":864},{},[12910],{"type":899},"Proven at scale: What security leaders are saying",{"data":12913,"content":12914,"nodeType":860},{},[12915],{"data":12916,"marks":12917,"value":12918,"nodeType":864},{},[],"Push launched its browser extension in 2022, making it one of the first and longest-running browser security extensions in the category, and it is now deployed across more than three million browsers worldwide.",{"data":12920,"content":12921,"nodeType":860},{},[12922,12926,12935],{"data":12923,"marks":12924,"value":12925,"nodeType":864},{},[],"Many ",{"data":12927,"content":12929,"nodeType":883},{"uri":12928},"https://pushsecurity.com/customer-stories",[12930],{"data":12931,"marks":12932,"value":12934,"nodeType":864},{},[12933],{"type":1455},"Push customers",{"data":12936,"marks":12937,"value":12938,"nodeType":864},{},[]," were initially considering full-stack enterprise browsers, but found that Push provided all the visibility and control they needed without the migration headache.",{"data":12940,"content":12944,"nodeType":996},{"target":12941},{"sys":12942},{"id":12943,"type":1001,"linkType":1002},"4RDIOAuVN10mZCtjltJCB4",[],{"data":12946,"content":12947,"nodeType":1312},{},[12948],{"data":12949,"marks":12950,"value":12952,"nodeType":864},{},[12951],{"type":899},"The extension matters, but it's what we built around it that really counts",{"data":12954,"content":12955,"nodeType":860},{},[12956],{"data":12957,"marks":12958,"value":12959,"nodeType":864},{},[],"The extension is the most visible part of the Push platform, but what Push has built around it makes the solution the most powerful security tool in the browser:",{"data":12961,"content":12962,"nodeType":941},{},[12963,13013,13050,13089,13104],{"data":12964,"content":12965,"nodeType":945},{},[12966],{"data":12967,"content":12968,"nodeType":860},{},[12969,12974,12978,12986,12990,12998,13002,13009],{"data":12970,"marks":12971,"value":12973,"nodeType":864},{},[12972],{"type":899},"In-house threat research that discovers attack techniques as they emerge.",{"data":12975,"marks":12976,"value":12977,"nodeType":864},{},[]," Push researchers track real-world adversary activity and discover new techniques as they appear, including ",{"data":12979,"content":12981,"nodeType":883},{"uri":12980},"https://pushsecurity.com/blog/consentfix/",[12982],{"data":12983,"marks":12984,"value":12985,"nodeType":864},{},[],"ConsentFix",{"data":12987,"marks":12988,"value":12989,"nodeType":864},{},[],",",{"data":12991,"content":12993,"nodeType":883},{"uri":12992},"https://pushsecurity.com/blog/installfix/",[12994],{"data":12995,"marks":12996,"value":12997,"nodeType":864},{},[]," InstallFix",{"data":12999,"marks":13000,"value":13001,"nodeType":864},{},[],", and creating the ",{"data":13003,"content":13004,"nodeType":883},{"uri":8804},[13005],{"data":13006,"marks":13007,"value":13008,"nodeType":864},{},[],"Browser & Identity Attacks Matrix",{"data":13010,"marks":13011,"value":13012,"nodeType":864},{},[],". Detection is only as good as the threat understanding behind it, and research is what keeps that understanding ahead of what attackers are doing in the wild.",{"data":13014,"content":13015,"nodeType":945},{},[13016],{"data":13017,"content":13018,"nodeType":860},{},[13019,13024,13028,13034,13038,13046],{"data":13020,"marks":13021,"value":13023,"nodeType":864},{},[13022],{"type":899},"Agentic threat hunting and detection engineering at machine speed.",{"data":13025,"marks":13026,"value":13027,"nodeType":864},{},[]," Push's ",{"data":13029,"content":13030,"nodeType":883},{"uri":8827},[13031],{"data":13032,"marks":13033,"value":8833,"nodeType":864},{},[],{"data":13035,"marks":13036,"value":13037,"nodeType":864},{},[]," operationalizes the research, generating new behavioral detections in minutes rather than quarterly releases — covering the ",{"data":13039,"content":13041,"nodeType":883},{"uri":13040},"https://pushsecurity.com/blog/how-the-browser-became-the-main-cyber-battleground/",[13042],{"data":13043,"marks":13044,"value":13045,"nodeType":864},{},[],"techniques behind the Scattered Spider, Scattered Lapsus$ Hunters, and ShinyHunters breaches",{"data":13047,"marks":13048,"value":13049,"nodeType":864},{},[]," of the past three years. Attackers are using AI to accelerate the pace at which they generate new lures, kits, and infrastructure; Push keeps security teams in front by advancing the capability at machine speed and scale.",{"data":13051,"content":13052,"nodeType":945},{},[13053],{"data":13054,"content":13055,"nodeType":860},{},[13056,13061,13065,13073,13077,13085],{"data":13057,"marks":13058,"value":13060,"nodeType":864},{},[13059],{"type":899},"Collecting the right telemetry to surface both attacker behavior and risky user action.",{"data":13062,"marks":13063,"value":13064,"nodeType":864},{},[]," Telemetry by itself is just data — the value comes from knowing what to collect, why it matters, and how to turn it into detections and controls. Push combines deep instrumentation of the browser with the expertise to use what we collect: the same browser-layer telemetry that detects AiTM kits, ClickFix and ConsentFix lures, and session token replay also surfaces what users are pasting into AI tools, which ",{"data":13066,"content":13068,"nodeType":883},{"uri":13067},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[13069],{"data":13070,"marks":13071,"value":13072,"nodeType":864},{},[],"SaaS apps they're logging into outside the IdP",{"data":13074,"marks":13075,"value":13076,"nodeType":864},{},[],", which OAuth grants are being made, and which ",{"data":13078,"content":13080,"nodeType":883},{"uri":13079},"https://pushsecurity.com/blog/browser-extension-management-guide/",[13081],{"data":13082,"marks":13083,"value":13084,"nodeType":864},{},[],"extensions are running in their browsers",{"data":13086,"marks":13087,"value":13088,"nodeType":864},{},[],". The threat detection and the identity, AI, and DLP use cases are not separate features — they are different applications of the same underlying telemetry, surfaced because Push knows what to look for.",{"data":13090,"content":13091,"nodeType":945},{},[13092],{"data":13093,"content":13094,"nodeType":860},{},[13095,13100],{"data":13096,"marks":13097,"value":13099,"nodeType":864},{},[13098],{"type":899},"Enforcing the right controls at the right place at the right moment.",{"data":13101,"marks":13102,"value":13103,"nodeType":864},{},[]," Visibility without actionability is only half a solution. Push turns the browser into a strong control point for stopping attacks and risky user behaviors in real time — reusing passwords, intercepting credential submission to non-IdP domains, blocking ClickFix clipboard payloads before paste-execute, prompting MFA enrollment at the point of login, warning on weak or breached passwords at credential entry, and surfacing app banners that communicate policy at the moment of use. The same control surface that stops attackers stops the user's mistakes that lead to the next breach.",{"data":13105,"content":13106,"nodeType":945},{},[13107],{"data":13108,"content":13109,"nodeType":860},{},[13110,13115],{"data":13111,"marks":13112,"value":13114,"nodeType":864},{},[13113],{"type":899},"Balancing security and privacy.",{"data":13116,"marks":13117,"value":13118,"nodeType":864},{},[]," Push is designed to give security teams the telemetry they need without monitoring personal browsing. By default, only logins to configured corporate domains are observed; personal browsing is not collected. (Though administrators have the option to observe personal account logins to work apps, and identify where browsers are being synced to personal accounts, which can result in password loss.) Plaintext passwords and form inputs are never transmitted — passwords are analyzed locally using salted partial hashes. Broader browser metadata is stored on the device and only transmitted when it matches a detection rule. Push does not train AI models on customer telemetry.",{"data":13120,"content":13121,"nodeType":1005},{},[],{"data":13123,"content":13124,"nodeType":1009},{},[13125],{"data":13126,"marks":13127,"value":13129,"nodeType":864},{},[13128],{"type":899},"Full-stack enterprise browsers and Push’s browser extension are not mutually exclusive",{"data":13131,"content":13132,"nodeType":860},{},[13133],{"data":13134,"marks":13135,"value":13136,"nodeType":864},{},[],"It’s worth pausing on a point that often gets lost in the way the market discusses this choice. Full-stack enterprise browsers and Push’s extension-based solution are not mutually exclusive. They do different things for different teams, and they run together. ",{"data":13138,"content":13139,"nodeType":860},{},[13140],{"data":13141,"marks":13142,"value":13143,"nodeType":864},{},[],"Push supports enterprise browsers like Island and Prisma Browser. Many of Push’s customers use a full-stack browser for the contractor population or regulated workload where the IT team needs workspace controls, and Push across the rest of the workforce to provide the deep security capabilities that the IT team is not measured on but the security team is. The right framing for many enterprises is not whether to choose full-stack or extension. It is full-stack for the IT use cases that need it, and Push everywhere else.",{"data":13145,"content":13146,"nodeType":1005},{},[],{"data":13148,"content":13149,"nodeType":1009},{},[13150],{"data":13151,"marks":13152,"value":13154,"nodeType":864},{},[13153],{"type":899},"Which one is right for your security team?",{"data":13156,"content":13157,"nodeType":860},{},[13158],{"data":13159,"marks":13160,"value":13161,"nodeType":864},{},[],"The answer follows from the need you are trying to meet. The scenarios below cover the most common real-world situations and the approach that fits each.",{"data":13163,"content":13164,"nodeType":860},{},[13165,13170],{"data":13166,"marks":13167,"value":13169,"nodeType":864},{},[13168],{"type":899},"Is your priority detecting and stopping attacks in the browser?",{"data":13171,"marks":13172,"value":13173,"nodeType":864},{},[]," Go with Push. Push detects and stops the threats actually breaching enterprises — AiTM phishing, ClickFix, OAuth abuse, malicious browser extensions. It also provides valuable additional insight during investigations to understand incidents better and decide how to respond to them. ",{"data":13175,"content":13176,"nodeType":860},{},[13177,13182],{"data":13178,"marks":13179,"value":13181,"nodeType":864},{},[13180],{"type":899},"Do you have a large contractor or third-party population needing locked-down workspace controls?",{"data":13183,"marks":13184,"value":13185,"nodeType":864},{},[]," Use a full-stack enterprise browser for that population and Push for everyone else. Watermarking, screenshot blocking and print restriction are OS-level controls that extensions cannot reliably replicate.",{"data":13187,"content":13188,"nodeType":860},{},[13189,13194],{"data":13190,"marks":13191,"value":13193,"nodeType":864},{},[13192],{"type":899},"Do you have a multi-browser estate including a mix of consumer and agentic browsers?",{"data":13195,"marks":13196,"value":13197,"nodeType":864},{},[]," Push will provide the coverage you need to secure users. The browser options are growing, and locking your workforce into a single corporate browser becomes harder every time a new productivity-shaping browser ships. Push regularly adds support for emerging browsers.",{"data":13199,"content":13200,"nodeType":860},{},[13201,13206],{"data":13202,"marks":13203,"value":13205,"nodeType":864},{},[13204],{"type":899},"Is significant BYOD or unmanaged-device coverage required.",{"data":13207,"marks":13208,"value":13209,"nodeType":864},{},[]," Push is a great option, particularly if you also have Chromebooks that fall outside of your EDR coverage. The extension can easily be installed via email or landing page self-enrollment, with options to enforce coverage through conditional access policies. This provides full threat detection and policy enforcement on devices the organization does not own.",{"data":13211,"content":13212,"nodeType":860},{},[13213],{"data":13214,"marks":13215,"value":13216,"nodeType":864},{},[],"In short, if you are solving for workspace control, the right tool is a full-stack enterprise browser. If you’re solving for protecting users as they work in their browsers, Push is the tool built specifically for that need — with the research depth, detection engineering, and operational scale to do the job.",{"data":13218,"content":13219,"nodeType":860},{},[13220,13223,13231],{"data":13221,"marks":13222,"value":21,"nodeType":864},{},[],{"data":13224,"content":13225,"nodeType":883},{"uri":1700},[13226],{"data":13227,"marks":13228,"value":13230,"nodeType":864},{},[13229],{"type":1455},"Book a live demo to learn more",{"data":13232,"marks":13233,"value":2924,"nodeType":864},{},[],"Enterprise browser vs. browser extension: Which should your security team choose?","If you're building a shortlist of browser security vendors, do you need a full-stack enterprise browser, or browser security extension? ","2026-05-21T00:00:00.000Z","enterprise-browser-vs-browser-extension-which-should-your-security-team-choose",{"items":13239},[13240,13242],{"sys":13241,"name":297},{"id":2732},{"sys":13243,"name":2729},{"id":2728},{"items":13245},[13246],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":13247},{"url":4881},"blog/browser-visibility-and-control-can-achieve-ai-compliance",{"json":13250},{"data":13251,"content":13252,"nodeType":856},{},[13253],{"data":13254,"content":13255,"nodeType":860},{},[13256],{"data":13257,"marks":13258,"value":13259,"nodeType":864},{},[],"AI regulations across the US, EU, and UK are converging on five categories of obligation that most organizations cannot meet without browser-layer visibility into how employees actually use AI tools.",{"id":6986,"publishedAt":13261},"2026-08-12T12:00:45.359Z",{"items":13263},[13264,13266],{"sys":13265,"name":2729},{"id":2728},{"sys":13267,"name":297},{"id":2732},{"items":13269},[13270,13272,13274,13276,13278,13280,13282,13284,13286],{"sys":13271,"name":235,"slug":236,"tier":31},{"id":232},{"sys":13273,"name":297,"slug":298,"tier":31},{"id":294},{"sys":13275,"name":252,"slug":253,"tier":45},{"id":249},{"sys":13277,"name":580,"slug":581,"tier":45},{"id":577},{"sys":13279,"name":457,"slug":458,"tier":45},{"id":454},{"sys":13281,"name":484,"slug":485,"tier":45},{"id":481},{"sys":13283,"name":288,"slug":289,"tier":45},{"id":285},{"sys":13285,"name":368,"slug":369,"tier":45},{"id":365},{"sys":13287,"name":633,"slug":634,"tier":45},{"id":630},"ax7t5LR08xIdyOvvNuQpkG1-GJUNpnmhM9jsM-xV8f8",{"id":13290,"title":8945,"authorsCollection":13291,"content":13295,"extension":228,"faqItemsCollection":14257,"faqTitle":59,"featured":6,"hashTags":59,"meta":14259,"metaTitle":14260,"ogImage":59,"postType":6981,"publishedDate":8007,"relatedBlogPostsCollection":14261,"slug":8947,"stem":16417,"subtitle":16418,"summary":16419,"synopsis":8946,"sys":16429,"tagsCollection":16431,"topicsCollection":16437,"__hash__":16477},"blog/blog/why-you-cant-control-ai-without-being-in-the-browser.json",{"items":13292},[13293],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":13294},{"url":853},{"json":13296,"links":14083},{"data":13297,"content":13298,"nodeType":856},{},[13299,13305,13311,13328,13334,13340,13343,13350,13356,13362,13383,13389,13395,13400,13403,13410,13416,13421,13427,13434,13460,13475,13480,13487,13493,13498,13514,13521,13527,13552,13557,13570,13573,13580,13586,13591,13605,13611,13617,13627,13643,13649,13655,13662,13668,13684,13689,13695,13700,13705,13708,13715,13721,13727,13782,13788,13794,13800,13806,13819,13825,13831,13837,13843,13849,13855,13861,13867,13873,13879,13885,13891,13897,13900,13907,13913,13923,13929,13935,13941,13947,14053,14059,14064,14067],{"data":13300,"content":13301,"nodeType":860},{},[13302],{"data":13303,"marks":13304,"value":8036,"nodeType":864},{},[],{"data":13306,"content":13307,"nodeType":860},{},[13308],{"data":13309,"marks":13310,"value":8043,"nodeType":864},{},[],{"data":13312,"content":13313,"nodeType":860},{},[13314,13318,13321,13325],{"data":13315,"marks":13316,"value":8051,"nodeType":864},{},[13317],{"type":899},{"data":13319,"marks":13320,"value":8055,"nodeType":864},{},[],{"data":13322,"marks":13323,"value":8060,"nodeType":864},{},[13324],{"type":2246},{"data":13326,"marks":13327,"value":8064,"nodeType":864},{},[],{"data":13329,"content":13330,"nodeType":860},{},[13331],{"data":13332,"marks":13333,"value":8071,"nodeType":864},{},[],{"data":13335,"content":13336,"nodeType":860},{},[13337],{"data":13338,"marks":13339,"value":8078,"nodeType":864},{},[],{"data":13341,"content":13342,"nodeType":1005},{},[],{"data":13344,"content":13345,"nodeType":1009},{},[13346],{"data":13347,"marks":13348,"value":8089,"nodeType":864},{},[13349],{"type":899},{"data":13351,"content":13352,"nodeType":860},{},[13353],{"data":13354,"marks":13355,"value":8096,"nodeType":864},{},[],{"data":13357,"content":13358,"nodeType":860},{},[13359],{"data":13360,"marks":13361,"value":8103,"nodeType":864},{},[],{"data":13363,"content":13364,"nodeType":941},{},[13365,13374],{"data":13366,"content":13367,"nodeType":945},{},[13368],{"data":13369,"content":13370,"nodeType":860},{},[13371],{"data":13372,"marks":13373,"value":8116,"nodeType":864},{},[],{"data":13375,"content":13376,"nodeType":945},{},[13377],{"data":13378,"content":13379,"nodeType":860},{},[13380],{"data":13381,"marks":13382,"value":8126,"nodeType":864},{},[],{"data":13384,"content":13385,"nodeType":860},{},[13386],{"data":13387,"marks":13388,"value":8133,"nodeType":864},{},[],{"data":13390,"content":13391,"nodeType":860},{},[13392],{"data":13393,"marks":13394,"value":8140,"nodeType":864},{},[],{"data":13396,"content":13399,"nodeType":996},{"target":13397},{"sys":13398},{"id":8145,"type":1001,"linkType":1002},[],{"data":13401,"content":13402,"nodeType":1005},{},[],{"data":13404,"content":13405,"nodeType":1009},{},[13406],{"data":13407,"marks":13408,"value":8157,"nodeType":864},{},[13409],{"type":899},{"data":13411,"content":13412,"nodeType":860},{},[13413],{"data":13414,"marks":13415,"value":8164,"nodeType":864},{},[],{"data":13417,"content":13420,"nodeType":996},{"target":13418},{"sys":13419},{"id":8169,"type":1001,"linkType":1002},[],{"data":13422,"content":13423,"nodeType":860},{},[13424],{"data":13425,"marks":13426,"value":8177,"nodeType":864},{},[],{"data":13428,"content":13429,"nodeType":1312},{},[13430],{"data":13431,"marks":13432,"value":8185,"nodeType":864},{},[13433],{"type":899},{"data":13435,"content":13436,"nodeType":860},{},[13437,13440,13447,13450,13457],{"data":13438,"marks":13439,"value":8192,"nodeType":864},{},[],{"data":13441,"content":13442,"nodeType":883},{"uri":8195},[13443],{"data":13444,"marks":13445,"value":8201,"nodeType":864},{},[13446],{"type":1455},{"data":13448,"marks":13449,"value":8205,"nodeType":864},{},[],{"data":13451,"content":13452,"nodeType":883},{"uri":3259},[13453],{"data":13454,"marks":13455,"value":8213,"nodeType":864},{},[13456],{"type":1455},{"data":13458,"marks":13459,"value":8217,"nodeType":864},{},[],{"data":13461,"content":13462,"nodeType":860},{},[13463,13466,13472],{"data":13464,"marks":13465,"value":8224,"nodeType":864},{},[],{"data":13467,"content":13468,"nodeType":883},{"uri":8227},[13469],{"data":13470,"marks":13471,"value":8232,"nodeType":864},{},[],{"data":13473,"marks":13474,"value":8236,"nodeType":864},{},[],{"data":13476,"content":13479,"nodeType":996},{"target":13477},{"sys":13478},{"id":8241,"type":1001,"linkType":1002},[],{"data":13481,"content":13482,"nodeType":1312},{},[13483],{"data":13484,"marks":13485,"value":8250,"nodeType":864},{},[13486],{"type":899},{"data":13488,"content":13489,"nodeType":860},{},[13490],{"data":13491,"marks":13492,"value":8257,"nodeType":864},{},[],{"data":13494,"content":13497,"nodeType":996},{"target":13495},{"sys":13496},{"id":8262,"type":1001,"linkType":1002},[],{"data":13499,"content":13500,"nodeType":860},{},[13501,13504,13511],{"data":13502,"marks":13503,"value":8270,"nodeType":864},{},[],{"data":13505,"content":13506,"nodeType":883},{"uri":8273},[13507],{"data":13508,"marks":13509,"value":8279,"nodeType":864},{},[13510],{"type":1455},{"data":13512,"marks":13513,"value":8283,"nodeType":864},{},[],{"data":13515,"content":13516,"nodeType":1312},{},[13517],{"data":13518,"marks":13519,"value":8291,"nodeType":864},{},[13520],{"type":899},{"data":13522,"content":13523,"nodeType":860},{},[13524],{"data":13525,"marks":13526,"value":8298,"nodeType":864},{},[],{"data":13528,"content":13529,"nodeType":860},{},[13530,13533,13540,13543,13549],{"data":13531,"marks":13532,"value":8305,"nodeType":864},{},[],{"data":13534,"content":13535,"nodeType":883},{"uri":8308},[13536],{"data":13537,"marks":13538,"value":8314,"nodeType":864},{},[13539],{"type":1455},{"data":13541,"marks":13542,"value":8318,"nodeType":864},{},[],{"data":13544,"content":13545,"nodeType":883},{"uri":8321},[13546],{"data":13547,"marks":13548,"value":1555,"nodeType":864},{},[],{"data":13550,"marks":13551,"value":8329,"nodeType":864},{},[],{"data":13553,"content":13556,"nodeType":996},{"target":13554},{"sys":13555},{"id":8334,"type":1001,"linkType":1002},[],{"data":13558,"content":13559,"nodeType":860},{},[13560,13563,13567],{"data":13561,"marks":13562,"value":8342,"nodeType":864},{},[],{"data":13564,"marks":13565,"value":8347,"nodeType":864},{},[13566],{"type":899},{"data":13568,"marks":13569,"value":2924,"nodeType":864},{},[],{"data":13571,"content":13572,"nodeType":1005},{},[],{"data":13574,"content":13575,"nodeType":1009},{},[13576],{"data":13577,"marks":13578,"value":8361,"nodeType":864},{},[13579],{"type":899},{"data":13581,"content":13582,"nodeType":860},{},[13583],{"data":13584,"marks":13585,"value":8368,"nodeType":864},{},[],{"data":13587,"content":13590,"nodeType":996},{"target":13588},{"sys":13589},{"id":1040,"type":1001,"linkType":1002},[],{"data":13592,"content":13593,"nodeType":1312},{},[13594,13598,13601],{"data":13595,"marks":13596,"value":8381,"nodeType":864},{},[13597],{"type":899},{"data":13599,"marks":13600,"value":1171,"nodeType":864},{},[],{"data":13602,"marks":13603,"value":8389,"nodeType":864},{},[13604],{"type":899},{"data":13606,"content":13607,"nodeType":860},{},[13608],{"data":13609,"marks":13610,"value":8396,"nodeType":864},{},[],{"data":13612,"content":13613,"nodeType":860},{},[13614],{"data":13615,"marks":13616,"value":8403,"nodeType":864},{},[],{"data":13618,"content":13619,"nodeType":1312},{},[13620,13624],{"data":13621,"marks":13622,"value":8411,"nodeType":864},{},[13623],{"type":899},{"data":13625,"marks":13626,"value":8415,"nodeType":864},{},[],{"data":13628,"content":13629,"nodeType":860},{},[13630,13633,13640],{"data":13631,"marks":13632,"value":8422,"nodeType":864},{},[],{"data":13634,"content":13635,"nodeType":883},{"uri":8425},[13636],{"data":13637,"marks":13638,"value":8431,"nodeType":864},{},[13639],{"type":1455},{"data":13641,"marks":13642,"value":8435,"nodeType":864},{},[],{"data":13644,"content":13645,"nodeType":860},{},[13646],{"data":13647,"marks":13648,"value":8442,"nodeType":864},{},[],{"data":13650,"content":13651,"nodeType":860},{},[13652],{"data":13653,"marks":13654,"value":8449,"nodeType":864},{},[],{"data":13656,"content":13657,"nodeType":1312},{},[13658],{"data":13659,"marks":13660,"value":8457,"nodeType":864},{},[13661],{"type":899},{"data":13663,"content":13664,"nodeType":860},{},[13665],{"data":13666,"marks":13667,"value":8464,"nodeType":864},{},[],{"data":13669,"content":13670,"nodeType":860},{},[13671,13674,13681],{"data":13672,"marks":13673,"value":2761,"nodeType":864},{},[],{"data":13675,"content":13676,"nodeType":883},{"uri":4103},[13677],{"data":13678,"marks":13679,"value":8478,"nodeType":864},{},[13680],{"type":1455},{"data":13682,"marks":13683,"value":8482,"nodeType":864},{},[],{"data":13685,"content":13688,"nodeType":996},{"target":13686},{"sys":13687},{"id":8487,"type":1001,"linkType":1002},[],{"data":13690,"content":13691,"nodeType":860},{},[13692],{"data":13693,"marks":13694,"value":8495,"nodeType":864},{},[],{"data":13696,"content":13699,"nodeType":996},{"target":13697},{"sys":13698},{"id":8500,"type":1001,"linkType":1002},[],{"data":13701,"content":13704,"nodeType":996},{"target":13702},{"sys":13703},{"id":8506,"type":1001,"linkType":1002},[],{"data":13706,"content":13707,"nodeType":1005},{},[],{"data":13709,"content":13710,"nodeType":1009},{},[13711],{"data":13712,"marks":13713,"value":8518,"nodeType":864},{},[13714],{"type":899},{"data":13716,"content":13717,"nodeType":860},{},[13718],{"data":13719,"marks":13720,"value":8525,"nodeType":864},{},[],{"data":13722,"content":13723,"nodeType":860},{},[13724],{"data":13725,"marks":13726,"value":8532,"nodeType":864},{},[],{"data":13728,"content":13729,"nodeType":941},{},[13730,13743,13756,13769],{"data":13731,"content":13732,"nodeType":945},{},[13733],{"data":13734,"content":13735,"nodeType":860},{},[13736,13740],{"data":13737,"marks":13738,"value":8546,"nodeType":864},{},[13739],{"type":899},{"data":13741,"marks":13742,"value":8550,"nodeType":864},{},[],{"data":13744,"content":13745,"nodeType":945},{},[13746],{"data":13747,"content":13748,"nodeType":860},{},[13749,13753],{"data":13750,"marks":13751,"value":8561,"nodeType":864},{},[13752],{"type":899},{"data":13754,"marks":13755,"value":8565,"nodeType":864},{},[],{"data":13757,"content":13758,"nodeType":945},{},[13759],{"data":13760,"content":13761,"nodeType":860},{},[13762,13766],{"data":13763,"marks":13764,"value":8576,"nodeType":864},{},[13765],{"type":899},{"data":13767,"marks":13768,"value":8580,"nodeType":864},{},[],{"data":13770,"content":13771,"nodeType":945},{},[13772],{"data":13773,"content":13774,"nodeType":860},{},[13775,13779],{"data":13776,"marks":13777,"value":8591,"nodeType":864},{},[13778],{"type":899},{"data":13780,"marks":13781,"value":8595,"nodeType":864},{},[],{"data":13783,"content":13784,"nodeType":860},{},[13785],{"data":13786,"marks":13787,"value":8602,"nodeType":864},{},[],{"data":13789,"content":13790,"nodeType":1312},{},[13791],{"data":13792,"marks":13793,"value":8609,"nodeType":864},{},[],{"data":13795,"content":13796,"nodeType":860},{},[13797],{"data":13798,"marks":13799,"value":8616,"nodeType":864},{},[],{"data":13801,"content":13802,"nodeType":860},{},[13803],{"data":13804,"marks":13805,"value":8623,"nodeType":864},{},[],{"data":13807,"content":13808,"nodeType":860},{},[13809,13812,13816],{"data":13810,"marks":13811,"value":8630,"nodeType":864},{},[],{"data":13813,"marks":13814,"value":8635,"nodeType":864},{},[13815],{"type":899},{"data":13817,"marks":13818,"value":8639,"nodeType":864},{},[],{"data":13820,"content":13821,"nodeType":860},{},[13822],{"data":13823,"marks":13824,"value":8646,"nodeType":864},{},[],{"data":13826,"content":13827,"nodeType":860},{},[13828],{"data":13829,"marks":13830,"value":8653,"nodeType":864},{},[],{"data":13832,"content":13833,"nodeType":1312},{},[13834],{"data":13835,"marks":13836,"value":8660,"nodeType":864},{},[],{"data":13838,"content":13839,"nodeType":860},{},[13840],{"data":13841,"marks":13842,"value":8667,"nodeType":864},{},[],{"data":13844,"content":13845,"nodeType":860},{},[13846],{"data":13847,"marks":13848,"value":8674,"nodeType":864},{},[],{"data":13850,"content":13851,"nodeType":860},{},[13852],{"data":13853,"marks":13854,"value":8681,"nodeType":864},{},[],{"data":13856,"content":13857,"nodeType":1312},{},[13858],{"data":13859,"marks":13860,"value":8688,"nodeType":864},{},[],{"data":13862,"content":13863,"nodeType":860},{},[13864],{"data":13865,"marks":13866,"value":8695,"nodeType":864},{},[],{"data":13868,"content":13869,"nodeType":860},{},[13870],{"data":13871,"marks":13872,"value":8702,"nodeType":864},{},[],{"data":13874,"content":13875,"nodeType":1312},{},[13876],{"data":13877,"marks":13878,"value":8709,"nodeType":864},{},[],{"data":13880,"content":13881,"nodeType":860},{},[13882],{"data":13883,"marks":13884,"value":8716,"nodeType":864},{},[],{"data":13886,"content":13887,"nodeType":860},{},[13888],{"data":13889,"marks":13890,"value":8723,"nodeType":864},{},[],{"data":13892,"content":13893,"nodeType":860},{},[13894],{"data":13895,"marks":13896,"value":8730,"nodeType":864},{},[],{"data":13898,"content":13899,"nodeType":1005},{},[],{"data":13901,"content":13902,"nodeType":1009},{},[13903],{"data":13904,"marks":13905,"value":8741,"nodeType":864},{},[13906],{"type":899},{"data":13908,"content":13909,"nodeType":860},{},[13910],{"data":13911,"marks":13912,"value":8748,"nodeType":864},{},[],{"data":13914,"content":13915,"nodeType":860},{},[13916,13919],{"data":13917,"marks":13918,"value":8755,"nodeType":864},{},[],{"data":13920,"marks":13921,"value":8760,"nodeType":864},{},[13922],{"type":899},{"data":13924,"content":13925,"nodeType":860},{},[13926],{"data":13927,"marks":13928,"value":8767,"nodeType":864},{},[],{"data":13930,"content":13931,"nodeType":860},{},[13932],{"data":13933,"marks":13934,"value":8774,"nodeType":864},{},[],{"data":13936,"content":13937,"nodeType":860},{},[13938],{"data":13939,"marks":13940,"value":8781,"nodeType":864},{},[],{"data":13942,"content":13943,"nodeType":1312},{},[13944],{"data":13945,"marks":13946,"value":8788,"nodeType":864},{},[],{"data":13948,"content":13949,"nodeType":941},{},[13950,13969,13988,14007,14016,14025,14034],{"data":13951,"content":13952,"nodeType":945},{},[13953],{"data":13954,"content":13955,"nodeType":860},{},[13956,13959,13966],{"data":13957,"marks":13958,"value":8801,"nodeType":864},{},[],{"data":13960,"content":13961,"nodeType":883},{"uri":8804},[13962],{"data":13963,"marks":13964,"value":8810,"nodeType":864},{},[13965],{"type":1455},{"data":13967,"marks":13968,"value":8814,"nodeType":864},{},[],{"data":13970,"content":13971,"nodeType":945},{},[13972],{"data":13973,"content":13974,"nodeType":860},{},[13975,13978,13985],{"data":13976,"marks":13977,"value":8824,"nodeType":864},{},[],{"data":13979,"content":13980,"nodeType":883},{"uri":8827},[13981],{"data":13982,"marks":13983,"value":8833,"nodeType":864},{},[13984],{"type":1455},{"data":13986,"marks":13987,"value":8837,"nodeType":864},{},[],{"data":13989,"content":13990,"nodeType":945},{},[13991],{"data":13992,"content":13993,"nodeType":860},{},[13994,13997,14004],{"data":13995,"marks":13996,"value":21,"nodeType":864},{},[],{"data":13998,"content":13999,"nodeType":883},{"uri":8849},[14000],{"data":14001,"marks":14002,"value":8855,"nodeType":864},{},[14003],{"type":1455},{"data":14005,"marks":14006,"value":8859,"nodeType":864},{},[],{"data":14008,"content":14009,"nodeType":945},{},[14010],{"data":14011,"content":14012,"nodeType":860},{},[14013],{"data":14014,"marks":14015,"value":8869,"nodeType":864},{},[],{"data":14017,"content":14018,"nodeType":945},{},[14019],{"data":14020,"content":14021,"nodeType":860},{},[14022],{"data":14023,"marks":14024,"value":8879,"nodeType":864},{},[],{"data":14026,"content":14027,"nodeType":945},{},[14028],{"data":14029,"content":14030,"nodeType":860},{},[14031],{"data":14032,"marks":14033,"value":8889,"nodeType":864},{},[],{"data":14035,"content":14036,"nodeType":945},{},[14037],{"data":14038,"content":14039,"nodeType":860},{},[14040,14043,14050],{"data":14041,"marks":14042,"value":8899,"nodeType":864},{},[],{"data":14044,"content":14045,"nodeType":883},{"uri":5494},[14046],{"data":14047,"marks":14048,"value":8907,"nodeType":864},{},[14049],{"type":1455},{"data":14051,"marks":14052,"value":8911,"nodeType":864},{},[],{"data":14054,"content":14055,"nodeType":860},{},[14056],{"data":14057,"marks":14058,"value":21,"nodeType":864},{},[],{"data":14060,"content":14063,"nodeType":996},{"target":14061},{"sys":14062},{"id":8922,"type":1001,"linkType":1002},[],{"data":14065,"content":14066,"nodeType":1005},{},[],{"data":14068,"content":14069,"nodeType":860},{},[14070,14073,14080],{"data":14071,"marks":14072,"value":8933,"nodeType":864},{},[],{"data":14074,"content":14075,"nodeType":883},{"uri":1700},[14076],{"data":14077,"marks":14078,"value":8941,"nodeType":864},{},[14079],{"type":1455},{"data":14081,"marks":14082,"value":2924,"nodeType":864},{},[],{"entries":14084},{"hyperlink":14085,"inline":14086,"block":14087},[],[],[14088,14094,14118,14145,14170,14177,14180,14207,14214,14251],{"sys":14089,"__typename":1724,"title":14090,"caption":14090,"layoutMode":59,"file":14091},{"id":8145},"The browser is the natural control point for both AI-enabled attacks targeting employees and AI tool usage that introduces risk into organizations. ",{"url":14092,"width":1736,"height":14093},"https://images.ctfassets.net/y1cdw1ablpvd/3vtPqgrZRuVxkVKw9sGLor/ce1d265590cfc23848e25b03fb3ed5a2/image4.png",1142,{"sys":14095,"__typename":1740,"content":14096,"name":14117,"title":59},{"id":8169},{"json":14097},{"data":14098,"content":14099,"nodeType":856},{},[14100],{"data":14101,"content":14102,"nodeType":860},{},[14103,14107,14114],{"data":14104,"marks":14105,"value":14106,"nodeType":864},{},[],"Learn how AI-enabled attacks are making infrastructure-based detection increasingly ineffective in our ",{"data":14108,"content":14109,"nodeType":883},{"uri":11115},[14110],{"data":14111,"marks":14112,"value":14113,"nodeType":864},{},[],"update on the Pyramid of Pain concept for 2026",{"data":14115,"marks":14116,"value":2924,"nodeType":864},{},[],"AI Browser Control IB1",{"sys":14119,"__typename":1740,"content":14120,"name":14144,"title":59},{"id":8241},{"json":14121},{"data":14122,"content":14123,"nodeType":856},{},[14124],{"data":14125,"content":14126,"nodeType":860},{},[14127,14131,14140],{"data":14128,"marks":14129,"value":14130,"nodeType":864},{},[],"Nearly every phishing toolkit that Push encounters in the wild today displays the fingerprints of AI use. Check out our ",{"data":14132,"content":14134,"nodeType":883},{"uri":14133},"https://pushsecurity.com/blog/inside-criminal-phishing-panel/",[14135],{"data":14136,"marks":14137,"value":14139,"nodeType":864},{},[14138],{"type":1455},"recent analysis",{"data":14141,"marks":14142,"value":14143,"nodeType":864},{},[]," of Doko's Panel, a real-time vishing and AiTM kit, for a under-the-hood look at this. ","AI Browser Control IB3",{"sys":14146,"__typename":1740,"content":14147,"name":14169,"title":59},{"id":8262},{"json":14148},{"data":14149,"content":14150,"nodeType":856},{},[14151],{"data":14152,"content":14153,"nodeType":860},{},[14154,14157,14165],{"data":14155,"marks":14156,"value":3719,"nodeType":864},{},[],{"data":14158,"content":14159,"nodeType":883},{"uri":3858},[14160],{"data":14161,"marks":14162,"value":14164,"nodeType":864},{},[14163],{"type":1455},"Spamhaus",{"data":14166,"marks":14167,"value":14168,"nodeType":864},{},[],", 89% of phishing domains are active for fewer than two days, with just 6.5% surviving past 15 days. That means that if you're primarily looking at static indicators, you're already behind. IOC-based detections can't keep up with how quickly attackers can rotate infrastructure.","AI Browser Control IB2",{"sys":14171,"__typename":1724,"title":14172,"caption":14173,"layoutMode":59,"file":14174},{"id":8334},"LLMShare example","The recent LLMShare campaign shows how attackers are abusing AI tools, legitimate pages, and malvertising. ",{"url":14175,"width":1736,"height":14176},"https://images.ctfassets.net/y1cdw1ablpvd/7u7yyvyg3P9jepZi7iIwxf/d2c42d257d2e7ac4dfe28c37aa69a4b3/image4.png",875,{"sys":14178,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":14179},{"id":1040},{"url":1728,"width":1729,"height":1730},{"sys":14181,"__typename":1740,"content":14182,"name":14206,"title":59},{"id":8487},{"json":14183},{"nodeType":856,"data":14184,"content":14185},{},[14186],{"nodeType":860,"data":14187,"content":14188},{},[14189,14193,14202],{"nodeType":864,"value":14190,"marks":14191,"data":14192},"The Vercel breach isn't an isolated incident. ShinyHunters demonstrated the breadth and scale of ",[],{},{"nodeType":883,"data":14194,"content":14196},{"uri":14195},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/#id-vector-3-oauth-supply-chain-attacks-through-compromised-integrators",[14197],{"nodeType":864,"value":14198,"marks":14199,"data":14201},"OAuth-targeted attacks last year",[14200],{"type":1455},{},{"nodeType":864,"value":14203,"marks":14204,"data":14205},", impacting more than 1,000 organizations in targeted campaigns against Salesloft/Drift. Adversaries compromised Salesloft’s GitHub environment, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight.",[],{},"AI Browser Control IB5",{"sys":14208,"__typename":1724,"title":14209,"caption":14209,"layoutMode":59,"file":14210},{"id":8500},"AI tools are the hub of the modern workplace. ",{"url":14211,"width":14212,"height":14213},"https://images.ctfassets.net/y1cdw1ablpvd/7mRgALIClC1R2Cmuu7xKse/cdaf8cbb26a54ad75b7d52a8c92b1f84/Group_737.png",6824,4280,{"sys":14215,"__typename":1740,"content":14216,"name":14250,"title":59},{"id":8506},{"json":14217},{"nodeType":856,"data":14218,"content":14219},{},[14220,14232,14239],{"nodeType":860,"data":14221,"content":14222},{},[14223,14228],{"nodeType":864,"value":14224,"marks":14225,"data":14227},"A word on prompt injection: ",[14226],{"type":899},{},{"nodeType":864,"value":14229,"marks":14230,"data":14231},"Prompt injection is a serious and structurally difficult to solve problem, and one AI researchers and the security industry are still working out how to defend against. ",[],{},{"nodeType":860,"data":14233,"content":14234},{},[14235],{"nodeType":864,"value":14236,"marks":14237,"data":14238},"High-impact attacks of this kind are still rare in the wild, but the building blocks are all demonstrated and the attack surface is growing as agentic browsers and in-app AI features proliferate. The threat is evolving quickly and detections are still limited, so it pays to start with the controls that hold up regardless of how attacks evolve. ",[],{},{"nodeType":860,"data":14240,"content":14241},{},[14242,14246],{"nodeType":864,"value":14243,"marks":14244,"data":14245},"This starts with k",[],{},{"nodeType":864,"value":14247,"marks":14248,"data":14249},"nowing which AI browsers, extensions, and assistants employees are using, which SaaS apps have AI features enabled, and what OAuth scopes those AIs have been granted. The blast radius of any successful prompt injection is exactly the data and actions those grants permit, so visibility into AI tooling and AI-connected identity is the foundation that any further defense builds on.",[],{},"AI Browser Control IB4",{"sys":14252,"__typename":14253,"title":14254,"arcadeDemoUrl":14255,"playText":14256},{"id":8922},"ArcadeDemo","Secure AI apps demo","https://demo.arcade.software/ibou7WyNSvBX4uRpK25H?embed","2 mins",{"items":14258},[],{},"Why browser visibility and control is key to AI security",{"items":14262},[14263,15038,15844],{"__typename":2059,"sys":14264,"content":14266,"title":15021,"synopsis":15022,"hashTags":59,"publishedDate":15023,"slug":15024,"tagsCollection":15025,"authorsCollection":15034},{"id":14265},"5RDOpmzJolwT1hk0fNIxzf",{"json":14267},{"data":14268,"content":14269,"nodeType":856},{},[14270,14289,14295,14302,14309,14312,14320,14339,14358,14365,14371,14378,14384,14391,14399,14406,14424,14453,14459,14465,14473,14480,14498,14528,14560,14567,14573,14581,14588,14599,14606,14645,14651,14692,14729,14735,14738,14746,14753,14759,14766,14773,14779,14786,14793,14820,14823,14831,14838,14846,14853,14860,14879,14886,14892,14899,14907,14914,14932,14939,14957,14960,14968,14975,14982,14989,14992,14998,15004],{"data":14271,"content":14272,"nodeType":860},{},[14273,14277,14285],{"data":14274,"marks":14275,"value":14276,"nodeType":864},{},[],"Back in 2024, we wrote about ",{"data":14278,"content":14280,"nodeType":883},{"uri":14279},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[14281],{"data":14282,"marks":14283,"value":14284,"nodeType":864},{},[],"how the Pyramid of Pain shapes Push's detection philosophy",{"data":14286,"marks":14287,"value":14288,"nodeType":864},{},[]," — detections targeting indicators that are easy for attackers to change deliver diminishing returns, while detections targeting attacker techniques impose a cost that's hard to absorb. Two years on, every force that made IoC-based detection fragile has intensified.",{"data":14290,"content":14294,"nodeType":996},{"target":14291},{"sys":14292},{"id":14293,"type":1001,"linkType":1002},"1iuLYxwI8T1wDUIFSom0G0",[],{"data":14296,"content":14297,"nodeType":860},{},[14298],{"data":14299,"marks":14300,"value":14301,"nodeType":864},{},[],"AI hasn't introduced a new problem so much as it's compressed the timelines on an existing one — attackers can generate infrastructure, iterate on tooling, and industrialize newly discovered techniques faster than before. The bottom layers of the Pyramid are collapsing under the weight of machine-speed operations, and the middle layers are starting to buckle too.",{"data":14303,"content":14304,"nodeType":860},{},[14305],{"data":14306,"marks":14307,"value":14308,"nodeType":864},{},[],"These changes mean that technique-level detection is more important than ever. In this article, we’ll dig into how the Pyramid is changing, and what this means for our detection philosophy at Push (TL;DR — it reinforces the path we’re already on: building detections at the top of the Pyramid by harnessing browser visibility). ",{"data":14310,"content":14311,"nodeType":1005},{},[],{"data":14313,"content":14314,"nodeType":1009},{},[14315],{"data":14316,"marks":14317,"value":14319,"nodeType":864},{},[14318],{"type":899},"The bottom of the Pyramid was already crumbling",{"data":14321,"content":14322,"nodeType":860},{},[14323,14327,14335],{"data":14324,"marks":14325,"value":14326,"nodeType":864},{},[],"The case against indicator-based detection didn't need AI to be compelling. ",{"data":14328,"content":14330,"nodeType":883},{"uri":14329},"https://www.spamhaus.org/",[14331],{"data":14332,"marks":14333,"value":14334,"nodeType":864},{},[],"89% of phishing domains are active for fewer than two days",{"data":14336,"marks":14337,"value":14338,"nodeType":864},{},[],", with just 6.5% surviving past 15 days — by the time a domain makes it onto a blocklist, the campaign has moved on.",{"data":14340,"content":14341,"nodeType":860},{},[14342,14346,14354],{"data":14343,"marks":14344,"value":14345,"nodeType":864},{},[],"We've ",{"data":14347,"content":14349,"nodeType":883},{"uri":14348},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[14350],{"data":14351,"marks":14352,"value":14353,"nodeType":864},{},[],"written before",{"data":14355,"marks":14356,"value":14357,"nodeType":864},{},[]," about how this makes every phishing attack effectively a zero-day for organizations relying on known-bad detection. The phishing kit's behavior — its page structure, script signatures, malicious payload mechanics — is the only detection target that outlasts a single campaign.",{"data":14359,"content":14360,"nodeType":860},{},[14361],{"data":14362,"marks":14363,"value":14364,"nodeType":864},{},[],"When we blogged about the Pyramid of Pain for modern attacks that happen predominantly over the internet, with minimal (or zero) endpoint contact, it first looked like this: ",{"data":14366,"content":14370,"nodeType":996},{"target":14367},{"sys":14368},{"id":14369,"type":1001,"linkType":1002},"2N04ycJ6RKGfHdX5X1TwU3",[],{"data":14372,"content":14373,"nodeType":860},{},[14374],{"data":14375,"marks":14376,"value":14377,"nodeType":864},{},[],"Now, it looks more like this:",{"data":14379,"content":14383,"nodeType":996},{"target":14380},{"sys":14381},{"id":14382,"type":1001,"linkType":1002},"mfhP4WToOQkrHnVkXU0tX",[],{"data":14385,"content":14386,"nodeType":860},{},[14387],{"data":14388,"marks":14389,"value":14390,"nodeType":864},{},[],"Let’s explore why. ",{"data":14392,"content":14393,"nodeType":1312},{},[14394],{"data":14395,"marks":14396,"value":14398,"nodeType":864},{},[14397],{"type":899},"AI is accelerating phishing rotation and delivery",{"data":14400,"content":14401,"nodeType":860},{},[14402],{"data":14403,"marks":14404,"value":14405,"nodeType":864},{},[],"Attackers are harnessing AI at every stage, speeding up the process of creating, rotating, and replacing phishing infrastructure at every level, as well as capitalizing on AI adoption itself to enhance their lures. The operational signature is more domains, shorter lifespans, more variation, and fewer of the reuse patterns that blocklists depend on.",{"data":14407,"content":14408,"nodeType":860},{},[14409,14413,14420],{"data":14410,"marks":14411,"value":14412,"nodeType":864},{},[],"Attackers can ",{"data":14414,"content":14415,"nodeType":883},{"uri":8827},[14416],{"data":14417,"marks":14418,"value":14419,"nodeType":864},{},[],"vibe-code entire phishing pages in minutes",{"data":14421,"marks":14422,"value":14423,"nodeType":864},{},[]," — not just cloning legitimate login pages but vibe-cloning them, feeding an AI a screenshot and having it rebuild a convincing frontend with a completely unique backend. ",{"data":14425,"content":14426,"nodeType":860},{},[14427,14431,14439,14443,14449],{"data":14428,"marks":14429,"value":14430,"nodeType":864},{},[],"We've seen attackers clone free SaaS tools like background removers and PDF converters, then inject phishing components or ClickFix payloads into what looks like a functional utility. We’ve even seen attackers distributing malware using AI-generated pages shared using ",{"data":14432,"content":14433,"nodeType":883},{"uri":8321},[14434],{"data":14435,"marks":14436,"value":14438,"nodeType":864},{},[14437],{"type":1455},"LLM tool sharing functionality",{"data":14440,"marks":14441,"value":14442,"nodeType":864},{},[],", resulting in phishing delivery pages hosted on real claude.ai and chatgpt.com. And legitimate cloud platforms like ",{"data":14444,"content":14445,"nodeType":883},{"uri":8273},[14446],{"data":14447,"marks":14448,"value":8279,"nodeType":864},{},[],{"data":14450,"marks":14451,"value":14452,"nodeType":864},{},[],", Cloudflare Workers, and Vercel host and dynamically rotate attack infrastructure, so the domains feeding into blocklists often belong to reputable services that can't simply be blocked. ",{"data":14454,"content":14458,"nodeType":996},{"target":14455},{"sys":14456},{"id":14457,"type":1001,"linkType":1002},"5yoLmqysyQazfzLITCUTfc",[],{"data":14460,"content":14464,"nodeType":996},{"target":14461},{"sys":14462},{"id":14463,"type":1001,"linkType":1002},"5XK5qZMQU19xlA8L2T5y0Z",[],{"data":14466,"content":14467,"nodeType":1312},{},[14468],{"data":14469,"marks":14470,"value":14472,"nodeType":864},{},[14471],{"type":899},"The kit ecosystem is fragmenting faster than anyone can track",{"data":14474,"content":14475,"nodeType":860},{},[14476],{"data":14477,"marks":14478,"value":14479,"nodeType":864},{},[],"What we see across our install base is a huge and growing variation in phishing kits — new kits, derivative kits of known platforms, derivatives of those derivatives — appearing on a weekly basis.",{"data":14481,"content":14482,"nodeType":860},{},[14483,14487,14494],{"data":14484,"marks":14485,"value":14486,"nodeType":864},{},[],"As we reported in our ",{"data":14488,"content":14489,"nodeType":883},{"uri":12790},[14490],{"data":14491,"marks":14492,"value":14493,"nodeType":864},{},[],"Browser Attacks Report",{"data":14495,"marks":14496,"value":14497,"nodeType":864},{},[],", the most common AiTM kits we detected over the last year were Tycoon 2FA (59% of detections), followed by Sneaky 2FA, FlowerStorm, Evilginx (nominally a red team tool, but widely abused by attackers), NakedPages, Gabagool, and dozens more — but those established names are just the visible layer.",{"data":14499,"content":14500,"nodeType":860},{},[14501,14505,14513,14517,14524],{"data":14502,"marks":14503,"value":14504,"nodeType":864},{},[],"Code is forked, modified, and redeployed across kits in a pattern that ",{"data":14506,"content":14508,"nodeType":883},{"uri":14507},"https://blog.barracuda.com/2026/04/16/threat-spotlight-tycoon-2fa-scattered-everywhere",[14509],{"data":14510,"marks":14511,"value":14512,"nodeType":864},{},[],"resembles open-source development",{"data":14514,"marks":14515,"value":14516,"nodeType":864},{},[]," more than traditional criminal enterprise, and the rate at which new variants appear is accelerating. The ",{"data":14518,"content":14519,"nodeType":883},{"uri":3259},[14520],{"data":14521,"marks":14522,"value":14523,"nodeType":864},{},[],"Venom kit",{"data":14525,"marks":14526,"value":14527,"nodeType":864},{},[]," reuses Sneaky 2FA's AiTM infrastructure but carries different branding and adds device code phishing — whether it's the same developers, stolen code, or a deliberate fork is unclear.",{"data":14529,"content":14530,"nodeType":860},{},[14531,14535,14543,14547,14556],{"data":14532,"marks":14533,"value":14534,"nodeType":864},{},[],"Tycoon 2FA illustrates the scale of the evolution. The kit evolves continuously, addingnew capabilities, new evasion techniques, and hybridizing with other platforms. Even when Sekoia and Microsoft seized 330+ Tycoon domains in March 2026, the techniques it popularized were already embedded across competitors, and the slack was taken up by rival platforms within days. And in any case, Tycoon was back to ",{"data":14536,"content":14538,"nodeType":883},{"uri":14537},"https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/",[14539],{"data":14540,"marks":14541,"value":14542,"nodeType":864},{},[],"normal levels of operation",{"data":14544,"marks":14545,"value":14546,"nodeType":864},{},[]," shortly after. It has also been observed ",{"data":14548,"content":14550,"nodeType":883},{"uri":14549},"https://www.okta.com/en-nl/blog/threat-intelligence/tycoon_2fa_phishing_actors_scatter/",[14551],{"data":14552,"marks":14553,"value":14555,"nodeType":864},{},[14554],{"type":1455},"pivoting to add new device code phishing capabilities",{"data":14557,"marks":14558,"value":14559,"nodeType":864},{},[]," (more on that below). ",{"data":14561,"content":14562,"nodeType":860},{},[14563],{"data":14564,"marks":14565,"value":14566,"nodeType":864},{},[],"Tear one down and there are many more to take its place — and meanwhile the original is already evolving into something new.",{"data":14568,"content":14572,"nodeType":996},{"target":14569},{"sys":14570},{"id":14571,"type":1001,"linkType":1002},"3UDzUCCizPJhXp3SsoZuSK",[],{"data":14574,"content":14575,"nodeType":1312},{},[14576],{"data":14577,"marks":14578,"value":14580,"nodeType":864},{},[14579],{"type":899},"New techniques are being industrialized faster than ever",{"data":14582,"content":14583,"nodeType":860},{},[14584],{"data":14585,"marks":14586,"value":14587,"nodeType":864},{},[],"As well as the fragmentation of existing kits, we’re seeing new techniques added at an accelerating rate. ",{"data":14589,"content":14590,"nodeType":860},{},[14591,14595],{"data":14592,"marks":14593,"value":360,"nodeType":864},{},[14594],{"type":899},{"data":14596,"marks":14597,"value":14598,"nodeType":864},{},[]," is the clearest case study. From early nation state adoption in 2024, it took until 2026 for criminal adoption to really take off, but the take-up this year is unprecedented. The EvilTokens kit packaged device code phishing into a PhaaS offering with GPT-powered spear-phishing and adaptive landing pages, hitting 340+ organizations across five countries in March 2026. ",{"data":14600,"content":14601,"nodeType":860},{},[14602],{"data":14603,"marks":14604,"value":14605,"nodeType":864},{},[],"Now, device code functionality is now a core phish kit component. We’re tracking 18+ kits with device code phishing capabilities and a 37.5x increase in device code phishing detections this year alone, with the technique moving from state-sponsored exclusivity to something any PhaaS customer can rent.",{"data":14607,"content":14608,"nodeType":860},{},[14609,14613,14621,14625,14630,14634,14642],{"data":14610,"marks":14611,"value":14612,"nodeType":864},{},[],"Similarly, when we ",{"data":14614,"content":14616,"nodeType":883},{"uri":14615},"https://pushsecurity.com/blog/inside-criminal-phishing-panel",[14617],{"data":14618,"marks":14619,"value":14620,"nodeType":864},{},[],"infiltrated Doko's Panel",{"data":14622,"marks":14623,"value":14624,"nodeType":864},{},[]," — a ",{"data":14626,"marks":14627,"value":14629,"nodeType":864},{},[14628],{"type":899},"real-time vishing and AiTM platform",{"data":14631,"marks":14632,"value":14633,"nodeType":864},{},[]," used by ShinyHunters and affiliated groups — the codebase was full of LLM-generated artifacts. Multiple groups were using the templated vishing panel and spinning up their own variants, but the AI-generated indicators persisted throughout. This approach to real-time vishing + browser payload has been a ",{"data":14635,"content":14636,"nodeType":883},{"uri":4082},[14637],{"data":14638,"marks":14639,"value":14641,"nodeType":864},{},[14640],{"type":1455},"mainstay of the Com affiliates like ShinyHunters this year",{"data":14643,"marks":14644,"value":1774,"nodeType":864},{},[],{"data":14646,"content":14650,"nodeType":996},{"target":14647},{"sys":14648},{"id":14649,"type":1001,"linkType":1002},"01mOiserRBXraawXwQyJNm",[],{"data":14652,"content":14653,"nodeType":860},{},[14654,14658,14662,14666,14675,14679,14688],{"data":14655,"marks":14656,"value":14657,"nodeType":864},{},[],"The broader ",{"data":14659,"marks":14660,"value":315,"nodeType":864},{},[14661],{"type":899},{"data":14663,"marks":14664,"value":14665,"nodeType":864},{},[]," family shows the same acceleration: First reported in early 2024 and adopted by four nation-state groups within a single quarter. Fast forward and ",{"data":14667,"content":14669,"nodeType":883},{"uri":14668},"https://www.crowdstrike.com/en-us/global-threat-report/",[14670],{"data":14671,"marks":14672,"value":14674,"nodeType":864},{},[14673],{"type":1455},"CrowdStrike's data",{"data":14676,"marks":14677,"value":14678,"nodeType":864},{},[]," shows a 563% increase in fake CAPTCHA incidents (one of the more common ClickFix lure types), while ",{"data":14680,"content":14682,"nodeType":883},{"uri":14681},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf",[14683],{"data":14684,"marks":14685,"value":14687,"nodeType":864},{},[14686],{"type":1455},"Microsoft reported",{"data":14689,"marks":14690,"value":14691,"nodeType":864},{},[]," it as making up 47% of observed attacks according to their Digital Defense Report.",{"data":14693,"content":14694,"nodeType":860},{},[14695,14699,14703,14707,14714,14718,14725],{"data":14696,"marks":14697,"value":14698,"nodeType":864},{},[],"And ",{"data":14700,"marks":14701,"value":12985,"nodeType":864},{},[14702],{"type":899},{"data":14704,"marks":14705,"value":14706,"nodeType":864},{},[]," — a combination of ClickFix and OAuth consent phishing techniques — suggests the next compression is already underway. Push researchers ",{"data":14708,"content":14709,"nodeType":883},{"uri":12980},[14710],{"data":14711,"marks":14712,"value":14713,"nodeType":864},{},[],"discovered the technique",{"data":14715,"marks":14716,"value":14717,"nodeType":864},{},[]," in December 2025 — a browser-native ClickFix variant hijacking OAuth consent grants via Azure CLI's localhost redirect. It was later confirmed to be tied to APT29. By January 2026, a ",{"data":14719,"content":14720,"nodeType":883},{"uri":8195},[14721],{"data":14722,"marks":14723,"value":14724,"nodeType":864},{},[],"criminal ConsentFix v3 toolkit",{"data":14726,"marks":14727,"value":14728,"nodeType":864},{},[]," had appeared on the XSS forum with Cloudflare Workers, ZoomInfo targeting, and automated exfiltration via Pipedream.",{"data":14730,"content":14734,"nodeType":996},{"target":14731},{"sys":14732},{"id":14733,"type":1001,"linkType":1002},"41FMif4T0y1maflzonWgL8",[],{"data":14736,"content":14737,"nodeType":1005},{},[],{"data":14739,"content":14740,"nodeType":1009},{},[14741],{"data":14742,"marks":14743,"value":14745,"nodeType":864},{},[14744],{"type":899},"Why technique-level detection is the only layer that holds",{"data":14747,"content":14748,"nodeType":860},{},[14749],{"data":14750,"marks":14751,"value":14752,"nodeType":864},{},[],"The middle of the Pyramid — tool signatures and artifacts — used to offer much more durable detection than infrastructure indicators. Fingerprinting a specific phishing kit by its JavaScript structure or HTML patterns provided a detection target that survived across dozens or hundreds of campaigns, even as the underlying domains rotated. Tool level detections are still better, but not by quite the same margin.",{"data":14754,"content":14758,"nodeType":996},{"target":14755},{"sys":14756},{"id":14757,"type":1001,"linkType":1002},"5pxaYdCIFiFKLPhRaPoldX",[],{"data":14760,"content":14761,"nodeType":860},{},[14762],{"data":14763,"marks":14764,"value":14765,"nodeType":864},{},[],"When the kit landscape was dominated by a handful of platforms, you could write signatures for Tycoon, Sneaky2FA, EvilProxy, and so on, and cover the lion's share of attacks. With the ecosystem now producing new variants and entirely new kits on a weekly basis, detecting by kit fingerprint starts to look uncomfortably similar to detecting by domain.",{"data":14767,"content":14768,"nodeType":860},{},[14769],{"data":14770,"marks":14771,"value":14772,"nodeType":864},{},[],"But many of these proliferating kits do share behavioral patterns at a deeper level than their code signatures. For example, every device code phishing kit implements fundamentally the same flow: present a lure, generate a device code via the OAuth Device Authorization endpoint, get the user to enter it on the legitimate authorization page, and poll for the resulting tokens. The frontends vary, the infrastructure varies, but the behavioral pattern doesn't.",{"data":14774,"content":14778,"nodeType":996},{"target":14775},{"sys":14776},{"id":14777,"type":1001,"linkType":1002},"FyyHayQtsJTwoB1kluMOl",[],{"data":14780,"content":14781,"nodeType":860},{},[14782],{"data":14783,"marks":14784,"value":14785,"nodeType":864},{},[],"Genuinely new attack techniques still require human creativity — an attacker has to identify a gap in how a legitimate protocol or feature can be subverted. That kind of innovation hasn't been automated. But the window to discover a technique, build a detection, and then deploy it before it is adopted by criminals at scale is compressing with each generation.",{"data":14787,"content":14788,"nodeType":860},{},[14789],{"data":14790,"marks":14791,"value":14792,"nodeType":864},{},[],"Organizations that detect at the technique level and deploy before commoditization have a structural advantage that increases over time. Waiting for indicators — even tool-level indicators — means chasing a curve that's accelerating away from you. This is the challenge we grapple with every day as we strive for the most resilient detections possible. ",{"data":14794,"content":14795,"nodeType":1116},{},[14796],{"data":14797,"content":14798,"nodeType":860},{},[14799,14803,14811,14815],{"data":14800,"marks":14801,"value":14802,"nodeType":864},{},[],"As our CPO Jacques Louw put it on ",{"data":14804,"content":14806,"nodeType":883},{"uri":14805},"https://risky.biz/RBNEWSSI128/",[14807],{"data":14808,"marks":14809,"value":14810,"nodeType":864},{},[],"Risky Business",{"data":14812,"marks":14813,"value":14814,"nodeType":864},{},[],": ",{"data":14816,"marks":14817,"value":14819,"nodeType":864},{},[14818],{"type":2246},"\"There's no list of bad domains anywhere in the product. It's a crutch — a false cheat code that stops you from doing the detection in the way that actually is resilient, because the next time you see it, it will be on a different domain.\"",{"data":14821,"content":14822,"nodeType":1005},{},[],{"data":14824,"content":14825,"nodeType":1009},{},[14826],{"data":14827,"marks":14828,"value":14830,"nodeType":864},{},[14829],{"type":899},"What it takes to detect at the top of the Pyramid",{"data":14832,"content":14833,"nodeType":860},{},[14834],{"data":14835,"marks":14836,"value":14837,"nodeType":864},{},[],"If technique-level detection is the only layer that holds, two things have to be true about your detection capability: You need the right vantage point, and you need the research velocity to stay ahead.",{"data":14839,"content":14840,"nodeType":1312},{},[14841],{"data":14842,"marks":14843,"value":14845,"nodeType":864},{},[14844],{"type":899},"You need the right vantage point",{"data":14847,"content":14848,"nodeType":860},{},[14849],{"data":14850,"marks":14851,"value":14852,"nodeType":864},{},[],"Technique-level behaviors in browser-based identity attacks — how a phishing page orchestrates credential entry, how a device code flow presents its authorization prompt, how a ClickFix variant manipulates the clipboard — are visible in the browser session and nowhere else.",{"data":14854,"content":14855,"nodeType":860},{},[14856],{"data":14857,"marks":14858,"value":14859,"nodeType":864},{},[],"Network proxies see encrypted traffic and can attempt to reconstruct page behavior from metadata, but DOM manipulation, user interaction sequences, and script execution aren't visible from that vantage point. Email gateways see the delivery mechanism (or nothing at all in the increasing number of social media and search engine based attacks) but not the payload.",{"data":14861,"content":14862,"nodeType":860},{},[14863,14867,14875],{"data":14864,"marks":14865,"value":14866,"nodeType":864},{},[],"As we disclosed in our ",{"data":14868,"content":14869,"nodeType":883},{"uri":12790},[14870],{"data":14871,"marks":14872,"value":14874,"nodeType":864},{},[14873],{"type":1455},"browser attacks report",{"data":14876,"marks":14877,"value":14878,"nodeType":864},{},[],", 95% of in-browser attacks we detect use some form of bot protection, often combined with conditional loading techniques like referrer and browser checks, reliably defeating automated analysis techniques. ",{"data":14880,"content":14881,"nodeType":860},{},[14882],{"data":14883,"marks":14884,"value":14885,"nodeType":864},{},[],"Behavioral detection at the technique level requires observing what happens on the page at the moment the user interacts with it — analyzing pages, not links. When you see the entire browsing flow — ad click, redirect chain, page render, credential prompt — an attack stands out immediately. Without that context, any detection system is forced to fill in gaps, and the gaps are where attacks hide.",{"data":14887,"content":14891,"nodeType":996},{"target":14888},{"sys":14889},{"id":14890,"type":1001,"linkType":1002},"4804g6u4POUDpL42bzP0EY",[],{"data":14893,"content":14894,"nodeType":860},{},[14895],{"data":14896,"marks":14897,"value":14898,"nodeType":864},{},[],"Push sits inside the browser session, observing this in real time. Its detections target the behavioral mechanics of techniques rather than the surface characteristics of individual kits or infrastructure.",{"data":14900,"content":14901,"nodeType":1312},{},[14902],{"data":14903,"marks":14904,"value":14906,"nodeType":864},{},[14905],{"type":899},"You need the research expertise",{"data":14908,"content":14909,"nodeType":860},{},[14910],{"data":14911,"marks":14912,"value":14913,"nodeType":864},{},[],"When the window between technique discovery and industrialized exploitation is measured in weeks rather than years, the detection pipeline needs to operate on that same compressed timescale.",{"data":14915,"content":14916,"nodeType":860},{},[14917,14921,14928],{"data":14918,"marks":14919,"value":14920,"nodeType":864},{},[],"This is where our ",{"data":14922,"content":14923,"nodeType":883},{"uri":8827},[14924],{"data":14925,"marks":14926,"value":14927,"nodeType":864},{},[],"agentic threat hunting pipeline",{"data":14929,"marks":14930,"value":14931,"nodeType":864},{},[]," fits. It's tripled our monthly detection output — not by generating bigger blocklists, but by scaling the process of discovering behavioral patterns across the telemetry generated by 3+ million browser deployments.",{"data":14933,"content":14934,"nodeType":860},{},[14935],{"data":14936,"marks":14937,"value":14938,"nodeType":864},{},[],"The detections it produces are technique-class by design, targeting how attacks work rather than the infrastructure or specific tool that implements them. The goal is curation, not accumulation — hundreds of high-fidelity behavioral detections rather than the billions of signatures and domain entries that traditional approaches require.",{"data":14940,"content":14941,"nodeType":860},{},[14942,14946,14953],{"data":14943,"marks":14944,"value":14945,"nodeType":864},{},[],"When we detected the first in-the-wild ",{"data":14947,"content":14948,"nodeType":883},{"uri":12992},[14949],{"data":14950,"marks":14951,"value":14952,"nodeType":864},{},[],"InstallFix attack",{"data":14954,"marks":14955,"value":14956,"nodeType":864},{},[]," through the pipeline — a user had searched for NotebookLM, clicked a paid Google ad, and was redirected to a fake page with a WebAssembly C2 connector — the detection shipped to all customers within minutes. It didn't depend on knowing the domain, the ad creative, or the specific kit. It depended on recognizing the technique itself.",{"data":14958,"content":14959,"nodeType":1005},{},[],{"data":14961,"content":14962,"nodeType":1009},{},[14963],{"data":14964,"marks":14965,"value":14967,"nodeType":864},{},[14966],{"type":899},"Technique-level detection is now the only option",{"data":14969,"content":14970,"nodeType":860},{},[14971],{"data":14972,"marks":14973,"value":14974,"nodeType":864},{},[],"As a framework for detection durability, the Pyramid of Pain is more relevant than ever. ",{"data":14976,"content":14977,"nodeType":860},{},[14978],{"data":14979,"marks":14980,"value":14981,"nodeType":864},{},[],"AI has made infrastructure indicators essentially disposable. The tools tier is compressing as criminal vendors vibe-code, fork, and clone tooling at machine speed. Technique-level detection is the layer that holds long-term to be able to proactively detect and block net-new attacks and the kits that power them. ",{"data":14983,"content":14984,"nodeType":860},{},[14985],{"data":14986,"marks":14987,"value":14988,"nodeType":864},{},[],"Novel attack techniques still require human creativity to discover, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation. Defending that layer requires a vantage point inside the browser session and a research pipeline fast enough to stay ahead of the accelerating path from discovery to industrialization.",{"data":14990,"content":14991,"nodeType":1005},{},[],{"data":14993,"content":14994,"nodeType":860},{},[14995],{"data":14996,"marks":14997,"value":1682,"nodeType":864},{},[],{"data":14999,"content":15000,"nodeType":860},{},[15001],{"data":15002,"marks":15003,"value":1689,"nodeType":864},{},[],{"data":15005,"content":15006,"nodeType":860},{},[15007,15010,15018],{"data":15008,"marks":15009,"value":21,"nodeType":864},{},[],{"data":15011,"content":15012,"nodeType":883},{"uri":1700},[15013],{"data":15014,"marks":15015,"value":15017,"nodeType":864},{},[15016],{"type":1455},"Book a live demo",{"data":15019,"marks":15020,"value":2719,"nodeType":864},{},[],"The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever","AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.","2026-06-01T00:00:00.000Z","the-pyramid-of-pain-in-the-ai-era",{"items":15026},[15027,15030],{"sys":15028,"name":342},{"id":15029},"4ksQNCFeBf8H4QIORqpRLw",{"sys":15031,"name":15033},{"id":15032},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"items":15035},[15036],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":15037},{"url":2740},{"__typename":2059,"sys":15039,"content":15041,"title":15827,"synopsis":15828,"hashTags":59,"publishedDate":5641,"slug":15829,"tagsCollection":15830,"authorsCollection":15836},{"id":15040},"Gcg7PGuICrlRcqq1QFXxH",{"json":15042},{"data":15043,"content":15044,"nodeType":856},{},[15045,15052,15059,15090,15097,15103,15109,15121,15124,15132,15148,15155,15161,15168,15175,15181,15184,15192,15199,15205,15211,15218,15225,15243,15249,15252,15260,15278,15284,15291,15294,15302,15309,15316,15322,15328,15371,15378,15381,15389,15396,15403,15446,15453,15484,15491,15534,15541,15544,15552,15571,15578,15586,15601,15608,15625,15632,15635,15641,15647,15664,15667,15675,15694,15701,15821],{"data":15046,"content":15047,"nodeType":860},{},[15048],{"data":15049,"marks":15050,"value":15051,"nodeType":864},{},[],"Shared conversations on AI chatbot platforms have become the latest delivery mechanism for malware campaigns targeting macOS and Windows users. Attackers create content on platforms like ChatGPT and Claude that appears to offer installation guidance or service updates, then drive traffic to it via search engine results in the form of malvertising and SEO poisoning.  ",{"data":15053,"content":15054,"nodeType":860},{},[15055],{"data":15056,"marks":15057,"value":15058,"nodeType":864},{},[],"The content lives on chatgpt.com or claude.ai — domains that users and security tools trust implicitly — so the attack bypasses URL reputation checks before the victim even reaches the malicious payload.",{"data":15060,"content":15061,"nodeType":860},{},[15062,15066,15074,15078,15086],{"data":15063,"marks":15064,"value":15065,"nodeType":864},{},[],"Several variants of this technique have been ",{"data":15067,"content":15069,"nodeType":883},{"uri":15068},"https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/",[15070],{"data":15071,"marks":15072,"value":15073,"nodeType":864},{},[],"reported over the past few months",{"data":15075,"marks":15076,"value":15077,"nodeType":864},{},[],". The earliest examples used shared Claude.ai conversations disguised as installation guides — complete with fake \"Apple Support\" attribution — that walked users through opening a terminal and pasting a curl command that downloaded and executed an infostealer. ",{"data":15079,"content":15081,"nodeType":883},{"uri":15080},"https://www.kaspersky.com/blog/share-chatgpt-chat-clickfix-macos-amos-infostealer/54928/",[15082],{"data":15083,"marks":15084,"value":15085,"nodeType":864},{},[],"Kaspersky documented a parallel campaign",{"data":15087,"marks":15088,"value":15089,"nodeType":864},{},[]," using shared ChatGPT conversations to deliver the AMOS (Atomic macOS Stealer) via the same paste-this-command social engineering pattern. ",{"data":15091,"content":15092,"nodeType":860},{},[15093],{"data":15094,"marks":15095,"value":15096,"nodeType":864},{},[],"Push has detected a new variant that goes beyond the previously reported technique of embedding terminal commands in shared conversations: the attacker has used ChatGPT's code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT's download page that delivers a malicious executable. ",{"data":15098,"content":15102,"nodeType":996},{"target":15099},{"sys":15100},{"id":15101,"type":1001,"linkType":1002},"5lz9zt223pecGvdaqdvSTQ",[],{"data":15104,"content":15108,"nodeType":996},{"target":15105},{"sys":15106},{"id":15107,"type":1001,"linkType":1002},"51GomAj3VOjnbmgd1DWYu0",[],{"data":15110,"content":15111,"nodeType":860},{},[15112,15117],{"data":15113,"marks":15114,"value":15116,"nodeType":864},{},[15115],{"type":899},"This is a live campaign which is still generating detections across our customer base at the time of writing. ",{"data":15118,"marks":15119,"value":15120,"nodeType":864},{},[],"Push customers are already protected and do not need to take further action. The malicious page URLs can be found at the end of this report but are not exhaustive and are liable to change. ",{"data":15122,"content":15123,"nodeType":1005},{},[],{"data":15125,"content":15126,"nodeType":1009},{},[15127],{"data":15128,"marks":15129,"value":15131,"nodeType":864},{},[15130],{"type":899},"A fake page, not a fake conversation",{"data":15133,"content":15134,"nodeType":860},{},[15135,15139,15144],{"data":15136,"marks":15137,"value":15138,"nodeType":864},{},[],"Previously reported variants relied on shared ",{"data":15140,"marks":15141,"value":15143,"nodeType":864},{},[15142],{"type":2246},"conversations",{"data":15145,"marks":15146,"value":15147,"nodeType":864},{},[]," — the attacker created a chat that contained step-by-step instructions for the victim to follow, typically involving pasting a command into their terminal. The social engineering was conversational: the \"AI assistant\" appeared to be helpfully guiding the user through an installation process.",{"data":15149,"content":15150,"nodeType":860},{},[15151],{"data":15152,"marks":15153,"value":15154,"nodeType":864},{},[],"But now, rather than a shared conversation, the attacker has used ChatGPT's code rendering feature to create a fully designed, self-contained web page hosted at a chatgpt.com/s/ URL. It renders as what appears to be a ChatGPT service disruption notice:",{"data":15156,"content":15160,"nodeType":996},{"target":15157},{"sys":15158},{"id":15159,"type":1001,"linkType":1002},"1O9gyQab81SnbxhQp2aa5Z",[],{"data":15162,"content":15163,"nodeType":860},{},[15164],{"data":15165,"marks":15166,"value":15167,"nodeType":864},{},[],"A professional-looking error message reads: \"We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue.\" A prominent download button sits below.",{"data":15169,"content":15170,"nodeType":860},{},[15171],{"data":15172,"marks":15173,"value":15174,"nodeType":864},{},[],"The \"Show code\" toggle at the top of the page reveals what's actually happening — the entire thing is custom HTML and CSS, authored to mimic a ChatGPT system notice, rendered using ChatGPT's code output feature. A web page inside a web page, hosted on a domain that every URL reputation system in the world considers safe.",{"data":15176,"content":15180,"nodeType":996},{"target":15177},{"sys":15178},{"id":15179,"type":1001,"linkType":1002},"4kQTfxB3aVH9W9BeYOuljP",[],{"data":15182,"content":15183,"nodeType":1005},{},[],{"data":15185,"content":15186,"nodeType":1009},{},[15187],{"data":15188,"marks":15189,"value":15191,"nodeType":864},{},[15190],{"type":899},"The download page",{"data":15193,"content":15194,"nodeType":860},{},[15195],{"data":15196,"marks":15197,"value":15198,"nodeType":864},{},[],"Clicking the download button redirects the user to openew[.]app, which presents a convincing clone of ChatGPT's official desktop application download page — complete with OpenAI branding, macOS and Windows download buttons, a Chrome extension link, and a mobile download section.",{"data":15200,"content":15204,"nodeType":996},{"target":15201},{"sys":15202},{"id":15203,"type":1001,"linkType":1002},"4MdFc4OB37ZihTGx506QJ6",[],{"data":15206,"content":15210,"nodeType":996},{"target":15207},{"sys":15208},{"id":15209,"type":1001,"linkType":1002},"LaPUy0zpIeY8s4PF2wkat",[],{"data":15212,"content":15213,"nodeType":860},{},[15214],{"data":15215,"marks":15216,"value":15217,"nodeType":864},{},[],"The site also displays differently depending on who visits it. When Push researchers examined the URL via URLScan, the scanner was redirected to a different page entirely — a generic AR/VR company website with no obvious connection to ChatGPT. ",{"data":15219,"content":15220,"nodeType":860},{},[15221],{"data":15222,"marks":15223,"value":15224,"nodeType":864},{},[],"Real users in a browser see the fake download page; automated scanners and bots see something benign. This kind of conditional rendering is a well-established evasion technique in the malvertising ecosystem, and it makes the malicious infrastructure harder for security teams and threat intelligence services to identify and analyze.",{"data":15226,"content":15227,"nodeType":860},{},[15228,15232,15240],{"data":15229,"marks":15230,"value":15231,"nodeType":864},{},[],"The downloaded executable poses as \"ChatGPT for Desktop\" and is ",{"data":15233,"content":15235,"nodeType":883},{"uri":15234},"https://www.virustotal.com/gui/file/de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",[15236],{"data":15237,"marks":15238,"value":15239,"nodeType":864},{},[],"flagged on VirusTotal",{"data":15241,"marks":15242,"value":2924,"nodeType":864},{},[],{"data":15244,"content":15248,"nodeType":996},{"target":15245},{"sys":15246},{"id":15247,"type":1001,"linkType":1002},"3FSbwoFJYQrcyo9uMsQIWI",[],{"data":15250,"content":15251,"nodeType":1005},{},[],{"data":15253,"content":15254,"nodeType":1009},{},[15255],{"data":15256,"marks":15257,"value":15259,"nodeType":864},{},[15258],{"type":899},"The Claude variant: same campaign, different platform",{"data":15261,"content":15262,"nodeType":860},{},[15263,15267,15274],{"data":15264,"marks":15265,"value":15266,"nodeType":864},{},[],"Alongside the ChatGPT rendered-page variant, Push has also detected the previously reported style of attack using shared Claude.ai conversations. These follow the pattern documented by ",{"data":15268,"content":15269,"nodeType":883},{"uri":15068},[15270],{"data":15271,"marks":15272,"value":15273,"nodeType":864},{},[],"BleepingComputer",{"data":15275,"marks":15276,"value":15277,"nodeType":864},{},[],": a shared chat disguised as a \"Claude Code on Mac\" installation guide, attributed to \"Apple Support,\" containing a curl command that downloads and executes malware.",{"data":15279,"content":15283,"nodeType":996},{"target":15280},{"sys":15281},{"id":15282,"type":1001,"linkType":1002},"5sWayuTsVdiLSLoS4sv2Vc",[],{"data":15285,"content":15286,"nodeType":860},{},[15287],{"data":15288,"marks":15289,"value":15290,"nodeType":864},{},[],"The fact that both the ChatGPT and Claude variants are appearing in Push customer environments suggests a campaign — or at least a shared playbook — that is actively experimenting with different platforms and different social engineering approaches to find what converts best.",{"data":15292,"content":15293,"nodeType":1005},{},[],{"data":15295,"content":15296,"nodeType":1009},{},[15297],{"data":15298,"marks":15299,"value":15301,"nodeType":864},{},[15300],{"type":899},"Malvertising remains one of the top phishing delivery channels",{"data":15303,"content":15304,"nodeType":860},{},[15305],{"data":15306,"marks":15307,"value":15308,"nodeType":864},{},[],"Push has detected this variant across multiple customer environments, with users arriving at these shared chat URLs after searching for terms including \"chatgpt,\" \"chatgpt free,\" \"chat gpt,\" and common typos like \"chatgo,\" \"chatgot,\" and \"cvhatgpt.\" ",{"data":15310,"content":15311,"nodeType":860},{},[15312],{"data":15313,"marks":15314,"value":15315,"nodeType":864},{},[],"You can see an example of this below: it's incredibly convincing, and uses the real ChatGPT domain — so even users that are paying attention are liable to fall for it. ",{"data":15317,"content":15321,"nodeType":996},{"target":15318},{"sys":15319},{"id":15320,"type":1001,"linkType":1002},"1GYWOyHpZT1rdTm6IGOKu8",[],{"data":15323,"content":15327,"nodeType":996},{"target":15324},{"sys":15325},{"id":15326,"type":1001,"linkType":1002},"4HpFJRAZH2lbygaEk2xOnN",[],{"data":15329,"content":15330,"nodeType":860},{},[15331,15335,15343,15347,15355,15358,15367],{"data":15332,"marks":15333,"value":15334,"nodeType":864},{},[],"This fits a pattern Push has tracked extensively. ",{"data":15336,"content":15338,"nodeType":883},{"uri":15337},"https://pushsecurity.com/blog/verizon-dbir-2026-review/",[15339],{"data":15340,"marks":15341,"value":15342,"nodeType":864},{},[],"Search-based delivery is now the dominant channel for malware distribution",{"data":15344,"marks":15345,"value":15346,"nodeType":864},{},[]," — our own data shows that ClickFix attacks are reached via search results rather than email in 4 of 5 cases, and Push's own research into ",{"data":15348,"content":15350,"nodeType":883},{"uri":15349},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack/",[15351],{"data":15352,"marks":15353,"value":15354,"nodeType":864},{},[],"malvertising campaigns impersonating brands like TradingView",{"data":15356,"marks":15357,"value":902,"nodeType":864},{},[],{"data":15359,"content":15361,"nodeType":883},{"uri":15360},"https://pushsecurity.com/blog/google-search-malvertising-campaign-continues-now-impersonating-ahrefs/",[15362],{"data":15363,"marks":15364,"value":15366,"nodeType":864},{},[15365],{"type":1455},"Ahrefs",{"data":15368,"marks":15369,"value":15370,"nodeType":864},{},[]," has demonstrated how effectively search ads can funnel victims to malicious pages. ",{"data":15372,"content":15373,"nodeType":860},{},[15374],{"data":15375,"marks":15376,"value":15377,"nodeType":864},{},[],"The shared-chat technique adds a new dimension: the destination URL itself is genuine (chatgpt.com, claude.ai), which means even a cautious user who checks the URL before clicking will see nothing suspicious.",{"data":15379,"content":15380,"nodeType":1005},{},[],{"data":15382,"content":15383,"nodeType":1009},{},[15384],{"data":15385,"marks":15386,"value":15388,"nodeType":864},{},[15387],{"type":899},"Legitimate platform abuse is everywhere",{"data":15390,"content":15391,"nodeType":860},{},[15392],{"data":15393,"marks":15394,"value":15395,"nodeType":864},{},[],"This is one example of a much broader pattern that has become one of the defining characteristics of the 2026 threat landscape: attackers systematically abusing legitimate platforms as attack infrastructure. The scale and variety of this abuse in recent months alone is striking, and it spans every stage of the phishing chain.",{"data":15397,"content":15398,"nodeType":1312},{},[15399],{"data":15400,"marks":15401,"value":15402,"nodeType":864},{},[],"Legit platform abuse for delivery",{"data":15404,"content":15405,"nodeType":860},{},[15406,15410,15418,15422,15430,15434,15442],{"data":15407,"marks":15408,"value":15409,"nodeType":864},{},[],"On the delivery side, attackers have been ",{"data":15411,"content":15413,"nodeType":883},{"uri":15412},"https://www.bleepingcomputer.com/news/security/amazon-ses-increasingly-abused-in-phishing-to-evade-detection/",[15414],{"data":15415,"marks":15416,"value":15417,"nodeType":864},{},[],"weaponizing stolen AWS credentials to send phishing through Amazon SES",{"data":15419,"marks":15420,"value":15421,"nodeType":864},{},[]," that passes SPF, DKIM, and DMARC validation because SES is a legitimate Amazon service. A Vietnamese operation dubbed ",{"data":15423,"content":15425,"nodeType":883},{"uri":15424},"https://thehackernews.com/2026/05/30000-facebook-accounts-hacked-via.html",[15426],{"data":15427,"marks":15428,"value":15429,"nodeType":864},{},[],"AccountDumpling used Google AppSheet's built-in email capability",{"data":15431,"marks":15432,"value":15433,"nodeType":864},{},[]," as a phishing relay to harvest 30,000 Facebook credentials. ",{"data":15435,"content":15437,"nodeType":883},{"uri":15436},"https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/",[15438],{"data":15439,"marks":15440,"value":15441,"nodeType":864},{},[],"Scammers exploited Microsoft's own internal notification pipeline",{"data":15443,"marks":15444,"value":15445,"nodeType":864},{},[]," — sending phishing from the same msonlineservicesteam@microsoftonline.com address that delivers legitimate 2FA codes — with Spamhaus confirming months of ongoing abuse.",{"data":15447,"content":15448,"nodeType":1312},{},[15449],{"data":15450,"marks":15451,"value":15452,"nodeType":864},{},[],"Legit platform abuse for hosting",{"data":15454,"content":15455,"nodeType":860},{},[15456,15460,15468,15472,15480],{"data":15457,"marks":15458,"value":15459,"nodeType":864},{},[],"For hosting, the platforms being abused read like a who's who of modern web infrastructure. ",{"data":15461,"content":15463,"nodeType":883},{"uri":15462},"https://www.securityweek.com/over-500-organizations-hit-in-years-long-phishing-campaign/",[15464],{"data":15465,"marks":15466,"value":15467,"nodeType":864},{},[],"Operation HookedWing ran for four years",{"data":15469,"marks":15470,"value":15471,"nodeType":864},{},[]," on GitHub Pages and Vercel, compromising 500+ organizations across more than 100 GitHub Pages domains before anyone documented it publicly. Cofense has separately ",{"data":15473,"content":15475,"nodeType":883},{"uri":15474},"https://cofense.com/blog/steal-smarter-not-harder-malicious-use-of-vercel-for-credential-phishing/",[15476],{"data":15477,"marks":15478,"value":15479,"nodeType":864},{},[],"documented the growing abuse of Vercel",{"data":15481,"marks":15482,"value":15483,"nodeType":864},{},[]," for credential phishing hosting. Pixm's Q1 2026 phishing report tracked over 100 unique Azure Blob Storage subdomain variants hosting phishing content that carried Microsoft's own domain reputation, alongside abuse of Cloudflare CDN, Cloudflare Workers, Cloudflare R2, Backblaze B2, and Supabase. ",{"data":15485,"content":15486,"nodeType":1312},{},[15487],{"data":15488,"marks":15489,"value":15490,"nodeType":864},{},[],"Abuse of compromised websites that are otherwise legit",{"data":15492,"content":15493,"nodeType":860},{},[15494,15498,15506,15510,15518,15522,15530],{"data":15495,"marks":15496,"value":15497,"nodeType":864},{},[],"Compromised legitimate sites are also being repurposed at scale. A mass exploitation of a ",{"data":15499,"content":15501,"nodeType":883},{"uri":15500},"https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/",[15502],{"data":15503,"marks":15504,"value":15505,"nodeType":864},{},[],"Ghost CMS vulnerability planted ClickFix pages across 700+ websites",{"data":15507,"marks":15508,"value":15509,"nodeType":864},{},[]," including Harvard, Oxford, and DuckDuckGo subdomains. Microsoft recently documented a campaign where ",{"data":15511,"content":15513,"nodeType":883},{"uri":15512},"https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/",[15514],{"data":15515,"marks":15516,"value":15517,"nodeType":864},{},[],"SEO poisoning was combined with AI chatbot recommendation manipulation",{"data":15519,"marks":15520,"value":15521,"nodeType":864},{},[]," to deliver GPU mining malware — extending the poisoning from traditional search results into AI-generated software recommendations. And ",{"data":15523,"content":15525,"nodeType":883},{"uri":15524},"https://www.helpnetsecurity.com/2026/05/27/deno-rat-malware-fake-chatgpt-claude-installers/",[15526],{"data":15527,"marks":15528,"value":15529,"nodeType":864},{},[],"fake ChatGPT and Claude installers on GitHub and SourceForge",{"data":15531,"marks":15532,"value":15533,"nodeType":864},{},[]," have been delivering the DinDoor backdoor and a Deno-based RAT via repositories that mimic legitimate developer tool distributions.",{"data":15535,"content":15536,"nodeType":860},{},[15537],{"data":15538,"marks":15539,"value":15540,"nodeType":864},{},[],"The structural problem is that every one of these platforms is genuinely legitimate, and the security controls that evaluate them — domain reputation, email authentication, URL categorization — confirm them as trusted because they are trusted. This attack extends this pattern into new territory by weaponizing the content-sharing features of AI chatbot platforms specifically, but the underlying principles are the same. ",{"data":15542,"content":15543,"nodeType":1005},{},[],{"data":15545,"content":15546,"nodeType":1009},{},[15547],{"data":15548,"marks":15549,"value":15551,"nodeType":864},{},[15550],{"type":899},"Impact analysis",{"data":15553,"content":15554,"nodeType":860},{},[15555,15559,15567],{"data":15556,"marks":15557,"value":15558,"nodeType":864},{},[],"Shared-chat malware delivery exploits a structural property of AI platforms that traditional security controls aren't designed to handle. Domain reputation, URL categorization, and safe browsing databases all treat chatgpt.com and claude.ai as trusted — because they are. Using these trusted pages to link off to further convincing-looking pages hosting malware allows the attacker to run campaigns that blend in, as well as rotate the phishing delivery pages later in the chain should they ever be flagged, allowing the campaign to continue without interruption (a well known ",{"data":15560,"content":15562,"nodeType":883},{"uri":15561},"https://phishing-techniques.pushsecurity.com/",[15563],{"data":15564,"marks":15565,"value":15566,"nodeType":864},{},[],"detection evasion technique",{"data":15568,"marks":15569,"value":15570,"nodeType":864},{},[],"). ",{"data":15572,"content":15573,"nodeType":860},{},[15574],{"data":15575,"marks":15576,"value":15577,"nodeType":864},{},[],"What makes the rendered-page variant particularly concerning is that it eliminates the most obvious red flag in the earlier attacks. The Claude.ai conversation variants required the victim to recognize that a shared chat instructing them to paste terminal commands might be suspicious — a tall order for many users, but at least the attack surface was visible. The rendered-page variant shows nothing that looks like an attack. It presents what appears to be a routine service disruption with a reasonable call to action: download the desktop app to continue using ChatGPT. ",{"data":15579,"content":15580,"nodeType":1312},{},[15581],{"data":15582,"marks":15583,"value":15585,"nodeType":864},{},[15584],{"type":899},"How Push detected the attack",{"data":15587,"content":15588,"nodeType":860},{},[15589,15593,15597],{"data":15590,"marks":15591,"value":15592,"nodeType":864},{},[],"We've aligned our detection logic for this technique under the name ",{"data":15594,"marks":15595,"value":1555,"nodeType":864},{},[15596],{"type":899},{"data":15598,"marks":15599,"value":15600,"nodeType":864},{},[]," — a technique-level detection that covers shared content abuse across LLM platforms, not tied to any single campaign or set of IOCs. ",{"data":15602,"content":15603,"nodeType":860},{},[15604],{"data":15605,"marks":15606,"value":15607,"nodeType":864},{},[],"Because Push sees the full context of how a user arrived at a page and what that page does once it renders, we can identify LLMShare attacks regardless of which AI platform is being abused or what social engineering wrapper the attacker has chosen. ",{"data":15609,"content":15610,"nodeType":860},{},[15611,15615,15621],{"data":15612,"marks":15613,"value":15614,"nodeType":864},{},[],"When we identified the initial instances of this campaign, we used our ",{"data":15616,"content":15617,"nodeType":883},{"uri":8827},[15618],{"data":15619,"marks":15620,"value":14927,"nodeType":864},{},[],{"data":15622,"marks":15623,"value":15624,"nodeType":864},{},[]," to hunt for additional examples across our customer telemetry, develop the LLMShare detection, and rapidly deploy it to customers. Push blocks users from interacting with the page before any malicious activity can occur. ",{"data":15626,"content":15627,"nodeType":860},{},[15628],{"data":15629,"marks":15630,"value":15631,"nodeType":864},{},[],"Push customers do not need to take any further action.",{"data":15633,"content":15634,"nodeType":1005},{},[],{"data":15636,"content":15637,"nodeType":860},{},[15638],{"data":15639,"marks":15640,"value":1682,"nodeType":864},{},[],{"data":15642,"content":15643,"nodeType":860},{},[15644],{"data":15645,"marks":15646,"value":1689,"nodeType":864},{},[],{"data":15648,"content":15649,"nodeType":860},{},[15650,15653,15661],{"data":15651,"marks":15652,"value":21,"nodeType":864},{},[],{"data":15654,"content":15656,"nodeType":883},{"uri":15655},"https://pushsecurity.com/demo/",[15657],{"data":15658,"marks":15659,"value":1703,"nodeType":864},{},[15660],{"type":1455},{"data":15662,"marks":15663,"value":21,"nodeType":864},{},[],{"data":15665,"content":15666,"nodeType":1005},{},[],{"data":15668,"content":15669,"nodeType":1009},{},[15670],{"data":15671,"marks":15672,"value":15674,"nodeType":864},{},[15673],{"type":899},"Indicators of compromise",{"data":15676,"content":15677,"nodeType":860},{},[15678,15682,15690],{"data":15679,"marks":15680,"value":15681,"nodeType":864},{},[],"As we always say, short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":15683,"content":15685,"nodeType":883},{"uri":15684},"https://phishing-techniques.pushsecurity.com/techniques/domain-rotation-redirection/",[15686],{"data":15687,"marks":15688,"value":15689,"nodeType":864},{},[],"quickly spin up and rotate the sites used",{"data":15691,"marks":15692,"value":15693,"nodeType":864},{},[]," in the attack chain. IoC-based detections for campaigns like this are of limited value.",{"data":15695,"content":15696,"nodeType":860},{},[15697],{"data":15698,"marks":15699,"value":15700,"nodeType":864},{},[],"At the time of writing, the indicators observed were:",{"data":15702,"content":15703,"nodeType":4845},{},[15704,15730,15753,15775,15798],{"data":15705,"content":15706,"nodeType":4581},{},[15707,15719],{"data":15708,"content":15709,"nodeType":15718},{},[15710],{"data":15711,"content":15712,"nodeType":860},{},[15713],{"data":15714,"marks":15715,"value":15717,"nodeType":864},{},[15716],{"type":899},"Indicator","table-header-cell",{"data":15720,"content":15721,"nodeType":15718},{},[15722],{"data":15723,"content":15724,"nodeType":860},{},[15725],{"data":15726,"marks":15727,"value":15729,"nodeType":864},{},[15728],{"type":899},"Type",{"data":15731,"content":15732,"nodeType":4581},{},[15733,15743],{"data":15734,"content":15735,"nodeType":4569},{},[15736],{"data":15737,"content":15738,"nodeType":860},{},[15739],{"data":15740,"marks":15741,"value":15742,"nodeType":864},{},[],"hxxps://claude[.]ai/share/8e6401b5-4849-46c4-a3cb-29e1c3c49131",{"data":15744,"content":15745,"nodeType":4569},{},[15746],{"data":15747,"content":15748,"nodeType":860},{},[15749],{"data":15750,"marks":15751,"value":15752,"nodeType":864},{},[],"URL",{"data":15754,"content":15755,"nodeType":4581},{},[15756,15766],{"data":15757,"content":15758,"nodeType":4569},{},[15759],{"data":15760,"content":15761,"nodeType":860},{},[15762],{"data":15763,"marks":15764,"value":15765,"nodeType":864},{},[],"hxxps://chatgpt[.]com/s/cb_6a0f1e6bbec88191aa7fede27163f08d",{"data":15767,"content":15768,"nodeType":4569},{},[15769],{"data":15770,"content":15771,"nodeType":860},{},[15772],{"data":15773,"marks":15774,"value":15752,"nodeType":864},{},[],{"data":15776,"content":15777,"nodeType":4581},{},[15778,15788],{"data":15779,"content":15780,"nodeType":4569},{},[15781],{"data":15782,"content":15783,"nodeType":860},{},[15784],{"data":15785,"marks":15786,"value":15787,"nodeType":864},{},[],"openew[.]app",{"data":15789,"content":15790,"nodeType":4569},{},[15791],{"data":15792,"content":15793,"nodeType":860},{},[15794],{"data":15795,"marks":15796,"value":15797,"nodeType":864},{},[],"Domain",{"data":15799,"content":15800,"nodeType":4581},{},[15801,15811],{"data":15802,"content":15803,"nodeType":4569},{},[15804],{"data":15805,"content":15806,"nodeType":860},{},[15807],{"data":15808,"marks":15809,"value":15810,"nodeType":864},{},[],"de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",{"data":15812,"content":15813,"nodeType":4569},{},[15814],{"data":15815,"content":15816,"nodeType":860},{},[15817],{"data":15818,"marks":15819,"value":15820,"nodeType":864},{},[],"SHA256",{"data":15822,"content":15823,"nodeType":860},{},[15824],{"data":15825,"marks":15826,"value":21,"nodeType":864},{},[],"LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms","How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.","llmshare-malvertising-campaign",{"items":15831},[15832,15834],{"sys":15833,"name":15033},{"id":15032},{"sys":15835,"name":342},{"id":15029},{"items":15837},[15838],{"fullName":15839,"firstName":15840,"jobTitle":15841,"profilePicture":15842},"Keanu Maharaj","Keanu","Senior Security Researcher",{"url":15843},"https://images.ctfassets.net/y1cdw1ablpvd/VCGOm62jiocjwngWTh32U/e9a30637b1c76bf988d2fec90f5b6c36/1689361049351_1.png",{"__typename":2059,"sys":15845,"content":15846,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":16407,"authorsCollection":16413},{"id":2061},{"json":15847},{"data":15848,"content":15849,"nodeType":856},{},[15850,15856,15862,15868,15873,15876,15883,15889,15918,15924,15948,15953,15956,15963,15969,15976,16010,16015,16021,16026,16029,16036,16042,16049,16055,16061,16074,16081,16101,16107,16112,16118,16125,16138,16160,16165,16180,16185,16192,16198,16218,16224,16230,16236,16241,16244,16251,16257,16263,16278,16285,16291,16298,16317,16327,16332,16335,16342,16348,16354,16360,16376,16379,16385,16391],{"data":15851,"content":15852,"nodeType":860},{},[15853],{"data":15854,"marks":15855,"value":2072,"nodeType":864},{},[],{"data":15857,"content":15858,"nodeType":860},{},[15859],{"data":15860,"marks":15861,"value":2079,"nodeType":864},{},[],{"data":15863,"content":15864,"nodeType":860},{},[15865],{"data":15866,"marks":15867,"value":2086,"nodeType":864},{},[],{"data":15869,"content":15872,"nodeType":996},{"target":15870},{"sys":15871},{"id":2091,"type":1001,"linkType":1002},[],{"data":15874,"content":15875,"nodeType":1005},{},[],{"data":15877,"content":15878,"nodeType":1009},{},[15879],{"data":15880,"marks":15881,"value":2103,"nodeType":864},{},[15882],{"type":899},{"data":15884,"content":15885,"nodeType":860},{},[15886],{"data":15887,"marks":15888,"value":2110,"nodeType":864},{},[],{"data":15890,"content":15891,"nodeType":941},{},[15892,15905],{"data":15893,"content":15894,"nodeType":945},{},[15895],{"data":15896,"content":15897,"nodeType":860},{},[15898,15902],{"data":15899,"marks":15900,"value":2124,"nodeType":864},{},[15901],{"type":899},{"data":15903,"marks":15904,"value":2128,"nodeType":864},{},[],{"data":15906,"content":15907,"nodeType":945},{},[15908],{"data":15909,"content":15910,"nodeType":860},{},[15911,15915],{"data":15912,"marks":15913,"value":2139,"nodeType":864},{},[15914],{"type":899},{"data":15916,"marks":15917,"value":2143,"nodeType":864},{},[],{"data":15919,"content":15920,"nodeType":860},{},[15921],{"data":15922,"marks":15923,"value":2150,"nodeType":864},{},[],{"data":15925,"content":15926,"nodeType":860},{},[15927,15930,15936,15939,15945],{"data":15928,"marks":15929,"value":2157,"nodeType":864},{},[],{"data":15931,"content":15932,"nodeType":883},{"uri":1543},[15933],{"data":15934,"marks":15935,"value":1758,"nodeType":864},{},[],{"data":15937,"marks":15938,"value":1762,"nodeType":864},{},[],{"data":15940,"content":15941,"nodeType":883},{"uri":1765},[15942],{"data":15943,"marks":15944,"value":1770,"nodeType":864},{},[],{"data":15946,"marks":15947,"value":1774,"nodeType":864},{},[],{"data":15949,"content":15952,"nodeType":996},{"target":15950},{"sys":15951},{"id":2180,"type":1001,"linkType":1002},[],{"data":15954,"content":15955,"nodeType":1005},{},[],{"data":15957,"content":15958,"nodeType":1009},{},[15959],{"data":15960,"marks":15961,"value":2192,"nodeType":864},{},[15962],{"type":899},{"data":15964,"content":15965,"nodeType":860},{},[15966],{"data":15967,"marks":15968,"value":2199,"nodeType":864},{},[],{"data":15970,"content":15971,"nodeType":860},{},[15972],{"data":15973,"marks":15974,"value":2207,"nodeType":864},{},[15975],{"type":899},{"data":15977,"content":15978,"nodeType":860},{},[15979,15982,15986,15989,15993,15996,16000,16003,16007],{"data":15980,"marks":15981,"value":2214,"nodeType":864},{},[],{"data":15983,"marks":15984,"value":2219,"nodeType":864},{},[15985],{"type":899},{"data":15987,"marks":15988,"value":2223,"nodeType":864},{},[],{"data":15990,"marks":15991,"value":2228,"nodeType":864},{},[15992],{"type":899},{"data":15994,"marks":15995,"value":2232,"nodeType":864},{},[],{"data":15997,"marks":15998,"value":2237,"nodeType":864},{},[15999],{"type":899},{"data":16001,"marks":16002,"value":2241,"nodeType":864},{},[],{"data":16004,"marks":16005,"value":2247,"nodeType":864},{},[16006],{"type":2246},{"data":16008,"marks":16009,"value":2251,"nodeType":864},{},[],{"data":16011,"content":16014,"nodeType":996},{"target":16012},{"sys":16013},{"id":2256,"type":1001,"linkType":1002},[],{"data":16016,"content":16017,"nodeType":860},{},[16018],{"data":16019,"marks":16020,"value":2264,"nodeType":864},{},[],{"data":16022,"content":16025,"nodeType":996},{"target":16023},{"sys":16024},{"id":1040,"type":1001,"linkType":1002},[],{"data":16027,"content":16028,"nodeType":1005},{},[],{"data":16030,"content":16031,"nodeType":1009},{},[16032],{"data":16033,"marks":16034,"value":2280,"nodeType":864},{},[16035],{"type":899},{"data":16037,"content":16038,"nodeType":860},{},[16039],{"data":16040,"marks":16041,"value":2287,"nodeType":864},{},[],{"data":16043,"content":16044,"nodeType":1312},{},[16045],{"data":16046,"marks":16047,"value":2295,"nodeType":864},{},[16048],{"type":899},{"data":16050,"content":16051,"nodeType":860},{},[16052],{"data":16053,"marks":16054,"value":2302,"nodeType":864},{},[],{"data":16056,"content":16057,"nodeType":860},{},[16058],{"data":16059,"marks":16060,"value":2309,"nodeType":864},{},[],{"data":16062,"content":16063,"nodeType":860},{},[16064,16067,16071],{"data":16065,"marks":16066,"value":2316,"nodeType":864},{},[],{"data":16068,"marks":16069,"value":2321,"nodeType":864},{},[16070],{"type":899},{"data":16072,"marks":16073,"value":2325,"nodeType":864},{},[],{"data":16075,"content":16076,"nodeType":1312},{},[16077],{"data":16078,"marks":16079,"value":2333,"nodeType":864},{},[16080],{"type":899},{"data":16082,"content":16083,"nodeType":860},{},[16084,16087,16091,16094,16098],{"data":16085,"marks":16086,"value":2340,"nodeType":864},{},[],{"data":16088,"marks":16089,"value":2345,"nodeType":864},{},[16090],{"type":899},{"data":16092,"marks":16093,"value":2349,"nodeType":864},{},[],{"data":16095,"marks":16096,"value":2354,"nodeType":864},{},[16097],{"type":899},{"data":16099,"marks":16100,"value":2358,"nodeType":864},{},[],{"data":16102,"content":16103,"nodeType":860},{},[16104],{"data":16105,"marks":16106,"value":2365,"nodeType":864},{},[],{"data":16108,"content":16111,"nodeType":996},{"target":16109},{"sys":16110},{"id":2370,"type":1001,"linkType":1002},[],{"data":16113,"content":16114,"nodeType":860},{},[16115],{"data":16116,"marks":16117,"value":2378,"nodeType":864},{},[],{"data":16119,"content":16120,"nodeType":1312},{},[16121],{"data":16122,"marks":16123,"value":2386,"nodeType":864},{},[16124],{"type":899},{"data":16126,"content":16127,"nodeType":860},{},[16128,16131,16135],{"data":16129,"marks":16130,"value":2393,"nodeType":864},{},[],{"data":16132,"marks":16133,"value":2228,"nodeType":864},{},[16134],{"type":899},{"data":16136,"marks":16137,"value":2401,"nodeType":864},{},[],{"data":16139,"content":16140,"nodeType":860},{},[16141,16144,16150,16153,16157],{"data":16142,"marks":16143,"value":2408,"nodeType":864},{},[],{"data":16145,"content":16146,"nodeType":883},{"uri":2411},[16147],{"data":16148,"marks":16149,"value":2416,"nodeType":864},{},[],{"data":16151,"marks":16152,"value":2420,"nodeType":864},{},[],{"data":16154,"marks":16155,"value":2425,"nodeType":864},{},[16156],{"type":899},{"data":16158,"marks":16159,"value":2429,"nodeType":864},{},[],{"data":16161,"content":16164,"nodeType":996},{"target":16162},{"sys":16163},{"id":2434,"type":1001,"linkType":1002},[],{"data":16166,"content":16167,"nodeType":860},{},[16168,16171,16177],{"data":16169,"marks":16170,"value":2442,"nodeType":864},{},[],{"data":16172,"content":16173,"nodeType":883},{"uri":2411},[16174],{"data":16175,"marks":16176,"value":2449,"nodeType":864},{},[],{"data":16178,"marks":16179,"value":2453,"nodeType":864},{},[],{"data":16181,"content":16184,"nodeType":996},{"target":16182},{"sys":16183},{"id":2458,"type":1001,"linkType":1002},[],{"data":16186,"content":16187,"nodeType":1312},{},[16188],{"data":16189,"marks":16190,"value":2467,"nodeType":864},{},[16191],{"type":899},{"data":16193,"content":16194,"nodeType":860},{},[16195],{"data":16196,"marks":16197,"value":2474,"nodeType":864},{},[],{"data":16199,"content":16200,"nodeType":860},{},[16201,16204,16208,16211,16215],{"data":16202,"marks":16203,"value":2481,"nodeType":864},{},[],{"data":16205,"marks":16206,"value":2486,"nodeType":864},{},[16207],{"type":899},{"data":16209,"marks":16210,"value":2490,"nodeType":864},{},[],{"data":16212,"marks":16213,"value":2495,"nodeType":864},{},[16214],{"type":2246},{"data":16216,"marks":16217,"value":2499,"nodeType":864},{},[],{"data":16219,"content":16220,"nodeType":860},{},[16221],{"data":16222,"marks":16223,"value":2506,"nodeType":864},{},[],{"data":16225,"content":16226,"nodeType":860},{},[16227],{"data":16228,"marks":16229,"value":2513,"nodeType":864},{},[],{"data":16231,"content":16232,"nodeType":860},{},[16233],{"data":16234,"marks":16235,"value":2520,"nodeType":864},{},[],{"data":16237,"content":16240,"nodeType":996},{"target":16238},{"sys":16239},{"id":2525,"type":1001,"linkType":1002},[],{"data":16242,"content":16243,"nodeType":1005},{},[],{"data":16245,"content":16246,"nodeType":1009},{},[16247],{"data":16248,"marks":16249,"value":2537,"nodeType":864},{},[16250],{"type":899},{"data":16252,"content":16253,"nodeType":860},{},[16254],{"data":16255,"marks":16256,"value":2544,"nodeType":864},{},[],{"data":16258,"content":16259,"nodeType":860},{},[16260],{"data":16261,"marks":16262,"value":2551,"nodeType":864},{},[],{"data":16264,"content":16265,"nodeType":860},{},[16266,16269,16275],{"data":16267,"marks":16268,"value":2558,"nodeType":864},{},[],{"data":16270,"content":16271,"nodeType":883},{"uri":2561},[16272],{"data":16273,"marks":16274,"value":2566,"nodeType":864},{},[],{"data":16276,"marks":16277,"value":2570,"nodeType":864},{},[],{"data":16279,"content":16280,"nodeType":1312},{},[16281],{"data":16282,"marks":16283,"value":2578,"nodeType":864},{},[16284],{"type":899},{"data":16286,"content":16287,"nodeType":860},{},[16288],{"data":16289,"marks":16290,"value":2585,"nodeType":864},{},[],{"data":16292,"content":16293,"nodeType":860},{},[16294],{"data":16295,"marks":16296,"value":2593,"nodeType":864},{},[16297],{"type":899},{"data":16299,"content":16300,"nodeType":860},{},[16301,16305,16308,16314],{"data":16302,"marks":16303,"value":2601,"nodeType":864},{},[16304],{"type":899},{"data":16306,"marks":16307,"value":2605,"nodeType":864},{},[],{"data":16309,"content":16310,"nodeType":883},{"uri":2411},[16311],{"data":16312,"marks":16313,"value":2612,"nodeType":864},{},[],{"data":16315,"marks":16316,"value":2616,"nodeType":864},{},[],{"data":16318,"content":16319,"nodeType":860},{},[16320,16324],{"data":16321,"marks":16322,"value":2624,"nodeType":864},{},[16323],{"type":899},{"data":16325,"marks":16326,"value":2628,"nodeType":864},{},[],{"data":16328,"content":16331,"nodeType":996},{"target":16329},{"sys":16330},{"id":2633,"type":1001,"linkType":1002},[],{"data":16333,"content":16334,"nodeType":1005},{},[],{"data":16336,"content":16337,"nodeType":1009},{},[16338],{"data":16339,"marks":16340,"value":2645,"nodeType":864},{},[16341],{"type":899},{"data":16343,"content":16344,"nodeType":860},{},[16345],{"data":16346,"marks":16347,"value":2652,"nodeType":864},{},[],{"data":16349,"content":16350,"nodeType":860},{},[16351],{"data":16352,"marks":16353,"value":2659,"nodeType":864},{},[],{"data":16355,"content":16356,"nodeType":860},{},[16357],{"data":16358,"marks":16359,"value":2666,"nodeType":864},{},[],{"data":16361,"content":16362,"nodeType":860},{},[16363,16366,16373],{"data":16364,"marks":16365,"value":2673,"nodeType":864},{},[],{"data":16367,"content":16368,"nodeType":883},{"uri":2676},[16369],{"data":16370,"marks":16371,"value":580,"nodeType":864},{},[16372],{"type":1455},{"data":16374,"marks":16375,"value":2685,"nodeType":864},{},[],{"data":16377,"content":16378,"nodeType":1005},{},[],{"data":16380,"content":16381,"nodeType":860},{},[16382],{"data":16383,"marks":16384,"value":1682,"nodeType":864},{},[],{"data":16386,"content":16387,"nodeType":860},{},[16388],{"data":16389,"marks":16390,"value":1689,"nodeType":864},{},[],{"data":16392,"content":16393,"nodeType":860},{},[16394,16397,16404],{"data":16395,"marks":16396,"value":2707,"nodeType":864},{},[],{"data":16398,"content":16399,"nodeType":883},{"uri":1700},[16400],{"data":16401,"marks":16402,"value":2715,"nodeType":864},{},[16403],{"type":1455},{"data":16405,"marks":16406,"value":2719,"nodeType":864},{},[],{"items":16408},[16409,16411],{"sys":16410,"name":2729},{"id":2728},{"sys":16412,"name":297},{"id":2732},{"items":16414},[16415],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":16416},{"url":2740},"blog/why-you-cant-control-ai-without-being-in-the-browser","AI visibility and control is a feature. Browser security is the foundation.",{"json":16420},{"data":16421,"content":16422,"nodeType":856},{},[16423],{"data":16424,"content":16425,"nodeType":860},{},[16426],{"data":16427,"marks":16428,"value":8946,"nodeType":864},{},[],{"id":8025,"publishedAt":16430},"2026-08-12T11:52:42.429Z",{"items":16432},[16433,16435],{"sys":16434,"name":297},{"id":2732},{"sys":16436,"name":2729},{"id":2728},{"items":16438},[16439,16441,16443,16445,16447,16449,16451,16453,16455,16457,16459,16461,16463,16465,16467,16469,16471,16473,16475],{"sys":16440,"name":235,"slug":236,"tier":31},{"id":232},{"sys":16442,"name":297,"slug":298,"tier":31},{"id":294},{"sys":16444,"name":279,"slug":280,"tier":31},{"id":276},{"sys":16446,"name":519,"slug":520,"tier":31},{"id":516},{"sys":16448,"name":545,"slug":546,"tier":31},{"id":542},{"sys":16450,"name":580,"slug":581,"tier":45},{"id":577},{"sys":16452,"name":252,"slug":253,"tier":45},{"id":249},{"sys":16454,"name":368,"slug":369,"tier":45},{"id":365},{"sys":16456,"name":484,"slug":485,"tier":45},{"id":481},{"sys":16458,"name":288,"slug":289,"tier":45},{"id":285},{"sys":16460,"name":315,"slug":316,"tier":45},{"id":312},{"sys":16462,"name":360,"slug":361,"tier":45},{"id":357},{"sys":16464,"name":261,"slug":262,"tier":45},{"id":258},{"sys":16466,"name":440,"slug":441,"tier":45},{"id":437},{"sys":16468,"name":475,"slug":476,"tier":45},{"id":472},{"sys":16470,"name":324,"slug":325,"tier":45},{"id":321},{"sys":16472,"name":633,"slug":634,"tier":45},{"id":630},{"sys":16474,"name":244,"slug":245,"tier":45},{"id":241},{"sys":16476,"name":607,"slug":608,"tier":45},{"id":604},"sEvs1NG13z8Guz6oaxJbRvlEv7Tcmf1seFlO6IQdBPM",{"id":16479,"title":5639,"authorsCollection":16480,"content":16484,"extension":228,"faqItemsCollection":16750,"faqTitle":59,"featured":6,"hashTags":59,"meta":16752,"metaTitle":16753,"ogImage":59,"postType":5356,"publishedDate":5641,"relatedBlogPostsCollection":16754,"slug":5642,"stem":17207,"subtitle":59,"summary":17208,"synopsis":5640,"sys":17219,"tagsCollection":17221,"topicsCollection":17225,"__hash__":17233},"blog/blog/product-release-may-2026.json",{"items":16481},[16482],{"fullName":4949,"firstName":4950,"jobTitle":4951,"socialLinks":59,"profilePicture":16483},{"url":4953},{"json":16485,"links":16732},{"data":16486,"content":16487,"nodeType":856},{},[16488,16494,16533,16539,16545,16551,16557,16596,16611,16617,16623,16629,16642,16648,16665,16671,16677,16692,16697,16714,16720,16726],{"data":16489,"content":16490,"nodeType":1009},{},[16491],{"data":16492,"marks":16493,"value":4964,"nodeType":864},{},[],{"data":16495,"content":16496,"nodeType":941},{},[16497,16506,16515,16524],{"data":16498,"content":16499,"nodeType":945},{},[16500],{"data":16501,"content":16502,"nodeType":860},{},[16503],{"data":16504,"marks":16505,"value":5385,"nodeType":864},{},[],{"data":16507,"content":16508,"nodeType":945},{},[16509],{"data":16510,"content":16511,"nodeType":860},{},[16512],{"data":16513,"marks":16514,"value":5120,"nodeType":864},{},[],{"data":16516,"content":16517,"nodeType":945},{},[16518],{"data":16519,"content":16520,"nodeType":860},{},[16521],{"data":16522,"marks":16523,"value":5404,"nodeType":864},{},[],{"data":16525,"content":16526,"nodeType":945},{},[16527],{"data":16528,"content":16529,"nodeType":860},{},[16530],{"data":16531,"marks":16532,"value":5414,"nodeType":864},{},[],{"data":16534,"content":16535,"nodeType":1009},{},[16536],{"data":16537,"marks":16538,"value":5421,"nodeType":864},{},[],{"data":16540,"content":16541,"nodeType":860},{},[16542],{"data":16543,"marks":16544,"value":5428,"nodeType":864},{},[],{"data":16546,"content":16547,"nodeType":860},{},[16548],{"data":16549,"marks":16550,"value":5435,"nodeType":864},{},[],{"data":16552,"content":16553,"nodeType":860},{},[16554],{"data":16555,"marks":16556,"value":5442,"nodeType":864},{},[],{"data":16558,"content":16559,"nodeType":941},{},[16560,16569,16578,16587],{"data":16561,"content":16562,"nodeType":945},{},[16563],{"data":16564,"content":16565,"nodeType":860},{},[16566],{"data":16567,"marks":16568,"value":5455,"nodeType":864},{},[],{"data":16570,"content":16571,"nodeType":945},{},[16572],{"data":16573,"content":16574,"nodeType":860},{},[16575],{"data":16576,"marks":16577,"value":5465,"nodeType":864},{},[],{"data":16579,"content":16580,"nodeType":945},{},[16581],{"data":16582,"content":16583,"nodeType":860},{},[16584],{"data":16585,"marks":16586,"value":5475,"nodeType":864},{},[],{"data":16588,"content":16589,"nodeType":945},{},[16590],{"data":16591,"content":16592,"nodeType":860},{},[16593],{"data":16594,"marks":16595,"value":5485,"nodeType":864},{},[],{"data":16597,"content":16598,"nodeType":860},{},[16599,16602,16608],{"data":16600,"marks":16601,"value":21,"nodeType":864},{},[],{"data":16603,"content":16604,"nodeType":883},{"uri":5494},[16605],{"data":16606,"marks":16607,"value":5063,"nodeType":864},{},[],{"data":16609,"marks":16610,"value":21,"nodeType":864},{},[],{"data":16612,"content":16613,"nodeType":1009},{},[16614],{"data":16615,"marks":16616,"value":5508,"nodeType":864},{},[],{"data":16618,"content":16619,"nodeType":860},{},[16620],{"data":16621,"marks":16622,"value":5515,"nodeType":864},{},[],{"data":16624,"content":16625,"nodeType":860},{},[16626],{"data":16627,"marks":16628,"value":5522,"nodeType":864},{},[],{"data":16630,"content":16631,"nodeType":860},{},[16632,16635,16639],{"data":16633,"marks":16634,"value":5529,"nodeType":864},{},[],{"data":16636,"marks":16637,"value":5534,"nodeType":864},{},[16638],{"type":899},{"data":16640,"marks":16641,"value":5538,"nodeType":864},{},[],{"data":16643,"content":16644,"nodeType":860},{},[16645],{"data":16646,"marks":16647,"value":5545,"nodeType":864},{},[],{"data":16649,"content":16650,"nodeType":860},{},[16651,16654,16662],{"data":16652,"marks":16653,"value":21,"nodeType":864},{},[],{"data":16655,"content":16658,"nodeType":5064},{"target":16656},{"sys":16657},{"id":5114,"type":1001,"linkType":1002},[16659],{"data":16660,"marks":16661,"value":5063,"nodeType":864},{},[],{"data":16663,"marks":16664,"value":21,"nodeType":864},{},[],{"data":16666,"content":16667,"nodeType":1009},{},[16668],{"data":16669,"marks":16670,"value":5404,"nodeType":864},{},[],{"data":16672,"content":16673,"nodeType":860},{},[16674],{"data":16675,"marks":16676,"value":5575,"nodeType":864},{},[],{"data":16678,"content":16679,"nodeType":860},{},[16680,16683,16689],{"data":16681,"marks":16682,"value":5582,"nodeType":864},{},[],{"data":16684,"content":16685,"nodeType":883},{"uri":5585},[16686],{"data":16687,"marks":16688,"value":5590,"nodeType":864},{},[],{"data":16690,"marks":16691,"value":2924,"nodeType":864},{},[],{"data":16693,"content":16696,"nodeType":996},{"target":16694},{"sys":16695},{"id":5598,"type":1001,"linkType":1002},[],{"data":16698,"content":16699,"nodeType":860},{},[16700,16703,16711],{"data":16701,"marks":16702,"value":21,"nodeType":864},{},[],{"data":16704,"content":16707,"nodeType":5064},{"target":16705},{"sys":16706},{"id":5610,"type":1001,"linkType":1002},[16708],{"data":16709,"marks":16710,"value":5063,"nodeType":864},{},[],{"data":16712,"marks":16713,"value":21,"nodeType":864},{},[],{"data":16715,"content":16716,"nodeType":1009},{},[16717],{"data":16718,"marks":16719,"value":5624,"nodeType":864},{},[],{"data":16721,"content":16722,"nodeType":860},{},[16723],{"data":16724,"marks":16725,"value":5631,"nodeType":864},{},[],{"data":16727,"content":16728,"nodeType":860},{},[16729],{"data":16730,"marks":16731,"value":5638,"nodeType":864},{},[],{"entries":16733},{"inline":16734,"hyperlink":16735,"block":16743},[],[16736,16738],{"sys":16737,"__typename":5291,"title":5297,"slug":5298,"articleId":5299},{"id":5114},{"sys":16739,"__typename":5291,"title":16740,"slug":16741,"articleId":16742},{"id":5610},"Can Push prevent password entry in username fields?","can-push-prevent-password-entry-in-username-fields",10151,[16744],{"sys":16745,"__typename":1724,"title":16746,"caption":59,"layoutMode":59,"file":16747},{"id":5598},"Password entry prevention tooltip - KB 10151",{"url":16748,"width":1736,"height":16749},"https://images.ctfassets.net/y1cdw1ablpvd/7m6BPXQ232ZUaRqwMpPptZ/c724034f56f6a46d39dc0f44a9fae1f4/password_entry_tooltip.png",1565,{"items":16751},[],{},"Push Security new product features for May 2026",{"items":16755},[16756],{"__typename":2059,"sys":16757,"content":16758,"title":6154,"synopsis":6155,"hashTags":59,"publishedDate":6156,"slug":6157,"tagsCollection":17199,"authorsCollection":17203},{"id":5655},{"json":16759},{"data":16760,"content":16761,"nodeType":856},{},[16762,16768,16825,16831,16837,16850,16863,16868,16885,16891,16904,16910,16915,16932,16938,16955,16982,16999,17005,17011,17024,17029,17046,17052,17058,17078,17098,17115,17121,17127,17193],{"data":16763,"content":16764,"nodeType":1009},{},[16765],{"data":16766,"marks":16767,"value":5666,"nodeType":864},{},[],{"data":16769,"content":16770,"nodeType":941},{},[16771,16780,16789,16798,16807,16816],{"data":16772,"content":16773,"nodeType":945},{},[16774],{"data":16775,"content":16776,"nodeType":860},{},[16777],{"data":16778,"marks":16779,"value":5679,"nodeType":864},{},[],{"data":16781,"content":16782,"nodeType":945},{},[16783],{"data":16784,"content":16785,"nodeType":860},{},[16786],{"data":16787,"marks":16788,"value":5689,"nodeType":864},{},[],{"data":16790,"content":16791,"nodeType":945},{},[16792],{"data":16793,"content":16794,"nodeType":860},{},[16795],{"data":16796,"marks":16797,"value":5699,"nodeType":864},{},[],{"data":16799,"content":16800,"nodeType":945},{},[16801],{"data":16802,"content":16803,"nodeType":860},{},[16804],{"data":16805,"marks":16806,"value":5709,"nodeType":864},{},[],{"data":16808,"content":16809,"nodeType":945},{},[16810],{"data":16811,"content":16812,"nodeType":860},{},[16813],{"data":16814,"marks":16815,"value":5719,"nodeType":864},{},[],{"data":16817,"content":16818,"nodeType":945},{},[16819],{"data":16820,"content":16821,"nodeType":860},{},[16822],{"data":16823,"marks":16824,"value":5729,"nodeType":864},{},[],{"data":16826,"content":16827,"nodeType":1009},{},[16828],{"data":16829,"marks":16830,"value":5736,"nodeType":864},{},[],{"data":16832,"content":16833,"nodeType":860},{},[16834],{"data":16835,"marks":16836,"value":5743,"nodeType":864},{},[],{"data":16838,"content":16839,"nodeType":860},{},[16840,16843,16847],{"data":16841,"marks":16842,"value":5750,"nodeType":864},{},[],{"data":16844,"marks":16845,"value":5755,"nodeType":864},{},[16846],{"type":899},{"data":16848,"marks":16849,"value":5759,"nodeType":864},{},[],{"data":16851,"content":16852,"nodeType":860},{},[16853,16856,16860],{"data":16854,"marks":16855,"value":5766,"nodeType":864},{},[],{"data":16857,"marks":16858,"value":5771,"nodeType":864},{},[16859],{"type":899},{"data":16861,"marks":16862,"value":5775,"nodeType":864},{},[],{"data":16864,"content":16867,"nodeType":996},{"target":16865},{"sys":16866},{"id":5780,"type":1001,"linkType":1002},[],{"data":16869,"content":16870,"nodeType":860},{},[16871,16874,16882],{"data":16872,"marks":16873,"value":21,"nodeType":864},{},[],{"data":16875,"content":16878,"nodeType":5064},{"target":16876},{"sys":16877},{"id":5792,"type":1001,"linkType":1002},[16879],{"data":16880,"marks":16881,"value":5063,"nodeType":864},{},[],{"data":16883,"marks":16884,"value":21,"nodeType":864},{},[],{"data":16886,"content":16887,"nodeType":1009},{},[16888],{"data":16889,"marks":16890,"value":5689,"nodeType":864},{},[],{"data":16892,"content":16893,"nodeType":860},{},[16894,16897,16901],{"data":16895,"marks":16896,"value":5812,"nodeType":864},{},[],{"data":16898,"marks":16899,"value":5817,"nodeType":864},{},[16900],{"type":899},{"data":16902,"marks":16903,"value":5027,"nodeType":864},{},[],{"data":16905,"content":16906,"nodeType":860},{},[16907],{"data":16908,"marks":16909,"value":5827,"nodeType":864},{},[],{"data":16911,"content":16914,"nodeType":996},{"target":16912},{"sys":16913},{"id":5832,"type":1001,"linkType":1002},[],{"data":16916,"content":16917,"nodeType":860},{},[16918,16921,16929],{"data":16919,"marks":16920,"value":21,"nodeType":864},{},[],{"data":16922,"content":16925,"nodeType":5064},{"target":16923},{"sys":16924},{"id":5844,"type":1001,"linkType":1002},[16926],{"data":16927,"marks":16928,"value":5063,"nodeType":864},{},[],{"data":16930,"marks":16931,"value":21,"nodeType":864},{},[],{"data":16933,"content":16934,"nodeType":1009},{},[16935],{"data":16936,"marks":16937,"value":5699,"nodeType":864},{},[],{"data":16939,"content":16940,"nodeType":860},{},[16941,16944,16952],{"data":16942,"marks":16943,"value":5864,"nodeType":864},{},[],{"data":16945,"content":16948,"nodeType":5064},{"target":16946},{"sys":16947},{"id":5869,"type":1001,"linkType":1002},[16949],{"data":16950,"marks":16951,"value":5874,"nodeType":864},{},[],{"data":16953,"marks":16954,"value":5878,"nodeType":864},{},[],{"data":16956,"content":16957,"nodeType":860},{},[16958,16961,16965,16968,16972,16975,16979],{"data":16959,"marks":16960,"value":5885,"nodeType":864},{},[],{"data":16962,"marks":16963,"value":5890,"nodeType":864},{},[16964],{"type":899},{"data":16966,"marks":16967,"value":5894,"nodeType":864},{},[],{"data":16969,"marks":16970,"value":5899,"nodeType":864},{},[16971],{"type":899},{"data":16973,"marks":16974,"value":902,"nodeType":864},{},[],{"data":16976,"marks":16977,"value":5907,"nodeType":864},{},[16978],{"type":899},{"data":16980,"marks":16981,"value":5911,"nodeType":864},{},[],{"data":16983,"content":16984,"nodeType":860},{},[16985,16988,16996],{"data":16986,"marks":16987,"value":21,"nodeType":864},{},[],{"data":16989,"content":16992,"nodeType":5064},{"target":16990},{"sys":16991},{"id":5922,"type":1001,"linkType":1002},[16993],{"data":16994,"marks":16995,"value":5063,"nodeType":864},{},[],{"data":16997,"marks":16998,"value":21,"nodeType":864},{},[],{"data":17000,"content":17001,"nodeType":1009},{},[17002],{"data":17003,"marks":17004,"value":5709,"nodeType":864},{},[],{"data":17006,"content":17007,"nodeType":860},{},[17008],{"data":17009,"marks":17010,"value":5942,"nodeType":864},{},[],{"data":17012,"content":17013,"nodeType":860},{},[17014,17017,17021],{"data":17015,"marks":17016,"value":5949,"nodeType":864},{},[],{"data":17018,"marks":17019,"value":5954,"nodeType":864},{},[17020],{"type":899},{"data":17022,"marks":17023,"value":2924,"nodeType":864},{},[],{"data":17025,"content":17028,"nodeType":996},{"target":17026},{"sys":17027},{"id":5962,"type":1001,"linkType":1002},[],{"data":17030,"content":17031,"nodeType":860},{},[17032,17035,17043],{"data":17033,"marks":17034,"value":21,"nodeType":864},{},[],{"data":17036,"content":17039,"nodeType":5064},{"target":17037},{"sys":17038},{"id":5974,"type":1001,"linkType":1002},[17040],{"data":17041,"marks":17042,"value":5063,"nodeType":864},{},[],{"data":17044,"marks":17045,"value":21,"nodeType":864},{},[],{"data":17047,"content":17048,"nodeType":1009},{},[17049],{"data":17050,"marks":17051,"value":5719,"nodeType":864},{},[],{"data":17053,"content":17054,"nodeType":860},{},[17055],{"data":17056,"marks":17057,"value":5994,"nodeType":864},{},[],{"data":17059,"content":17060,"nodeType":860},{},[17061,17064,17068,17071,17075],{"data":17062,"marks":17063,"value":6001,"nodeType":864},{},[],{"data":17065,"marks":17066,"value":5755,"nodeType":864},{},[17067],{"type":899},{"data":17069,"marks":17070,"value":6009,"nodeType":864},{},[],{"data":17072,"marks":17073,"value":1334,"nodeType":864},{},[17074],{"type":899},{"data":17076,"marks":17077,"value":6017,"nodeType":864},{},[],{"data":17079,"content":17080,"nodeType":860},{},[17081,17084,17088,17091,17095],{"data":17082,"marks":17083,"value":6024,"nodeType":864},{},[],{"data":17085,"marks":17086,"value":6029,"nodeType":864},{},[17087],{"type":899},{"data":17089,"marks":17090,"value":6033,"nodeType":864},{},[],{"data":17092,"marks":17093,"value":6038,"nodeType":864},{},[17094],{"type":899},{"data":17096,"marks":17097,"value":6042,"nodeType":864},{},[],{"data":17099,"content":17100,"nodeType":860},{},[17101,17104,17112],{"data":17102,"marks":17103,"value":21,"nodeType":864},{},[],{"data":17105,"content":17108,"nodeType":5064},{"target":17106},{"sys":17107},{"id":6053,"type":1001,"linkType":1002},[17109],{"data":17110,"marks":17111,"value":5063,"nodeType":864},{},[],{"data":17113,"marks":17114,"value":21,"nodeType":864},{},[],{"data":17116,"content":17117,"nodeType":1009},{},[17118],{"data":17119,"marks":17120,"value":6067,"nodeType":864},{},[],{"data":17122,"content":17123,"nodeType":860},{},[17124],{"data":17125,"marks":17126,"value":6074,"nodeType":864},{},[],{"data":17128,"content":17129,"nodeType":941},{},[17130,17148,17157,17175],{"data":17131,"content":17132,"nodeType":945},{},[17133],{"data":17134,"content":17135,"nodeType":860},{},[17136,17139,17145],{"data":17137,"marks":17138,"value":6087,"nodeType":864},{},[],{"data":17140,"content":17141,"nodeType":883},{"uri":6090},[17142],{"data":17143,"marks":17144,"value":5063,"nodeType":864},{},[],{"data":17146,"marks":17147,"value":21,"nodeType":864},{},[],{"data":17149,"content":17150,"nodeType":945},{},[17151],{"data":17152,"content":17153,"nodeType":860},{},[17154],{"data":17155,"marks":17156,"value":6107,"nodeType":864},{},[],{"data":17158,"content":17159,"nodeType":945},{},[17160],{"data":17161,"content":17162,"nodeType":860},{},[17163,17166,17172],{"data":17164,"marks":17165,"value":6117,"nodeType":864},{},[],{"data":17167,"content":17168,"nodeType":883},{"uri":6120},[17169],{"data":17170,"marks":17171,"value":5063,"nodeType":864},{},[],{"data":17173,"marks":17174,"value":21,"nodeType":864},{},[],{"data":17176,"content":17177,"nodeType":945},{},[17178],{"data":17179,"content":17180,"nodeType":860},{},[17181,17184,17190],{"data":17182,"marks":17183,"value":6137,"nodeType":864},{},[],{"data":17185,"content":17186,"nodeType":883},{"uri":6140},[17187],{"data":17188,"marks":17189,"value":5063,"nodeType":864},{},[],{"data":17191,"marks":17192,"value":21,"nodeType":864},{},[],{"data":17194,"content":17195,"nodeType":860},{},[17196],{"data":17197,"marks":17198,"value":21,"nodeType":864},{},[],{"items":17200},[17201],{"sys":17202,"name":5648},{"id":5647},{"items":17204},[17205],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":17206},{"url":4953},"blog/product-release-may-2026",{"json":17209},{"data":17210,"content":17211,"nodeType":856},{},[17212],{"data":17213,"content":17214,"nodeType":860},{},[17215],{"data":17216,"marks":17217,"value":17218,"nodeType":864},{},[],"Custom detections, file download telemetry, and more",{"id":5362,"publishedAt":17220},"2026-08-13T09:35:03.059Z",{"items":17222},[17223],{"sys":17224,"name":5648},{"id":5647},{"items":17226},[17227,17229,17231],{"sys":17228,"name":297,"slug":298,"tier":31},{"id":294},{"sys":17230,"name":502,"slug":503,"tier":45},{"id":499},{"sys":17232,"name":368,"slug":369,"tier":45},{"id":365},"yrh1LR3eIXmvuMK5Z5M_aNxR376WgT7Mm_GeqK5JQdw",{"id":17235,"title":2720,"authorsCollection":17236,"content":17242,"extension":228,"faqItemsCollection":18052,"faqTitle":18151,"featured":6,"hashTags":59,"meta":18152,"metaTitle":18153,"ogImage":59,"postType":6981,"publishedDate":2722,"relatedBlogPostsCollection":18154,"slug":2723,"stem":20724,"subtitle":59,"summary":20725,"synopsis":2721,"sys":20736,"tagsCollection":20738,"topicsCollection":20744,"__hash__":20768},"blog/blog/what-push-data-reveals-about-the-state-of-shadow-ai.json",{"items":17237},[17238],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":17239,"profilePicture":17241},[17240],"https://www.linkedin.com/in/daniel-g-/",{"url":2740},{"json":17243,"links":17803},{"data":17244,"content":17245,"nodeType":856},{},[17246,17252,17258,17264,17269,17272,17279,17285,17314,17320,17344,17349,17352,17359,17365,17372,17406,17411,17417,17422,17425,17432,17438,17445,17451,17457,17470,17477,17497,17503,17508,17514,17521,17534,17556,17561,17576,17581,17588,17594,17614,17620,17626,17632,17637,17640,17647,17653,17659,17674,17681,17687,17694,17713,17723,17728,17731,17738,17744,17750,17756,17772,17775,17781,17787],{"data":17247,"content":17248,"nodeType":860},{},[17249],{"data":17250,"marks":17251,"value":2072,"nodeType":864},{},[],{"data":17253,"content":17254,"nodeType":860},{},[17255],{"data":17256,"marks":17257,"value":2079,"nodeType":864},{},[],{"data":17259,"content":17260,"nodeType":860},{},[17261],{"data":17262,"marks":17263,"value":2086,"nodeType":864},{},[],{"data":17265,"content":17268,"nodeType":996},{"target":17266},{"sys":17267},{"id":2091,"type":1001,"linkType":1002},[],{"data":17270,"content":17271,"nodeType":1005},{},[],{"data":17273,"content":17274,"nodeType":1009},{},[17275],{"data":17276,"marks":17277,"value":2103,"nodeType":864},{},[17278],{"type":899},{"data":17280,"content":17281,"nodeType":860},{},[17282],{"data":17283,"marks":17284,"value":2110,"nodeType":864},{},[],{"data":17286,"content":17287,"nodeType":941},{},[17288,17301],{"data":17289,"content":17290,"nodeType":945},{},[17291],{"data":17292,"content":17293,"nodeType":860},{},[17294,17298],{"data":17295,"marks":17296,"value":2124,"nodeType":864},{},[17297],{"type":899},{"data":17299,"marks":17300,"value":2128,"nodeType":864},{},[],{"data":17302,"content":17303,"nodeType":945},{},[17304],{"data":17305,"content":17306,"nodeType":860},{},[17307,17311],{"data":17308,"marks":17309,"value":2139,"nodeType":864},{},[17310],{"type":899},{"data":17312,"marks":17313,"value":2143,"nodeType":864},{},[],{"data":17315,"content":17316,"nodeType":860},{},[17317],{"data":17318,"marks":17319,"value":2150,"nodeType":864},{},[],{"data":17321,"content":17322,"nodeType":860},{},[17323,17326,17332,17335,17341],{"data":17324,"marks":17325,"value":2157,"nodeType":864},{},[],{"data":17327,"content":17328,"nodeType":883},{"uri":1543},[17329],{"data":17330,"marks":17331,"value":1758,"nodeType":864},{},[],{"data":17333,"marks":17334,"value":1762,"nodeType":864},{},[],{"data":17336,"content":17337,"nodeType":883},{"uri":1765},[17338],{"data":17339,"marks":17340,"value":1770,"nodeType":864},{},[],{"data":17342,"marks":17343,"value":1774,"nodeType":864},{},[],{"data":17345,"content":17348,"nodeType":996},{"target":17346},{"sys":17347},{"id":2180,"type":1001,"linkType":1002},[],{"data":17350,"content":17351,"nodeType":1005},{},[],{"data":17353,"content":17354,"nodeType":1009},{},[17355],{"data":17356,"marks":17357,"value":2192,"nodeType":864},{},[17358],{"type":899},{"data":17360,"content":17361,"nodeType":860},{},[17362],{"data":17363,"marks":17364,"value":2199,"nodeType":864},{},[],{"data":17366,"content":17367,"nodeType":860},{},[17368],{"data":17369,"marks":17370,"value":2207,"nodeType":864},{},[17371],{"type":899},{"data":17373,"content":17374,"nodeType":860},{},[17375,17378,17382,17385,17389,17392,17396,17399,17403],{"data":17376,"marks":17377,"value":2214,"nodeType":864},{},[],{"data":17379,"marks":17380,"value":2219,"nodeType":864},{},[17381],{"type":899},{"data":17383,"marks":17384,"value":2223,"nodeType":864},{},[],{"data":17386,"marks":17387,"value":2228,"nodeType":864},{},[17388],{"type":899},{"data":17390,"marks":17391,"value":2232,"nodeType":864},{},[],{"data":17393,"marks":17394,"value":2237,"nodeType":864},{},[17395],{"type":899},{"data":17397,"marks":17398,"value":2241,"nodeType":864},{},[],{"data":17400,"marks":17401,"value":2247,"nodeType":864},{},[17402],{"type":2246},{"data":17404,"marks":17405,"value":2251,"nodeType":864},{},[],{"data":17407,"content":17410,"nodeType":996},{"target":17408},{"sys":17409},{"id":2256,"type":1001,"linkType":1002},[],{"data":17412,"content":17413,"nodeType":860},{},[17414],{"data":17415,"marks":17416,"value":2264,"nodeType":864},{},[],{"data":17418,"content":17421,"nodeType":996},{"target":17419},{"sys":17420},{"id":1040,"type":1001,"linkType":1002},[],{"data":17423,"content":17424,"nodeType":1005},{},[],{"data":17426,"content":17427,"nodeType":1009},{},[17428],{"data":17429,"marks":17430,"value":2280,"nodeType":864},{},[17431],{"type":899},{"data":17433,"content":17434,"nodeType":860},{},[17435],{"data":17436,"marks":17437,"value":2287,"nodeType":864},{},[],{"data":17439,"content":17440,"nodeType":1312},{},[17441],{"data":17442,"marks":17443,"value":2295,"nodeType":864},{},[17444],{"type":899},{"data":17446,"content":17447,"nodeType":860},{},[17448],{"data":17449,"marks":17450,"value":2302,"nodeType":864},{},[],{"data":17452,"content":17453,"nodeType":860},{},[17454],{"data":17455,"marks":17456,"value":2309,"nodeType":864},{},[],{"data":17458,"content":17459,"nodeType":860},{},[17460,17463,17467],{"data":17461,"marks":17462,"value":2316,"nodeType":864},{},[],{"data":17464,"marks":17465,"value":2321,"nodeType":864},{},[17466],{"type":899},{"data":17468,"marks":17469,"value":2325,"nodeType":864},{},[],{"data":17471,"content":17472,"nodeType":1312},{},[17473],{"data":17474,"marks":17475,"value":2333,"nodeType":864},{},[17476],{"type":899},{"data":17478,"content":17479,"nodeType":860},{},[17480,17483,17487,17490,17494],{"data":17481,"marks":17482,"value":2340,"nodeType":864},{},[],{"data":17484,"marks":17485,"value":2345,"nodeType":864},{},[17486],{"type":899},{"data":17488,"marks":17489,"value":2349,"nodeType":864},{},[],{"data":17491,"marks":17492,"value":2354,"nodeType":864},{},[17493],{"type":899},{"data":17495,"marks":17496,"value":2358,"nodeType":864},{},[],{"data":17498,"content":17499,"nodeType":860},{},[17500],{"data":17501,"marks":17502,"value":2365,"nodeType":864},{},[],{"data":17504,"content":17507,"nodeType":996},{"target":17505},{"sys":17506},{"id":2370,"type":1001,"linkType":1002},[],{"data":17509,"content":17510,"nodeType":860},{},[17511],{"data":17512,"marks":17513,"value":2378,"nodeType":864},{},[],{"data":17515,"content":17516,"nodeType":1312},{},[17517],{"data":17518,"marks":17519,"value":2386,"nodeType":864},{},[17520],{"type":899},{"data":17522,"content":17523,"nodeType":860},{},[17524,17527,17531],{"data":17525,"marks":17526,"value":2393,"nodeType":864},{},[],{"data":17528,"marks":17529,"value":2228,"nodeType":864},{},[17530],{"type":899},{"data":17532,"marks":17533,"value":2401,"nodeType":864},{},[],{"data":17535,"content":17536,"nodeType":860},{},[17537,17540,17546,17549,17553],{"data":17538,"marks":17539,"value":2408,"nodeType":864},{},[],{"data":17541,"content":17542,"nodeType":883},{"uri":2411},[17543],{"data":17544,"marks":17545,"value":2416,"nodeType":864},{},[],{"data":17547,"marks":17548,"value":2420,"nodeType":864},{},[],{"data":17550,"marks":17551,"value":2425,"nodeType":864},{},[17552],{"type":899},{"data":17554,"marks":17555,"value":2429,"nodeType":864},{},[],{"data":17557,"content":17560,"nodeType":996},{"target":17558},{"sys":17559},{"id":2434,"type":1001,"linkType":1002},[],{"data":17562,"content":17563,"nodeType":860},{},[17564,17567,17573],{"data":17565,"marks":17566,"value":2442,"nodeType":864},{},[],{"data":17568,"content":17569,"nodeType":883},{"uri":2411},[17570],{"data":17571,"marks":17572,"value":2449,"nodeType":864},{},[],{"data":17574,"marks":17575,"value":2453,"nodeType":864},{},[],{"data":17577,"content":17580,"nodeType":996},{"target":17578},{"sys":17579},{"id":2458,"type":1001,"linkType":1002},[],{"data":17582,"content":17583,"nodeType":1312},{},[17584],{"data":17585,"marks":17586,"value":2467,"nodeType":864},{},[17587],{"type":899},{"data":17589,"content":17590,"nodeType":860},{},[17591],{"data":17592,"marks":17593,"value":2474,"nodeType":864},{},[],{"data":17595,"content":17596,"nodeType":860},{},[17597,17600,17604,17607,17611],{"data":17598,"marks":17599,"value":2481,"nodeType":864},{},[],{"data":17601,"marks":17602,"value":2486,"nodeType":864},{},[17603],{"type":899},{"data":17605,"marks":17606,"value":2490,"nodeType":864},{},[],{"data":17608,"marks":17609,"value":2495,"nodeType":864},{},[17610],{"type":2246},{"data":17612,"marks":17613,"value":2499,"nodeType":864},{},[],{"data":17615,"content":17616,"nodeType":860},{},[17617],{"data":17618,"marks":17619,"value":2506,"nodeType":864},{},[],{"data":17621,"content":17622,"nodeType":860},{},[17623],{"data":17624,"marks":17625,"value":2513,"nodeType":864},{},[],{"data":17627,"content":17628,"nodeType":860},{},[17629],{"data":17630,"marks":17631,"value":2520,"nodeType":864},{},[],{"data":17633,"content":17636,"nodeType":996},{"target":17634},{"sys":17635},{"id":2525,"type":1001,"linkType":1002},[],{"data":17638,"content":17639,"nodeType":1005},{},[],{"data":17641,"content":17642,"nodeType":1009},{},[17643],{"data":17644,"marks":17645,"value":2537,"nodeType":864},{},[17646],{"type":899},{"data":17648,"content":17649,"nodeType":860},{},[17650],{"data":17651,"marks":17652,"value":2544,"nodeType":864},{},[],{"data":17654,"content":17655,"nodeType":860},{},[17656],{"data":17657,"marks":17658,"value":2551,"nodeType":864},{},[],{"data":17660,"content":17661,"nodeType":860},{},[17662,17665,17671],{"data":17663,"marks":17664,"value":2558,"nodeType":864},{},[],{"data":17666,"content":17667,"nodeType":883},{"uri":2561},[17668],{"data":17669,"marks":17670,"value":2566,"nodeType":864},{},[],{"data":17672,"marks":17673,"value":2570,"nodeType":864},{},[],{"data":17675,"content":17676,"nodeType":1312},{},[17677],{"data":17678,"marks":17679,"value":2578,"nodeType":864},{},[17680],{"type":899},{"data":17682,"content":17683,"nodeType":860},{},[17684],{"data":17685,"marks":17686,"value":2585,"nodeType":864},{},[],{"data":17688,"content":17689,"nodeType":860},{},[17690],{"data":17691,"marks":17692,"value":2593,"nodeType":864},{},[17693],{"type":899},{"data":17695,"content":17696,"nodeType":860},{},[17697,17701,17704,17710],{"data":17698,"marks":17699,"value":2601,"nodeType":864},{},[17700],{"type":899},{"data":17702,"marks":17703,"value":2605,"nodeType":864},{},[],{"data":17705,"content":17706,"nodeType":883},{"uri":2411},[17707],{"data":17708,"marks":17709,"value":2612,"nodeType":864},{},[],{"data":17711,"marks":17712,"value":2616,"nodeType":864},{},[],{"data":17714,"content":17715,"nodeType":860},{},[17716,17720],{"data":17717,"marks":17718,"value":2624,"nodeType":864},{},[17719],{"type":899},{"data":17721,"marks":17722,"value":2628,"nodeType":864},{},[],{"data":17724,"content":17727,"nodeType":996},{"target":17725},{"sys":17726},{"id":2633,"type":1001,"linkType":1002},[],{"data":17729,"content":17730,"nodeType":1005},{},[],{"data":17732,"content":17733,"nodeType":1009},{},[17734],{"data":17735,"marks":17736,"value":2645,"nodeType":864},{},[17737],{"type":899},{"data":17739,"content":17740,"nodeType":860},{},[17741],{"data":17742,"marks":17743,"value":2652,"nodeType":864},{},[],{"data":17745,"content":17746,"nodeType":860},{},[17747],{"data":17748,"marks":17749,"value":2659,"nodeType":864},{},[],{"data":17751,"content":17752,"nodeType":860},{},[17753],{"data":17754,"marks":17755,"value":2666,"nodeType":864},{},[],{"data":17757,"content":17758,"nodeType":860},{},[17759,17762,17769],{"data":17760,"marks":17761,"value":2673,"nodeType":864},{},[],{"data":17763,"content":17764,"nodeType":883},{"uri":2676},[17765],{"data":17766,"marks":17767,"value":580,"nodeType":864},{},[17768],{"type":1455},{"data":17770,"marks":17771,"value":2685,"nodeType":864},{},[],{"data":17773,"content":17774,"nodeType":1005},{},[],{"data":17776,"content":17777,"nodeType":860},{},[17778],{"data":17779,"marks":17780,"value":1682,"nodeType":864},{},[],{"data":17782,"content":17783,"nodeType":860},{},[17784],{"data":17785,"marks":17786,"value":1689,"nodeType":864},{},[],{"data":17788,"content":17789,"nodeType":860},{},[17790,17793,17800],{"data":17791,"marks":17792,"value":2707,"nodeType":864},{},[],{"data":17794,"content":17795,"nodeType":883},{"uri":1700},[17796],{"data":17797,"marks":17798,"value":2715,"nodeType":864},{},[17799],{"type":1455},{"data":17801,"marks":17802,"value":2719,"nodeType":864},{},[],{"entries":17804},{"hyperlink":17805,"inline":17806,"block":17807},[],[],[17808,17860,17874,17888,17891,17933,17984,17991,18047],{"sys":17809,"__typename":1740,"content":17810,"name":17859,"title":59},{"id":2091},{"json":17811},{"data":17812,"content":17813,"nodeType":856},{},[17814],{"data":17815,"content":17816,"nodeType":860},{},[17817,17821,17828,17832,17837,17841,17850,17854],{"data":17818,"marks":17819,"value":17820,"nodeType":864},{},[],"The industry data backs this up. The ",{"data":17822,"content":17823,"nodeType":883},{"uri":8425},[17824],{"data":17825,"marks":17826,"value":17827,"nodeType":864},{},[],"Verizon DBIR 2026",{"data":17829,"marks":17830,"value":17831,"nodeType":864},{},[]," reports that ",{"data":17833,"marks":17834,"value":17836,"nodeType":864},{},[17835],{"type":899},"45% of employees are now regular AI users on corporate devices",{"data":17838,"marks":17839,"value":17840,"nodeType":864},{},[],", up from 15% the year before. ",{"data":17842,"content":17844,"nodeType":883},{"uri":17843},"https://omdia.tech.informa.com/",[17845],{"data":17846,"marks":17847,"value":17849,"nodeType":864},{},[17848],{"type":1455},"Omdia's 2026 browser security research",{"data":17851,"marks":17852,"value":17853,"nodeType":864},{},[]," presents a stronger picture, finding that 92% allow employees to use public GenAI applications. However, given that the typical company policy sanctions a small number of approved tools, this means everything else employees are using is unsanctioned by default. ",{"data":17855,"marks":17856,"value":17858,"nodeType":864},{},[17857],{"type":899},"In other words: every organization in the survey had unsanctioned AI usage.","shadow ai insight box 1",{"sys":17861,"__typename":1740,"content":17862,"name":17873,"title":59},{"id":2180},{"json":17863},{"nodeType":856,"data":17864,"content":17865},{},[17866],{"nodeType":860,"data":17867,"content":17868},{},[17869],{"nodeType":864,"value":17870,"marks":17871,"data":17872},"An added dimension here is the role of autonomous agents. Unsupervised agents can lead to the introduction of security vulnerabilities and data exposures, while agents themselves can be targeted through new classes of attack like prompt injection. But for the majority of organizations, where most of the workforce is simply using GenAI tools in the browser, agentic security is more of a niche concern for developers. ",[],{},"Shadow AI insight box",{"sys":17875,"__typename":1740,"content":17876,"name":17887,"title":59},{"id":2256},{"json":17877},{"data":17878,"content":17879,"nodeType":856},{},[17880],{"data":17881,"content":17882,"nodeType":860},{},[17883],{"data":17884,"marks":17885,"value":17886,"nodeType":864},{},[],"These are counts of unique products observed in one week, not total installs or connections across the workforce — each unique app, extension, or integration represents a separate AI tool that at least one employee has adopted, so the actual number of individual installs and active sessions across the organization is considerably larger. When the average organization has 17 unique AI extensions deployed, for instance, and many of those are popular tools adopted independently by multiple employees, the per-user footprint adds up quickly.","Shadow ai ib1",{"sys":17889,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":17890},{"id":1040},{"url":1728,"width":1729,"height":1730},{"sys":17892,"__typename":1740,"content":17893,"name":17932,"title":59},{"id":2370},{"json":17894},{"nodeType":856,"data":17895,"content":17896},{},[17897,17926],{"nodeType":860,"data":17898,"content":17899},{},[17900,17904,17908,17918,17922],{"nodeType":864,"value":17901,"marks":17902,"data":17903},"This is a perfect example of where",[],{},{"nodeType":864,"value":1171,"marks":17905,"data":17907},[17906],{"type":899},{},{"nodeType":883,"data":17909,"content":17911},{"uri":17910},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/evil-twin-integrations",[17912],{"nodeType":864,"value":17913,"marks":17914,"data":17917},"Evil Twin",[17915,17916],{"type":1455},{"type":899},{},{"nodeType":864,"value":1171,"marks":17919,"data":17921},[17920],{"type":899},{},{"nodeType":864,"value":17923,"marks":17924,"data":17925},"opportunities are likely to be abused by attackers. If you’re not familiar, this is where an attacker can effectively hide a malicious integration where an existing connection for that app is already approved, blending in with normal activity. But while historically maybe 1 out of 100 users had an automation tool like Zapier integrated already, the modern equivalent is that a much higher proportion of users already has Claude or ChatGPT integrated.",[],{},{"nodeType":860,"data":17927,"content":17928},{},[17929],{"nodeType":864,"value":21,"marks":17930,"data":17931},[],{},"Shadow ai ib4",{"sys":17934,"__typename":1740,"content":17935,"name":17983,"title":59},{"id":2434},{"json":17936},{"nodeType":856,"data":17937,"content":17938},{},[17939],{"nodeType":860,"data":17940,"content":17941},{},[17942,17946,17957,17961,17971,17974,17979],{"nodeType":864,"value":17943,"marks":17944,"data":17945},"This isn't just a Push observation —",[],{},{"nodeType":883,"data":17947,"content":17948},{"uri":2561},[17949,17952],{"nodeType":864,"value":1171,"marks":17950,"data":17951},[],{},{"nodeType":864,"value":17953,"marks":17954,"data":17956},"Omdia found that malicious browser extensions were cited by 34% of organizations",[17955],{"type":1455},{},{"nodeType":864,"value":17958,"marks":17959,"data":17960}," that experienced a browser-based attack, making them the third most common attack type after phishing and data leakage. The",[],{},{"nodeType":883,"data":17962,"content":17963},{"uri":8425},[17964,17967],{"nodeType":864,"value":1171,"marks":17965,"data":17966},[],{},{"nodeType":864,"value":17827,"marks":17968,"data":17970},[17969],{"type":1455},{},{"nodeType":864,"value":17831,"marks":17972,"data":17973},[],{},{"nodeType":864,"value":17975,"marks":17976,"data":17978},"more than 15% of corporate users had unauthorized AI browser extensions installed",[17977],{"type":899},{},{"nodeType":864,"value":17980,"marks":17981,"data":17982}," — meaning a material share of the workforce is running AI-powered code with broad permissions that no one in security approved or is monitoring. ",[],{},"Shadow ai ib2",{"sys":17985,"__typename":1724,"title":17986,"caption":17987,"layoutMode":59,"file":17988},{"id":2458},"Examples of AI imitation apps","Examples of imitation AI apps observed in active use by Push. Scammy and misleading, but not necessarily malicious (yet), but probably not something you want employees using.",{"url":17989,"width":1736,"height":17990},"https://images.ctfassets.net/y1cdw1ablpvd/73PW50LMkqoFWmsbxP7pIU/a29ed68622aeb453f618fc1eb9a1a55c/image1.png",1189,{"sys":17992,"__typename":1740,"content":17993,"name":18046,"title":59},{"id":2525},{"json":17994},{"nodeType":856,"data":17995,"content":17996},{},[17997,18015],{"nodeType":860,"data":17998,"content":17999},{},[18000,18004,18011],{"nodeType":864,"value":18001,"marks":18002,"data":18003},"The Vercel breach is a textbook illustration of integration risk. A Vercel employee had connected a consumer-grade AI app from Context.ai into their Google Workspace tenant — most likely a self-service trial that was lightly used and forgotten about. Vercel ",[],{},{"nodeType":883,"data":18005,"content":18006},{"uri":4103},[18007],{"nodeType":864,"value":18008,"marks":18009,"data":18010},"wasn't even a registered customer",[],{},{"nodeType":864,"value":18012,"marks":18013,"data":18014}," of Context.ai. When Context.ai was subsequently compromised via an infostealer infection, the attacker leveraged stored OAuth tokens to pivot into the Vercel employee's Google Workspace account, accessing internal dashboards, API keys, NPM tokens, and GitHub tokens.",[],{},{"nodeType":860,"data":18016,"content":18017},{},[18018,18022,18030,18034,18042],{"nodeType":864,"value":18019,"marks":18020,"data":18021},"Vercel is far from an isolated case. In 2025, ",[],{},{"nodeType":883,"data":18023,"content":18025},{"uri":18024},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[18026],{"nodeType":864,"value":18027,"marks":18028,"data":18029},"Scattered Lapsus$ Hunters",[],{},{"nodeType":864,"value":18031,"marks":18032,"data":18033}," launched OAuth-driven supply chain attacks against Salesforce and Google Workspace tenants after breaching Salesloft Drift and Gainsight, impacting over 1,000 organizations and stealing over 1.5 billion records. More recently, Snowflake customers were impacted after a ",[],{},{"nodeType":883,"data":18035,"content":18037},{"uri":18036},"https://www.bleepingcomputer.com/news/security/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach/",[18038],{"nodeType":864,"value":18039,"marks":18040,"data":18041},"breach at data anomaly detection company Anodot",[],{},{"nodeType":864,"value":18043,"marks":18044,"data":18045},", where attackers attempted to leverage stolen authentication tokens to access downstream environments.",[],{},"Shadow ai ib3",{"sys":18048,"__typename":1717,"type":1718,"ctaText":18049,"buttonLabel":18050,"buttonColour":1721,"buttonUrl":18051},{"id":2633},"For a step-by-step walkthrough of how to implement these controls, including shadow AI discovery, graduated enforcement, and data loss prevention, see our practical guide to shadow AI visibility and control.","Read Now","pushsecurity.com/blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps",{"items":18053},[18054,18074,18106,18131],{"answer":18055,"question":18073},{"json":18056},{"nodeType":856,"data":18057,"content":18058},{},[18059,18066],{"nodeType":860,"data":18060,"content":18061},{},[18062],{"nodeType":864,"value":18063,"marks":18064,"data":18065},"Shadow IT management has a well-established playbook: discover unauthorized apps through CASB logs or network monitoring, enforce SSO to bring them under identity governance, and apply block/allow decisions at the proxy or firewall. That playbook assumes the tool is a discrete app that employees signed up for, that it's reachable through the network layer, and that the main risk is ungoverned data storage. ",[],{},{"nodeType":860,"data":18067,"content":18068},{},[18069],{"nodeType":864,"value":18070,"marks":18071,"data":18072},"Shadow AI breaks all three assumptions. AI doesn't just store data — it actively processes it, and employees submit qualitatively more sensitive material (source code, credentials, internal strategy) into AI prompts than they typically put into a project management tool or file-sharing app. AI also arrives embedded inside tools you've already approved — Salesforce, Google Workspace, Notion, Slack all ship AI features that activate without a separate procurement decision, so there's no sign-up event for a CASB to catch. And the integration surface is different: AI tools connect to other enterprise apps through OAuth grants and MCP connections that create persistent API-level access, turning each one into a potential pivot point across your SaaS estate. This level of AI integration dwarfs typical SaaS-to-SaaS interconnectivity, and what an agent can do with the data in a given app is typically much more permissive and way less predictable. ",[],{},"How is shadow AI different from regular shadow IT or shadow SaaS?",{"answer":18075,"question":18105},{"json":18076},{"nodeType":856,"data":18077,"content":18078},{},[18079,18086],{"nodeType":860,"data":18080,"content":18081},{},[18082],{"nodeType":864,"value":18083,"marks":18084,"data":18085},"When an employee uses a personal ChatGPT, Gemini, or Claude account to do work, everything they submit — prompts, file uploads, pasted code — goes to an environment your organization has no governance over. There are no data retention controls, no audit trail, no DLP policies, and no way to revoke access if that employee leaves. The Verizon DBIR found 67% of GenAI users on corporate devices use non-corporate accounts, and Push data shows 38% of file uploads to AI tools come from these shadow accounts rather than approved organizational ones. The risk isn't hypothetical usage of a banned tool — it's real work happening on the same tool you approved, just on an account you can't see or control.",[],{},{"nodeType":860,"data":18087,"content":18088},{},[18089,18093,18101],{"nodeType":864,"value":18090,"marks":18091,"data":18092},"It's even worse if that employee has been tricked into joining an external tenant (",[],{},{"nodeType":883,"data":18094,"content":18096},{"uri":18095},"https://pushsecurity.com/blog/openai-poisoned-tenant-attack",[18097],{"nodeType":864,"value":18098,"marks":18099,"data":18100},"as attackers tried to trick Push employees into doing recently",[],{},{"nodeType":864,"value":18102,"marks":18103,"data":18104},") where your data flows directly into the hands of a malicious outsider. ",[],{},"What's the risk if employees use personal AI accounts for work?",{"answer":18107,"question":18130},{"json":18108},{"nodeType":856,"data":18109,"content":18110},{},[18111],{"nodeType":860,"data":18112,"content":18113},{},[18114,18118,18126],{"nodeType":864,"value":18115,"marks":18116,"data":18117},"Yes, and this is one of the less visible risks of shadow AI. Many AI tools request OAuth permissions to connect to Google Workspace, Microsoft 365, Slack, or code repositories during setup — a \"Connect to Google Drive\" or \"Sign in with Microsoft\" flow that grants persistent API-level access to data in those systems. Unlike a browser session that expires, these tokens survive password resets and MFA changes, and they often have broader scope than users realize (shared drives, shared calendars, any collaborative resource the consenting user can reach). The ",[],{},{"nodeType":883,"data":18119,"content":18121},{"uri":18120},"https://pushsecurity.com/blog/unpacking-the-vercel-breach",[18122],{"nodeType":864,"value":18123,"marks":18124,"data":18125},"Vercel breach",[],{},{"nodeType":864,"value":18127,"marks":18128,"data":18129}," showed what happens when one of these goes wrong: a single forgotten OAuth integration from a consumer AI app gave attackers a path into internal dashboards, API keys, and source code repositories.",[],{},"Can AI tools access my other enterprise apps?",{"answer":18132,"question":18150},{"json":18133},{"nodeType":856,"data":18134,"content":18135},{},[18136,18143],{"nodeType":860,"data":18137,"content":18138},{},[18139],{"nodeType":864,"value":18140,"marks":18141,"data":18142},"MCP (Model Context Protocol) connections let AI tools interact with other applications — reading files, querying databases, triggering workflows — through a standardized interface. Approving an MCP connection grants the AI tool persistent access to whatever systems the MCP server exposes, and that access operates at the API layer rather than through the browser session you're used to controlling. ",[],{},{"nodeType":860,"data":18144,"content":18145},{},[18146],{"nodeType":864,"value":18147,"marks":18148,"data":18149},"The risk is similar to OAuth but often broader in scope: a single MCP connection to a code repository or project management tool can give the AI agent read and write access across that system, and if the AI tool or MCP server is compromised, those permissions become the attacker's permissions. Unlike a browser session, MCP tokens persist until explicitly revoked, and compromising one AI agent that's connected to multiple MCP servers yields tokens for every service it was connected to.",[],{},"What's the risk if I approve an MCP connection?","Shadow AI: Frequently asked questions",{},"Shadow AI: the numbers behind each type of shadow AI",{"items":18155},[18156,18921,20002],{"__typename":2059,"sys":18157,"content":18159,"title":18907,"synopsis":18908,"hashTags":59,"publishedDate":18909,"slug":18910,"tagsCollection":18911,"authorsCollection":18917},{"id":18158},"Lq2AFQ8VG2rMEe4h2CYuH",{"json":18160},{"data":18161,"content":18162,"nodeType":856},{},[18163,18190,18223,18230,18236,18239,18247,18254,18260,18279,18286,18294,18314,18330,18337,18344,18347,18355,18362,18369,18432,18439,18447,18459,18466,18473,18479,18487,18494,18501,18508,18515,18521,18529,18536,18620,18626,18629,18637,18644,18660,18667,18674,18680,18699,18702,18709,18716,18722,18740,18747,18754,18760,18763,18770,18777,18784,18790,18797,18803,18809,18834,18840,18852,18859,18866],{"data":18164,"content":18165,"nodeType":860},{},[18166,18170,18178,18182,18187],{"data":18167,"marks":18168,"value":18169,"nodeType":864},{},[],"This week, a user going by the name of “ShinyHunters” (though allegedly not ",{"data":18171,"content":18172,"nodeType":883},{"uri":18024},[18173],{"data":18174,"marks":18175,"value":18177,"nodeType":864},{},[18176],{"type":1455},"actual ShinyHunters",{"data":18179,"marks":18180,"value":18181,"nodeType":864},{},[],", but someone imitating them in an attempt to trade off their credibility) posted on a breach forum claiming access keys, source code, and database data stolen from cloud development platform provider ",{"data":18183,"marks":18184,"value":18186,"nodeType":864},{},[18185],{"type":899},"Vercel",{"data":18188,"marks":18189,"value":12800,"nodeType":864},{},[],{"data":18191,"content":18192,"nodeType":860},{},[18193,18197,18206,18210,18219],{"data":18194,"marks":18195,"value":18196,"nodeType":864},{},[],"This happened because a Vercel employee had connected an AI app, Context.ai, into their Google Workspace tenant. When Context.ai was compromised — ",{"data":18198,"content":18200,"nodeType":883},{"uri":18199},"https://www.infostealers.com/article/breaking-vercel-breach-linked-to-infostealer-infection-at-context-ai/",[18201],{"data":18202,"marks":18203,"value":18205,"nodeType":864},{},[18204],{"type":1455},"allegedly the result of an infostealer infection from an employee searching for Roblox cheats",{"data":18207,"marks":18208,"value":18209,"nodeType":864},{},[]," — the attacker was able to leverage OAuth tokens stored in Context.ai’s Supabase platform to access downstream customer accounts (pointing to a heavily permissioned victim, probably a developer, possibly even a ",{"data":18211,"content":18213,"nodeType":883},{"uri":18212},"https://pushsecurity.com/blog/browser-sync-attacks-where-personal-account-hacks-lead-to-corporate-breaches/",[18214],{"data":18215,"marks":18216,"value":18218,"nodeType":864},{},[18217],{"type":1455},"personal device with access to corp credentials",{"data":18220,"marks":18221,"value":18222,"nodeType":864},{},[],"). ",{"data":18224,"content":18225,"nodeType":860},{},[18226],{"data":18227,"marks":18228,"value":18229,"nodeType":864},{},[],"This access included a Vercel employee’s Google Workspace account. This particular user had significant access to data and secrets in Vercel’s systems, including internal dashboards, employee records, API keys, NPM tokens, and GitHub tokens, which the attacker was able to exfiltrate, holding Vercel to ransom for $2 million. ",{"data":18231,"content":18235,"nodeType":996},{"target":18232},{"sys":18233},{"id":18234,"type":1001,"linkType":1002},"6Ft8aSnzfYVZ7j57mYeXgQ",[],{"data":18237,"content":18238,"nodeType":1005},{},[],{"data":18240,"content":18241,"nodeType":1009},{},[18242],{"data":18243,"marks":18244,"value":18246,"nodeType":864},{},[18245],{"type":899},"How did this happen, and what could have stopped it?",{"data":18248,"content":18249,"nodeType":860},{},[18250],{"data":18251,"marks":18252,"value":18253,"nodeType":864},{},[],"From Vercel’s perspective, this attack could have been avoided had their employees been blocked from adding new OAuth integrations without admin approval (a toggle in their Google admin panel, and an essential control in a well-configured environment). Or, if the integration had been flagged in a routine audit and removed. ",{"data":18255,"content":18259,"nodeType":996},{"target":18256},{"sys":18257},{"id":18258,"type":1001,"linkType":1002},"b5HFvY1m6RnuXL3a95jVt",[],{"data":18261,"content":18262,"nodeType":860},{},[18263,18267,18275],{"data":18264,"marks":18265,"value":18266,"nodeType":864},{},[],"It probably should have been removed, too. The particular OAuth app that was connected into the environment was a deprecated “AI Office Suite” product intended for consumer use. ",{"data":18268,"content":18270,"nodeType":883},{"uri":18269},"https://context.ai/security-update",[18271],{"data":18272,"marks":18273,"value":18274,"nodeType":864},{},[],"According to Context.ai",{"data":18276,"marks":18277,"value":18278,"nodeType":864},{},[],", Vercel aren’t even a registered customer — adding more evidence that this was probably the result of a self-service trial that was subsequently forgotten about. That consumer product has also since been replaced by an enterprise product. But for whatever reason, the access hadn’t been revoked (from either side). ",{"data":18280,"content":18281,"nodeType":860},{},[18282],{"data":18283,"marks":18284,"value":18285,"nodeType":864},{},[],"The elephant in the room is that Context.ai is an AI app. Most organizations are rightly nervous about employees adding unapproved AI SaaS into their environment. Having employees use shadow AI in the form of LLMs is one thing — users uploading sensitive data to unapproved apps or external tenants being the key concern. But OAuth grants are even more dangerous. Because if that app or vendor is compromised, the apps and accounts you’ve integrated it with are also at risk — which is what was exploited here. ",{"data":18287,"content":18288,"nodeType":1312},{},[18289],{"data":18290,"marks":18291,"value":18293,"nodeType":864},{},[18292],{"type":899},"Where’s the fault?",{"data":18295,"content":18296,"nodeType":860},{},[18297,18301,18310],{"data":18298,"marks":18299,"value":18300,"nodeType":864},{},[],"It’s easy to point fingers here. There are multiple control gaps and failures for both parties. Vercel should have disabled OAuth grants without admin approval, and regularly audited the connections in their environment. From a vendor's perspective, they could have also default applied a control that ",{"data":18302,"content":18304,"nodeType":883},{"uri":18303},"https://vercel.com/kb/bulletin/vercel-april-2026-security-incident",[18305],{"data":18306,"marks":18307,"value":18309,"nodeType":864},{},[18308],{"type":1455},"prevents secret environment variables from being read",{"data":18311,"marks":18312,"value":18313,"nodeType":864},{},[]," — which would have significantly reduced the impact to Vercel customers from the data breach. ",{"data":18315,"content":18316,"nodeType":860},{},[18317,18321,18326],{"data":18318,"marks":18319,"value":18320,"nodeType":864},{},[],"Context.ai comes off worse. They could and should have had better separation of accounts and privileges — and if true, their users really shouldn’t be downloading Roblox scripts on devices they use for work access. It’s important to say ",{"data":18322,"marks":18323,"value":18325,"nodeType":864},{},[18324],{"type":2246},"if true",{"data":18327,"marks":18328,"value":18329,"nodeType":864},{},[]," here, but the prospect of third parties accessing your environment from insecure devices that they use for gaming is the stuff of nightmares for enterprise security and compliance teams.",{"data":18331,"content":18332,"nodeType":860},{},[18333],{"data":18334,"marks":18335,"value":18336,"nodeType":864},{},[],"You definitely don’t want to be Context.ai in this scenario. The reputational harm could be pretty significant, and is a wake-up call for other SaaS vendors to check that their house is in order. But although Vercel have responded quickly and transparently to the incident, this could only really have happened as a result of technical and procedural control gaps on their end.",{"data":18338,"content":18339,"nodeType":860},{},[18340],{"data":18341,"marks":18342,"value":18343,"nodeType":864},{},[],"It’s worth taking a step back and looking at the bigger picture here — and how these issues might impact your organization too. ",{"data":18345,"content":18346,"nodeType":1005},{},[],{"data":18348,"content":18349,"nodeType":1009},{},[18350],{"data":18351,"marks":18352,"value":18354,"nodeType":864},{},[18353],{"type":899},"Shadow AI is still just shadow SaaS – but the AI scramble is a force multiplier",{"data":18356,"content":18357,"nodeType":860},{},[18358],{"data":18359,"marks":18360,"value":18361,"nodeType":864},{},[],"Shadow IT, and in particular shadow SaaS, is not a new problem. Most organizations run heavily (or exclusively) on SaaS, accessed in the browser, with hundreds of apps per enterprise. Unmanaged, self-adopted apps have been a thorn in the side of security teams for some time. ",{"data":18363,"content":18364,"nodeType":860},{},[18365],{"data":18366,"marks":18367,"value":18368,"nodeType":864},{},[],"There are essentially four kinds of shadow IT to be wary of in the context of AI apps:",{"data":18370,"content":18371,"nodeType":941},{},[18372,18387,18402,18417],{"data":18373,"content":18374,"nodeType":945},{},[18375],{"data":18376,"content":18377,"nodeType":860},{},[18378,18383],{"data":18379,"marks":18380,"value":18382,"nodeType":864},{},[18381],{"type":899},"Shadow apps:",{"data":18384,"marks":18385,"value":18386,"nodeType":864},{},[]," Apps that employees have signed up to and are using for business purposes without business approval. This includes apps signed up to with a corporate account or personal account. ",{"data":18388,"content":18389,"nodeType":945},{},[18390],{"data":18391,"content":18392,"nodeType":860},{},[18393,18398],{"data":18394,"marks":18395,"value":18397,"nodeType":864},{},[18396],{"type":899},"Shadow tenants:",{"data":18399,"marks":18400,"value":18401,"nodeType":864},{},[]," Apps that employees are accessing with personal accounts, essentially creating shadow tenants outside of your organization’s control — even if you’ve approved the app itself.",{"data":18403,"content":18404,"nodeType":945},{},[18405],{"data":18406,"content":18407,"nodeType":860},{},[18408,18413],{"data":18409,"marks":18410,"value":18412,"nodeType":864},{},[18411],{"type":899},"Shadow extensions:",{"data":18414,"marks":18415,"value":18416,"nodeType":864},{},[]," Many AI apps come with an extension counterpart, along with countless third-party extensions that are either untrustworthy or downright malicious. Browser extensions add another angle to the equation by presenting visibility beyond the application into browser activity. ",{"data":18418,"content":18419,"nodeType":945},{},[18420],{"data":18421,"content":18422,"nodeType":860},{},[18423,18428],{"data":18424,"marks":18425,"value":18427,"nodeType":864},{},[18426],{"type":899},"Shadow integrations:",{"data":18429,"marks":18430,"value":18431,"nodeType":864},{},[]," OAuth connections across apps that aren’t known or approved. Even if an app itself is approved, plugging that app directly into your primary enterprise apps — with all the sensitive data and functionality therein — isn't necessarily also approved.  ",{"data":18433,"content":18434,"nodeType":860},{},[18435],{"data":18436,"marks":18437,"value":18438,"nodeType":864},{},[],"In the Vercel case, we’re talking specifically about shadow integrations. But all of these present a key risk to your organization. ",{"data":18440,"content":18441,"nodeType":1312},{},[18442],{"data":18443,"marks":18444,"value":18446,"nodeType":864},{},[18445],{"type":899},"The web of OAuth sprawl spans way beyond Google and Microsoft ",{"data":18448,"content":18449,"nodeType":860},{},[18450,18455],{"data":18451,"marks":18452,"value":18454,"nodeType":864},{},[18453],{"type":899},"On average we see 17 unique AI app integrations per organization in Microsoft and Google alone",{"data":18456,"marks":18457,"value":18458,"nodeType":864},{},[],". If you consider that most organizations have probably approved 1 or 2 max for business use, and may have approved none at all for app-to-app OAuth connectivity, that’s quite a significant difference. ",{"data":18460,"content":18461,"nodeType":860},{},[18462],{"data":18463,"marks":18464,"value":18465,"nodeType":864},{},[],"The number of connections outside of these core platforms is significantly higher. Just think how the typical AI app operates. If you want it to be able to effectively automate workflows — pull data from one app, aggregate and analyze it in another, present that information in a report, dashboard, or presentation, and then distribute it — that’s a fair few integrations in just one workflow. MCP connections use OAuth to achieve this interconnectivity in the same way as any other SaaS app.",{"data":18467,"content":18468,"nodeType":860},{},[18469],{"data":18470,"marks":18471,"value":18472,"nodeType":864},{},[],"We used to talk about automation apps like Zapier as being a goldmine for attackers. Well, AI apps are on their way to being even more interconnected, more frequently used, and more flexible in terms of how attackers can abuse them. ",{"data":18474,"content":18478,"nodeType":996},{"target":18475},{"sys":18476},{"id":18477,"type":1001,"linkType":1002},"4FiWyVw7mpVBA5uBVJoOKL",[],{"data":18480,"content":18481,"nodeType":1312},{},[18482],{"data":18483,"marks":18484,"value":18486,"nodeType":864},{},[18485],{"type":899},"A note on OAuth configuration complexity",{"data":18488,"content":18489,"nodeType":860},{},[18490],{"data":18491,"marks":18492,"value":18493,"nodeType":864},{},[],"A common misconception is that when a regular user consents to an OAuth app (let's use Google Workspace as the example) the app only gets access to the things they can directly access. Technically that's true — the access is scoped to that user's permissions. But in practice, the blast radius is almost always bigger than people think.",{"data":18495,"content":18496,"nodeType":860},{},[18497],{"data":18498,"marks":18499,"value":18500,"nodeType":864},{},[],"The scope includes shared drives, shared calendars, documents shared with them, and any other collaborative resources. A single well-permissioned user (think: developer with access to secrets, dashboards, and internal tooling) is more than enough to cause serious damage through a single OAuth grant. ",{"data":18502,"content":18503,"nodeType":860},{},[18504],{"data":18505,"marks":18506,"value":18507,"nodeType":864},{},[],"The scopes themselves are often deceptively broad. An app requesting https://www.googleapis.com/auth/drive gets full read/write access to everything the user can see in Drive — not just their personal files. And the blast radius is further contingent on the data and user permission hygiene in these broader environments. ",{"data":18509,"content":18510,"nodeType":860},{},[18511],{"data":18512,"marks":18513,"value":18514,"nodeType":864},{},[],"So if your environment hasn't got cleanly separated access and permissions for different users and groups, an attacker compromising a \"normal\" user account can end up with extensive access. You don't need tenant-wide admin access when a normal user's access already spans the crown jewels.",{"data":18516,"content":18520,"nodeType":996},{"target":18517},{"sys":18518},{"id":18519,"type":1001,"linkType":1002},"2t81AnAHx2On3fBynM4vVe",[],{"data":18522,"content":18523,"nodeType":1312},{},[18524],{"data":18525,"marks":18526,"value":18528,"nodeType":864},{},[18527],{"type":899},"Unsurprisingly, OAuth breaches are stacking up",{"data":18530,"content":18531,"nodeType":860},{},[18532],{"data":18533,"marks":18534,"value":18535,"nodeType":864},{},[],"Widespread OAuth interconnectedness isn’t just an AI app problem. Attackers have been exploiting this for some time:",{"data":18537,"content":18538,"nodeType":941},{},[18539,18586],{"data":18540,"content":18541,"nodeType":945},{},[18542],{"data":18543,"content":18544,"nodeType":860},{},[18545,18549,18556,18560,18569,18573,18582],{"data":18546,"marks":18547,"value":18548,"nodeType":864},{},[],"In 2025, ",{"data":18550,"content":18551,"nodeType":883},{"uri":18024},[18552],{"data":18553,"marks":18554,"value":18027,"nodeType":864},{},[18555],{"type":1455},{"data":18557,"marks":18558,"value":18559,"nodeType":864},{},[]," launched OAuth-driven supply chain attacks against Salesforce and Google Workspace tenants after breaching Salesloft (specifically the ",{"data":18561,"content":18563,"nodeType":883},{"uri":18562},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[18564],{"data":18565,"marks":18566,"value":18568,"nodeType":864},{},[18567],{"type":1455},"Salesloft Drift",{"data":18570,"marks":18571,"value":18572,"nodeType":864},{},[]," platform) and ",{"data":18574,"content":18576,"nodeType":883},{"uri":18575},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[18577],{"data":18578,"marks":18579,"value":18581,"nodeType":864},{},[18580],{"type":1455},"Gainsight",{"data":18583,"marks":18584,"value":18585,"nodeType":864},{},[],". In total, over 1000 organizations were impacted, including Google, Cloudflare, Rubrik, Elastic, Proofpoint, JFrog, Zscaler, Tenable, Palo Alto Networks, CyberArk, BeyondTrust, Qualys, and many more, with over 1.5B records stolen. ",{"data":18587,"content":18588,"nodeType":945},{},[18589],{"data":18590,"content":18591,"nodeType":860},{},[18592,18596,18603,18607,18616],{"data":18593,"marks":18594,"value":18595,"nodeType":864},{},[],"More recently, Snowflake customers were impacted after a ",{"data":18597,"content":18598,"nodeType":883},{"uri":18036},[18599],{"data":18600,"marks":18601,"value":18039,"nodeType":864},{},[18602],{"type":1455},{"data":18604,"marks":18605,"value":18606,"nodeType":864},{},[]," where the attacker attempted to leverage the stolen authentication tokens to access Salesforce data, with ",{"data":18608,"content":18610,"nodeType":883},{"uri":18609},"https://www.bleepingcomputer.com/news/security/stolen-rockstar-games-analytics-data-leaked-by-extortion-gang/",[18611],{"data":18612,"marks":18613,"value":18615,"nodeType":864},{},[18614],{"type":1455},"Rockstar",{"data":18617,"marks":18618,"value":18619,"nodeType":864},{},[]," a high-profile victim of the breach (again linked to Scattered Lapsus$ Hunters). ",{"data":18621,"content":18625,"nodeType":996},{"target":18622},{"sys":18623},{"id":18624,"type":1001,"linkType":1002},"3oqoL9L3fxetFcIhnfQhMQ",[],{"data":18627,"content":18628,"nodeType":1005},{},[],{"data":18630,"content":18631,"nodeType":1009},{},[18632],{"data":18633,"marks":18634,"value":18636,"nodeType":864},{},[18635],{"type":899},"Infostealers continue to drive corporate breaches",{"data":18638,"content":18639,"nodeType":860},{},[18640],{"data":18641,"marks":18642,"value":18643,"nodeType":864},{},[],"While unverified, Hudson Rock’s case for an infostealer breach being the root cause of the Context.ai breach seems believable. Infostealer infections have been one of the leading security threats for some time, fuelling breaches powered by stolen credentials and session tokens.",{"data":18645,"content":18646,"nodeType":860},{},[18647,18651,18656],{"data":18648,"marks":18649,"value":18650,"nodeType":864},{},[],"With the assumed rise in MFA coverage, it’s often surprising to security teams that stolen credentials are still a problem. ",{"data":18652,"marks":18653,"value":18655,"nodeType":864},{},[18654],{"type":899},"But of the last million logins we saw, 1 in 4 were password logins (not SSO), 2 in 5 were not protected by MFA, and 1 in 5 used a weak, breached, or reused password. ",{"data":18657,"marks":18658,"value":18659,"nodeType":864},{},[],"Plenty of scope for abuse. ",{"data":18661,"content":18662,"nodeType":860},{},[18663],{"data":18664,"marks":18665,"value":18666,"nodeType":864},{},[],"Stolen session tokens are even more valuable to attackers, enabling them to bypass authentication controls by replaying the token in their own browser. In theory, they should only be valid for a limited timeframe, but in practice this can be as many as 90 days, and sometimes indefinite. ",{"data":18668,"content":18669,"nodeType":860},{},[18670],{"data":18671,"marks":18672,"value":18673,"nodeType":864},{},[],"In this case, it seems likely that the compromised device was a developer machine (given the access to Supabase), or potentially even a personal device (given they were installing Roblox cheats…). This is relevant because these personal, developer, and BYOD machines are often less secure — developer machines are often exempt from EDR monitoring or significantly tuned-down (too noisy), while personal devices naturally lack enterprise security software.",{"data":18675,"content":18679,"nodeType":996},{"target":18676},{"sys":18677},{"id":18678,"type":1001,"linkType":1002},"139oaGgwRKZbwJzyex9LA5",[],{"data":18681,"content":18682,"nodeType":860},{},[18683,18687,18695],{"data":18684,"marks":18685,"value":18686,"nodeType":864},{},[],"We’ve also seen an uptick in developer-oriented phishing and malvertising campaigns. The ",{"data":18688,"content":18689,"nodeType":883},{"uri":12992},[18690],{"data":18691,"marks":18692,"value":18694,"nodeType":864},{},[18693],{"type":1455},"InstallFix campaign",{"data":18696,"marks":18697,"value":18698,"nodeType":864},{},[]," we identified, intercepting users as they attempt to install AI tools like Claude Code and NotebookLM, is an example of this — and also another way that attackers are capitalizing on AI hype. ",{"data":18700,"content":18701,"nodeType":1005},{},[],{"data":18703,"content":18704,"nodeType":1009},{},[18705],{"data":18706,"marks":18707,"value":2578,"nodeType":864},{},[18708],{"type":899},{"data":18710,"content":18711,"nodeType":860},{},[18712],{"data":18713,"marks":18714,"value":18715,"nodeType":864},{},[],"There are some immediate next steps that we’ll quickly summarize here, as they've already been covered in wider reporting. If you’re a Vercel customer, you should urgently rotate every credential stored as a non-sensitive variable that could have been exposed, enable the sensitive variable feature toggle, and monitor your account for anomalous activity. And if you’re using the specific Context.ai integration, you need to revoke it ASAP and begin a full audit of the connected accounts, both inside Workspace and broader connected apps (this isn’t that easy, as we’ll highlight in a moment). ",{"data":18717,"content":18721,"nodeType":996},{"target":18718},{"sys":18719},{"id":18720,"type":1001,"linkType":1002},"76HViirkH2R4QAzWg605sv",[],{"data":18723,"content":18724,"nodeType":860},{},[18725,18729,18737],{"data":18726,"marks":18727,"value":18728,"nodeType":864},{},[],"Taking a step back, organizations really need to get their arms around OAuth integrations in their environment. A default-deny approach to allowing users to consent to new integrations, and routinely auditing the ones already in your environment to ensure they’re still definitely required, is essential. Each integration expands your attack surface and could potentially grant an attacker extensive access to your environment. This default-deny approach isn't exactly a new concept for security teams and is the same in principle as what we recently advised for ",{"data":18730,"content":18731,"nodeType":883},{"uri":13079},[18732],{"data":18733,"marks":18734,"value":18736,"nodeType":864},{},[18735],{"type":1455},"browser extension management",{"data":18738,"marks":18739,"value":12800,"nodeType":864},{},[],{"data":18741,"content":18742,"nodeType":860},{},[18743],{"data":18744,"marks":18745,"value":18746,"nodeType":864},{},[],"This is fairly straightforward in your main enterprise cloud environment (think M365 or Google Workspace). But doing it across every SaaS app that allows some level of OAuth integration with another (i.e. every SaaS app) is somewhat harder. Not only do you need to have a comprehensive and up-to-date inventory, you need to be an app admin for every app (not always the case for self-adopted apps) and the particular app needs to give you the control to restrict and remove OAuth grants on behalf of users in your tenant. ",{"data":18748,"content":18749,"nodeType":860},{},[18750],{"data":18751,"marks":18752,"value":18753,"nodeType":864},{},[],"Again, this is not exclusively a Shadow AI problem, even if AI adoption is contributing significantly to the sprawl. ",{"data":18755,"content":18759,"nodeType":996},{"target":18756},{"sys":18757},{"id":18758,"type":1001,"linkType":1002},"XKKHUiz56G82uwYhbv2Qv",[],{"data":18761,"content":18762,"nodeType":1005},{},[],{"data":18764,"content":18765,"nodeType":1009},{},[18766],{"data":18767,"marks":18768,"value":8788,"nodeType":864},{},[18769],{"type":899},{"data":18771,"content":18772,"nodeType":860},{},[18773],{"data":18774,"marks":18775,"value":18776,"nodeType":864},{},[],"As we’ve established, there are quite a few pieces to this puzzle. Push can help with all of them. ",{"data":18778,"content":18779,"nodeType":860},{},[18780],{"data":18781,"marks":18782,"value":18783,"nodeType":864},{},[],"Push observes every app login your employees make in their browser, building a comprehensive picture of SaaS and AI use across your organization. This includes how they’re logging in and how secure the login is: did it have MFA, what kind of MFA, was it using a weak or compromised password, did they use SSO, and so on. ",{"data":18785,"content":18789,"nodeType":996},{"target":18786},{"sys":18787},{"id":18788,"type":1001,"linkType":1002},"2B205bUaLm6vG8mIQ0rJvA",[],{"data":18791,"content":18792,"nodeType":860},{},[18793],{"data":18794,"marks":18795,"value":18796,"nodeType":864},{},[],"Push also tracks OAuth integrations in your environment and gives you the ability to manage and remove them in core environments like M365 and Google Workspace, providing a single platform for you to view, manage, and secure app use across your organization. ",{"data":18798,"content":18802,"nodeType":996},{"target":18799},{"sys":18800},{"id":18801,"type":1001,"linkType":1002},"eEbdBUfyzZsdIOjFOXHpM",[],{"data":18804,"content":18808,"nodeType":996},{"target":18805},{"sys":18806},{"id":18807,"type":1001,"linkType":1002},"1MTFxfROuGKxnkHQwWHe8K",[],{"data":18810,"content":18811,"nodeType":860},{},[18812,18816,18821,18825,18830],{"data":18813,"marks":18814,"value":18815,"nodeType":864},{},[],"This makes it easy to surface both vulnerabilities and possible control gaps, and do something about them. But where Push really excels is in the ability to observe and block OAuth connection requests ",{"data":18817,"marks":18818,"value":18820,"nodeType":864},{},[18819],{"type":899},"even outside of your primary enterprise apps.",{"data":18822,"marks":18823,"value":18824,"nodeType":864},{},[]," Using Push, you can detect and block OAuth integration requests as they traverse the browser. This ",{"data":18826,"marks":18827,"value":18829,"nodeType":864},{},[18828],{"type":899},"app-agnostic",{"data":18831,"marks":18832,"value":18833,"nodeType":864},{},[]," level of control is absolutely critical to halting OAuth integration sprawl. ",{"data":18835,"content":18839,"nodeType":996},{"target":18836},{"sys":18837},{"id":18838,"type":1001,"linkType":1002},"2VZ4uw6MXslXME2ueydGuT",[],{"data":18841,"content":18842,"nodeType":1312},{},[18843,18847],{"data":18844,"marks":18845,"value":18846,"nodeType":864},{},[],"And t",{"data":18848,"marks":18849,"value":18851,"nodeType":864},{},[18850],{"type":899},"hat’s not all …",{"data":18853,"content":18854,"nodeType":860},{},[18855],{"data":18856,"marks":18857,"value":18858,"nodeType":864},{},[],"Push’s browser-based security platform also detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, device code phishing, ClickFix, and session hijacking in real time. This includes the most prominent infostealer delivery vectors in terms of malvertising and *Fix-style attacks. Push analyzes every web page in every browser session and tab for threats, in real time, with no latency. ",{"data":18860,"content":18861,"nodeType":860},{},[18862],{"data":18863,"marks":18864,"value":18865,"nodeType":864},{},[],"But as we've established, you don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your attack surface.",{"data":18867,"content":18868,"nodeType":860},{},[18869,18873,18881,18884,18893,18897,18904],{"data":18870,"marks":18871,"value":18872,"nodeType":864},{},[],"To learn more about Push, ",{"data":18874,"content":18876,"nodeType":883},{"uri":18875},"https://pushsecurity.com/resources/product-brochure",[18877],{"data":18878,"marks":18879,"value":18880,"nodeType":864},{},[],"check out our latest product overview",{"data":18882,"marks":18883,"value":3731,"nodeType":864},{},[],{"data":18885,"content":18887,"nodeType":883},{"uri":18886},"https://pushsecurity.com/product-demo/",[18888],{"data":18889,"marks":18890,"value":18892,"nodeType":864},{},[18891],{"type":1455},"view our demo library",{"data":18894,"marks":18895,"value":18896,"nodeType":864},{},[],", or ",{"data":18898,"content":18899,"nodeType":883},{"uri":1700},[18900],{"data":18901,"marks":18902,"value":18903,"nodeType":864},{},[],"book some time with one of our team for a live demo",{"data":18905,"marks":18906,"value":2924,"nodeType":864},{},[],"Unpacking the Vercel breach: A cautionary tale for Shadow AI and OAuth sprawl","In April 2026, Vercel was compromised via an OAuth app integrated into their Google Workspace tenant stemming from a compromised third-party AI SaaS provider.","2026-04-23T00:00:00.000Z","unpacking-the-vercel-breach",{"items":18912},[18913,18915],{"sys":18914,"name":15033},{"id":15032},{"sys":18916,"name":342},{"id":15029},{"items":18918},[18919],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":18920},{"url":2740},{"__typename":2059,"sys":18922,"content":18923,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":19992,"authorsCollection":19998},{"id":3628},{"json":18924},{"data":18925,"content":18926,"nodeType":856},{},[18927,18940,18945,18951,18957,18962,18965,18972,18979,18994,19032,19037,19050,19053,19060,19067,19089,19121,19127,19130,19137,19144,19150,19155,19161,19164,19171,19178,19212,19242,19248,19251,19258,19265,19285,19291,19330,19336,19339,19346,19353,19389,19395,19400,19403,19410,19417,19443,19449,19454,19460,19463,19470,19477,19500,19506,19512,19518,19521,19528,19535,19541,19546,19552,19573,19596,19599,19606,19613,19619,19625,19628,19635,19690,19693,19700,19706,19974,19977],{"data":18928,"content":18929,"nodeType":860},{},[18930,18933,18937],{"data":18931,"marks":18932,"value":3639,"nodeType":864},{},[],{"data":18934,"marks":18935,"value":3644,"nodeType":864},{},[18936],{"type":899},{"data":18938,"marks":18939,"value":3648,"nodeType":864},{},[],{"data":18941,"content":18944,"nodeType":996},{"target":18942},{"sys":18943},{"id":3653,"type":1001,"linkType":1002},[],{"data":18946,"content":18947,"nodeType":860},{},[18948],{"data":18949,"marks":18950,"value":3661,"nodeType":864},{},[],{"data":18952,"content":18953,"nodeType":860},{},[18954],{"data":18955,"marks":18956,"value":3668,"nodeType":864},{},[],{"data":18958,"content":18961,"nodeType":996},{"target":18959},{"sys":18960},{"id":3673,"type":1001,"linkType":1002},[],{"data":18963,"content":18964,"nodeType":1005},{},[],{"data":18966,"content":18967,"nodeType":1009},{},[18968],{"data":18969,"marks":18970,"value":3685,"nodeType":864},{},[18971],{"type":899},{"data":18973,"content":18974,"nodeType":860},{},[18975],{"data":18976,"marks":18977,"value":3693,"nodeType":864},{},[18978],{"type":899},{"data":18980,"content":18981,"nodeType":860},{},[18982,18985,18991],{"data":18983,"marks":18984,"value":3700,"nodeType":864},{},[],{"data":18986,"content":18987,"nodeType":883},{"uri":3703},[18988],{"data":18989,"marks":18990,"value":3708,"nodeType":864},{},[],{"data":18992,"marks":18993,"value":3712,"nodeType":864},{},[],{"data":18995,"content":18996,"nodeType":860},{},[18997,19000,19006,19009,19013,19016,19020,19023,19029],{"data":18998,"marks":18999,"value":3719,"nodeType":864},{},[],{"data":19001,"content":19002,"nodeType":883},{"uri":3722},[19003],{"data":19004,"marks":19005,"value":3727,"nodeType":864},{},[],{"data":19007,"marks":19008,"value":3731,"nodeType":864},{},[],{"data":19010,"marks":19011,"value":3736,"nodeType":864},{},[19012],{"type":899},{"data":19014,"marks":19015,"value":2232,"nodeType":864},{},[],{"data":19017,"marks":19018,"value":3744,"nodeType":864},{},[19019],{"type":899},{"data":19021,"marks":19022,"value":3748,"nodeType":864},{},[],{"data":19024,"content":19025,"nodeType":883},{"uri":3751},[19026],{"data":19027,"marks":19028,"value":3756,"nodeType":864},{},[],{"data":19030,"marks":19031,"value":3760,"nodeType":864},{},[],{"data":19033,"content":19036,"nodeType":996},{"target":19034},{"sys":19035},{"id":3765,"type":1001,"linkType":1002},[],{"data":19038,"content":19039,"nodeType":860},{},[19040,19043,19047],{"data":19041,"marks":19042,"value":3773,"nodeType":864},{},[],{"data":19044,"marks":19045,"value":3778,"nodeType":864},{},[19046],{"type":899},{"data":19048,"marks":19049,"value":2924,"nodeType":864},{},[],{"data":19051,"content":19052,"nodeType":1005},{},[],{"data":19054,"content":19055,"nodeType":1009},{},[19056],{"data":19057,"marks":19058,"value":3792,"nodeType":864},{},[19059],{"type":899},{"data":19061,"content":19062,"nodeType":860},{},[19063],{"data":19064,"marks":19065,"value":3693,"nodeType":864},{},[19066],{"type":899},{"data":19068,"content":19069,"nodeType":860},{},[19070,19073,19079,19082,19086],{"data":19071,"marks":19072,"value":3806,"nodeType":864},{},[],{"data":19074,"content":19075,"nodeType":883},{"uri":3809},[19076],{"data":19077,"marks":19078,"value":3814,"nodeType":864},{},[],{"data":19080,"marks":19081,"value":3818,"nodeType":864},{},[],{"data":19083,"marks":19084,"value":3823,"nodeType":864},{},[19085],{"type":899},{"data":19087,"marks":19088,"value":3827,"nodeType":864},{},[],{"data":19090,"content":19091,"nodeType":860},{},[19092,19095,19101,19104,19108,19111,19118],{"data":19093,"marks":19094,"value":3834,"nodeType":864},{},[],{"data":19096,"content":19097,"nodeType":883},{"uri":3837},[19098],{"data":19099,"marks":19100,"value":3842,"nodeType":864},{},[],{"data":19102,"marks":19103,"value":3846,"nodeType":864},{},[],{"data":19105,"marks":19106,"value":3851,"nodeType":864},{},[19107],{"type":899},{"data":19109,"marks":19110,"value":3855,"nodeType":864},{},[],{"data":19112,"content":19113,"nodeType":883},{"uri":3858},[19114],{"data":19115,"marks":19116,"value":3864,"nodeType":864},{},[19117],{"type":899},{"data":19119,"marks":19120,"value":3868,"nodeType":864},{},[],{"data":19122,"content":19123,"nodeType":860},{},[19124],{"data":19125,"marks":19126,"value":3875,"nodeType":864},{},[],{"data":19128,"content":19129,"nodeType":1005},{},[],{"data":19131,"content":19132,"nodeType":1009},{},[19133],{"data":19134,"marks":19135,"value":3886,"nodeType":864},{},[19136],{"type":899},{"data":19138,"content":19139,"nodeType":860},{},[19140],{"data":19141,"marks":19142,"value":3894,"nodeType":864},{},[19143],{"type":899},{"data":19145,"content":19146,"nodeType":860},{},[19147],{"data":19148,"marks":19149,"value":3901,"nodeType":864},{},[],{"data":19151,"content":19154,"nodeType":996},{"target":19152},{"sys":19153},{"id":3906,"type":1001,"linkType":1002},[],{"data":19156,"content":19157,"nodeType":860},{},[19158],{"data":19159,"marks":19160,"value":3914,"nodeType":864},{},[],{"data":19162,"content":19163,"nodeType":1005},{},[],{"data":19165,"content":19166,"nodeType":1009},{},[19167],{"data":19168,"marks":19169,"value":3925,"nodeType":864},{},[19170],{"type":899},{"data":19172,"content":19173,"nodeType":860},{},[19174],{"data":19175,"marks":19176,"value":3894,"nodeType":864},{},[19177],{"type":899},{"data":19179,"content":19180,"nodeType":860},{},[19181,19184,19191,19194,19200,19203,19209],{"data":19182,"marks":19183,"value":3939,"nodeType":864},{},[],{"data":19185,"content":19186,"nodeType":883},{"uri":3942},[19187],{"data":19188,"marks":19189,"value":3948,"nodeType":864},{},[19190],{"type":1455},{"data":19192,"marks":19193,"value":3731,"nodeType":864},{},[],{"data":19195,"content":19196,"nodeType":883},{"uri":3954},[19197],{"data":19198,"marks":19199,"value":3959,"nodeType":864},{},[],{"data":19201,"marks":19202,"value":3731,"nodeType":864},{},[],{"data":19204,"content":19205,"nodeType":883},{"uri":3965},[19206],{"data":19207,"marks":19208,"value":3970,"nodeType":864},{},[],{"data":19210,"marks":19211,"value":3974,"nodeType":864},{},[],{"data":19213,"content":19214,"nodeType":860},{},[19215,19218,19225,19228,19232,19235,19239],{"data":19216,"marks":19217,"value":21,"nodeType":864},{},[],{"data":19219,"content":19220,"nodeType":883},{"uri":2411},[19221],{"data":19222,"marks":19223,"value":3988,"nodeType":864},{},[19224],{"type":1455},{"data":19226,"marks":19227,"value":3992,"nodeType":864},{},[],{"data":19229,"marks":19230,"value":3997,"nodeType":864},{},[19231],{"type":899},{"data":19233,"marks":19234,"value":4001,"nodeType":864},{},[],{"data":19236,"marks":19237,"value":4006,"nodeType":864},{},[19238],{"type":2246},{"data":19240,"marks":19241,"value":4010,"nodeType":864},{},[],{"data":19243,"content":19244,"nodeType":860},{},[19245],{"data":19246,"marks":19247,"value":4017,"nodeType":864},{},[],{"data":19249,"content":19250,"nodeType":1005},{},[],{"data":19252,"content":19253,"nodeType":1009},{},[19254],{"data":19255,"marks":19256,"value":4028,"nodeType":864},{},[19257],{"type":899},{"data":19259,"content":19260,"nodeType":860},{},[19261],{"data":19262,"marks":19263,"value":3894,"nodeType":864},{},[19264],{"type":899},{"data":19266,"content":19267,"nodeType":860},{},[19268,19271,19275,19278,19282],{"data":19269,"marks":19270,"value":4042,"nodeType":864},{},[],{"data":19272,"marks":19273,"value":4047,"nodeType":864},{},[19274],{"type":2246},{"data":19276,"marks":19277,"value":4051,"nodeType":864},{},[],{"data":19279,"marks":19280,"value":4056,"nodeType":864},{},[19281],{"type":2246},{"data":19283,"marks":19284,"value":4060,"nodeType":864},{},[],{"data":19286,"content":19287,"nodeType":860},{},[19288],{"data":19289,"marks":19290,"value":4067,"nodeType":864},{},[],{"data":19292,"content":19293,"nodeType":941},{},[19294,19312],{"data":19295,"content":19296,"nodeType":945},{},[19297],{"data":19298,"content":19299,"nodeType":860},{},[19300,19303,19309],{"data":19301,"marks":19302,"value":2761,"nodeType":864},{},[],{"data":19304,"content":19305,"nodeType":883},{"uri":4082},[19306],{"data":19307,"marks":19308,"value":4087,"nodeType":864},{},[],{"data":19310,"marks":19311,"value":4091,"nodeType":864},{},[],{"data":19313,"content":19314,"nodeType":945},{},[19315],{"data":19316,"content":19317,"nodeType":860},{},[19318,19321,19327],{"data":19319,"marks":19320,"value":2761,"nodeType":864},{},[],{"data":19322,"content":19323,"nodeType":883},{"uri":4103},[19324],{"data":19325,"marks":19326,"value":4108,"nodeType":864},{},[],{"data":19328,"marks":19329,"value":4112,"nodeType":864},{},[],{"data":19331,"content":19332,"nodeType":860},{},[19333],{"data":19334,"marks":19335,"value":4119,"nodeType":864},{},[],{"data":19337,"content":19338,"nodeType":1005},{},[],{"data":19340,"content":19341,"nodeType":1009},{},[19342],{"data":19343,"marks":19344,"value":4130,"nodeType":864},{},[19345],{"type":899},{"data":19347,"content":19348,"nodeType":860},{},[19349],{"data":19350,"marks":19351,"value":4138,"nodeType":864},{},[19352],{"type":899},{"data":19354,"content":19355,"nodeType":860},{},[19356,19359,19363,19366,19372,19375,19379,19382,19386],{"data":19357,"marks":19358,"value":4145,"nodeType":864},{},[],{"data":19360,"marks":19361,"value":4150,"nodeType":864},{},[19362],{"type":899},{"data":19364,"marks":19365,"value":4154,"nodeType":864},{},[],{"data":19367,"content":19368,"nodeType":883},{"uri":3237},[19369],{"data":19370,"marks":19371,"value":4161,"nodeType":864},{},[],{"data":19373,"marks":19374,"value":4165,"nodeType":864},{},[],{"data":19376,"marks":19377,"value":4170,"nodeType":864},{},[19378],{"type":899},{"data":19380,"marks":19381,"value":4174,"nodeType":864},{},[],{"data":19383,"marks":19384,"value":4179,"nodeType":864},{},[19385],{"type":899},{"data":19387,"marks":19388,"value":4183,"nodeType":864},{},[],{"data":19390,"content":19391,"nodeType":860},{},[19392],{"data":19393,"marks":19394,"value":4190,"nodeType":864},{},[],{"data":19396,"content":19399,"nodeType":996},{"target":19397},{"sys":19398},{"id":4195,"type":1001,"linkType":1002},[],{"data":19401,"content":19402,"nodeType":1005},{},[],{"data":19404,"content":19405,"nodeType":1009},{},[19406],{"data":19407,"marks":19408,"value":4207,"nodeType":864},{},[19409],{"type":899},{"data":19411,"content":19412,"nodeType":860},{},[19413],{"data":19414,"marks":19415,"value":4215,"nodeType":864},{},[19416],{"type":899},{"data":19418,"content":19419,"nodeType":860},{},[19420,19423,19430,19433,19440],{"data":19421,"marks":19422,"value":4222,"nodeType":864},{},[],{"data":19424,"content":19425,"nodeType":883},{"uri":2561},[19426],{"data":19427,"marks":19428,"value":4230,"nodeType":864},{},[19429],{"type":899},{"data":19431,"marks":19432,"value":4234,"nodeType":864},{},[],{"data":19434,"content":19435,"nodeType":883},{"uri":4237},[19436],{"data":19437,"marks":19438,"value":4243,"nodeType":864},{},[19439],{"type":899},{"data":19441,"marks":19442,"value":4247,"nodeType":864},{},[],{"data":19444,"content":19445,"nodeType":860},{},[19446],{"data":19447,"marks":19448,"value":4254,"nodeType":864},{},[],{"data":19450,"content":19453,"nodeType":996},{"target":19451},{"sys":19452},{"id":4259,"type":1001,"linkType":1002},[],{"data":19455,"content":19456,"nodeType":860},{},[19457],{"data":19458,"marks":19459,"value":4267,"nodeType":864},{},[],{"data":19461,"content":19462,"nodeType":1005},{},[],{"data":19464,"content":19465,"nodeType":1009},{},[19466],{"data":19467,"marks":19468,"value":4278,"nodeType":864},{},[19469],{"type":899},{"data":19471,"content":19472,"nodeType":860},{},[19473],{"data":19474,"marks":19475,"value":4286,"nodeType":864},{},[19476],{"type":899},{"data":19478,"content":19479,"nodeType":860},{},[19480,19483,19487,19490,19497],{"data":19481,"marks":19482,"value":4293,"nodeType":864},{},[],{"data":19484,"marks":19485,"value":4298,"nodeType":864},{},[19486],{"type":2246},{"data":19488,"marks":19489,"value":4302,"nodeType":864},{},[],{"data":19491,"content":19492,"nodeType":883},{"uri":4305},[19493],{"data":19494,"marks":19495,"value":4311,"nodeType":864},{},[19496],{"type":899},{"data":19498,"marks":19499,"value":4315,"nodeType":864},{},[],{"data":19501,"content":19502,"nodeType":860},{},[19503],{"data":19504,"marks":19505,"value":4322,"nodeType":864},{},[],{"data":19507,"content":19508,"nodeType":860},{},[19509],{"data":19510,"marks":19511,"value":4329,"nodeType":864},{},[],{"data":19513,"content":19514,"nodeType":860},{},[19515],{"data":19516,"marks":19517,"value":4336,"nodeType":864},{},[],{"data":19519,"content":19520,"nodeType":1005},{},[],{"data":19522,"content":19523,"nodeType":1009},{},[19524],{"data":19525,"marks":19526,"value":4347,"nodeType":864},{},[19527],{"type":899},{"data":19529,"content":19530,"nodeType":860},{},[19531],{"data":19532,"marks":19533,"value":4355,"nodeType":864},{},[19534],{"type":899},{"data":19536,"content":19537,"nodeType":860},{},[19538],{"data":19539,"marks":19540,"value":4362,"nodeType":864},{},[],{"data":19542,"content":19545,"nodeType":996},{"target":19543},{"sys":19544},{"id":4367,"type":1001,"linkType":1002},[],{"data":19547,"content":19548,"nodeType":860},{},[19549],{"data":19550,"marks":19551,"value":4375,"nodeType":864},{},[],{"data":19553,"content":19554,"nodeType":941},{},[19555,19564],{"data":19556,"content":19557,"nodeType":945},{},[19558],{"data":19559,"content":19560,"nodeType":860},{},[19561],{"data":19562,"marks":19563,"value":4388,"nodeType":864},{},[],{"data":19565,"content":19566,"nodeType":945},{},[19567],{"data":19568,"content":19569,"nodeType":860},{},[19570],{"data":19571,"marks":19572,"value":4398,"nodeType":864},{},[],{"data":19574,"content":19575,"nodeType":860},{},[19576,19579,19586,19589,19593],{"data":19577,"marks":19578,"value":4405,"nodeType":864},{},[],{"data":19580,"content":19581,"nodeType":883},{"uri":4408},[19582],{"data":19583,"marks":19584,"value":4414,"nodeType":864},{},[19585],{"type":899},{"data":19587,"marks":19588,"value":4418,"nodeType":864},{},[],{"data":19590,"marks":19591,"value":4423,"nodeType":864},{},[19592],{"type":2246},{"data":19594,"marks":19595,"value":4427,"nodeType":864},{},[],{"data":19597,"content":19598,"nodeType":1005},{},[],{"data":19600,"content":19601,"nodeType":1009},{},[19602],{"data":19603,"marks":19604,"value":4438,"nodeType":864},{},[19605],{"type":899},{"data":19607,"content":19608,"nodeType":860},{},[19609],{"data":19610,"marks":19611,"value":4446,"nodeType":864},{},[19612],{"type":899},{"data":19614,"content":19615,"nodeType":860},{},[19616],{"data":19617,"marks":19618,"value":4453,"nodeType":864},{},[],{"data":19620,"content":19621,"nodeType":860},{},[19622],{"data":19623,"marks":19624,"value":4460,"nodeType":864},{},[],{"data":19626,"content":19627,"nodeType":1005},{},[],{"data":19629,"content":19630,"nodeType":1009},{},[19631],{"data":19632,"marks":19633,"value":4471,"nodeType":864},{},[19634],{"type":899},{"data":19636,"content":19637,"nodeType":941},{},[19638,19651,19664,19677],{"data":19639,"content":19640,"nodeType":945},{},[19641],{"data":19642,"content":19643,"nodeType":860},{},[19644,19648],{"data":19645,"marks":19646,"value":4485,"nodeType":864},{},[19647],{"type":899},{"data":19649,"marks":19650,"value":4489,"nodeType":864},{},[],{"data":19652,"content":19653,"nodeType":945},{},[19654],{"data":19655,"content":19656,"nodeType":860},{},[19657,19661],{"data":19658,"marks":19659,"value":4500,"nodeType":864},{},[19660],{"type":899},{"data":19662,"marks":19663,"value":4504,"nodeType":864},{},[],{"data":19665,"content":19666,"nodeType":945},{},[19667],{"data":19668,"content":19669,"nodeType":860},{},[19670,19674],{"data":19671,"marks":19672,"value":4515,"nodeType":864},{},[19673],{"type":899},{"data":19675,"marks":19676,"value":4519,"nodeType":864},{},[],{"data":19678,"content":19679,"nodeType":945},{},[19680],{"data":19681,"content":19682,"nodeType":860},{},[19683,19687],{"data":19684,"marks":19685,"value":781,"nodeType":864},{},[19686],{"type":899},{"data":19688,"marks":19689,"value":4533,"nodeType":864},{},[],{"data":19691,"content":19692,"nodeType":1005},{},[],{"data":19694,"content":19695,"nodeType":1009},{},[19696],{"data":19697,"marks":19698,"value":4544,"nodeType":864},{},[19699],{"type":899},{"data":19701,"content":19702,"nodeType":860},{},[19703],{"data":19704,"marks":19705,"value":4551,"nodeType":864},{},[],{"data":19707,"content":19708,"nodeType":4845},{},[19709,19732,19754,19776,19798,19820,19842,19864,19886,19908,19930,19952],{"data":19710,"content":19711,"nodeType":4581},{},[19712,19722],{"data":19713,"content":19714,"nodeType":4569},{},[19715],{"data":19716,"content":19717,"nodeType":860},{},[19718],{"data":19719,"marks":19720,"value":4568,"nodeType":864},{},[19721],{"type":899},{"data":19723,"content":19724,"nodeType":4569},{},[19725],{"data":19726,"content":19727,"nodeType":860},{},[19728],{"data":19729,"marks":19730,"value":4580,"nodeType":864},{},[19731],{"type":899},{"data":19733,"content":19734,"nodeType":4581},{},[19735,19745],{"data":19736,"content":19737,"nodeType":4569},{},[19738],{"data":19739,"content":19740,"nodeType":860},{},[19741],{"data":19742,"marks":19743,"value":4595,"nodeType":864},{},[19744],{"type":899},{"data":19746,"content":19747,"nodeType":4569},{},[19748],{"data":19749,"content":19750,"nodeType":860},{},[19751],{"data":19752,"marks":19753,"value":4605,"nodeType":864},{},[],{"data":19755,"content":19756,"nodeType":4581},{},[19757,19767],{"data":19758,"content":19759,"nodeType":4569},{},[19760],{"data":19761,"content":19762,"nodeType":860},{},[19763],{"data":19764,"marks":19765,"value":4619,"nodeType":864},{},[19766],{"type":899},{"data":19768,"content":19769,"nodeType":4569},{},[19770],{"data":19771,"content":19772,"nodeType":860},{},[19773],{"data":19774,"marks":19775,"value":4629,"nodeType":864},{},[],{"data":19777,"content":19778,"nodeType":4581},{},[19779,19789],{"data":19780,"content":19781,"nodeType":4569},{},[19782],{"data":19783,"content":19784,"nodeType":860},{},[19785],{"data":19786,"marks":19787,"value":4643,"nodeType":864},{},[19788],{"type":899},{"data":19790,"content":19791,"nodeType":4569},{},[19792],{"data":19793,"content":19794,"nodeType":860},{},[19795],{"data":19796,"marks":19797,"value":4653,"nodeType":864},{},[],{"data":19799,"content":19800,"nodeType":4581},{},[19801,19811],{"data":19802,"content":19803,"nodeType":4569},{},[19804],{"data":19805,"content":19806,"nodeType":860},{},[19807],{"data":19808,"marks":19809,"value":4667,"nodeType":864},{},[19810],{"type":899},{"data":19812,"content":19813,"nodeType":4569},{},[19814],{"data":19815,"content":19816,"nodeType":860},{},[19817],{"data":19818,"marks":19819,"value":4677,"nodeType":864},{},[],{"data":19821,"content":19822,"nodeType":4581},{},[19823,19833],{"data":19824,"content":19825,"nodeType":4569},{},[19826],{"data":19827,"content":19828,"nodeType":860},{},[19829],{"data":19830,"marks":19831,"value":4691,"nodeType":864},{},[19832],{"type":899},{"data":19834,"content":19835,"nodeType":4569},{},[19836],{"data":19837,"content":19838,"nodeType":860},{},[19839],{"data":19840,"marks":19841,"value":4701,"nodeType":864},{},[],{"data":19843,"content":19844,"nodeType":4581},{},[19845,19855],{"data":19846,"content":19847,"nodeType":4569},{},[19848],{"data":19849,"content":19850,"nodeType":860},{},[19851],{"data":19852,"marks":19853,"value":4715,"nodeType":864},{},[19854],{"type":899},{"data":19856,"content":19857,"nodeType":4569},{},[19858],{"data":19859,"content":19860,"nodeType":860},{},[19861],{"data":19862,"marks":19863,"value":4725,"nodeType":864},{},[],{"data":19865,"content":19866,"nodeType":4581},{},[19867,19877],{"data":19868,"content":19869,"nodeType":4569},{},[19870],{"data":19871,"content":19872,"nodeType":860},{},[19873],{"data":19874,"marks":19875,"value":4739,"nodeType":864},{},[19876],{"type":899},{"data":19878,"content":19879,"nodeType":4569},{},[19880],{"data":19881,"content":19882,"nodeType":860},{},[19883],{"data":19884,"marks":19885,"value":4749,"nodeType":864},{},[],{"data":19887,"content":19888,"nodeType":4581},{},[19889,19899],{"data":19890,"content":19891,"nodeType":4569},{},[19892],{"data":19893,"content":19894,"nodeType":860},{},[19895],{"data":19896,"marks":19897,"value":4763,"nodeType":864},{},[19898],{"type":899},{"data":19900,"content":19901,"nodeType":4569},{},[19902],{"data":19903,"content":19904,"nodeType":860},{},[19905],{"data":19906,"marks":19907,"value":4773,"nodeType":864},{},[],{"data":19909,"content":19910,"nodeType":4581},{},[19911,19921],{"data":19912,"content":19913,"nodeType":4569},{},[19914],{"data":19915,"content":19916,"nodeType":860},{},[19917],{"data":19918,"marks":19919,"value":4787,"nodeType":864},{},[19920],{"type":899},{"data":19922,"content":19923,"nodeType":4569},{},[19924],{"data":19925,"content":19926,"nodeType":860},{},[19927],{"data":19928,"marks":19929,"value":4797,"nodeType":864},{},[],{"data":19931,"content":19932,"nodeType":4581},{},[19933,19943],{"data":19934,"content":19935,"nodeType":4569},{},[19936],{"data":19937,"content":19938,"nodeType":860},{},[19939],{"data":19940,"marks":19941,"value":4811,"nodeType":864},{},[19942],{"type":899},{"data":19944,"content":19945,"nodeType":4569},{},[19946],{"data":19947,"content":19948,"nodeType":860},{},[19949],{"data":19950,"marks":19951,"value":4821,"nodeType":864},{},[],{"data":19953,"content":19954,"nodeType":4581},{},[19955,19965],{"data":19956,"content":19957,"nodeType":4569},{},[19958],{"data":19959,"content":19960,"nodeType":860},{},[19961],{"data":19962,"marks":19963,"value":4500,"nodeType":864},{},[19964],{"type":899},{"data":19966,"content":19967,"nodeType":4569},{},[19968],{"data":19969,"content":19970,"nodeType":860},{},[19971],{"data":19972,"marks":19973,"value":4844,"nodeType":864},{},[],{"data":19975,"content":19976,"nodeType":1005},{},[],{"data":19978,"content":19979,"nodeType":860},{},[19980,19983,19989],{"data":19981,"marks":19982,"value":4855,"nodeType":864},{},[],{"data":19984,"content":19985,"nodeType":883},{"uri":1700},[19986],{"data":19987,"marks":19988,"value":1703,"nodeType":864},{},[],{"data":19990,"marks":19991,"value":21,"nodeType":864},{},[],{"items":19993},[19994,19996],{"sys":19995,"name":297},{"id":2732},{"sys":19997,"name":2729},{"id":2728},{"items":19999},[20000],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":20001},{"url":4881},{"__typename":2059,"sys":20003,"content":20004,"title":845,"synopsis":4895,"hashTags":59,"publishedDate":2055,"slug":4882,"tagsCollection":20714,"authorsCollection":20720},{"id":4897},{"json":20005},{"nodeType":856,"data":20006,"content":20007},{},[20008,20014,20020,20058,20064,20070,20118,20123,20126,20133,20139,20149,20154,20164,20169,20179,20184,20187,20194,20200,20215,20224,20230,20236,20239,20246,20252,20272,20277,20283,20296,20309,20314,20327,20340,20346,20352,20358,20363,20366,20373,20379,20385,20391,20404,20410,20430,20435,20441,20446,20456,20462,20467,20472,20475,20482,20488,20504,20510,20517,20523,20533,20546,20551,20561,20588,20594,20607,20612,20625,20631,20637,20640,20647,20653,20659,20665,20671,20677,20683,20686,20692,20698],{"nodeType":860,"data":20009,"content":20010},{},[20011],{"nodeType":864,"value":865,"marks":20012,"data":20013},[],{},{"nodeType":860,"data":20015,"content":20016},{},[20017],{"nodeType":864,"value":872,"marks":20018,"data":20019},[],{},{"nodeType":860,"data":20021,"content":20022},{},[20023,20026,20032,20035,20039,20042,20046,20049,20055],{"nodeType":864,"value":879,"marks":20024,"data":20025},[],{},{"nodeType":883,"data":20027,"content":20028},{"uri":885},[20029],{"nodeType":864,"value":888,"marks":20030,"data":20031},[],{},{"nodeType":864,"value":892,"marks":20033,"data":20034},[],{},{"nodeType":864,"value":896,"marks":20036,"data":20038},[20037],{"type":899},{},{"nodeType":864,"value":902,"marks":20040,"data":20041},[],{},{"nodeType":864,"value":906,"marks":20043,"data":20045},[20044],{"type":899},{},{"nodeType":864,"value":911,"marks":20047,"data":20048},[],{},{"nodeType":883,"data":20050,"content":20051},{"uri":916},[20052],{"nodeType":864,"value":919,"marks":20053,"data":20054},[],{},{"nodeType":864,"value":923,"marks":20056,"data":20057},[],{},{"nodeType":860,"data":20059,"content":20060},{},[20061],{"nodeType":864,"value":930,"marks":20062,"data":20063},[],{},{"nodeType":860,"data":20065,"content":20066},{},[20067],{"nodeType":864,"value":937,"marks":20068,"data":20069},[],{},{"nodeType":941,"data":20071,"content":20072},{},[20073,20082,20091,20100,20109],{"nodeType":945,"data":20074,"content":20075},{},[20076],{"nodeType":860,"data":20077,"content":20078},{},[20079],{"nodeType":864,"value":952,"marks":20080,"data":20081},[],{},{"nodeType":945,"data":20083,"content":20084},{},[20085],{"nodeType":860,"data":20086,"content":20087},{},[20088],{"nodeType":864,"value":962,"marks":20089,"data":20090},[],{},{"nodeType":945,"data":20092,"content":20093},{},[20094],{"nodeType":860,"data":20095,"content":20096},{},[20097],{"nodeType":864,"value":972,"marks":20098,"data":20099},[],{},{"nodeType":945,"data":20101,"content":20102},{},[20103],{"nodeType":860,"data":20104,"content":20105},{},[20106],{"nodeType":864,"value":982,"marks":20107,"data":20108},[],{},{"nodeType":945,"data":20110,"content":20111},{},[20112],{"nodeType":860,"data":20113,"content":20114},{},[20115],{"nodeType":864,"value":992,"marks":20116,"data":20117},[],{},{"nodeType":996,"data":20119,"content":20122},{"target":20120},{"sys":20121},{"id":1000,"type":1001,"linkType":1002},[],{"nodeType":1005,"data":20124,"content":20125},{},[],{"nodeType":1009,"data":20127,"content":20128},{},[20129],{"nodeType":864,"value":1013,"marks":20130,"data":20132},[20131],{"type":899},{},{"nodeType":860,"data":20134,"content":20135},{},[20136],{"nodeType":864,"value":1021,"marks":20137,"data":20138},[],{},{"nodeType":860,"data":20140,"content":20141},{},[20142,20146],{"nodeType":864,"value":1028,"marks":20143,"data":20145},[20144],{"type":899},{},{"nodeType":864,"value":1033,"marks":20147,"data":20148},[],{},{"nodeType":996,"data":20150,"content":20153},{"target":20151},{"sys":20152},{"id":1040,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20155,"content":20156},{},[20157,20161],{"nodeType":864,"value":1046,"marks":20158,"data":20160},[20159],{"type":899},{},{"nodeType":864,"value":1051,"marks":20162,"data":20163},[],{},{"nodeType":996,"data":20165,"content":20168},{"target":20166},{"sys":20167},{"id":1058,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20170,"content":20171},{},[20172,20176],{"nodeType":864,"value":1064,"marks":20173,"data":20175},[20174],{"type":899},{},{"nodeType":864,"value":1069,"marks":20177,"data":20178},[],{},{"nodeType":996,"data":20180,"content":20183},{"target":20181},{"sys":20182},{"id":1076,"type":1001,"linkType":1002},[],{"nodeType":1005,"data":20185,"content":20186},{},[],{"nodeType":1009,"data":20188,"content":20189},{},[20190],{"nodeType":864,"value":1085,"marks":20191,"data":20193},[20192],{"type":899},{},{"nodeType":860,"data":20195,"content":20196},{},[20197],{"nodeType":864,"value":1093,"marks":20198,"data":20199},[],{},{"nodeType":860,"data":20201,"content":20202},{},[20203,20206,20212],{"nodeType":864,"value":1100,"marks":20204,"data":20205},[],{},{"nodeType":883,"data":20207,"content":20208},{"uri":1105},[20209],{"nodeType":864,"value":1108,"marks":20210,"data":20211},[],{},{"nodeType":864,"value":1112,"marks":20213,"data":20214},[],{},{"nodeType":1116,"data":20216,"content":20217},{},[20218],{"nodeType":860,"data":20219,"content":20220},{},[20221],{"nodeType":864,"value":1123,"marks":20222,"data":20223},[],{},{"nodeType":860,"data":20225,"content":20226},{},[20227],{"nodeType":864,"value":1130,"marks":20228,"data":20229},[],{},{"nodeType":860,"data":20231,"content":20232},{},[20233],{"nodeType":864,"value":1137,"marks":20234,"data":20235},[],{},{"nodeType":1005,"data":20237,"content":20238},{},[],{"nodeType":1009,"data":20240,"content":20241},{},[20242],{"nodeType":864,"value":1147,"marks":20243,"data":20245},[20244],{"type":899},{},{"nodeType":860,"data":20247,"content":20248},{},[20249],{"nodeType":864,"value":1155,"marks":20250,"data":20251},[],{},{"nodeType":860,"data":20253,"content":20254},{},[20255,20258,20262,20265,20269],{"nodeType":864,"value":1162,"marks":20256,"data":20257},[],{},{"nodeType":864,"value":1166,"marks":20259,"data":20261},[20260],{"type":899},{},{"nodeType":864,"value":1171,"marks":20263,"data":20264},[],{},{"nodeType":864,"value":1175,"marks":20266,"data":20268},[20267],{"type":899},{},{"nodeType":864,"value":1180,"marks":20270,"data":20271},[],{},{"nodeType":996,"data":20273,"content":20276},{"target":20274},{"sys":20275},{"id":1187,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20278,"content":20279},{},[20280],{"nodeType":864,"value":1193,"marks":20281,"data":20282},[],{},{"nodeType":860,"data":20284,"content":20285},{},[20286,20289,20293],{"nodeType":864,"value":1200,"marks":20287,"data":20288},[],{},{"nodeType":864,"value":1204,"marks":20290,"data":20292},[20291],{"type":899},{},{"nodeType":864,"value":1209,"marks":20294,"data":20295},[],{},{"nodeType":860,"data":20297,"content":20298},{},[20299,20302,20306],{"nodeType":864,"value":1216,"marks":20300,"data":20301},[],{},{"nodeType":864,"value":1220,"marks":20303,"data":20305},[20304],{"type":899},{},{"nodeType":864,"value":1225,"marks":20307,"data":20308},[],{},{"nodeType":996,"data":20310,"content":20313},{"target":20311},{"sys":20312},{"id":1232,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20315,"content":20316},{},[20317,20320,20324],{"nodeType":864,"value":1238,"marks":20318,"data":20319},[],{},{"nodeType":864,"value":1242,"marks":20321,"data":20323},[20322],{"type":899},{},{"nodeType":864,"value":1247,"marks":20325,"data":20326},[],{},{"nodeType":860,"data":20328,"content":20329},{},[20330,20333,20337],{"nodeType":864,"value":1254,"marks":20331,"data":20332},[],{},{"nodeType":864,"value":1258,"marks":20334,"data":20336},[20335],{"type":899},{},{"nodeType":864,"value":1263,"marks":20338,"data":20339},[],{},{"nodeType":860,"data":20341,"content":20342},{},[20343],{"nodeType":864,"value":1270,"marks":20344,"data":20345},[],{},{"nodeType":860,"data":20347,"content":20348},{},[20349],{"nodeType":864,"value":1277,"marks":20350,"data":20351},[],{},{"nodeType":860,"data":20353,"content":20354},{},[20355],{"nodeType":864,"value":1284,"marks":20356,"data":20357},[],{},{"nodeType":996,"data":20359,"content":20362},{"target":20360},{"sys":20361},{"id":1291,"type":1001,"linkType":1002},[],{"nodeType":1005,"data":20364,"content":20365},{},[],{"nodeType":1009,"data":20367,"content":20368},{},[20369],{"nodeType":864,"value":1300,"marks":20370,"data":20372},[20371],{"type":899},{},{"nodeType":860,"data":20374,"content":20375},{},[20376],{"nodeType":864,"value":1308,"marks":20377,"data":20378},[],{},{"nodeType":1312,"data":20380,"content":20381},{},[20382],{"nodeType":864,"value":1316,"marks":20383,"data":20384},[],{},{"nodeType":860,"data":20386,"content":20387},{},[20388],{"nodeType":864,"value":1323,"marks":20389,"data":20390},[],{},{"nodeType":860,"data":20392,"content":20393},{},[20394,20397,20401],{"nodeType":864,"value":1330,"marks":20395,"data":20396},[],{},{"nodeType":864,"value":1334,"marks":20398,"data":20400},[20399],{"type":899},{},{"nodeType":864,"value":1339,"marks":20402,"data":20403},[],{},{"nodeType":860,"data":20405,"content":20406},{},[20407],{"nodeType":864,"value":1346,"marks":20408,"data":20409},[],{},{"nodeType":860,"data":20411,"content":20412},{},[20413,20416,20420,20423,20427],{"nodeType":864,"value":1353,"marks":20414,"data":20415},[],{},{"nodeType":864,"value":1357,"marks":20417,"data":20419},[20418],{"type":899},{},{"nodeType":864,"value":1362,"marks":20421,"data":20422},[],{},{"nodeType":864,"value":1366,"marks":20424,"data":20426},[20425],{"type":899},{},{"nodeType":864,"value":1371,"marks":20428,"data":20429},[],{},{"nodeType":996,"data":20431,"content":20434},{"target":20432},{"sys":20433},{"id":1378,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20436,"content":20437},{},[20438],{"nodeType":864,"value":1384,"marks":20439,"data":20440},[],{},{"nodeType":996,"data":20442,"content":20445},{"target":20443},{"sys":20444},{"id":1391,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20447,"content":20448},{},[20449,20453],{"nodeType":864,"value":1397,"marks":20450,"data":20452},[20451],{"type":899},{},{"nodeType":864,"value":1402,"marks":20454,"data":20455},[],{},{"nodeType":860,"data":20457,"content":20458},{},[20459],{"nodeType":864,"value":1409,"marks":20460,"data":20461},[],{},{"nodeType":996,"data":20463,"content":20466},{"target":20464},{"sys":20465},{"id":1416,"type":1001,"linkType":1002},[],{"nodeType":996,"data":20468,"content":20471},{"target":20469},{"sys":20470},{"id":1422,"type":1001,"linkType":1002},[],{"nodeType":1005,"data":20473,"content":20474},{},[],{"nodeType":1009,"data":20476,"content":20477},{},[20478],{"nodeType":864,"value":1431,"marks":20479,"data":20481},[20480],{"type":899},{},{"nodeType":860,"data":20483,"content":20484},{},[20485],{"nodeType":864,"value":1439,"marks":20486,"data":20487},[],{},{"nodeType":860,"data":20489,"content":20490},{},[20491,20494,20501],{"nodeType":864,"value":21,"marks":20492,"data":20493},[],{},{"nodeType":883,"data":20495,"content":20496},{"uri":916},[20497],{"nodeType":864,"value":1452,"marks":20498,"data":20500},[20499],{"type":1455},{},{"nodeType":864,"value":1458,"marks":20502,"data":20503},[],{},{"nodeType":860,"data":20505,"content":20506},{},[20507],{"nodeType":864,"value":1465,"marks":20508,"data":20509},[],{},{"nodeType":1312,"data":20511,"content":20512},{},[20513],{"nodeType":864,"value":1472,"marks":20514,"data":20516},[20515],{"type":899},{},{"nodeType":860,"data":20518,"content":20519},{},[20520],{"nodeType":864,"value":1480,"marks":20521,"data":20522},[],{},{"nodeType":860,"data":20524,"content":20525},{},[20526,20530],{"nodeType":864,"value":1487,"marks":20527,"data":20529},[20528],{"type":899},{},{"nodeType":864,"value":1492,"marks":20531,"data":20532},[],{},{"nodeType":860,"data":20534,"content":20535},{},[20536,20539,20543],{"nodeType":864,"value":1499,"marks":20537,"data":20538},[],{},{"nodeType":864,"value":1503,"marks":20540,"data":20542},[20541],{"type":899},{},{"nodeType":864,"value":1508,"marks":20544,"data":20545},[],{},{"nodeType":996,"data":20547,"content":20550},{"target":20548},{"sys":20549},{"id":1515,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20552,"content":20553},{},[20554,20558],{"nodeType":864,"value":1521,"marks":20555,"data":20557},[20556],{"type":899},{},{"nodeType":864,"value":1526,"marks":20559,"data":20560},[],{},{"nodeType":860,"data":20562,"content":20563},{},[20564,20568,20571,20578,20581,20585],{"nodeType":864,"value":1533,"marks":20565,"data":20567},[20566],{"type":899},{},{"nodeType":864,"value":1538,"marks":20569,"data":20570},[],{},{"nodeType":883,"data":20572,"content":20573},{"uri":1543},[20574],{"nodeType":864,"value":1546,"marks":20575,"data":20577},[20576],{"type":1455},{},{"nodeType":864,"value":1551,"marks":20579,"data":20580},[],{},{"nodeType":864,"value":1555,"marks":20582,"data":20584},[20583],{"type":899},{},{"nodeType":864,"value":1560,"marks":20586,"data":20587},[],{},{"nodeType":860,"data":20589,"content":20590},{},[20591],{"nodeType":864,"value":1567,"marks":20592,"data":20593},[],{},{"nodeType":860,"data":20595,"content":20596},{},[20597,20600,20604],{"nodeType":864,"value":1574,"marks":20598,"data":20599},[],{},{"nodeType":864,"value":1578,"marks":20601,"data":20603},[20602],{"type":899},{},{"nodeType":864,"value":1583,"marks":20605,"data":20606},[],{},{"nodeType":996,"data":20608,"content":20611},{"target":20609},{"sys":20610},{"id":1590,"type":1001,"linkType":1002},[],{"nodeType":860,"data":20613,"content":20614},{},[20615,20618,20622],{"nodeType":864,"value":1596,"marks":20616,"data":20617},[],{},{"nodeType":864,"value":1600,"marks":20619,"data":20621},[20620],{"type":899},{},{"nodeType":864,"value":1605,"marks":20623,"data":20624},[],{},{"nodeType":860,"data":20626,"content":20627},{},[20628],{"nodeType":864,"value":1612,"marks":20629,"data":20630},[],{},{"nodeType":860,"data":20632,"content":20633},{},[20634],{"nodeType":864,"value":1619,"marks":20635,"data":20636},[],{},{"nodeType":1005,"data":20638,"content":20639},{},[],{"nodeType":1312,"data":20641,"content":20642},{},[20643],{"nodeType":864,"value":1629,"marks":20644,"data":20646},[20645],{"type":899},{},{"nodeType":860,"data":20648,"content":20649},{},[20650],{"nodeType":864,"value":1637,"marks":20651,"data":20652},[],{},{"nodeType":860,"data":20654,"content":20655},{},[20656],{"nodeType":864,"value":1644,"marks":20657,"data":20658},[],{},{"nodeType":860,"data":20660,"content":20661},{},[20662],{"nodeType":864,"value":1651,"marks":20663,"data":20664},[],{},{"nodeType":860,"data":20666,"content":20667},{},[20668],{"nodeType":864,"value":1658,"marks":20669,"data":20670},[],{},{"nodeType":860,"data":20672,"content":20673},{},[20674],{"nodeType":864,"value":1665,"marks":20675,"data":20676},[],{},{"nodeType":860,"data":20678,"content":20679},{},[20680],{"nodeType":864,"value":1672,"marks":20681,"data":20682},[],{},{"nodeType":1005,"data":20684,"content":20685},{},[],{"nodeType":860,"data":20687,"content":20688},{},[20689],{"nodeType":864,"value":1682,"marks":20690,"data":20691},[],{},{"nodeType":860,"data":20693,"content":20694},{},[20695],{"nodeType":864,"value":1689,"marks":20696,"data":20697},[],{},{"nodeType":860,"data":20699,"content":20700},{},[20701,20704,20711],{"nodeType":864,"value":21,"marks":20702,"data":20703},[],{},{"nodeType":883,"data":20705,"content":20706},{"uri":1700},[20707],{"nodeType":864,"value":1703,"marks":20708,"data":20710},[20709],{"type":1455},{},{"nodeType":864,"value":21,"marks":20712,"data":20713},[],{},{"items":20715},[20716,20718],{"sys":20717,"name":4904},{"id":4903},{"sys":20719,"name":545},{"id":4907},{"items":20721},[20722],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":20723},{"url":853},"blog/what-push-data-reveals-about-the-state-of-shadow-ai",{"json":20726},{"data":20727,"content":20728,"nodeType":856},{},[20729],{"data":20730,"content":20731,"nodeType":860},{},[20732],{"data":20733,"marks":20734,"value":20735,"nodeType":864},{},[],"Push telemetry shows that the average organization has 16 unique AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in active use — most of them unapproved. Shadow AI is arguably shadow SaaS with better marketing. But AI adoption has been a genuine force multiplier for the problem.",{"id":2061,"publishedAt":20737},"2026-08-13T11:44:25.332Z",{"items":20739},[20740,20742],{"sys":20741,"name":2729},{"id":2728},{"sys":20743,"name":297},{"id":2732},{"items":20745},[20746,20748,20750,20752,20754,20756,20758,20760,20762,20764,20766],{"sys":20747,"name":235,"slug":236,"tier":31},{"id":232},{"sys":20749,"name":545,"slug":546,"tier":31},{"id":542},{"sys":20751,"name":297,"slug":298,"tier":31},{"id":294},{"sys":20753,"name":413,"slug":414,"tier":31},{"id":410},{"sys":20755,"name":580,"slug":581,"tier":45},{"id":577},{"sys":20757,"name":589,"slug":590,"tier":45},{"id":586},{"sys":20759,"name":484,"slug":485,"tier":45},{"id":481},{"sys":20761,"name":288,"slug":289,"tier":45},{"id":285},{"sys":20763,"name":368,"slug":369,"tier":45},{"id":365},{"sys":20765,"name":633,"slug":634,"tier":45},{"id":630},{"sys":20767,"name":252,"slug":253,"tier":45},{"id":249},"Fve3K-AKY2ZaHd8DzKxQ7Gji-9e6fXsHOZB-s2X214A",{"id":20770,"title":20771,"authorsCollection":20772,"content":20776,"extension":228,"faqItemsCollection":21380,"faqTitle":59,"featured":6,"hashTags":59,"meta":21382,"metaTitle":21383,"ogImage":59,"postType":6981,"publishedDate":21384,"relatedBlogPostsCollection":21385,"slug":23479,"stem":23480,"subtitle":59,"summary":23481,"synopsis":23492,"sys":23493,"tagsCollection":23496,"topicsCollection":23502,"__hash__":23552},"blog/blog/verizon-dbir-2026-review.json","What the Verizon DBIR tells us about how breaches happen in 2026",{"items":20773},[20774],{"fullName":3621,"firstName":3622,"jobTitle":3623,"socialLinks":59,"profilePicture":20775},{"url":3625},{"json":20777,"links":21306},{"data":20778,"content":20779,"nodeType":856},{},[20780,20787,20790,20798,20814,20821,20828,20834,20842,20849,20856,20862,20879,20885,20901,20909,20925,20932,20939,20942,20950,20966,20972,20990,20996,21004,21028,21035,21038,21046,21053,21059,21066,21084,21092,21108,21111,21119,21135,21142,21149,21167,21170,21178,21185,21192,21199,21205,21213,21229,21236,21253,21256,21264,21271,21278,21284,21290],{"data":20781,"content":20782,"nodeType":860},{},[20783],{"data":20784,"marks":20785,"value":20786,"nodeType":864},{},[],"The headline finding getting the most airtime in 2026 is that vulnerability exploitation has overtaken credential abuse as the top single initial access vector, jumping to 31% from 20% the year before. The vulnerability management crisis driving this statistic is one of the most important stories in this year's data. But reading it as evidence that identity threats are receding would be a mistake, because the DBIR's own data tells a more complicated and more useful story when you look at the full picture.",{"data":20788,"content":20789,"nodeType":1005},{},[],{"data":20791,"content":20792,"nodeType":1009},{},[20793],{"data":20794,"marks":20795,"value":20797,"nodeType":864},{},[20796],{"type":899},"Vulnerability exploitation has caught up with identity — not replaced it",{"data":20799,"content":20800,"nodeType":860},{},[20801,20805,20810],{"data":20802,"marks":20803,"value":20804,"nodeType":864},{},[],"The DBIR's headline comparison pits vulnerability exploitation (31%) against credential abuse (13%) as individual vectors. That comparison is accurate but incomplete, because the DBIR tracks identity-related initial access across ",{"data":20806,"marks":20807,"value":20809,"nodeType":864},{},[20808],{"type":899},"three",{"data":20811,"marks":20812,"value":20813,"nodeType":864},{},[]," separate categories: phishing (16%), credential abuse (13%), and pretexting (6%). Before interpreting those numbers, there's a methodological wrinkle worth understanding.",{"data":20815,"content":20816,"nodeType":860},{},[20817],{"data":20818,"marks":20819,"value":20820,"nodeType":864},{},[],"This year's report added pretexting as a newly tracked initial access vector, reclassifying some incidents previously counted as credential abuse. The DBIR is transparent about the effect: without that change, credential abuse would have been 16% rather than 13%. On an apples-to-apples basis, identity-related initial access (phishing 16% + credential abuse 16%) comes to 32% — versus 31% for vulnerability exploitation.",{"data":20822,"content":20823,"nodeType":860},{},[20824],{"data":20825,"marks":20826,"value":20827,"nodeType":864},{},[],"To be precise about what moved: phishing held roughly flat year over year, but credential abuse saw a modest decline even on the adjusted basis (from 22% to 16%). Overall, the identity picture is broadly stable. The reason the two categories have converged is that vulnerability exploitation surged 55%, not that identity attacks meaningfully receded.",{"data":20829,"content":20833,"nodeType":996},{"target":20830},{"sys":20831},{"id":20832,"type":1001,"linkType":1002},"5GvSsSY4R6X34ZBMidZ54X",[],{"data":20835,"content":20836,"nodeType":1312},{},[20837],{"data":20838,"marks":20839,"value":20841,"nodeType":864},{},[20840],{"type":899},"The taxonomy gap",{"data":20843,"content":20844,"nodeType":860},{},[20845],{"data":20846,"marks":20847,"value":20848,"nodeType":864},{},[],"It's also worth asking how much the DBIR's initial access taxonomy can tell us. The figure that everyone is citing — Figure 10 — is labelled \"select enumerations,\" and the four tracked vectors (vulnerability exploitation, phishing, credential abuse, pretexting) add up to only 66% of initial access. A third of the picture isn't represented in the headline breakdown at all.",{"data":20850,"content":20851,"nodeType":860},{},[20852],{"data":20853,"marks":20854,"value":20855,"nodeType":864},{},[],"The cluster boundaries and where you draw them also changes the story. The DBIR classifies ClickFix under \"baiting\" — a category that covers malicious downloads and SEO poisoning — rather than phishing, even though the end goal is often the same: getting a user to execute something they shouldn't. Pretexting absorbed incidents that were previously credential abuse, shifting the numbers between categories. These are useful analytical clusters, but they aren't clean divisions of a neatly partitioned attack surface.",{"data":20857,"content":20861,"nodeType":996},{"target":20858},{"sys":20859},{"id":20860,"type":1001,"linkType":1002},"7t6ZcHDycaPOyLstX4r8zl",[],{"data":20863,"content":20864,"nodeType":860},{},[20865,20869,20876],{"data":20866,"marks":20867,"value":20868,"nodeType":864},{},[],"These are identity attacks at scale, and it isn't clear where — or whether — they show up in the DBIR's initial access vectors. This lack of depth in identity and in-browser attack vectors is common in many defensive models, which is why we've created our own ",{"data":20870,"content":20871,"nodeType":883},{"uri":12816},[20872],{"data":20873,"marks":20874,"value":20875,"nodeType":864},{},[],"Browser and Identity Attacks Matrix",{"data":20877,"marks":20878,"value":2924,"nodeType":864},{},[],{"data":20880,"content":20884,"nodeType":996},{"target":20881},{"sys":20882},{"id":20883,"type":1001,"linkType":1002},"53U3LHhhHFYnEpShdLmDqs",[],{"data":20886,"content":20887,"nodeType":860},{},[20888,20892,20897],{"data":20889,"marks":20890,"value":20891,"nodeType":864},{},[],"That convergence at initial access also understates the role credentials play across full breach chains. The DBIR states plainly that credential abuse at any point in the breach progression — not just as the first action — appears in ",{"data":20893,"marks":20894,"value":20896,"nodeType":864},{},[20895],{"type":899},"39% of all breaches",{"data":20898,"marks":20899,"value":20900,"nodeType":864},{},[],", making it the single most pervasive technique in the dataset. Credentials don't just open the front door; they unlock lateral movement, privilege escalation, and persistence throughout the attack chain.",{"data":20902,"content":20903,"nodeType":1312},{},[20904],{"data":20905,"marks":20906,"value":20908,"nodeType":864},{},[20907],{"type":899},"The vulnerability treadmill",{"data":20910,"content":20911,"nodeType":860},{},[20912,20916,20921],{"data":20913,"marks":20914,"value":20915,"nodeType":864},{},[],"The vulnerability exploitation surge itself is driven by a structural capacity crisis rather than a shift in attacker preference. Edge devices and VPNs now account for 22% of vulnerability-exploitation breaches, up from 3% the prior year — a ",{"data":20917,"marks":20918,"value":20920,"nodeType":864},{},[20919],{"type":2246},"sevenfold",{"data":20922,"marks":20923,"value":20924,"nodeType":864},{},[]," increase. Organizations face 50% more CISA KEV vulnerabilities to remediate than a year ago, median remediation time has increased from 32 to 43 days, and the volume of vulnerability records in the dataset has grown roughly eightfold.",{"data":20926,"content":20927,"nodeType":860},{},[20928],{"data":20929,"marks":20930,"value":20931,"nodeType":864},{},[],"This trend was already visible in last year's DBIR, when vulnerability exploitation jumped from 15% to 20%. AI-assisted exploit development may be compounding the problem — the DBIR's own data shows 32% of AI-assisted initial access targeting vulnerability exploitation — but the structural capacity crisis was accelerating well before AI became a meaningful factor in the attacker toolkit.",{"data":20933,"content":20934,"nodeType":860},{},[20935],{"data":20936,"marks":20937,"value":20938,"nodeType":864},{},[],"The vulnerability treadmill is accelerating, and the DBIR's remediation data shows defenders losing ground. But this is an additive problem, not a substitution. Both attack surfaces are growing. ",{"data":20940,"content":20941,"nodeType":1005},{},[],{"data":20943,"content":20944,"nodeType":1009},{},[20945],{"data":20946,"marks":20947,"value":20949,"nodeType":864},{},[20948],{"type":899},"Phishing has left the inbox",{"data":20951,"content":20952,"nodeType":860},{},[20953,20957,20962],{"data":20954,"marks":20955,"value":20956,"nodeType":864},{},[],"41% percent of social engineering breaches now involve vectors other than email, with approximately a quarter coming from social media or phone-based channels. Voice phishing simulations show a ",{"data":20958,"marks":20959,"value":20961,"nodeType":864},{},[20960],{"type":899},"40% higher success rate",{"data":20963,"marks":20964,"value":20965,"nodeType":864},{},[]," than email phishing — a median click rate of 2% versus 1.4%.",{"data":20967,"content":20971,"nodeType":996},{"target":20968},{"sys":20969},{"id":20970,"type":1001,"linkType":1002},"7pK8qqIDDNmHmJmlcybNoe",[],{"data":20973,"content":20974,"nodeType":860},{},[20975,20979,20986],{"data":20976,"marks":20977,"value":20978,"nodeType":864},{},[],"Even within the email channel, the data confirms what ",{"data":20980,"content":20981,"nodeType":883},{"uri":12894},[20982],{"data":20983,"marks":20984,"value":20985,"nodeType":864},{},[],"browser-level detection data has been showing",{"data":20987,"marks":20988,"value":20989,"nodeType":864},{},[],": credential harvesting dominates. The DBIR's email security gateway breakdown shows 80% of blocked attacks are credential or session phishing, with only 10% involving malware delivery, 5% callback phishing, and 3% BEC. If you're running an email security gateway, the vast majority of what it catches is credential phishing — and 41% of social engineering is arriving through channels it can't see at all.",{"data":20991,"content":20995,"nodeType":996},{"target":20992},{"sys":20993},{"id":20994,"type":1001,"linkType":1002},"6CvwzQA3gJ8B3RFzLrH7Kp",[],{"data":20997,"content":20998,"nodeType":1312},{},[20999],{"data":21000,"marks":21001,"value":21003,"nodeType":864},{},[21002],{"type":899},"The ClickFix detection gap",{"data":21005,"content":21006,"nodeType":860},{},[21007,21011,21019,21023],{"data":21008,"marks":21009,"value":21010,"nodeType":864},{},[],"The DBIR reports ClickFix at only 2.7% of attacks detected at the browser level. For context, ",{"data":21012,"content":21014,"nodeType":883},{"uri":21013},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection/",[21015],{"data":21016,"marks":21017,"value":21018,"nodeType":864},{},[],"CrowdStrike reported a 563% increase in ClickFix lures",{"data":21020,"marks":21021,"value":21022,"nodeType":864},{},[]," over the same period and Microsoft identified it as the most common initial access point at 47% of observed attacks. Push's own data shows ClickFix at a significantly higher proportion of browser-level detections, ",{"data":21024,"marks":21025,"value":21027,"nodeType":864},{},[21026],{"type":899},"with 4 in 5 delivered via search engines specifically.",{"data":21029,"content":21030,"nodeType":860},{},[21031],{"data":21032,"marks":21033,"value":21034,"nodeType":864},{},[],"The gap is striking, and the most likely explanation is a visibility one. ClickFix attacks result in a malware download or script execution on the endpoint — and without browser-layer context, that execution looks like any other malware delivery. If a contributing organization doesn't have visibility into the browser session that preceded the payload, they'd attribute the incident to \"malware download\" or \"user execution\" rather than ClickFix specifically. The DBIR's 2.7% probably reflects how often contributors could trace the chain back to a ClickFix page, not how often ClickFix was actually the delivery mechanism.",{"data":21036,"content":21037,"nodeType":1005},{},[],{"data":21039,"content":21040,"nodeType":1009},{},[21041],{"data":21042,"marks":21043,"value":21045,"nodeType":864},{},[21044],{"type":899},"Stolen credentials are the ransomware on-ramp",{"data":21047,"content":21048,"nodeType":860},{},[21049],{"data":21050,"marks":21051,"value":21052,"nodeType":864},{},[],"One of the most powerful findings in this year's DBIR is the quantification of the relationship between credential compromise and ransomware outcomes. Fifty percent of ransomware victims had a credential or infostealer event occur within 95 days prior to the ransomware attack, drawing a causal line from credential theft to ransomware deployment.",{"data":21054,"content":21058,"nodeType":996},{"target":21055},{"sys":21056},{"id":21057,"type":1001,"linkType":1002},"3ZwG5UiweFR4fYiDaxJJDm",[],{"data":21060,"content":21061,"nodeType":860},{},[21062],{"data":21063,"marks":21064,"value":21065,"nodeType":864},{},[],"The infostealer supply chain data reinforces the picture. Infostealers are surfacing an average of 2,362 breached corporate credentials per month from organizational email domains in stealer log datasets, and 54% of devices in Initial Access Broker logs had at least one infostealer installed. The 95-day median window is consistent with the known timeline from credential harvest to ransomware deployment.",{"data":21067,"content":21068,"nodeType":860},{},[21069,21073,21080],{"data":21070,"marks":21071,"value":21072,"nodeType":864},{},[],"That timeline reinforces an argument we've been making about ",{"data":21074,"content":21075,"nodeType":883},{"uri":3210},[21076],{"data":21077,"marks":21078,"value":21079,"nodeType":864},{},[],"where the intervention point needs to be",{"data":21081,"marks":21082,"value":21083,"nodeType":864},{},[],": detecting credential compromise upstream — at the point of credential entry, session creation, or stolen credential reuse — rather than waiting for the ransomware deployment that follows weeks or months later.",{"data":21085,"content":21086,"nodeType":1312},{},[21087],{"data":21088,"marks":21089,"value":21091,"nodeType":864},{},[21090],{"type":899},"Post-compromise tradecraft is shifting",{"data":21093,"content":21094,"nodeType":860},{},[21095,21099,21104],{"data":21096,"marks":21097,"value":21098,"nodeType":864},{},[],"The DBIR's post-compromise data adds another dimension. RMM tool abuse by threat actors showed a ",{"data":21100,"marks":21101,"value":21103,"nodeType":864},{},[21102],{"type":899},"240% increase",{"data":21105,"marks":21106,"value":21107,"nodeType":864},{},[]," over the prior year, while traditional backdoor and C2 malware usage fell 27%. Attackers are increasingly living off the land with the same remote access tools IT teams use. Post-compromise detection is getting harder, which makes catching the initial credential compromise upstream that much more valuable.",{"data":21109,"content":21110,"nodeType":1005},{},[],{"data":21112,"content":21113,"nodeType":1009},{},[21114],{"data":21115,"marks":21116,"value":21118,"nodeType":864},{},[21117],{"type":899},"Your vendors are half the problem",{"data":21120,"content":21121,"nodeType":860},{},[21122,21126,21131],{"data":21123,"marks":21124,"value":21125,"nodeType":864},{},[],"Third-party involvement in breaches reached ",{"data":21127,"marks":21128,"value":21130,"nodeType":864},{},[21129],{"type":899},"48%",{"data":21132,"marks":21133,"value":21134,"nodeType":864},{},[]," this year, up from 30% — a 60% increase that follows a prior year where the figure had already doubled.",{"data":21136,"content":21137,"nodeType":860},{},[21138],{"data":21139,"marks":21140,"value":21141,"nodeType":864},{},[],"The DBIR's root cause analysis maps directly to identity security: insecure authentication — absent MFA, improper credential rotation — and lack of least privilege enforcement account for a substantial share of cloud-based third-party incidents. Only 23% of third-party organizations fully remediated missing or improperly secured MFA on cloud accounts, and weak password and permission misconfigurations took a median of 8 months to resolve 50% of findings.",{"data":21143,"content":21144,"nodeType":860},{},[21145],{"data":21146,"marks":21147,"value":21148,"nodeType":864},{},[],"Eight months. That's the median timeline for third-party vendors to resolve the identity hygiene issues that create the attack surface in their environments — environments that your data lives in.",{"data":21150,"content":21151,"nodeType":860},{},[21152,21156,21163],{"data":21153,"marks":21154,"value":21155,"nodeType":864},{},[],"Extend that posture gap across every vendor and third-party integration, and you start to see why the third-party breach figure keeps climbing. Visibility into ",{"data":21157,"content":21158,"nodeType":883},{"uri":4103},[21159],{"data":21160,"marks":21161,"value":21162,"nodeType":864},{},[],"OAuth consent flows and third-party integration sprawl",{"data":21164,"marks":21165,"value":21166,"nodeType":864},{},[]," is the starting point for getting ahead of a supply chain problem that is structurally getting worse.",{"data":21168,"content":21169,"nodeType":1005},{},[],{"data":21171,"content":21172,"nodeType":1009},{},[21173],{"data":21174,"marks":21175,"value":21177,"nodeType":864},{},[21176],{"type":899},"AI is scaling known techniques — and creating new blind spots from the inside",{"data":21179,"content":21180,"nodeType":860},{},[21181],{"data":21182,"marks":21183,"value":21184,"nodeType":864},{},[],"The DBIR's AI analysis this year is grounded in a collaboration with Anthropic covering 793 threat actors who received enforcement action for violating acceptable use policy between March 2025 and February 2026. The findings are measured rather than alarmist: in the median case, actors sought AI assistance across about 15 distinct ATT&CK techniques, 44% of AI-assisted initial access was phishing-related, and less than 2.5% of techniques observed were classified as rare.",{"data":21186,"content":21187,"nodeType":860},{},[21188],{"data":21189,"marks":21190,"value":21191,"nodeType":864},{},[],"AI is currently an operational tool for attackers — automating and scaling known techniques rather than unlocking novel ones. Despite heavy AI-assisted focus on phishing, the DBIR's own incident dataset shows phishing as an initial access vector has barely changed year over year — suggesting AI may be uplifting less-experienced attackers to a higher baseline of lure quality without meaningfully increasing success rates against organizations that already have detection in place.",{"data":21193,"content":21194,"nodeType":860},{},[21195],{"data":21196,"marks":21197,"value":21198,"nodeType":864},{},[],"The more concerning number is the 32% of AI-assisted initial access targeting vulnerability exploitation — compounding the patching capacity crisis discussed earlier in a trend that was already accelerating before AI entered the picture.",{"data":21200,"content":21204,"nodeType":996},{"target":21201},{"sys":21202},{"id":21203,"type":1001,"linkType":1002},"4bFTnVx1SXMQzZSaICCJOn",[],{"data":21206,"content":21207,"nodeType":1312},{},[21208],{"data":21209,"marks":21210,"value":21212,"nodeType":864},{},[21211],{"type":899},"Shadow AI is the bigger problem",{"data":21214,"content":21215,"nodeType":860},{},[21216,21220,21225],{"data":21217,"marks":21218,"value":21219,"nodeType":864},{},[],"The sharper AI risk for most organizations, though, is internal. Forty-five percent of employees are now regular AI users on corporate devices — up from 15%, a threefold increase — and ",{"data":21221,"marks":21222,"value":21224,"nodeType":864},{},[21223],{"type":899},"67% of them use non-corporate accounts",{"data":21226,"marks":21227,"value":21228,"nodeType":864},{},[],". Shadow AI has become the third most common non-malicious insider action in DLP data, a fourfold increase over the prior year, with source code as the leading data type submitted to unauthorized AI platforms by a wide margin.",{"data":21230,"content":21231,"nodeType":860},{},[21232],{"data":21233,"marks":21234,"value":21235,"nodeType":864},{},[],"The browser extension angle is particularly relevant. More than 15% of users had unauthorized AI browser extensions installed, and the DBIR specifically notes that these extensions collect and retain browsing context from internal sites — creating a data exfiltration pathway that operates independently of traditional DLP controls.",{"data":21237,"content":21238,"nodeType":860},{},[21239,21243,21250],{"data":21240,"marks":21241,"value":21242,"nodeType":864},{},[],"This is moving faster than any previous shadow IT wave, and the data loss vector is the browser — where users interact with AI tools, where extensions collect context, and where OAuth consent grants connect AI services to corporate data. Visibility and control at that layer isn't a nice-to-have for AI governance; ",{"data":21244,"content":21245,"nodeType":883},{"uri":13079},[21246],{"data":21247,"marks":21248,"value":21249,"nodeType":864},{},[],"it's the minimum viable starting point",{"data":21251,"marks":21252,"value":2924,"nodeType":864},{},[],{"data":21254,"content":21255,"nodeType":1005},{},[],{"data":21257,"content":21258,"nodeType":1009},{},[21259],{"data":21260,"marks":21261,"value":21263,"nodeType":864},{},[21262],{"type":899},"What this means for defenders",{"data":21265,"content":21266,"nodeType":860},{},[21267],{"data":21268,"marks":21269,"value":21270,"nodeType":864},{},[],"The DBIR's 2026 data paints a picture of converging pressures rather than shifting priorities. Vulnerability exploitation surged, but identity-related initial access is broadly stable and credential abuse at 39% across full breach chains remains the single most pervasive technique in the dataset. Phishing is arriving through channels that email gateways can't see. The infostealer-to-ransomware pipeline now has longitudinal data behind it. Third-party involvement keeps climbing because vendor identity hygiene takes months to remediate. And shadow AI is creating data exposure pathways that most security stacks weren't designed to see.",{"data":21272,"content":21273,"nodeType":860},{},[21274],{"data":21275,"marks":21276,"value":21277,"nodeType":864},{},[],"The common thread across all of these findings is that the browser — where credentials are entered, sessions are created, OAuth consent is granted, AI tools are accessed, and extensions collect data — is the layer where these risks converge and where defenders need visibility and control if they're going to address them at the point of risk rather than after the fact.",{"data":21279,"content":21280,"nodeType":860},{},[21281],{"data":21282,"marks":21283,"value":1682,"nodeType":864},{},[],{"data":21285,"content":21286,"nodeType":860},{},[21287],{"data":21288,"marks":21289,"value":1689,"nodeType":864},{},[],{"data":21291,"content":21292,"nodeType":860},{},[21293,21296,21303],{"data":21294,"marks":21295,"value":21,"nodeType":864},{},[],{"data":21297,"content":21298,"nodeType":883},{"uri":1700},[21299],{"data":21300,"marks":21301,"value":1703,"nodeType":864},{},[21302],{"type":1455},{"data":21304,"marks":21305,"value":21,"nodeType":864},{},[],{"entries":21307},{"hyperlink":21308,"inline":21309,"block":21310},[],[],[21311,21317,21342,21349,21363,21368,21375],{"sys":21312,"__typename":1724,"title":21313,"caption":21313,"layoutMode":59,"file":21314},{"id":20832},"DBIR Figure 10 (p.15) — Initial access vectors, select enumerations",{"url":21315,"width":1736,"height":21316},"https://images.ctfassets.net/y1cdw1ablpvd/18rPvZ4Sw11UCHE7MxzXkd/17d059302242b4034686b13ee3044c8e/image4.png",1521,{"sys":21318,"__typename":1740,"content":21319,"name":21341,"title":59},{"id":20860},{"json":21320},{"nodeType":856,"data":21321,"content":21322},{},[21323],{"nodeType":860,"data":21324,"content":21325},{},[21326,21330,21337],{"nodeType":864,"value":21327,"marks":21328,"data":21329},"Some of the ",[],{},{"nodeType":883,"data":21331,"content":21332},{"uri":1765},[21333],{"nodeType":864,"value":21334,"marks":21335,"data":21336},"most consequential identity-based campaigns of the past 12 months",[],{},{"nodeType":864,"value":21338,"marks":21339,"data":21340}," don't map cleanly to any of these categories — the mass Salesforce campaign that compromised over 1,000 organizations via device code phishing, the Anodot breach chain that pivoted through stored OAuth tokens to reach Snowflake customers, ConsentFix abusing Azure CLI's OAuth flow to bypass MFA entirely.",[],{},"DBIR 2026 IB1",{"sys":21343,"__typename":1724,"title":13008,"caption":21344,"layoutMode":59,"file":21345},{"id":20883},"Browser and identity-based techniques have exploded since we first launched our attack matrix",{"url":21346,"width":21347,"height":21348},"https://images.ctfassets.net/y1cdw1ablpvd/L0Yc77y9vzrKVD72BQGX2/4ffe0bf61bd62f025262b8efd74394b7/Browser___Identity_Attacks_Matrix__1_.png",6160,4432,{"sys":21350,"__typename":1740,"content":21351,"name":21362,"title":59},{"id":20970},{"json":21352},{"data":21353,"content":21354,"nodeType":856},{},[21355],{"data":21356,"content":21357,"nodeType":860},{},[21358],{"data":21359,"marks":21360,"value":21361,"nodeType":864},{},[],"The data is a little confusing. The DBIR draws a line between Phishing (asynchronous — send a message and hope for a click) and Pretexting (synchronous — someone interacting with you in real time). Voice phishing over a phone call is Pretexting in VERIS, not Phishing, even though most practitioners would call it phishing. Browser-based credential harvesting delivered via SEO poisoning or malicious downloads falls under \"Baiting.\" So the 16% phishing figure probably understates the full scope of credential-harvesting social engineering as most defenders would define it.","DBIR IB2",{"sys":21364,"__typename":1724,"title":21365,"caption":21365,"layoutMode":59,"file":21366},{"id":20994},"DBIR Figure 54 (p.49) — Median percentage of email attack types by month",{"url":21367,"width":1736,"height":21316},"https://images.ctfassets.net/y1cdw1ablpvd/4eWtJSz2QhM6QgXXjNuBNs/e6a33a088b7b0fb0dd1649c5d9164b53/image1.png",{"sys":21369,"__typename":1724,"title":21370,"caption":21370,"layoutMode":59,"file":21371},{"id":21057},"DBIR Figure 48 (p.45) — Credential leakage events prior to ransomware",{"url":21372,"width":21373,"height":21374},"https://images.ctfassets.net/y1cdw1ablpvd/26NpMQ31lpHgp5x8FrDumz/f022f1ede66b171dd756d28009a7d4a5/image2.png",1772,776,{"sys":21376,"__typename":1724,"title":21377,"caption":21377,"layoutMode":59,"file":21378},{"id":21203},"DBIR Figure 65 (p.60) — Select data types in DLP events targeting generative AI tools",{"url":21379,"width":1736,"height":21316},"https://images.ctfassets.net/y1cdw1ablpvd/584Txvap6FW9GlFlin9GwB/f5f5488251d9faee7fedc3030d2390b1/image5.png",{"items":21381},[],{},"What the Verizon DBIR tells us about breaches in 2026","2026-05-20T00:00:00.000Z",{"items":21386},[21387,21978,22957],{"__typename":2059,"sys":21388,"content":21390,"title":21964,"synopsis":21965,"hashTags":59,"publishedDate":21966,"slug":21967,"tagsCollection":21968,"authorsCollection":21974},{"id":21389},"217s8zu5idSdX25TUgbPQ1",{"json":21391},{"data":21392,"content":21393,"nodeType":856},{},[21394,21412,21419,21426,21432,21435,21443,21459,21466,21472,21479,21562,21569,21575,21582,21588,21591,21599,21611,21618,21630,21633,21641,21657,21664,21671,21674,21682,21689,21705,21711,21727,21734,21741,21748,21764,21771,21774,21782,21789,21805,21812,21815,21823,21839,21846,21865,21877,21880,21888,21904,21911,21918,21925,21932,21935,21942,21948],{"data":21395,"content":21396,"nodeType":860},{},[21397,21400,21408],{"data":21398,"marks":21399,"value":2761,"nodeType":864},{},[],{"data":21401,"content":21403,"nodeType":883},{"uri":21402},"https://research.esg-global.com/reportaction/515202191/Marketing",[21404],{"data":21405,"marks":21406,"value":21407,"nodeType":864},{},[],"Omdia Browser Management and Security report",{"data":21409,"marks":21410,"value":21411,"nodeType":864},{},[],", based on a survey of 400 IT and security professionals across North America fielded in late 2025, is the most comprehensive industry data to date on how organizations are experiencing, prioritizing, and investing in the secure enterprise browser (SEB) market. ",{"data":21413,"content":21414,"nodeType":860},{},[21415],{"data":21416,"marks":21417,"value":21418,"nodeType":864},{},[],"For us at Push, it externally validates what we've known to be true for some time — the browser is where work happens, where attacks land, and where defenders need to be if they want to detect and stop threats before damage is done.",{"data":21420,"content":21421,"nodeType":860},{},[21422],{"data":21423,"marks":21424,"value":21425,"nodeType":864},{},[],"We pulled out seven findings that matter most for security teams evaluating their approach.",{"data":21427,"content":21431,"nodeType":996},{"target":21428},{"sys":21429},{"id":21430,"type":1001,"linkType":1002},"4aM879egIFYmDvOhzyNI9A",[],{"data":21433,"content":21434,"nodeType":1005},{},[],{"data":21436,"content":21437,"nodeType":1009},{},[21438],{"data":21439,"marks":21440,"value":21442,"nodeType":864},{},[21441],{"type":899},"1. The attacks driving concern are the ones happening inside the browser session",{"data":21444,"content":21445,"nodeType":860},{},[21446,21450,21455],{"data":21447,"marks":21448,"value":21449,"nodeType":864},{},[],"The threat picture is driving everything else in this report, so it's the right place to start. ",{"data":21451,"marks":21452,"value":21454,"nodeType":864},{},[21453],{"type":899},"49% of organizations suffered a successful browser-based attack in the last 12 months.",{"data":21456,"marks":21457,"value":21458,"nodeType":864},{},[]," Among those affected, browser-originated incidents account for roughly 37% of all security incidents — and 68% say that share has grown over the past two years. ",{"data":21460,"content":21461,"nodeType":860},{},[21462],{"data":21463,"marks":21464,"value":21465,"nodeType":864},{},[],"The browser is not an emerging threat vector. It’s worth noting here that these numbers are also likely lower than the reality, since many are only identified later in the kill chain. Without browser-level telemetry they can be difficult to trace back their source — which in the vast majority of cases, even for malware-driven attacks, is the browser. ",{"data":21467,"content":21471,"nodeType":996},{"target":21468},{"sys":21469},{"id":21470,"type":1001,"linkType":1002},"6Kcz8oILKVHmhQIo5Du6V",[],{"data":21473,"content":21474,"nodeType":860},{},[21475],{"data":21476,"marks":21477,"value":21478,"nodeType":864},{},[],"What stands out is that every one of the top attack categories plays out inside the browser session itself — not against the browser as a piece of software, but within the sessions where users interact with applications:",{"data":21480,"content":21481,"nodeType":941},{},[21482,21492,21502,21512,21522,21532,21542,21552],{"data":21483,"content":21484,"nodeType":945},{},[21485],{"data":21486,"content":21487,"nodeType":860},{},[21488],{"data":21489,"marks":21490,"value":21491,"nodeType":864},{},[],"Phishing (40%)",{"data":21493,"content":21494,"nodeType":945},{},[21495],{"data":21496,"content":21497,"nodeType":860},{},[21498],{"data":21499,"marks":21500,"value":21501,"nodeType":864},{},[],"Data loss or leakage (38%)",{"data":21503,"content":21504,"nodeType":945},{},[21505],{"data":21506,"content":21507,"nodeType":860},{},[21508],{"data":21509,"marks":21510,"value":21511,"nodeType":864},{},[],"Malicious browser extensions (34%)",{"data":21513,"content":21514,"nodeType":945},{},[21515],{"data":21516,"content":21517,"nodeType":860},{},[21518],{"data":21519,"marks":21520,"value":21521,"nodeType":864},{},[],"Vulnerable browser extensions (33%)",{"data":21523,"content":21524,"nodeType":945},{},[21525],{"data":21526,"content":21527,"nodeType":860},{},[21528],{"data":21529,"marks":21530,"value":21531,"nodeType":864},{},[],"Malicious scripts (31%)",{"data":21533,"content":21534,"nodeType":945},{},[21535],{"data":21536,"content":21537,"nodeType":860},{},[21538],{"data":21539,"marks":21540,"value":21541,"nodeType":864},{},[],"Credential theft via browser (28%)",{"data":21543,"content":21544,"nodeType":945},{},[21545],{"data":21546,"content":21547,"nodeType":860},{},[21548],{"data":21549,"marks":21550,"value":21551,"nodeType":864},{},[],"Cookie theft (22%)",{"data":21553,"content":21554,"nodeType":945},{},[21555],{"data":21556,"content":21557,"nodeType":860},{},[21558],{"data":21559,"marks":21560,"value":21561,"nodeType":864},{},[],"AiTM attacks (17%)",{"data":21563,"content":21564,"nodeType":860},{},[21565],{"data":21566,"marks":21567,"value":21568,"nodeType":864},{},[],"Phishing, credential theft, cookie theft, and AiTM are attacks that target the user's interaction with a web page — the credential entry, the session creation, the token exchange. Malicious and vulnerable extensions are supply chain risks that operate inside the browser's own execution environment. Data loss happens through the browser when employees upload files, paste data into AI tools, or share information with unsanctioned applications. ",{"data":21570,"content":21574,"nodeType":996},{"target":21571},{"sys":21572},{"id":21573,"type":1001,"linkType":1002},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":21576,"content":21577,"nodeType":860},{},[21578],{"data":21579,"marks":21580,"value":21581,"nodeType":864},{},[],"None of these are attacks where network-layer traffic inspection, endpoint monitoring, or email scanning provides complete coverage, because the attack surface is the browser session itself.",{"data":21583,"content":21587,"nodeType":996},{"target":21584},{"sys":21585},{"id":21586,"type":1001,"linkType":1002},"5kI5h4Z31ByD73er7voayF",[],{"data":21589,"content":21590,"nodeType":1005},{},[],{"data":21592,"content":21593,"nodeType":1009},{},[21594],{"data":21595,"marks":21596,"value":21598,"nodeType":864},{},[21597],{"type":899},"2. Browser security is now a board-level priority",{"data":21600,"content":21601,"nodeType":860},{},[21602,21607],{"data":21603,"marks":21604,"value":21606,"nodeType":864},{},[21605],{"type":899},"88% of respondents rank browser security as at least a top-five security priority",{"data":21608,"marks":21609,"value":21610,"nodeType":864},{},[],", with more than a quarter (26%) calling it their single top priority. For context, this is a survey that covers the full spectrum of security concerns — cloud, supply chain, AI, insider risk — and browser security has risen above most of them.",{"data":21612,"content":21613,"nodeType":860},{},[21614],{"data":21615,"marks":21616,"value":21617,"nodeType":864},{},[],"This is not aspirational interest. The correlation between priority level and investment is sharp: among those who rank browser security as their top priority, 72% have significantly increased their investment due to emerging threats. Among those who rank it in their top five, that figure is 26%. The organizations that care most are spending the most.",{"data":21619,"content":21620,"nodeType":860},{},[21621,21626],{"data":21622,"marks":21623,"value":21625,"nodeType":864},{},[21624],{"type":899},"86% of respondents have increased their browser security investment in response to emerging threats",{"data":21627,"marks":21628,"value":21629,"nodeType":864},{},[],", with 36% saying the increase was significant. When you ask what's driving that spend, the answer is the threat landscape: the attacks cataloged in the previous section are the reason budgets are moving.",{"data":21631,"content":21632,"nodeType":1005},{},[],{"data":21634,"content":21635,"nodeType":1009},{},[21636],{"data":21637,"marks":21638,"value":21640,"nodeType":864},{},[21639],{"type":899},"3. Real budget is being allocated — and it's growing",{"data":21642,"content":21643,"nodeType":860},{},[21644,21648,21653],{"data":21645,"marks":21646,"value":21647,"nodeType":864},{},[],"Secure enterprise browser solutions already take up ",{"data":21649,"marks":21650,"value":21652,"nodeType":864},{},[21651],{"type":899},"12.6% of the average security budget",{"data":21654,"marks":21655,"value":21656,"nodeType":864},{},[]," — a substantial allocation for a category that didn't exist as a standalone line item a few years ago. And 85% of respondents expect to increase that spend over the next 12–24 months, with a quarter expecting significant increases.",{"data":21658,"content":21659,"nodeType":860},{},[21660],{"data":21661,"marks":21662,"value":21663,"nodeType":864},{},[],"Where the money comes from tells its own story. The most common funding model is a discrete line item within security program budgets (31%) or a dedicated secure browsing budget (30%). When organizations pull from an existing program budget, web security (26%) and endpoint security (21%) are the most common sources — while SASE/SSE accounts for just 9%, despite SASE vendors being the second most popular vendor category. That disconnect between vendor preference and budget origin suggests the SASE-bundled buying motion may be more aspirational than operational.",{"data":21665,"content":21666,"nodeType":860},{},[21667],{"data":21668,"marks":21669,"value":21670,"nodeType":864},{},[],"IT operations leadership is the top stakeholder in 82% of evaluations, with CISO and security leadership at 64% and CIOs at 42%. Day-to-day management sits primarily with IT Ops (77%) and SecOps (50%). This dual stakeholder picture — IT operations driving evaluation, security leadership providing strategic direction — shapes the competitive landscape in ways we'll come back to.",{"data":21672,"content":21673,"nodeType":1005},{},[],{"data":21675,"content":21676,"nodeType":1009},{},[21677],{"data":21678,"marks":21679,"value":21681,"nodeType":864},{},[21680],{"type":899},"4. AI is accelerating both the threat and the use case",{"data":21683,"content":21684,"nodeType":860},{},[21685],{"data":21686,"marks":21687,"value":21688,"nodeType":864},{},[],"AI shows up in this report from two directions, mirroring how it is reshaping the security landscape itself.",{"data":21690,"content":21691,"nodeType":860},{},[21692,21696,21701],{"data":21693,"marks":21694,"value":21695,"nodeType":864},{},[],"On the threat side, ",{"data":21697,"marks":21698,"value":21700,"nodeType":864},{},[21699],{"type":899},"AI-powered targeted phishing and social engineering is the top emerging concern",{"data":21702,"marks":21703,"value":21704,"nodeType":864},{},[],", cited by 75% of respondents as either very concerning or concerning. Data leakage via unsanctioned AI applications comes second at 71%, followed by deepfake/AI-generated malicious content at 69% and credential harvesting via fake AI or SaaS login pages at 66%. Every one of these threat categories involves the browser — AI-enhanced phishing lands in the browser, AI data leakage happens through browser-based AI tools, and fake AI login pages are browser-based credential harvesting.",{"data":21706,"content":21710,"nodeType":996},{"target":21707},{"sys":21708},{"id":21709,"type":1001,"linkType":1002},"2ajv2i5wn2GzKuyynQGlvq",[],{"data":21712,"content":21713,"nodeType":860},{},[21714,21718,21723],{"data":21715,"marks":21716,"value":21717,"nodeType":864},{},[],"On the adoption side, the picture is almost universal — and almost universally under-governed. ",{"data":21719,"marks":21720,"value":21722,"nodeType":864},{},[21721],{"type":899},"92% of organizations now allow employees to use public GenAI applications",{"data":21724,"marks":21725,"value":21726,"nodeType":864},{},[],", and virtually every organization has some kind of policy position: 37% have sanctioned one public app (with everything else unsanctioned), 39% have sanctioned multiple public apps (with others unsanctioned), and 23% restrict employees to a corporate instance while the public versions are unsanctioned. ",{"data":21728,"content":21729,"nodeType":860},{},[21730],{"data":21731,"marks":21732,"value":21733,"nodeType":864},{},[],"Even the 8% who don't allow GenAI at all have taken a policy position. Essentially 100% of organizations have a GenAI policy — but for the vast majority, that policy designates a large portion of public AI tool usage as unsanctioned, which raises the immediate question of whether they have the tooling to actually enforce it.",{"data":21735,"content":21736,"nodeType":860},{},[21737],{"data":21738,"marks":21739,"value":21740,"nodeType":864},{},[],"The answer, based on the current tooling landscape, appears to be: not quite. When Omdia asked how organizations currently secure GenAI usage, 58% rely on secure web gateways — tools that see traffic metadata but cannot observe what a user actually does inside a GenAI session — while 57% use secure browsing solutions and 57% use SaaS security solutions. ",{"data":21742,"content":21743,"nodeType":860},{},[21744],{"data":21745,"marks":21746,"value":21747,"nodeType":864},{},[],"An SWG can tell you that a user visited ChatGPT, but it cannot tell you whether they pasted your company's source code into the prompt. That distinction — between knowing where data went and knowing what the user actually did — is the fundamental gap that browser-layer visibility exists to close, and it is exactly the gap that makes GenAI policies unenforceable without browser-layer tooling.",{"data":21749,"content":21750,"nodeType":860},{},[21751,21755,21760],{"data":21752,"marks":21753,"value":21754,"nodeType":864},{},[],"The use case data reflects this. When Omdia asked about the most important use cases for a secure browsing solution, ",{"data":21756,"marks":21757,"value":21759,"nodeType":864},{},[21758],{"type":899},"generative AI application security came in first at 59%",{"data":21761,"marks":21762,"value":21763,"nodeType":864},{},[],", followed by data loss prevention at 51% and general web security enhancement at 42%. The feature priorities tell a consistent story: AI-powered threat detection and response (52%) and advanced GenAI usage controls and monitoring (41%) were the top two capabilities organizations said would be most important in a purchase decision. ",{"data":21765,"content":21766,"nodeType":860},{},[21767],{"data":21768,"marks":21769,"value":21770,"nodeType":864},{},[],"AI is both the top threat concern and the top use case for browser security — and it is a browser problem at both ends, because every LLM interaction, every prompt containing sensitive data, and every AI agent authorization happens inside a browser session.",{"data":21772,"content":21773,"nodeType":1005},{},[],{"data":21775,"content":21776,"nodeType":1009},{},[21777],{"data":21778,"marks":21779,"value":21781,"nodeType":864},{},[21780],{"type":899},"5. Organizations that have deployed secure enterprise browser solutions are seeing real results",{"data":21783,"content":21784,"nodeType":860},{},[21785],{"data":21786,"marks":21787,"value":21788,"nodeType":864},{},[],"One of the most useful sections in Omdia's report is the benefits data — what organizations that have deployed SEB solutions are actually getting out of them.",{"data":21790,"content":21791,"nodeType":860},{},[21792,21796,21801],{"data":21793,"marks":21794,"value":21795,"nodeType":864},{},[],"The top realized benefit is ",{"data":21797,"marks":21798,"value":21800,"nodeType":864},{},[21799],{"type":899},"improved data security, cited by 58% of respondents",{"data":21802,"marks":21803,"value":21804,"nodeType":864},{},[],", followed by fewer security incidents (49%), better visibility and auditing (47%), improved user experience (44%), and simplified configuration and policy management (41%). The picture that emerges is not just a security story but an operational one: organizations are seeing fewer incidents, better visibility, and simpler management alongside the security outcomes.",{"data":21806,"content":21807,"nodeType":860},{},[21808],{"data":21809,"marks":21810,"value":21811,"nodeType":864},{},[],"The 49% who cite fewer security incidents as a realized benefit is the number that matters most here, because it directly connects SEB deployment to measurable risk reduction. Organizations aren't just buying tools and hoping — they're deploying them and seeing fewer successful attacks as a result.",{"data":21813,"content":21814,"nodeType":1005},{},[],{"data":21816,"content":21817,"nodeType":1009},{},[21818],{"data":21819,"marks":21820,"value":21822,"nodeType":864},{},[21821],{"type":899},"6. The market wants protection in existing browsers, not migration",{"data":21824,"content":21825,"nodeType":860},{},[21826,21830,21835],{"data":21827,"marks":21828,"value":21829,"nodeType":864},{},[],"When Omdia asked what attributes matter most in a secure enterprise browser solution, ",{"data":21831,"marks":21832,"value":21834,"nodeType":864},{},[21833],{"type":899},"\"ability to use existing browsers\" ranked as the fourth most important attribute at 48%",{"data":21836,"marks":21837,"value":21838,"nodeType":864},{},[]," — behind only integration with other security tools (57%), controls over generative AI application usage (53%), and centralized policy enforcement (52%). ",{"data":21840,"content":21841,"nodeType":860},{},[21842],{"data":21843,"marks":21844,"value":21845,"nodeType":864},{},[],"That 48% figure, combined with 80% of respondents saying they expect to use an SEB solution as an integrated or alongside component rather than a replacement for existing tools, points to a clear market preference: organizations want browser security that works with their existing browser estate, not a migration to a new one.",{"data":21847,"content":21848,"nodeType":860},{},[21849,21853,21861],{"data":21850,"marks":21851,"value":21852,"nodeType":864},{},[],"This is consistent with what we hear from security leaders directly. As ",{"data":21854,"content":21855,"nodeType":883},{"uri":12928},[21856],{"data":21857,"marks":21858,"value":21860,"nodeType":864},{},[21859],{"type":1455},"Josh Lemos put it: ",{"data":21862,"marks":21863,"value":21864,"nodeType":864},{},[],"\"We looked at the full-stack enterprise browser approach, but converging on a single platform was tough. Push gave me the security instrumentation and context I needed without onerous headwinds.\" The deployment model matters because it determines adoption velocity — and a tool that requires browser migration introduces friction that delays time to value.",{"data":21866,"content":21867,"nodeType":860},{},[21868,21872],{"data":21869,"marks":21870,"value":21871,"nodeType":864},{},[],"Push was built around this insight from day one. As the secure enterprise browser extension for security teams, Push turns any browser — managed or unmanaged, including agentic browsers — into a telemetry source and control point the moment it's installed. It has been rolled out to 100,000 users in under an hour during normal office hours with zero downtime. ",{"data":21873,"marks":21874,"value":21876,"nodeType":864},{},[21875],{"type":899},"That is a deployment model that matches what Omdia's respondents are asking for.",{"data":21878,"content":21879,"nodeType":1005},{},[],{"data":21881,"content":21882,"nodeType":1009},{},[21883],{"data":21884,"marks":21885,"value":21887,"nodeType":864},{},[21886],{"type":899},"7. Dedicated vendors lead over platform plays",{"data":21889,"content":21890,"nodeType":860},{},[21891,21895,21900],{"data":21892,"marks":21893,"value":21894,"nodeType":864},{},[],"When Omdia asked which category of vendor organizations primarily use or expect to use for secure enterprise browsing, ",{"data":21896,"marks":21897,"value":21899,"nodeType":864},{},[21898],{"type":899},"36% chose a dedicated SEB vendor",{"data":21901,"marks":21902,"value":21903,"nodeType":864},{},[]," — the largest single category. SASE/network security vendors came second at 29%, followed by traditional VDI/desktop virtualization vendors at 19% and endpoint platform vendors at 15%.",{"data":21905,"content":21906,"nodeType":860},{},[21907],{"data":21908,"marks":21909,"value":21910,"nodeType":864},{},[],"The dedicated category leads, and the reason isn't just first-mover advantage — it's architectural. The alternative paths each come with structural constraints. SASE and SSE platforms are network-centric: they see traffic metadata and enforce URL categorization, but they can't observe the rendered page inside a browser tab — the DOM structure, the script behavior, the credential entry that distinguishes a legitimate login from an AiTM reverse-proxy kit. ",{"data":21912,"content":21913,"nodeType":860},{},[21914],{"data":21915,"marks":21916,"value":21917,"nodeType":864},{},[],"Endpoint platforms that bolt on browser visibility are still anchored to the OS layer, solving for browser exploit prevention rather than in-session behavioral detection of the attacks that actually dominate — phishing, credential theft, session hijacking, extension compromise. And when large platform vendors acquire browser security capabilities, the integration work takes years rather than months, during which detection depth sits in a transitional state. ",{"data":21919,"content":21920,"nodeType":860},{},[21921],{"data":21922,"marks":21923,"value":21924,"nodeType":864},{},[],"Dedicated browser-native vendors start from a different premise entirely: the browser isn't a supplementary signal feeding into someone else's SASE pipeline or XDR correlation engine — it is the telemetry source and the control point. The browser is the only place where you get simultaneous visibility into both the attacker's technique and the employee's action within the same session, because the phishing page, the credential submission, the token exchange, and the data exfiltration all happen inside the same tab. No network appliance, endpoint agent, or identity provider log can see all of that, because none of them are present where the interaction occurs.",{"data":21926,"content":21927,"nodeType":860},{},[21928],{"data":21929,"marks":21930,"value":21931,"nodeType":864},{},[],"For security teams evaluating SEB solutions, the architecture matters more than the vendor category label. The capabilities Omdia's respondents ranked highest — integration with existing tools, GenAI controls, centralized policy enforcement, and the ability to use existing browsers — all point toward solutions that deliver detection depth through a lightweight deployment model, without browser migration and without the integration debt of a platform acquisition.",{"data":21933,"content":21934,"nodeType":1005},{},[],{"data":21936,"content":21937,"nodeType":860},{},[21938],{"data":21939,"marks":21940,"value":21941,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":21943,"content":21944,"nodeType":860},{},[21945],{"data":21946,"marks":21947,"value":1689,"nodeType":864},{},[],{"data":21949,"content":21950,"nodeType":860},{},[21951,21954,21961],{"data":21952,"marks":21953,"value":21,"nodeType":864},{},[],{"data":21955,"content":21956,"nodeType":883},{"uri":1700},[21957],{"data":21958,"marks":21959,"value":15017,"nodeType":864},{},[21960],{"type":1455},{"data":21962,"marks":21963,"value":2719,"nodeType":864},{},[],"7 things Omdia's latest report tells us about the secure enterprise browser market","Unpacking the latest research report from Omdia and what it means for the secure enterprise browser market.","2026-05-13T00:00:00.000Z","7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market",{"items":21969},[21970,21972],{"sys":21971,"name":297},{"id":2732},{"sys":21973,"name":2729},{"id":2728},{"items":21975},[21976],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":21977},{"url":2740},{"__typename":2059,"sys":21979,"content":21981,"title":22943,"synopsis":22944,"hashTags":59,"publishedDate":22945,"slug":22946,"tagsCollection":22947,"authorsCollection":22953},{"id":21980},"3jF1fypt08TNlSoWuoMWhj",{"json":21982},{"data":21983,"content":21984,"nodeType":856},{},[21985,22011,22042,22084,22127,22133,22145,22148,22156,22207,22214,22237,22243,22246,22254,22283,22290,22298,22304,22307,22315,22322,22340,22347,22388,22395,22398,22406,22425,22480,22483,22491,22509,22527,22534,22541,22553,22565,22577,22589,22606,22614,22621,22624,22630,22636,22651,22654,22662,22680,22937],{"data":21986,"content":21987,"nodeType":860},{},[21988,21992,21998,22002,22007],{"data":21989,"marks":21990,"value":21991,"nodeType":864},{},[],"ShinyHunters and the broader SLH (",{"data":21993,"content":21994,"nodeType":883},{"uri":18024},[21995],{"data":21996,"marks":21997,"value":18027,"nodeType":864},{},[],{"data":21999,"marks":22000,"value":22001,"nodeType":864},{},[],") collective have claimed breaches at thousands of organizations over the past twelve months across retail, technology, aviation, financial services, media, gaming, and education, in what amounts to the most sustained data theft and extortion operation in recent cybercrime history. SLH's genealogy traces through a merger of Scattered Spider, Lapsus$, and ShinyHunters, all parts of ",{"data":22003,"marks":22004,"value":22006,"nodeType":864},{},[22005],{"type":899},"the Com",{"data":22008,"marks":22009,"value":22010,"nodeType":864},{},[],", a broader community of English-speaking cybercriminals with international links. ",{"data":22012,"content":22013,"nodeType":860},{},[22014,22018,22026,22030,22038],{"data":22015,"marks":22016,"value":22017,"nodeType":864},{},[],"The confirmed victim list reads like a Fortune 500 directory: Coca-Cola, Cisco, Qantas, Coinbase, ADT, Aflac, SoundCloud, Rockstar Games, Charter Communications, and recently ",{"data":22019,"content":22021,"nodeType":883},{"uri":22020},"https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/",[22022],{"data":22023,"marks":22024,"value":22025,"nodeType":864},{},[],"Instructure",{"data":22027,"marks":22028,"value":22029,"nodeType":864},{},[]," — whose breach ",{"data":22031,"content":22033,"nodeType":883},{"uri":22032},"https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/",[22034],{"data":22035,"marks":22036,"value":22037,"nodeType":864},{},[],"disrupted schools and universities nationwide",{"data":22039,"marks":22040,"value":22041,"nodeType":864},{},[]," during final exams — among dozens more named publicly and likely many more that haven't been (breaches settled quickly behind closed doors don't always make it into the public eye). ShinyHunters alone claimed over 1.5 billion stolen Salesforce records from a single campaign targeting more than 1,000 organizations.",{"data":22043,"content":22044,"nodeType":860},{},[22045,22049,22057,22061,22069,22073,22080],{"data":22046,"marks":22047,"value":22048,"nodeType":864},{},[],"Additional operating clusters, including Cordial Spider and Snarky Spider (which CrowdStrike ",{"data":22050,"content":22052,"nodeType":883},{"uri":22051},"https://cyberscoop.com/crowdstrike-cordial-spider-snarky-spider-extortion-attacks/",[22053],{"data":22054,"marks":22055,"value":22056,"nodeType":864},{},[],"characterizes as the new generation of Scattered Spider",{"data":22058,"marks":22059,"value":22060,"nodeType":864},{},[],") run parallel campaigns against different target sectors, unified not by shared infrastructure but by a shared playbook of techniques that exploit the structural weakness in modern SaaS-first organizations. ",{"data":22062,"content":22064,"nodeType":883},{"uri":22063},"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-12-Vishing-Campaigns-Lead-to-Data-Theft-and-Extortion.txt",[22065],{"data":22066,"marks":22067,"value":22068,"nodeType":864},{},[],"Unit 42 documented",{"data":22070,"marks":22071,"value":22072,"nodeType":864},{},[]," these groups moving from initial compromise to complete data exfiltration in under an hour — faster than most organizations can even begin to respond. Newer groups with links to the SLH ecosystem like CoinbaseCartel have also continued the tradition of weaponizing stolen credentials from the infostealer economy at scale, as ShinyHunters did in the ",{"data":22074,"content":22075,"nodeType":883},{"uri":18562},[22076],{"data":22077,"marks":22078,"value":22079,"nodeType":864},{},[],"2024 Snowflake breach",{"data":22081,"marks":22082,"value":22083,"nodeType":864},{},[]," that compromised over 165 customer environments (and claimed another billion-plus records).",{"data":22085,"content":22086,"nodeType":860},{},[22087,22091,22099,22103,22111,22115,22123],{"data":22088,"marks":22089,"value":22090,"nodeType":864},{},[],"Not every SLH breach is browser-based — the Instructure breach (275 million individuals, ~330 school login portals defaced) began with a Salesforce tenant compromise in September 2025, but resurfaced in May 2026 after attackers exploited a ",{"data":22092,"content":22094,"nodeType":883},{"uri":22093},"https://www.bitdefender.com/en-gb/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms",[22095],{"data":22096,"marks":22097,"value":22098,"nodeType":864},{},[],"vulnerability affecting Canvas's Free-For-Teacher program",{"data":22100,"marks":22101,"value":22102,"nodeType":864},{},[]," (it's now been confirmed that Instructure \"",{"data":22104,"content":22106,"nodeType":883},{"uri":22105},"https://www.instructure.com/incident_update",[22107],{"data":22108,"marks":22109,"value":22110,"nodeType":864},{},[],"reached a settlement",{"data":22112,"marks":22113,"value":22114,"nodeType":864},{},[],"\" for the deletion of the data, and shut down the free account tier), while the Coinbase breach cost ",{"data":22116,"content":22118,"nodeType":883},{"uri":22117},"https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/",[22119],{"data":22120,"marks":22121,"value":22122,"nodeType":864},{},[],"$180M–400M through insider bribery",{"data":22124,"marks":22125,"value":22126,"nodeType":864},{},[]," — but these are the exceptions that prove the rule. ",{"data":22128,"content":22132,"nodeType":996},{"target":22129},{"sys":22130},{"id":22131,"type":1001,"linkType":1002},"4qNrbDyMJIumQfdbh9YVkU",[],{"data":22134,"content":22135,"nodeType":860},{},[22136,22141],{"data":22137,"marks":22138,"value":22140,"nodeType":864},{},[22139],{"type":899},"The vast majority of SLH campaigns over the past year converge on three browser-based attack vectors: vishing combined with AiTM phishing, device code phishing exploiting account authorization flows, and OAuth supply chain attacks through compromised third-party integrators.",{"data":22142,"marks":22143,"value":22144,"nodeType":864},{},[]," Each is well-documented, each has produced confirmed victims at scale, and each is detectable or preventable through browser-layer security controls.",{"data":22146,"content":22147,"nodeType":1005},{},[],{"data":22149,"content":22150,"nodeType":1009},{},[22151],{"data":22152,"marks":22153,"value":22155,"nodeType":864},{},[22154],{"type":899},"Vector 1: Vishing combined with AiTM phishing",{"data":22157,"content":22158,"nodeType":860},{},[22159,22163,22171,22174,22182,22186,22193,22197,22204],{"data":22160,"marks":22161,"value":22162,"nodeType":864},{},[],"The most visible campaign right now pairs targeted voice calls with adversary-in-the-middle phishing pages — an approach that ",{"data":22164,"content":22166,"nodeType":883},{"uri":22165},"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",[22167],{"data":22168,"marks":22169,"value":22170,"nodeType":864},{},[],"Mandiant",{"data":22172,"marks":22173,"value":12989,"nodeType":864},{},[],{"data":22175,"content":22177,"nodeType":883},{"uri":22176},"https://www.crowdstrike.com/en-us/blog/defending-against-cordial-spider-and-snarky-spider-with-falcon-shield/",[22178],{"data":22179,"marks":22180,"value":22181,"nodeType":864},{},[]," CrowdStrike",{"data":22183,"marks":22184,"value":22185,"nodeType":864},{},[],", and",{"data":22187,"content":22188,"nodeType":883},{"uri":22063},[22189],{"data":22190,"marks":22191,"value":22192,"nodeType":864},{},[]," Unit 42",{"data":22194,"marks":22195,"value":22196,"nodeType":864},{},[]," have all documented from the incident response side, and which Push has ",{"data":22198,"content":22199,"nodeType":883},{"uri":14133},[22200],{"data":22201,"marks":22202,"value":22203,"nodeType":864},{},[],"documented from inside the attacker's own operator panels",{"data":22205,"marks":22206,"value":2924,"nodeType":864},{},[],{"data":22208,"content":22209,"nodeType":860},{},[22210],{"data":22211,"marks":22212,"value":22213,"nodeType":864},{},[],"An attacker impersonating IT support calls the target employee, establishes urgency — often citing a \"mandatory passkey rollout\" or a \"security compliance update\" — and directs them to a victim-branded AiTM phishing page (typically at a domain like \u003Ccompany>sso.com or \u003Ccompany>internal.com). The attack is processed by a live human in real time, relaying credentials and MFA codes to the legitimate identity provider as they are entered, capturing the resulting session token, and granting the attacker an authenticated session. ",{"data":22215,"content":22216,"nodeType":860},{},[22217,22221,22228,22232],{"data":22218,"marks":22219,"value":22220,"nodeType":864},{},[],"One of the reasons that this method is becoming so widespread is the commoditization of effective tools. Push's ",{"data":22222,"content":22223,"nodeType":883},{"uri":14133},[22224],{"data":22225,"marks":22226,"value":22227,"nodeType":864},{},[],"infiltration of the criminal phishing panels",{"data":22229,"marks":22230,"value":22231,"nodeType":864},{},[]," identified over 400 linked domains across four distinct infrastructure clusters. ",{"data":22233,"marks":22234,"value":22236,"nodeType":864},{},[22235],{"type":899},"This mirrors the pattern that turned AiTM phishing from a specialist capability into an industrialized market with competing PhaaS platforms, but with the added complication that voice phishing as the delivery vector makes the attack invisible to traditional anti-phishing controls at the email layer.",{"data":22238,"content":22242,"nodeType":996},{"target":22239},{"sys":22240},{"id":22241,"type":1001,"linkType":1002},"1Yhthl0PILGW7EmCcZUrNv",[],{"data":22244,"content":22245,"nodeType":1005},{},[],{"data":22247,"content":22248,"nodeType":1009},{},[22249],{"data":22250,"marks":22251,"value":22253,"nodeType":864},{},[22252],{"type":899},"Vector 2: Vishing combined with device code phishing",{"data":22255,"content":22256,"nodeType":860},{},[22257,22260,22268,22272,22279],{"data":22258,"marks":22259,"value":2761,"nodeType":864},{},[],{"data":22261,"content":22263,"nodeType":883},{"uri":22262},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[22264],{"data":22265,"marks":22266,"value":22267,"nodeType":864},{},[],"ShinyHunters Salesforce campaign",{"data":22269,"marks":22270,"value":22271,"nodeType":864},{},[]," that ran through 2025 and into 2026 used device code phishing as one of its core methods, ",{"data":22273,"content":22274,"nodeType":883},{"uri":18562},[22275],{"data":22276,"marks":22277,"value":22278,"nodeType":864},{},[],"compromising over 1,000 organizations and claiming 1.5 billion stolen records",{"data":22280,"marks":22281,"value":22282,"nodeType":864},{},[]," — including an attempted extortion of Salesforce itself. The attack involved registering an attacker-controlled \"DataLoader\" application mimicking a legitimate Salesforce tool, configuring it to request broad OAuth scopes including full API access and refresh token generation, and guiding victims through the device authorization flow via vishing calls.",{"data":22284,"content":22285,"nodeType":860},{},[22286],{"data":22287,"marks":22288,"value":22289,"nodeType":864},{},[],"Device code phishing exploits the OAuth 2.0 device authorization grant — a flow designed for devices without browsers, like smart TVs, but used in a wide range of scenarios including CLI logins — by tricking users into entering a code on Microsoft's (or another identity provider's) legitimate verification page. Since the victim is usually signed into the app in their browser, there’s no login at all. They simply navigate to the app’s device code login page and enter an attacker-provided code to grant the attacker an access token. ",{"data":22291,"content":22292,"nodeType":860},{},[22293],{"data":22294,"marks":22295,"value":22297,"nodeType":864},{},[22296],{"type":899},"This is what makes device code phishing structurally different from AiTM: it defeats all MFA (including passkeys) because the attack doesn’t target the login, but the authorization layer instead.",{"data":22299,"content":22303,"nodeType":996},{"target":22300},{"sys":22301},{"id":22302,"type":1001,"linkType":1002},"3ElQz8sLATnR8RY5nVlBGM",[],{"data":22305,"content":22306,"nodeType":1005},{},[],{"data":22308,"content":22309,"nodeType":1009},{},[22310],{"data":22311,"marks":22312,"value":22314,"nodeType":864},{},[22313],{"type":899},"Vector 3: OAuth supply chain attacks through compromised integrators",{"data":22316,"content":22317,"nodeType":860},{},[22318],{"data":22319,"marks":22320,"value":22321,"nodeType":864},{},[],"The third vector does not require the attacker to phish the victim organization's employees at all. Instead, it exploits the OAuth trust relationships that organizations create when they connect third-party SaaS vendors into their environments — and the consequence is that every organization that authorized one of these integrations effectively extended its security boundary to include the vendor's own security posture.",{"data":22323,"content":22324,"nodeType":860},{},[22325,22328,22336],{"data":22326,"marks":22327,"value":2761,"nodeType":864},{},[],{"data":22329,"content":22331,"nodeType":883},{"uri":22330},"https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",[22332],{"data":22333,"marks":22334,"value":22335,"nodeType":864},{},[],"Salesloft/Drift supply chain attack",{"data":22337,"marks":22338,"value":22339,"nodeType":864},{},[]," demonstrated this at scale in 2025: in an extension of the previously mentioned device code phishing campaign, the attacker compromised Salesloft's GitHub environment, used TruffleHog to find secrets, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight. ",{"data":22341,"content":22342,"nodeType":860},{},[22343],{"data":22344,"marks":22345,"value":22346,"nodeType":864},{},[],"Along with the previously mentioned device code phishing attacks,  more than 1000 organizations were breached. The attackers then harvested AWS keys, Snowflake credentials, and stored passwords from breached Salesforce instances, compounding the access into progressively wider reach.",{"data":22348,"content":22349,"nodeType":860},{},[22350,22354,22362,22366,22374,22378,22384],{"data":22351,"marks":22352,"value":22353,"nodeType":864},{},[],"The same structural pattern has continued into 2026 with the Anodot supply chain compromise, which has produced confirmed breaches at ",{"data":22355,"content":22357,"nodeType":883},{"uri":22356},"https://www.bleepingcomputer.com/news/security/vimeo-data-breach-exposes-personal-information-of-119-000-people/",[22358],{"data":22359,"marks":22360,"value":22361,"nodeType":864},{},[],"Vimeo",{"data":22363,"marks":22364,"value":22365,"nodeType":864},{},[]," (119,000 users), Rockstar Games (78.6 million records), and ",{"data":22367,"content":22369,"nodeType":883},{"uri":22368},"https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/",[22370],{"data":22371,"marks":22372,"value":22373,"nodeType":864},{},[],"Zara/Inditex",{"data":22375,"marks":22376,"value":22377,"nodeType":864},{},[]," (197,000 people), with further downstream victims likely still emerging. The ",{"data":22379,"content":22380,"nodeType":883},{"uri":4103},[22381],{"data":22382,"marks":22383,"value":18123,"nodeType":864},{},[],{"data":22385,"marks":22386,"value":22387,"nodeType":864},{},[],", which involved compromised OAuth tokens from Context.ai cascading into Google Workspace, also reinforces the same attack pattern (though it was likely not a ShinyHunters operation despite being claimed by someone pretending to be them).",{"data":22389,"content":22390,"nodeType":860},{},[22391],{"data":22392,"marks":22393,"value":22394,"nodeType":864},{},[],"A forgotten SaaS integration can easily become the pivot point for downstream compromise. The moment you authorize a third-party integration, your security boundary extends to include that vendor. If the third-party is compromised, every downstream customer organization with an active integration is exposed.",{"data":22396,"content":22397,"nodeType":1005},{},[],{"data":22399,"content":22400,"nodeType":1009},{},[22401],{"data":22402,"marks":22403,"value":22405,"nodeType":864},{},[22404],{"type":899},"The infostealer credential playbook sits alongside these attacks",{"data":22407,"content":22408,"nodeType":860},{},[22409,22413,22421],{"data":22410,"marks":22411,"value":22412,"nodeType":864},{},[],"Alongside the three vectors above, ShinyHunters has a track record of exploiting the infostealer credential economy at scale — and it predates any of them. The 2024 Snowflake campaign — 165+ customer environments compromised, over a billion records stolen from AT&T, Ticketmaster, Santander, and Advance Auto Parts among others — was built entirely on infostealer-harvested credentials replayed against MFA-less tenants, with ",{"data":22414,"content":22416,"nodeType":883},{"uri":22415},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[22417],{"data":22418,"marks":22419,"value":22420,"nodeType":864},{},[],"Mandiant's investigation",{"data":22422,"marks":22423,"value":22424,"nodeType":864},{},[]," finding that 80% of compromised accounts had prior breach exposure in datasets dating back to 2020. The credentials were already circulating in criminal marketplaces; ShinyHunters simply purchased and operationalized them at industrial scale.",{"data":22426,"content":22427,"nodeType":860},{},[22428,22432,22440,22444,22452,22456,22464,22468,22476],{"data":22429,"marks":22430,"value":22431,"nodeType":864},{},[],"The same methodology powered the ",{"data":22433,"content":22435,"nodeType":883},{"uri":22434},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials/",[22436],{"data":22437,"marks":22438,"value":22439,"nodeType":864},{},[],"HellCat Jira campaign",{"data":22441,"marks":22442,"value":22443,"nodeType":864},{},[]," through 2024–2025, and has now been industrialized as a standalone operation by ",{"data":22445,"content":22447,"nodeType":883},{"uri":22446},"https://www.halcyon.ai/jp/threat-group/coinbasecartel",[22448],{"data":22449,"marks":22450,"value":22451,"nodeType":864},{},[],"CoinbaseCartel",{"data":22453,"marks":22454,"value":22455,"nodeType":864},{},[],", another criminal group reported to be an offshoot of SLH. CoinbaseCartel's model is familiar: purchase old infostealer credentials, use them to access cloud and development environments, exfiltrate data, and demand ransom. ",{"data":22457,"content":22459,"nodeType":883},{"uri":22458},"https://www.infostealers.com/article/inside-the-coinbase-cartel-how-infostealer-credentials-fueled-a-100-company-ransomware-spree/",[22460],{"data":22461,"marks":22462,"value":22463,"nodeType":864},{},[],"Hudson Rock's analysis",{"data":22465,"marks":22466,"value":22467,"nodeType":864},{},[]," of the group's 170+ claimed victims confirms that roughly 80% had prior infostealer infections predating the attacks. The most recent named victim is ",{"data":22469,"content":22471,"nodeType":883},{"uri":22470},"https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/",[22472],{"data":22473,"marks":22474,"value":22475,"nodeType":864},{},[],"Grafana",{"data":22477,"marks":22478,"value":22479,"nodeType":864},{},[],", where a GitHub token compromised via the TanStack npm supply chain attack and missed during credential rotation was used to download the codebase and attempt extortion. ",{"data":22481,"content":22482,"nodeType":1005},{},[],{"data":22484,"content":22485,"nodeType":1009},{},[22486],{"data":22487,"marks":22488,"value":22490,"nodeType":864},{},[22489],{"type":899},"These attacks all happen in the browser",{"data":22492,"content":22493,"nodeType":860},{},[22494,22498,22505],{"data":22495,"marks":22496,"value":22497,"nodeType":864},{},[],"Every one of these attack chains is a browser-based attack that either occurs in the browser (AiTM phishing, device code phishing) or could have been prevented at the browser layer (OAuth consent governance). The techniques are interchangeable — the",{"data":22499,"content":22500,"nodeType":883},{"uri":3259},[22501],{"data":22502,"marks":22503,"value":22504,"nodeType":864},{},[]," same criminal kits now offer AiTM and device code phishing side by side",{"data":22506,"marks":22507,"value":22508,"nodeType":864},{},[],", and the same threat actor (ShinyHunters) has used all three vectors across different campaigns within the same twelve-month period.",{"data":22510,"content":22511,"nodeType":860},{},[22512,22516,22523],{"data":22513,"marks":22514,"value":22515,"nodeType":864},{},[],"Additionally, infostealer infections themselves are increasingly delivered through browser-based methods like ",{"data":22517,"content":22519,"nodeType":883},{"uri":22518},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection",[22520],{"data":22521,"marks":22522,"value":315,"nodeType":864},{},[],{"data":22524,"marks":22525,"value":22526,"nodeType":864},{},[],", closing the loop between the credential supply side and the browser-layer detection point.",{"data":22528,"content":22529,"nodeType":1312},{},[22530],{"data":22531,"marks":22532,"value":8788,"nodeType":864},{},[22533],{"type":899},{"data":22535,"content":22536,"nodeType":860},{},[22537],{"data":22538,"marks":22539,"value":22540,"nodeType":864},{},[],"Push operates at the exact point in each of these attack chains where automated intervention can still prevent the compromise. ",{"data":22542,"content":22543,"nodeType":860},{},[22544,22549],{"data":22545,"marks":22546,"value":22548,"nodeType":864},{},[22547],{"type":899},"For vishing + AiTM attacks, ",{"data":22550,"marks":22551,"value":22552,"nodeType":864},{},[],"Push's behavioral phishing detection analyzes and blocks the phishing page in real time by detecting it from the user's browser — regardless of the domains used, hosting infrastructure, or where the URL was delivered.  ",{"data":22554,"content":22555,"nodeType":860},{},[22556,22561],{"data":22557,"marks":22558,"value":22560,"nodeType":864},{},[22559],{"type":899},"For device code phishing,",{"data":22562,"marks":22563,"value":22564,"nodeType":864},{},[]," Push detects the phishing pages associated with device code phishing kits — including generic, technique-class detections that catch new kits without requiring kit-specific signatures. Second, Push provides an additional layer of protection on the legitimate device code authentication pages themselves, preventing users from entering attacker-supplied codes into them. Together, these detections cover both the kit-operated phishing infrastructure and the legitimate auth pages that the attack flow depends on.",{"data":22566,"content":22567,"nodeType":860},{},[22568,22573],{"data":22569,"marks":22570,"value":22572,"nodeType":864},{},[22571],{"type":899},"For OAuth supply chain attacks,",{"data":22574,"marks":22575,"value":22576,"nodeType":864},{},[]," Push's detects and controls OAuth consent flows at the browser layer — capturing which application is requesting access, what scopes it's requesting, and whether the grant should be permitted under organizational policy. Push customers can also block OAuth connection requests as they transit the browser, enabling security teams to stop unwanted integrations being added in the first place. ",{"data":22578,"content":22579,"nodeType":860},{},[22580,22585],{"data":22581,"marks":22582,"value":22584,"nodeType":864},{},[22583],{"type":899},"For the infostealer credential playbook,",{"data":22586,"marks":22587,"value":22588,"nodeType":864},{},[]," Push's stolen credential detection identifies when employees are using credentials that have appeared in breach datasets or dark web feeds — catching the moment a dormant infostealer credential surfaces at a browser-based login, as well as surfacing insecure login methods missing mitigating controls like MFA and enforcing them through in-browser guardrails. And on the supply side, Push's ClickFix detection addresses the browser-based delivery vector that is now the primary method for distributing infostealer malware in the first place.",{"data":22590,"content":22591,"nodeType":860},{},[22592,22595,22603],{"data":22593,"marks":22594,"value":21,"nodeType":864},{},[],{"data":22596,"content":22598,"nodeType":883},{"uri":22597},"https://pushsecurity.com/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks/",[22599],{"data":22600,"marks":22601,"value":22602,"nodeType":864},{},[],"Learn more about how you can use Push controls to protect your users from in-browser threats here. ",{"data":22604,"marks":22605,"value":21,"nodeType":864},{},[],{"data":22607,"content":22608,"nodeType":1312},{},[22609],{"data":22610,"marks":22611,"value":22613,"nodeType":864},{},[22612],{"type":899},"Closing thoughts",{"data":22615,"content":22616,"nodeType":860},{},[22617],{"data":22618,"marks":22619,"value":22620,"nodeType":864},{},[],"The campaigns documented in this post are not historical — they are ongoing, with new victims surfacing weekly and the underlying criminal infrastructure still actively developing. But the defensive strategy does not require anticipating which specific group, vector, or target sector comes next, because all of them converge on the same control point: the browser, where the attack begins or the integration decision is made. Organizations with browser-layer detection and OAuth governance in place have defense-in-depth against the full range of techniques these groups employ, regardless of which specific vector any given campaign uses.",{"data":22622,"content":22623,"nodeType":1005},{},[],{"data":22625,"content":22626,"nodeType":860},{},[22627],{"data":22628,"marks":22629,"value":4855,"nodeType":864},{},[],{"data":22631,"content":22632,"nodeType":860},{},[22633],{"data":22634,"marks":22635,"value":1689,"nodeType":864},{},[],{"data":22637,"content":22638,"nodeType":860},{},[22639,22642,22648],{"data":22640,"marks":22641,"value":21,"nodeType":864},{},[],{"data":22643,"content":22644,"nodeType":883},{"uri":15655},[22645],{"data":22646,"marks":22647,"value":1703,"nodeType":864},{},[],{"data":22649,"marks":22650,"value":21,"nodeType":864},{},[],{"data":22652,"content":22653,"nodeType":1005},{},[],{"data":22655,"content":22656,"nodeType":1009},{},[22657],{"data":22658,"marks":22659,"value":22661,"nodeType":864},{},[22660],{"type":899},"Appendix: named ShinyHunters victims since May 2025",{"data":22663,"content":22664,"nodeType":860},{},[22665,22669,22676],{"data":22666,"marks":22667,"value":22668,"nodeType":864},{},[],"To give an indication of the scale, the following table documents all publicly named victims attributed to ShinyHunters specifically since the Salesforce campaign began in May 2025. It is not exhaustive: ShinyHunters has claimed over 1,000 organizations in aggregate across its Salesforce campaigns alone, and many victims have not been publicly named. This list also doesn’t include the billion-plus records compromised in the 2024 Snowflake breaches. The major ransomware attacks executed against M&S, Co-op, and Jaguar Land Rover claimed by the ",{"data":22670,"content":22671,"nodeType":883},{"uri":18024},[22672],{"data":22673,"marks":22674,"value":22675,"nodeType":864},{},[],"Scattered Lapsus$ Hunters \"brand\"",{"data":22677,"marks":22678,"value":22679,"nodeType":864},{},[]," also aren't listed below. ",{"data":22681,"content":22682,"nodeType":4845},{},[22683,22730,22794,22842,22890],{"data":22684,"content":22685,"nodeType":4581},{},[22686,22697,22708,22719],{"data":22687,"content":22688,"nodeType":4569},{},[22689],{"data":22690,"content":22691,"nodeType":860},{},[22692],{"data":22693,"marks":22694,"value":22696,"nodeType":864},{},[22695],{"type":899},"Campaign",{"data":22698,"content":22699,"nodeType":4569},{},[22700],{"data":22701,"content":22702,"nodeType":860},{},[22703],{"data":22704,"marks":22705,"value":22707,"nodeType":864},{},[22706],{"type":899},"Began",{"data":22709,"content":22710,"nodeType":4569},{},[22711],{"data":22712,"content":22713,"nodeType":860},{},[22714],{"data":22715,"marks":22716,"value":22718,"nodeType":864},{},[22717],{"type":899},"Named victims",{"data":22720,"content":22721,"nodeType":4569},{},[22722],{"data":22723,"content":22724,"nodeType":860},{},[22725],{"data":22726,"marks":22727,"value":22729,"nodeType":864},{},[22728],{"type":899},"Confirmed impact",{"data":22731,"content":22732,"nodeType":4581},{},[22733,22757,22767,22777],{"data":22734,"content":22735,"nodeType":4569},{},[22736],{"data":22737,"content":22738,"nodeType":860},{},[22739,22744,22748,22753],{"data":22740,"marks":22741,"value":22743,"nodeType":864},{},[22742],{"type":899},"ShinyHunters Salesforce Vishing",{"data":22745,"marks":22746,"value":22747,"nodeType":864},{},[]," (vishing + device code phishing → Salesforce connected app authorization) \n\n& ",{"data":22749,"marks":22750,"value":22752,"nodeType":864},{},[22751],{"type":899},"Salesloft/Drift Supply Chain",{"data":22754,"marks":22755,"value":22756,"nodeType":864},{},[]," (stolen OAuth tokens → downstream Salesforce access)",{"data":22758,"content":22759,"nodeType":4569},{},[22760],{"data":22761,"content":22762,"nodeType":860},{},[22763],{"data":22764,"marks":22765,"value":22766,"nodeType":864},{},[],"May 2025",{"data":22768,"content":22769,"nodeType":4569},{},[22770],{"data":22771,"content":22772,"nodeType":860},{},[22773],{"data":22774,"marks":22775,"value":22776,"nodeType":864},{},[],"Coca-Cola Europacific Partners, Cisco, Qantas, LVMH, Adidas, Google, Chanel, Pandora, Allianz Life, Air France-KLM, Farmers Insurance, Workday, TransUnion, Stellantis, Kering, Odido, Hallmark, Salesloft (origin), Toast, Avalara, Fastly, Cato Networks, Cloudflare, Palo Alto Networks, Zscaler, Tenable, Elastic, JFrog, CyberArk, Rubrik, BeyondTrust, Proofpoint, Workiva, Mercer Advisors, Beacon Pointe, Ameriprise, Kemper, Udemy, 7-Eleven, Mytheresa, Marcus & Millichap, Carnival, Pitney Bowes, Alert 360, Amtrak, McGraw-Hill, Canada Life, Charter Communications",{"data":22778,"content":22779,"nodeType":4569},{},[22780,22787],{"data":22781,"content":22782,"nodeType":860},{},[22783],{"data":22784,"marks":22785,"value":22786,"nodeType":864},{},[],"49 named victims. Confirmed individual impact includes 23M+ records (Coca-Cola), 5.7M records (Qantas), 6.2M customers (Odido), 4.4M consumers (TransUnion), up to 18M records (Stellantis), 13.5M emails (McGraw-Hill), 8.2M emails (Pitney Bowes), 7.5M emails (Carnival), 7-Eleven: 185K confirmed by HIBP (SSNs, driver's licenses; franchisee data), Charter Communications: millions of records claimed (company disputes scope). ",{"data":22788,"content":22789,"nodeType":860},{},[22790],{"data":22791,"marks":22792,"value":22793,"nodeType":864},{},[],"ShinyHunters claims 1.5B+ Salesforce records across 1,000+ organizations total.",{"data":22795,"content":22796,"nodeType":4581},{},[22797,22812,22822,22832],{"data":22798,"content":22799,"nodeType":4569},{},[22800],{"data":22801,"content":22802,"nodeType":860},{},[22803,22808],{"data":22804,"marks":22805,"value":22807,"nodeType":864},{},[22806],{"type":899},"Vishing + AiTM SSO",{"data":22809,"marks":22810,"value":22811,"nodeType":864},{},[]," (vishing → AiTM phishing page → SSO session capture → SaaS data exfiltration)",{"data":22813,"content":22814,"nodeType":4569},{},[22815],{"data":22816,"content":22817,"nodeType":860},{},[22818],{"data":22819,"marks":22820,"value":22821,"nodeType":864},{},[],"Aug 2025",{"data":22823,"content":22824,"nodeType":4569},{},[22825],{"data":22826,"content":22827,"nodeType":860},{},[22828],{"data":22829,"marks":22830,"value":22831,"nodeType":864},{},[],"SoundCloud, GrubHub, Panera Bread, Match Group, Crunchbase, Betterment, CarMax, Edmunds, CarGurus, Hims & Hers, University of Pennsylvania, Harvard University, Optimizely, TELUS Digital, Crunchyroll, ADT",{"data":22833,"content":22834,"nodeType":4569},{},[22835],{"data":22836,"content":22837,"nodeType":860},{},[22838],{"data":22839,"marks":22840,"value":22841,"nodeType":864},{},[],"16 named victims. Confirmed individual impact includes ~30M records (SoundCloud), ~14M records (Panera), 10M+ records (Match Group), ~20M records (Betterment), 5.5M people (ADT), 1M+ records (UPenn), ~1PB stolen from TELUS Digital ($65M ransom refused).",{"data":22843,"content":22844,"nodeType":4581},{},[22845,22860,22870,22880],{"data":22846,"content":22847,"nodeType":4569},{},[22848],{"data":22849,"content":22850,"nodeType":860},{},[22851,22856],{"data":22852,"marks":22853,"value":22855,"nodeType":864},{},[22854],{"type":899},"Anodot Supply Chain",{"data":22857,"marks":22858,"value":22859,"nodeType":864},{},[]," (stolen OAuth tokens → downstream Snowflake/BigQuery access)",{"data":22861,"content":22862,"nodeType":4569},{},[22863],{"data":22864,"content":22865,"nodeType":860},{},[22866],{"data":22867,"marks":22868,"value":22869,"nodeType":864},{},[],"Apr 2026",{"data":22871,"content":22872,"nodeType":4569},{},[22873],{"data":22874,"content":22875,"nodeType":860},{},[22876],{"data":22877,"marks":22878,"value":22879,"nodeType":864},{},[],"Anodot/Glassbox (origin), Rockstar Games, Vimeo, Zara/Inditex",{"data":22881,"content":22882,"nodeType":4569},{},[22883],{"data":22884,"content":22885,"nodeType":860},{},[22886],{"data":22887,"marks":22888,"value":22889,"nodeType":864},{},[],"4 named victims (12+ total claimed). 78.6M records (Rockstar Games), 197K individuals (Zara), 119K individuals (Vimeo).",{"data":22891,"content":22892,"nodeType":4581},{},[22893,22908,22917,22927],{"data":22894,"content":22895,"nodeType":4569},{},[22896],{"data":22897,"content":22898,"nodeType":860},{},[22899,22904],{"data":22900,"marks":22901,"value":22903,"nodeType":864},{},[22902],{"type":899},"Other SLH-attributed",{"data":22905,"marks":22906,"value":22907,"nodeType":864},{},[]," (misc. vectors including infostealer chains, CI/CD supply chain, SaaS platform compromise)",{"data":22909,"content":22910,"nodeType":4569},{},[22911],{"data":22912,"content":22913,"nodeType":860},{},[22914],{"data":22915,"marks":22916,"value":22766,"nodeType":864},{},[],{"data":22918,"content":22919,"nodeType":4569},{},[22920],{"data":22921,"content":22922,"nodeType":860},{},[22923],{"data":22924,"marks":22925,"value":22926,"nodeType":864},{},[],"UK Legal Aid Agency, Mixpanel, Wynn Resorts, Woflow, Vercel, European Commission, Mercor, Medtronic, Instructure",{"data":22928,"content":22929,"nodeType":4569},{},[22930],{"data":22931,"content":22932,"nodeType":860},{},[22933],{"data":22934,"marks":22935,"value":22936,"nodeType":864},{},[],"10 named victims across varied vectors. Notable: Vercel (Lumma Stealer → Context.ai OAuth app → Google Workspace), European Commission (poisoned Trivy GitHub Action → 340GB across 71 EU entities)",{"data":22938,"content":22939,"nodeType":860},{},[22940],{"data":22941,"marks":22942,"value":21,"nodeType":864},{},[],"The three attack techniques behind ShinyHunters' 2026 campaigns ","ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture. ","2026-05-08T00:00:00.000Z","analyzing-the-instructure-breach",{"items":22948},[22949,22951],{"sys":22950,"name":15033},{"id":15032},{"sys":22952,"name":342},{"id":15029},{"items":22954},[22955],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":22956},{"url":2740},{"__typename":2059,"sys":22958,"content":22960,"title":23465,"synopsis":23466,"hashTags":59,"publishedDate":23467,"slug":23468,"tagsCollection":23469,"authorsCollection":23475},{"id":22959},"2MWicW07sNEBp59wxYtAiC",{"json":22961},{"data":22962,"content":22963,"nodeType":856},{},[22964,22972,23003,23009,23016,23035,23050,23053,23061,23076,23095,23120,23126,23142,23171,23177,23183,23199,23202,23210,23217,23225,23243,23259,23266,23291,23298,23306,23335,23342,23350,23357,23363,23366,23374,23381,23389,23395,23398,23406,23413,23420,23427,23439,23442,23448],{"data":22965,"content":22966,"nodeType":1009},{},[22967],{"data":22968,"marks":22969,"value":22971,"nodeType":864},{},[22970],{"type":899},"The quantification problem nobody talks about",{"data":22973,"content":22974,"nodeType":860},{},[22975,22979,22987,22991,22999],{"data":22976,"marks":22977,"value":22978,"nodeType":864},{},[],"I was recently teaching ",{"data":22980,"content":22982,"nodeType":883},{"uri":22981},"https://www.sans.org/cyber-security-courses/cybersecurity-leaders/",[22983],{"data":22984,"marks":22985,"value":22986,"nodeType":864},{},[],"SANS LDR551",{"data":22988,"marks":22989,"value":22990,"nodeType":864},{},[],", where we cover some of the flawed approaches used in risk measurement and prioritization — for example, presenting ordinal data in a risk matrix as ratio data, implying that the matrix represents quantitative analysis when it’s more of a best guess. We then look at modeling using ",{"data":22992,"content":22994,"nodeType":883},{"uri":22993},"https://en.wikipedia.org/wiki/Loss_exceedance_curve",[22995],{"data":22996,"marks":22997,"value":22998,"nodeType":864},{},[],"Loss Exceedance Curves",{"data":23000,"marks":23001,"value":23002,"nodeType":864},{},[]," as a more accurate, if much more difficult, approach to quantitative risk assessment.",{"data":23004,"content":23008,"nodeType":996},{"target":23005},{"sys":23006},{"id":23007,"type":1001,"linkType":1002},"4S1wJUm6E1qvyZzwrl2DL",[],{"data":23010,"content":23011,"nodeType":860},{},[23012],{"data":23013,"marks":23014,"value":23015,"nodeType":864},{},[],"The only problem is, we rarely have the time or the data to construct such models. Ask a CISO how they measure risk for credential compromise and other account takeover attacks, and the answer will probably include one or more of the following: a risk assessment, a whiteboard, and a room full of smart people making educated guesses about attack frequency and control strength. ",{"data":23017,"content":23018,"nodeType":860},{},[23019,23023,23031],{"data":23020,"marks":23021,"value":23022,"nodeType":864},{},[],"That isn't a criticism — for most risk scenarios, expert elicitation is the best (and most convenient) available method. Breach cost data is sparse, threat actor behavior is unpredictable, and internal incident history is (ideally!) a limited sample. Quantitative risk frameworks like ",{"data":23024,"content":23026,"nodeType":883},{"uri":23025},"https://www.fairinstitute.org/",[23027],{"data":23028,"marks":23029,"value":23030,"nodeType":864},{},[],"FAIR",{"data":23032,"marks":23033,"value":23034,"nodeType":864},{},[]," give structure to that uncertainty, but they can't conjure data that just doesn't exist.",{"data":23036,"content":23037,"nodeType":860},{},[23038,23042,23047],{"data":23039,"marks":23040,"value":23041,"nodeType":864},{},[],"The results are usually estimates with wide confidence intervals and loss distributions that appear precise, but are hard to defend to a CFO or a board. Finance leaders have seen Monte Carlo simulations before; the capable ones will challenge the quality of the outputs if they doubt the quality of the inputs. ",{"data":23043,"marks":23044,"value":23046,"nodeType":864},{},[23045],{"type":899},"But with the right telemetry, we can get both",{"data":23048,"marks":23049,"value":2924,"nodeType":864},{},[],{"data":23051,"content":23052,"nodeType":1005},{},[],{"data":23054,"content":23055,"nodeType":1009},{},[23056],{"data":23057,"marks":23058,"value":23060,"nodeType":864},{},[23059],{"type":899},"Why the identity attack surface is uniquely measurable",{"data":23062,"content":23063,"nodeType":860},{},[23064,23068,23073],{"data":23065,"marks":23066,"value":23067,"nodeType":864},{},[],"We've written extensively about the shift to identity as a primary attack vector — and the evidence continues to stack up. Credential phishing, device code phishing, ClickFix, adversary-in-the-middle attacks, session hijacking, and SaaS account compromise now account for the majority of breach entry points in most enterprise environments. But the silver lining here is that this shift has created something valuable for risk quantification: ",{"data":23069,"marks":23070,"value":23072,"nodeType":864},{},[23071],{"type":2246},"a highly observable threat surface",{"data":23074,"marks":23075,"value":2924,"nodeType":864},{},[],{"data":23077,"content":23078,"nodeType":860},{},[23079,23083,23091],{"data":23080,"marks":23081,"value":23082,"nodeType":864},{},[],"Identity attacks execute ",{"data":23084,"content":23085,"nodeType":883},{"uri":8804},[23086],{"data":23087,"marks":23088,"value":23090,"nodeType":864},{},[23089],{"type":1455},"in the browser",{"data":23092,"marks":23093,"value":23094,"nodeType":864},{},[],". They leave traces in authentication flows, login behaviors, OAuth integrations, extension activity, and SaaS access patterns — all of which are captured in real time by the Push extension. Unlike network or endpoint attacks, where the signal is often binary and retroactive, browser-based identity threats generate continuous, high-frequency telemetry that maps directly onto the inputs that drive quantitative risk models.",{"data":23096,"content":23097,"nodeType":860},{},[23098,23102,23107,23111,23116],{"data":23099,"marks":23100,"value":23101,"nodeType":864},{},[],"This telemetry directly informs the hardest inputs in any quantitative risk model. One is ",{"data":23103,"marks":23104,"value":23106,"nodeType":864},{},[23105],{"type":899},"Threat Event Frequency (TEF)",{"data":23108,"marks":23109,"value":23110,"nodeType":864},{},[],": how often a threat agent acts against an asset in a given period. For identity risks, this can be answered in how many credential phishing attempts reached your users across all delivery channels (social media, email, malvertising, etc.), or how frequently your users authorize malicious or compromised SaaS apps. Browser-level telemetry can answer these questions with ",{"data":23112,"marks":23113,"value":23115,"nodeType":864},{},[23114],{"type":2246},"observed",{"data":23117,"marks":23118,"value":23119,"nodeType":864},{},[]," data rather than industry lookups and general benchmarks. ",{"data":23121,"content":23125,"nodeType":996},{"target":23122},{"sys":23123},{"id":23124,"type":1001,"linkType":1002},"EvjT68MCWW7nz5q86xe8S",[],{"data":23127,"content":23128,"nodeType":860},{},[23129,23133,23138],{"data":23130,"marks":23131,"value":23132,"nodeType":864},{},[],"The other input to risk modeling that's difficult to express in concrete terms is ",{"data":23134,"marks":23135,"value":23137,"nodeType":864},{},[23136],{"type":899},"vulnerability",{"data":23139,"marks":23140,"value":23141,"nodeType":864},{},[],": the probability a threat becomes a loss event or, more specifically, how likely it is that your controls will fail. ",{"data":23143,"content":23144,"nodeType":860},{},[23145,23149,23157,23161,23168],{"data":23146,"marks":23147,"value":23148,"nodeType":864},{},[],"This is where browser telemetry gets especially concrete. ",{"data":23150,"content":23152,"nodeType":883},{"uri":23151},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[23153],{"data":23154,"marks":23155,"value":23156,"nodeType":864},{},[],"Analysis of login telemetry across Push-monitored environments",{"data":23158,"marks":23159,"value":23160,"nodeType":864},{},[]," shows that 1 in 4 logins are still password-only (not SSO), 2 in 5 are not protected by MFA, and 1 in 5 use a weak, breached, or reused password. Many of these logins occur outside the visibility of a central IdP platform like Microsoft, Google or Okta — the result of downstream ",{"data":23162,"content":23163,"nodeType":883},{"uri":13067},[23164],{"data":23165,"marks":23166,"value":23167,"nodeType":864},{},[],"ghost logins",{"data":23169,"marks":23170,"value":1774,"nodeType":864},{},[],{"data":23172,"content":23176,"nodeType":996},{"target":23173},{"sys":23174},{"id":23175,"type":1001,"linkType":1002},"5GctExdVGjHRwKifiP00Fp",[],{"data":23178,"content":23182,"nodeType":996},{"target":23179},{"sys":23180},{"id":23181,"type":1001,"linkType":1002},"2mWToHCJcuB9FMwxxzd67F",[],{"data":23184,"content":23185,"nodeType":860},{},[23186,23190,23195],{"data":23187,"marks":23188,"value":23189,"nodeType":864},{},[],"In a FAIR-based model, TEF and vulnerability together determine ",{"data":23191,"marks":23192,"value":23194,"nodeType":864},{},[23193],{"type":899},"loss event frequency",{"data":23196,"marks":23197,"value":23198,"nodeType":864},{},[],": the foundational driver of the entire risk calculation. Using telemetry from your own environment as the basis for these calculations makes them far more accurate, and more likely to stand up to scrutiny.",{"data":23200,"content":23201,"nodeType":1005},{},[],{"data":23203,"content":23204,"nodeType":1009},{},[23205],{"data":23206,"marks":23207,"value":23209,"nodeType":864},{},[23208],{"type":899},"The attack surface is bigger than most models assume",{"data":23211,"content":23212,"nodeType":860},{},[23213],{"data":23214,"marks":23215,"value":23216,"nodeType":864},{},[],"One of the consistent failures in identity risk modeling is the tendency to model risks defenders can see, and leave the rest off the balance sheet. These omissions create a systematic understatement of exposure that browser-based telemetry can offset.",{"data":23218,"content":23219,"nodeType":1312},{},[23220],{"data":23221,"marks":23222,"value":23224,"nodeType":864},{},[23223],{"type":899},"Shadow AI and OAuth sprawl",{"data":23226,"content":23227,"nodeType":860},{},[23228,23231,23239],{"data":23229,"marks":23230,"value":21,"nodeType":864},{},[],{"data":23232,"content":23233,"nodeType":883},{"uri":4103},[23234],{"data":23235,"marks":23236,"value":23238,"nodeType":864},{},[23237],{"type":1455},"The Vercel breach in April 2026",{"data":23240,"marks":23241,"value":23242,"nodeType":864},{},[]," was the result of an OAuth connection to a third-party AI SaaS tool a developer connected into the organization's Google Workspace tenant (without admin approval). When the AI vendor was compromised, the attacker leveraged stored OAuth tokens to access downstream accounts, ultimately reaching internal dashboards, API keys, and source code. ",{"data":23244,"content":23245,"nodeType":860},{},[23246,23250,23255],{"data":23247,"marks":23248,"value":23249,"nodeType":864},{},[],"Push telemetry across customer environments shows an average of ",{"data":23251,"marks":23252,"value":23254,"nodeType":864},{},[23253],{"type":899},"17 unique AI app integrations per organization in Microsoft and Google alone",{"data":23256,"marks":23257,"value":23258,"nodeType":864},{},[],", most of which security teams would describe as unapproved. These generally don't appear in a conventional risk model that isn't looking for them.",{"data":23260,"content":23261,"nodeType":1312},{},[23262],{"data":23263,"marks":23264,"value":288,"nodeType":864},{},[23265],{"type":899},{"data":23267,"content":23268,"nodeType":860},{},[23269,23273,23282,23287],{"data":23270,"marks":23271,"value":21,"nodeType":864},{},[23272],{"type":899},{"data":23274,"content":23275,"nodeType":883},{"uri":2411},[23276],{"data":23277,"marks":23278,"value":23281,"nodeType":864},{},[23279,23280],{"type":1455},{"type":899},"Analysis of 20,000 unique extensions deployed across Push customer environments",{"data":23283,"marks":23284,"value":23286,"nodeType":864},{},[23285],{"type":899}," found that 46.76% have the permission combinations required for account takeover without user interaction. ",{"data":23288,"marks":23289,"value":23290,"nodeType":864},{},[],"The extensions carrying these permissions aren't flagged by risk scoring systems because the same permissions are used by ad blockers, password managers, and translation tools (the downside of relying on tools that rely on dubious scoring to assess extensions, but I digress). ",{"data":23292,"content":23293,"nodeType":860},{},[23294],{"data":23295,"marks":23296,"value":23297,"nodeType":864},{},[],"What matters for risk quantification isn't the permission set or an arbitrary score assigned by a vendor; it's whether the monitoring exists to detect when a previously-clean extension changes ownership, escalates permissions, or behaves anomalously. Without that monitoring, the exposure is real but unquantified.",{"data":23299,"content":23300,"nodeType":1312},{},[23301],{"data":23302,"marks":23303,"value":23305,"nodeType":864},{},[23304],{"type":899},"ClickFix and non-email delivery channels",{"data":23307,"content":23308,"nodeType":860},{},[23309,23313,23320,23324,23331],{"data":23310,"marks":23311,"value":23312,"nodeType":864},{},[],"ClickFix — where a malicious page silently writes a PowerShell or mshta command into the victim's clipboard and instructs them to paste it — was ",{"data":23314,"content":23315,"nodeType":883},{"uri":14681},[23316],{"data":23317,"marks":23318,"value":23319,"nodeType":864},{},[],"the most common initial access vector observed by Microsoft in 2025",{"data":23321,"marks":23322,"value":23323,"nodeType":864},{},[],", and CrowdStrike reported a",{"data":23325,"content":23326,"nodeType":883},{"uri":3237},[23327],{"data":23328,"marks":23329,"value":23330,"nodeType":864},{},[]," 563% increase in fake CAPTCHA lures",{"data":23332,"marks":23333,"value":23334,"nodeType":864},{},[]," (one of the most common ClickFix styles in which the user has to \"verify they're human\" by running a command on their machine). ",{"data":23336,"content":23337,"nodeType":860},{},[23338],{"data":23339,"marks":23340,"value":23341,"nodeType":864},{},[],"What makes this particularly relevant for risk quantification is the delivery channel: 4 in 5 ClickFix payloads intercepted by Push arrive via search engines, not email. A risk model that estimates threat event frequency from email-based phishing telemetry alone is structurally blind to an entire category of attack that has become one of the most prevalent initial access methods in the landscape.",{"data":23343,"content":23344,"nodeType":1312},{},[23345],{"data":23346,"marks":23347,"value":23349,"nodeType":864},{},[23348],{"type":899},"Authorization attacks",{"data":23351,"content":23352,"nodeType":860},{},[23353],{"data":23354,"marks":23355,"value":23356,"nodeType":864},{},[],"Device code phishing and OAuth consent abuse represent a slightly separate category of identity attack that most risk models don't account for because they operate after the authentication flow has already completed — meaning password strength, MFA coverage, and SSO adoption are irrelevant to whether the attack succeeds. ",{"data":23358,"content":23362,"nodeType":996},{"target":23359},{"sys":23360},{"id":23361,"type":1001,"linkType":1002},"7qtHmxCzBm5664jD6HsCwN",[],{"data":23364,"content":23365,"nodeType":1005},{},[],{"data":23367,"content":23368,"nodeType":1009},{},[23369],{"data":23370,"marks":23371,"value":23373,"nodeType":864},{},[23372],{"type":899},"The key lesson for CISOs",{"data":23375,"content":23376,"nodeType":860},{},[23377],{"data":23378,"marks":23379,"value":23380,"nodeType":864},{},[],"A risk model that measures identity vulnerability purely in terms of authentication hygiene at the IdP layer — how many accounts have MFA, how many use SSO — will correctly quantify one dimension of exposure while completely missing another that is growing faster and is structurally immune to the controls being measured.",{"data":23382,"content":23383,"nodeType":860},{},[23384],{"data":23385,"marks":23386,"value":23388,"nodeType":864},{},[23387],{"type":899},"For a CISO building a risk model, these aren't edge cases. They represent a real attack surface that doesn't show up in models built on conventional network, endpoint, and cloud telemetry. We aren't just talking about better inputs to risk modeling — we're talking about entirely new risk scenarios that aren't being modeled at all, supported by live data.",{"data":23390,"content":23394,"nodeType":996},{"target":23391},{"sys":23392},{"id":23393,"type":1001,"linkType":1002},"2ObEcO1gqz8lrOLCZzfpNw",[],{"data":23396,"content":23397,"nodeType":1005},{},[],{"data":23399,"content":23400,"nodeType":1312},{},[23401],{"data":23402,"marks":23403,"value":23405,"nodeType":864},{},[23404],{"type":899},"Browser telemetry makes a CISO's life easier",{"data":23407,"content":23408,"nodeType":860},{},[23409],{"data":23410,"marks":23411,"value":23412,"nodeType":864},{},[],"Browser-based telemetry changes the conversation a CISO can have with a CFO or board. Instead of \"industry benchmarks suggest our expected annual loss from account compromise is somewhere in this range,\" the answer is, \"We can see how often these attacks are attempted against our users, and we can measure what percentage of our accounts have the controls in place to stop them,\" or \"We know how many shadow AI apps our users self-provision and share data with each month.\" ",{"data":23414,"content":23415,"nodeType":860},{},[23416],{"data":23417,"marks":23418,"value":23419,"nodeType":864},{},[],"Identity risk is only a piece of the quantification problem. Loss magnitude, regulatory exposure, and reputational impact are still extremely hard to estimate regardless of how good your frequency inputs are. ",{"data":23421,"content":23422,"nodeType":860},{},[23423],{"data":23424,"marks":23425,"value":23426,"nodeType":864},{},[],"But the identity attack surface is one of the few areas in security where measurement is genuinely achievable right now, and the gap between what most organizations are modeling and what's actually observable is significant. Shadow SaaS integrations, unapproved AI connections, browser extensions with excessive privileges — these are enumerable risks that don't appear in models built on network, endpoint, and cloud access telemetry alone. ",{"data":23428,"content":23429,"nodeType":860},{},[23430,23435],{"data":23431,"marks":23432,"value":23434,"nodeType":864},{},[23433],{"type":899},"The lesson for CISOs serious about quantitative risk management is this: the frameworks exist, the talent is available, and the bottleneck is almost always data quality. ",{"data":23436,"marks":23437,"value":23438,"nodeType":864},{},[],"Browser telemetry is a good example of the kind of high-fidelity, environment-specific measurement that closes that gap.",{"data":23440,"content":23441,"nodeType":1005},{},[],{"data":23443,"content":23444,"nodeType":860},{},[23445],{"data":23446,"marks":23447,"value":4855,"nodeType":864},{},[],{"data":23449,"content":23450,"nodeType":860},{},[23451,23455,23462],{"data":23452,"marks":23453,"value":23454,"nodeType":864},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see. ",{"data":23456,"content":23458,"nodeType":883},{"uri":23457},"https://pushsecurity.com/book-demo/",[23459],{"data":23460,"marks":23461,"value":15017,"nodeType":864},{},[],{"data":23463,"marks":23464,"value":2719,"nodeType":864},{},[],"The CISO's data problem (and how browser telemetry can help)","How CISOs can use browser telemetry to support cyber risk quantification in areas where traditional data points fall short. ","2026-05-11T00:00:00.000Z","the-cisos-data-problem-and-how-browser-telemetry-can-help",{"items":23470},[23471,23473],{"sys":23472,"name":2729},{"id":2728},{"sys":23474,"name":342},{"id":15029},{"items":23476},[23477],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":23478},{"url":3625},"verizon-dbir-2026-review","blog/verizon-dbir-2026-review",{"json":23482},{"data":23483,"content":23484,"nodeType":856},{},[23485],{"data":23486,"content":23487,"nodeType":860},{},[23488],{"data":23489,"marks":23490,"value":23491,"nodeType":864},{},[],"Verizon's 2026 Data Breach Investigations Report landed this week with the largest dataset in the report's 19-year history — more than 22,000 confirmed breaches across 145 countries, nearly double last year's count.","What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.",{"id":23494,"publishedAt":23495},"7sZs2lHCTN8oYc2OIGCIQG","2026-08-12T12:00:55.865Z",{"items":23497},[23498,23500],{"sys":23499,"name":297},{"id":2732},{"sys":23501,"name":15033},{"id":15032},{"items":23503},[23504,23506,23508,23510,23512,23514,23516,23518,23520,23522,23524,23526,23528,23530,23532,23534,23536,23538,23540,23542,23544,23546,23548,23550],{"sys":23505,"name":279,"slug":280,"tier":31},{"id":276},{"sys":23507,"name":413,"slug":414,"tier":31},{"id":410},{"sys":23509,"name":642,"slug":643,"tier":31},{"id":639},{"sys":23511,"name":519,"slug":520,"tier":31},{"id":516},{"sys":23513,"name":297,"slug":298,"tier":31},{"id":294},{"sys":23515,"name":235,"slug":236,"tier":31},{"id":232},{"sys":23517,"name":422,"slug":423,"tier":45},{"id":419},{"sys":23519,"name":315,"slug":316,"tier":45},{"id":312},{"sys":23521,"name":324,"slug":325,"tier":45},{"id":321},{"sys":23523,"name":580,"slug":581,"tier":45},{"id":577},{"sys":23525,"name":537,"slug":538,"tier":45},{"id":534},{"sys":23527,"name":633,"slug":634,"tier":45},{"id":630},{"sys":23529,"name":261,"slug":262,"tier":45},{"id":258},{"sys":23531,"name":475,"slug":476,"tier":45},{"id":472},{"sys":23533,"name":333,"slug":334,"tier":45},{"id":330},{"sys":23535,"name":457,"slug":458,"tier":45},{"id":454},{"sys":23537,"name":288,"slug":289,"tier":45},{"id":285},{"sys":23539,"name":252,"slug":253,"tier":45},{"id":249},{"sys":23541,"name":607,"slug":608,"tier":45},{"id":604},{"sys":23543,"name":650,"slug":651,"tier":45},{"id":647},{"sys":23545,"name":244,"slug":245,"tier":45},{"id":241},{"sys":23547,"name":368,"slug":369,"tier":45},{"id":365},{"sys":23549,"name":571,"slug":572,"tier":45},{"id":568},{"sys":23551,"name":484,"slug":485,"tier":45},{"id":481},"hcNrtVGANdYvnes1Z8X1g9b6b_dm694k5qOhLd1GfaI",{"id":23554,"title":4865,"authorsCollection":23555,"content":23561,"extension":228,"faqItemsCollection":24836,"faqTitle":59,"featured":6,"hashTags":59,"meta":24838,"metaTitle":24839,"ogImage":59,"postType":6981,"publishedDate":4867,"relatedBlogPostsCollection":24840,"slug":4868,"stem":26573,"subtitle":59,"summary":26574,"synopsis":4866,"sys":26585,"tagsCollection":26587,"topicsCollection":26593,"__hash__":26645},"blog/blog/the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value.json",{"items":23556},[23557],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":23558,"profilePicture":23560},[23559],"https://www.linkedin.com/in/alexhenshall/",{"url":4881},{"json":23562,"links":24630},{"data":23563,"content":23564,"nodeType":856},{},[23565,23578,23583,23589,23595,23600,23603,23610,23617,23632,23670,23675,23688,23691,23698,23705,23727,23759,23765,23768,23775,23782,23788,23793,23799,23802,23809,23816,23850,23880,23886,23889,23896,23903,23923,23929,23968,23974,23977,23984,23991,24027,24033,24038,24041,24048,24055,24081,24087,24092,24098,24101,24108,24115,24138,24144,24150,24156,24159,24166,24173,24179,24184,24190,24211,24234,24237,24244,24251,24257,24263,24266,24273,24328,24331,24338,24344,24612,24615],{"data":23566,"content":23567,"nodeType":860},{},[23568,23571,23575],{"data":23569,"marks":23570,"value":3639,"nodeType":864},{},[],{"data":23572,"marks":23573,"value":3644,"nodeType":864},{},[23574],{"type":899},{"data":23576,"marks":23577,"value":3648,"nodeType":864},{},[],{"data":23579,"content":23582,"nodeType":996},{"target":23580},{"sys":23581},{"id":3653,"type":1001,"linkType":1002},[],{"data":23584,"content":23585,"nodeType":860},{},[23586],{"data":23587,"marks":23588,"value":3661,"nodeType":864},{},[],{"data":23590,"content":23591,"nodeType":860},{},[23592],{"data":23593,"marks":23594,"value":3668,"nodeType":864},{},[],{"data":23596,"content":23599,"nodeType":996},{"target":23597},{"sys":23598},{"id":3673,"type":1001,"linkType":1002},[],{"data":23601,"content":23602,"nodeType":1005},{},[],{"data":23604,"content":23605,"nodeType":1009},{},[23606],{"data":23607,"marks":23608,"value":3685,"nodeType":864},{},[23609],{"type":899},{"data":23611,"content":23612,"nodeType":860},{},[23613],{"data":23614,"marks":23615,"value":3693,"nodeType":864},{},[23616],{"type":899},{"data":23618,"content":23619,"nodeType":860},{},[23620,23623,23629],{"data":23621,"marks":23622,"value":3700,"nodeType":864},{},[],{"data":23624,"content":23625,"nodeType":883},{"uri":3703},[23626],{"data":23627,"marks":23628,"value":3708,"nodeType":864},{},[],{"data":23630,"marks":23631,"value":3712,"nodeType":864},{},[],{"data":23633,"content":23634,"nodeType":860},{},[23635,23638,23644,23647,23651,23654,23658,23661,23667],{"data":23636,"marks":23637,"value":3719,"nodeType":864},{},[],{"data":23639,"content":23640,"nodeType":883},{"uri":3722},[23641],{"data":23642,"marks":23643,"value":3727,"nodeType":864},{},[],{"data":23645,"marks":23646,"value":3731,"nodeType":864},{},[],{"data":23648,"marks":23649,"value":3736,"nodeType":864},{},[23650],{"type":899},{"data":23652,"marks":23653,"value":2232,"nodeType":864},{},[],{"data":23655,"marks":23656,"value":3744,"nodeType":864},{},[23657],{"type":899},{"data":23659,"marks":23660,"value":3748,"nodeType":864},{},[],{"data":23662,"content":23663,"nodeType":883},{"uri":3751},[23664],{"data":23665,"marks":23666,"value":3756,"nodeType":864},{},[],{"data":23668,"marks":23669,"value":3760,"nodeType":864},{},[],{"data":23671,"content":23674,"nodeType":996},{"target":23672},{"sys":23673},{"id":3765,"type":1001,"linkType":1002},[],{"data":23676,"content":23677,"nodeType":860},{},[23678,23681,23685],{"data":23679,"marks":23680,"value":3773,"nodeType":864},{},[],{"data":23682,"marks":23683,"value":3778,"nodeType":864},{},[23684],{"type":899},{"data":23686,"marks":23687,"value":2924,"nodeType":864},{},[],{"data":23689,"content":23690,"nodeType":1005},{},[],{"data":23692,"content":23693,"nodeType":1009},{},[23694],{"data":23695,"marks":23696,"value":3792,"nodeType":864},{},[23697],{"type":899},{"data":23699,"content":23700,"nodeType":860},{},[23701],{"data":23702,"marks":23703,"value":3693,"nodeType":864},{},[23704],{"type":899},{"data":23706,"content":23707,"nodeType":860},{},[23708,23711,23717,23720,23724],{"data":23709,"marks":23710,"value":3806,"nodeType":864},{},[],{"data":23712,"content":23713,"nodeType":883},{"uri":3809},[23714],{"data":23715,"marks":23716,"value":3814,"nodeType":864},{},[],{"data":23718,"marks":23719,"value":3818,"nodeType":864},{},[],{"data":23721,"marks":23722,"value":3823,"nodeType":864},{},[23723],{"type":899},{"data":23725,"marks":23726,"value":3827,"nodeType":864},{},[],{"data":23728,"content":23729,"nodeType":860},{},[23730,23733,23739,23742,23746,23749,23756],{"data":23731,"marks":23732,"value":3834,"nodeType":864},{},[],{"data":23734,"content":23735,"nodeType":883},{"uri":3837},[23736],{"data":23737,"marks":23738,"value":3842,"nodeType":864},{},[],{"data":23740,"marks":23741,"value":3846,"nodeType":864},{},[],{"data":23743,"marks":23744,"value":3851,"nodeType":864},{},[23745],{"type":899},{"data":23747,"marks":23748,"value":3855,"nodeType":864},{},[],{"data":23750,"content":23751,"nodeType":883},{"uri":3858},[23752],{"data":23753,"marks":23754,"value":3864,"nodeType":864},{},[23755],{"type":899},{"data":23757,"marks":23758,"value":3868,"nodeType":864},{},[],{"data":23760,"content":23761,"nodeType":860},{},[23762],{"data":23763,"marks":23764,"value":3875,"nodeType":864},{},[],{"data":23766,"content":23767,"nodeType":1005},{},[],{"data":23769,"content":23770,"nodeType":1009},{},[23771],{"data":23772,"marks":23773,"value":3886,"nodeType":864},{},[23774],{"type":899},{"data":23776,"content":23777,"nodeType":860},{},[23778],{"data":23779,"marks":23780,"value":3894,"nodeType":864},{},[23781],{"type":899},{"data":23783,"content":23784,"nodeType":860},{},[23785],{"data":23786,"marks":23787,"value":3901,"nodeType":864},{},[],{"data":23789,"content":23792,"nodeType":996},{"target":23790},{"sys":23791},{"id":3906,"type":1001,"linkType":1002},[],{"data":23794,"content":23795,"nodeType":860},{},[23796],{"data":23797,"marks":23798,"value":3914,"nodeType":864},{},[],{"data":23800,"content":23801,"nodeType":1005},{},[],{"data":23803,"content":23804,"nodeType":1009},{},[23805],{"data":23806,"marks":23807,"value":3925,"nodeType":864},{},[23808],{"type":899},{"data":23810,"content":23811,"nodeType":860},{},[23812],{"data":23813,"marks":23814,"value":3894,"nodeType":864},{},[23815],{"type":899},{"data":23817,"content":23818,"nodeType":860},{},[23819,23822,23829,23832,23838,23841,23847],{"data":23820,"marks":23821,"value":3939,"nodeType":864},{},[],{"data":23823,"content":23824,"nodeType":883},{"uri":3942},[23825],{"data":23826,"marks":23827,"value":3948,"nodeType":864},{},[23828],{"type":1455},{"data":23830,"marks":23831,"value":3731,"nodeType":864},{},[],{"data":23833,"content":23834,"nodeType":883},{"uri":3954},[23835],{"data":23836,"marks":23837,"value":3959,"nodeType":864},{},[],{"data":23839,"marks":23840,"value":3731,"nodeType":864},{},[],{"data":23842,"content":23843,"nodeType":883},{"uri":3965},[23844],{"data":23845,"marks":23846,"value":3970,"nodeType":864},{},[],{"data":23848,"marks":23849,"value":3974,"nodeType":864},{},[],{"data":23851,"content":23852,"nodeType":860},{},[23853,23856,23863,23866,23870,23873,23877],{"data":23854,"marks":23855,"value":21,"nodeType":864},{},[],{"data":23857,"content":23858,"nodeType":883},{"uri":2411},[23859],{"data":23860,"marks":23861,"value":3988,"nodeType":864},{},[23862],{"type":1455},{"data":23864,"marks":23865,"value":3992,"nodeType":864},{},[],{"data":23867,"marks":23868,"value":3997,"nodeType":864},{},[23869],{"type":899},{"data":23871,"marks":23872,"value":4001,"nodeType":864},{},[],{"data":23874,"marks":23875,"value":4006,"nodeType":864},{},[23876],{"type":2246},{"data":23878,"marks":23879,"value":4010,"nodeType":864},{},[],{"data":23881,"content":23882,"nodeType":860},{},[23883],{"data":23884,"marks":23885,"value":4017,"nodeType":864},{},[],{"data":23887,"content":23888,"nodeType":1005},{},[],{"data":23890,"content":23891,"nodeType":1009},{},[23892],{"data":23893,"marks":23894,"value":4028,"nodeType":864},{},[23895],{"type":899},{"data":23897,"content":23898,"nodeType":860},{},[23899],{"data":23900,"marks":23901,"value":3894,"nodeType":864},{},[23902],{"type":899},{"data":23904,"content":23905,"nodeType":860},{},[23906,23909,23913,23916,23920],{"data":23907,"marks":23908,"value":4042,"nodeType":864},{},[],{"data":23910,"marks":23911,"value":4047,"nodeType":864},{},[23912],{"type":2246},{"data":23914,"marks":23915,"value":4051,"nodeType":864},{},[],{"data":23917,"marks":23918,"value":4056,"nodeType":864},{},[23919],{"type":2246},{"data":23921,"marks":23922,"value":4060,"nodeType":864},{},[],{"data":23924,"content":23925,"nodeType":860},{},[23926],{"data":23927,"marks":23928,"value":4067,"nodeType":864},{},[],{"data":23930,"content":23931,"nodeType":941},{},[23932,23950],{"data":23933,"content":23934,"nodeType":945},{},[23935],{"data":23936,"content":23937,"nodeType":860},{},[23938,23941,23947],{"data":23939,"marks":23940,"value":2761,"nodeType":864},{},[],{"data":23942,"content":23943,"nodeType":883},{"uri":4082},[23944],{"data":23945,"marks":23946,"value":4087,"nodeType":864},{},[],{"data":23948,"marks":23949,"value":4091,"nodeType":864},{},[],{"data":23951,"content":23952,"nodeType":945},{},[23953],{"data":23954,"content":23955,"nodeType":860},{},[23956,23959,23965],{"data":23957,"marks":23958,"value":2761,"nodeType":864},{},[],{"data":23960,"content":23961,"nodeType":883},{"uri":4103},[23962],{"data":23963,"marks":23964,"value":4108,"nodeType":864},{},[],{"data":23966,"marks":23967,"value":4112,"nodeType":864},{},[],{"data":23969,"content":23970,"nodeType":860},{},[23971],{"data":23972,"marks":23973,"value":4119,"nodeType":864},{},[],{"data":23975,"content":23976,"nodeType":1005},{},[],{"data":23978,"content":23979,"nodeType":1009},{},[23980],{"data":23981,"marks":23982,"value":4130,"nodeType":864},{},[23983],{"type":899},{"data":23985,"content":23986,"nodeType":860},{},[23987],{"data":23988,"marks":23989,"value":4138,"nodeType":864},{},[23990],{"type":899},{"data":23992,"content":23993,"nodeType":860},{},[23994,23997,24001,24004,24010,24013,24017,24020,24024],{"data":23995,"marks":23996,"value":4145,"nodeType":864},{},[],{"data":23998,"marks":23999,"value":4150,"nodeType":864},{},[24000],{"type":899},{"data":24002,"marks":24003,"value":4154,"nodeType":864},{},[],{"data":24005,"content":24006,"nodeType":883},{"uri":3237},[24007],{"data":24008,"marks":24009,"value":4161,"nodeType":864},{},[],{"data":24011,"marks":24012,"value":4165,"nodeType":864},{},[],{"data":24014,"marks":24015,"value":4170,"nodeType":864},{},[24016],{"type":899},{"data":24018,"marks":24019,"value":4174,"nodeType":864},{},[],{"data":24021,"marks":24022,"value":4179,"nodeType":864},{},[24023],{"type":899},{"data":24025,"marks":24026,"value":4183,"nodeType":864},{},[],{"data":24028,"content":24029,"nodeType":860},{},[24030],{"data":24031,"marks":24032,"value":4190,"nodeType":864},{},[],{"data":24034,"content":24037,"nodeType":996},{"target":24035},{"sys":24036},{"id":4195,"type":1001,"linkType":1002},[],{"data":24039,"content":24040,"nodeType":1005},{},[],{"data":24042,"content":24043,"nodeType":1009},{},[24044],{"data":24045,"marks":24046,"value":4207,"nodeType":864},{},[24047],{"type":899},{"data":24049,"content":24050,"nodeType":860},{},[24051],{"data":24052,"marks":24053,"value":4215,"nodeType":864},{},[24054],{"type":899},{"data":24056,"content":24057,"nodeType":860},{},[24058,24061,24068,24071,24078],{"data":24059,"marks":24060,"value":4222,"nodeType":864},{},[],{"data":24062,"content":24063,"nodeType":883},{"uri":2561},[24064],{"data":24065,"marks":24066,"value":4230,"nodeType":864},{},[24067],{"type":899},{"data":24069,"marks":24070,"value":4234,"nodeType":864},{},[],{"data":24072,"content":24073,"nodeType":883},{"uri":4237},[24074],{"data":24075,"marks":24076,"value":4243,"nodeType":864},{},[24077],{"type":899},{"data":24079,"marks":24080,"value":4247,"nodeType":864},{},[],{"data":24082,"content":24083,"nodeType":860},{},[24084],{"data":24085,"marks":24086,"value":4254,"nodeType":864},{},[],{"data":24088,"content":24091,"nodeType":996},{"target":24089},{"sys":24090},{"id":4259,"type":1001,"linkType":1002},[],{"data":24093,"content":24094,"nodeType":860},{},[24095],{"data":24096,"marks":24097,"value":4267,"nodeType":864},{},[],{"data":24099,"content":24100,"nodeType":1005},{},[],{"data":24102,"content":24103,"nodeType":1009},{},[24104],{"data":24105,"marks":24106,"value":4278,"nodeType":864},{},[24107],{"type":899},{"data":24109,"content":24110,"nodeType":860},{},[24111],{"data":24112,"marks":24113,"value":4286,"nodeType":864},{},[24114],{"type":899},{"data":24116,"content":24117,"nodeType":860},{},[24118,24121,24125,24128,24135],{"data":24119,"marks":24120,"value":4293,"nodeType":864},{},[],{"data":24122,"marks":24123,"value":4298,"nodeType":864},{},[24124],{"type":2246},{"data":24126,"marks":24127,"value":4302,"nodeType":864},{},[],{"data":24129,"content":24130,"nodeType":883},{"uri":4305},[24131],{"data":24132,"marks":24133,"value":4311,"nodeType":864},{},[24134],{"type":899},{"data":24136,"marks":24137,"value":4315,"nodeType":864},{},[],{"data":24139,"content":24140,"nodeType":860},{},[24141],{"data":24142,"marks":24143,"value":4322,"nodeType":864},{},[],{"data":24145,"content":24146,"nodeType":860},{},[24147],{"data":24148,"marks":24149,"value":4329,"nodeType":864},{},[],{"data":24151,"content":24152,"nodeType":860},{},[24153],{"data":24154,"marks":24155,"value":4336,"nodeType":864},{},[],{"data":24157,"content":24158,"nodeType":1005},{},[],{"data":24160,"content":24161,"nodeType":1009},{},[24162],{"data":24163,"marks":24164,"value":4347,"nodeType":864},{},[24165],{"type":899},{"data":24167,"content":24168,"nodeType":860},{},[24169],{"data":24170,"marks":24171,"value":4355,"nodeType":864},{},[24172],{"type":899},{"data":24174,"content":24175,"nodeType":860},{},[24176],{"data":24177,"marks":24178,"value":4362,"nodeType":864},{},[],{"data":24180,"content":24183,"nodeType":996},{"target":24181},{"sys":24182},{"id":4367,"type":1001,"linkType":1002},[],{"data":24185,"content":24186,"nodeType":860},{},[24187],{"data":24188,"marks":24189,"value":4375,"nodeType":864},{},[],{"data":24191,"content":24192,"nodeType":941},{},[24193,24202],{"data":24194,"content":24195,"nodeType":945},{},[24196],{"data":24197,"content":24198,"nodeType":860},{},[24199],{"data":24200,"marks":24201,"value":4388,"nodeType":864},{},[],{"data":24203,"content":24204,"nodeType":945},{},[24205],{"data":24206,"content":24207,"nodeType":860},{},[24208],{"data":24209,"marks":24210,"value":4398,"nodeType":864},{},[],{"data":24212,"content":24213,"nodeType":860},{},[24214,24217,24224,24227,24231],{"data":24215,"marks":24216,"value":4405,"nodeType":864},{},[],{"data":24218,"content":24219,"nodeType":883},{"uri":4408},[24220],{"data":24221,"marks":24222,"value":4414,"nodeType":864},{},[24223],{"type":899},{"data":24225,"marks":24226,"value":4418,"nodeType":864},{},[],{"data":24228,"marks":24229,"value":4423,"nodeType":864},{},[24230],{"type":2246},{"data":24232,"marks":24233,"value":4427,"nodeType":864},{},[],{"data":24235,"content":24236,"nodeType":1005},{},[],{"data":24238,"content":24239,"nodeType":1009},{},[24240],{"data":24241,"marks":24242,"value":4438,"nodeType":864},{},[24243],{"type":899},{"data":24245,"content":24246,"nodeType":860},{},[24247],{"data":24248,"marks":24249,"value":4446,"nodeType":864},{},[24250],{"type":899},{"data":24252,"content":24253,"nodeType":860},{},[24254],{"data":24255,"marks":24256,"value":4453,"nodeType":864},{},[],{"data":24258,"content":24259,"nodeType":860},{},[24260],{"data":24261,"marks":24262,"value":4460,"nodeType":864},{},[],{"data":24264,"content":24265,"nodeType":1005},{},[],{"data":24267,"content":24268,"nodeType":1009},{},[24269],{"data":24270,"marks":24271,"value":4471,"nodeType":864},{},[24272],{"type":899},{"data":24274,"content":24275,"nodeType":941},{},[24276,24289,24302,24315],{"data":24277,"content":24278,"nodeType":945},{},[24279],{"data":24280,"content":24281,"nodeType":860},{},[24282,24286],{"data":24283,"marks":24284,"value":4485,"nodeType":864},{},[24285],{"type":899},{"data":24287,"marks":24288,"value":4489,"nodeType":864},{},[],{"data":24290,"content":24291,"nodeType":945},{},[24292],{"data":24293,"content":24294,"nodeType":860},{},[24295,24299],{"data":24296,"marks":24297,"value":4500,"nodeType":864},{},[24298],{"type":899},{"data":24300,"marks":24301,"value":4504,"nodeType":864},{},[],{"data":24303,"content":24304,"nodeType":945},{},[24305],{"data":24306,"content":24307,"nodeType":860},{},[24308,24312],{"data":24309,"marks":24310,"value":4515,"nodeType":864},{},[24311],{"type":899},{"data":24313,"marks":24314,"value":4519,"nodeType":864},{},[],{"data":24316,"content":24317,"nodeType":945},{},[24318],{"data":24319,"content":24320,"nodeType":860},{},[24321,24325],{"data":24322,"marks":24323,"value":781,"nodeType":864},{},[24324],{"type":899},{"data":24326,"marks":24327,"value":4533,"nodeType":864},{},[],{"data":24329,"content":24330,"nodeType":1005},{},[],{"data":24332,"content":24333,"nodeType":1009},{},[24334],{"data":24335,"marks":24336,"value":4544,"nodeType":864},{},[24337],{"type":899},{"data":24339,"content":24340,"nodeType":860},{},[24341],{"data":24342,"marks":24343,"value":4551,"nodeType":864},{},[],{"data":24345,"content":24346,"nodeType":4845},{},[24347,24370,24392,24414,24436,24458,24480,24502,24524,24546,24568,24590],{"data":24348,"content":24349,"nodeType":4581},{},[24350,24360],{"data":24351,"content":24352,"nodeType":4569},{},[24353],{"data":24354,"content":24355,"nodeType":860},{},[24356],{"data":24357,"marks":24358,"value":4568,"nodeType":864},{},[24359],{"type":899},{"data":24361,"content":24362,"nodeType":4569},{},[24363],{"data":24364,"content":24365,"nodeType":860},{},[24366],{"data":24367,"marks":24368,"value":4580,"nodeType":864},{},[24369],{"type":899},{"data":24371,"content":24372,"nodeType":4581},{},[24373,24383],{"data":24374,"content":24375,"nodeType":4569},{},[24376],{"data":24377,"content":24378,"nodeType":860},{},[24379],{"data":24380,"marks":24381,"value":4595,"nodeType":864},{},[24382],{"type":899},{"data":24384,"content":24385,"nodeType":4569},{},[24386],{"data":24387,"content":24388,"nodeType":860},{},[24389],{"data":24390,"marks":24391,"value":4605,"nodeType":864},{},[],{"data":24393,"content":24394,"nodeType":4581},{},[24395,24405],{"data":24396,"content":24397,"nodeType":4569},{},[24398],{"data":24399,"content":24400,"nodeType":860},{},[24401],{"data":24402,"marks":24403,"value":4619,"nodeType":864},{},[24404],{"type":899},{"data":24406,"content":24407,"nodeType":4569},{},[24408],{"data":24409,"content":24410,"nodeType":860},{},[24411],{"data":24412,"marks":24413,"value":4629,"nodeType":864},{},[],{"data":24415,"content":24416,"nodeType":4581},{},[24417,24427],{"data":24418,"content":24419,"nodeType":4569},{},[24420],{"data":24421,"content":24422,"nodeType":860},{},[24423],{"data":24424,"marks":24425,"value":4643,"nodeType":864},{},[24426],{"type":899},{"data":24428,"content":24429,"nodeType":4569},{},[24430],{"data":24431,"content":24432,"nodeType":860},{},[24433],{"data":24434,"marks":24435,"value":4653,"nodeType":864},{},[],{"data":24437,"content":24438,"nodeType":4581},{},[24439,24449],{"data":24440,"content":24441,"nodeType":4569},{},[24442],{"data":24443,"content":24444,"nodeType":860},{},[24445],{"data":24446,"marks":24447,"value":4667,"nodeType":864},{},[24448],{"type":899},{"data":24450,"content":24451,"nodeType":4569},{},[24452],{"data":24453,"content":24454,"nodeType":860},{},[24455],{"data":24456,"marks":24457,"value":4677,"nodeType":864},{},[],{"data":24459,"content":24460,"nodeType":4581},{},[24461,24471],{"data":24462,"content":24463,"nodeType":4569},{},[24464],{"data":24465,"content":24466,"nodeType":860},{},[24467],{"data":24468,"marks":24469,"value":4691,"nodeType":864},{},[24470],{"type":899},{"data":24472,"content":24473,"nodeType":4569},{},[24474],{"data":24475,"content":24476,"nodeType":860},{},[24477],{"data":24478,"marks":24479,"value":4701,"nodeType":864},{},[],{"data":24481,"content":24482,"nodeType":4581},{},[24483,24493],{"data":24484,"content":24485,"nodeType":4569},{},[24486],{"data":24487,"content":24488,"nodeType":860},{},[24489],{"data":24490,"marks":24491,"value":4715,"nodeType":864},{},[24492],{"type":899},{"data":24494,"content":24495,"nodeType":4569},{},[24496],{"data":24497,"content":24498,"nodeType":860},{},[24499],{"data":24500,"marks":24501,"value":4725,"nodeType":864},{},[],{"data":24503,"content":24504,"nodeType":4581},{},[24505,24515],{"data":24506,"content":24507,"nodeType":4569},{},[24508],{"data":24509,"content":24510,"nodeType":860},{},[24511],{"data":24512,"marks":24513,"value":4739,"nodeType":864},{},[24514],{"type":899},{"data":24516,"content":24517,"nodeType":4569},{},[24518],{"data":24519,"content":24520,"nodeType":860},{},[24521],{"data":24522,"marks":24523,"value":4749,"nodeType":864},{},[],{"data":24525,"content":24526,"nodeType":4581},{},[24527,24537],{"data":24528,"content":24529,"nodeType":4569},{},[24530],{"data":24531,"content":24532,"nodeType":860},{},[24533],{"data":24534,"marks":24535,"value":4763,"nodeType":864},{},[24536],{"type":899},{"data":24538,"content":24539,"nodeType":4569},{},[24540],{"data":24541,"content":24542,"nodeType":860},{},[24543],{"data":24544,"marks":24545,"value":4773,"nodeType":864},{},[],{"data":24547,"content":24548,"nodeType":4581},{},[24549,24559],{"data":24550,"content":24551,"nodeType":4569},{},[24552],{"data":24553,"content":24554,"nodeType":860},{},[24555],{"data":24556,"marks":24557,"value":4787,"nodeType":864},{},[24558],{"type":899},{"data":24560,"content":24561,"nodeType":4569},{},[24562],{"data":24563,"content":24564,"nodeType":860},{},[24565],{"data":24566,"marks":24567,"value":4797,"nodeType":864},{},[],{"data":24569,"content":24570,"nodeType":4581},{},[24571,24581],{"data":24572,"content":24573,"nodeType":4569},{},[24574],{"data":24575,"content":24576,"nodeType":860},{},[24577],{"data":24578,"marks":24579,"value":4811,"nodeType":864},{},[24580],{"type":899},{"data":24582,"content":24583,"nodeType":4569},{},[24584],{"data":24585,"content":24586,"nodeType":860},{},[24587],{"data":24588,"marks":24589,"value":4821,"nodeType":864},{},[],{"data":24591,"content":24592,"nodeType":4581},{},[24593,24603],{"data":24594,"content":24595,"nodeType":4569},{},[24596],{"data":24597,"content":24598,"nodeType":860},{},[24599],{"data":24600,"marks":24601,"value":4500,"nodeType":864},{},[24602],{"type":899},{"data":24604,"content":24605,"nodeType":4569},{},[24606],{"data":24607,"content":24608,"nodeType":860},{},[24609],{"data":24610,"marks":24611,"value":4844,"nodeType":864},{},[],{"data":24613,"content":24614,"nodeType":1005},{},[],{"data":24616,"content":24617,"nodeType":860},{},[24618,24621,24627],{"data":24619,"marks":24620,"value":4855,"nodeType":864},{},[],{"data":24622,"content":24623,"nodeType":883},{"uri":1700},[24624],{"data":24625,"marks":24626,"value":1703,"nodeType":864},{},[],{"data":24628,"marks":24629,"value":21,"nodeType":864},{},[],{"entries":24631},{"hyperlink":24632,"inline":24633,"block":24634},[],[],[24635,24677,24685,24719,24755,24779,24793],{"sys":24636,"__typename":1740,"content":24637,"name":24676,"title":59},{"id":3653},{"json":24638},{"nodeType":856,"data":24639,"content":24640},{},[24641],{"nodeType":860,"data":24642,"content":24643},{},[24644,24647,24654,24658,24663,24667,24672],{"nodeType":864,"value":3719,"marks":24645,"data":24646},[],{},{"nodeType":883,"data":24648,"content":24649},{"uri":2561},[24650],{"nodeType":864,"value":24651,"marks":24652,"data":24653},"Omdia's 2026 research",[],{},{"nodeType":864,"value":24655,"marks":24656,"data":24657},", browser security is already a top-five priority for ",[],{},{"nodeType":864,"value":24659,"marks":24660,"data":24662},"88% of organizations",[24661],{"type":899},{},{"nodeType":864,"value":24664,"marks":24665,"data":24666},", and the top priority for ",[],{},{"nodeType":864,"value":24668,"marks":24669,"data":24671},"26%",[24670],{"type":899},{},{"nodeType":864,"value":24673,"marks":24674,"data":24675},". Of those that have deployed browser security solutions, the results speak for themselves: security leaders consistently report high satisfaction with the visibility and control they gain at a layer that was previously a blind spot.",[],{},"Top 10 Browser Problems IB1",{"sys":24678,"__typename":1724,"title":24679,"caption":24680,"layoutMode":59,"file":24681},{"id":3673},"top 10 browser security infographic","The top 10 security problems you can solve in the browser, ranked by security value and browser fit.",{"url":24682,"width":24683,"height":24684},"https://images.ctfassets.net/y1cdw1ablpvd/1ARDI5m8UJTN9QXXfbyyeO/ad04834463f3537a724ecfcaa0054fb0/top10_browser_security_infographic_4x__14_.png",2080,2484,{"sys":24686,"__typename":1740,"content":24687,"name":24718,"title":59},{"id":3765},{"json":24688},{"nodeType":856,"data":24689,"content":24690},{},[24691],{"nodeType":860,"data":24692,"content":24693},{},[24694,24698,24705,24709,24714],{"nodeType":864,"value":24695,"marks":24696,"data":24697},"Every login, regardless of method or app, happens inside a browser session. That makes the browser the only layer capable of observing the complete authentication picture. ",[],{},{"nodeType":883,"data":24699,"content":24700},{"uri":23151},[24701],{"nodeType":864,"value":24702,"marks":24703,"data":24704},"Push's telemetry illustrates the gap",[],{},{"nodeType":864,"value":24706,"marks":24707,"data":24708},": of the last million logins observed, ",[],{},{"nodeType":864,"value":24710,"marks":24711,"data":24713},"1 in 4 were password logins rather than SSO, 2 in 5 lacked MFA, and 1 in 5 used a weak, breached, or reused credential",[24712],{"type":899},{},{"nodeType":864,"value":24715,"marks":24716,"data":24717}," — none of which is visible to an IdP that only surfaces authentications flowing through it. ",[],{},"Top 10 Browser Problems IB2",{"sys":24720,"__typename":1740,"content":24721,"name":24754,"title":59},{"id":3906},{"json":24722},{"data":24723,"content":24724,"nodeType":856},{},[24725],{"data":24726,"content":24727,"nodeType":860},{},[24728,24732,24737,24741,24750],{"data":24729,"marks":24730,"value":24731,"nodeType":864},{},[],"The average employee logs into more than 15 applications, the majority with logins outside SSO coverage. IdP policies and SSPM findings have no mechanism to intervene in authentication flows they don't control. ",{"data":24733,"marks":24734,"value":24736,"nodeType":864},{},[24735],{"type":899},"47% of BEC victims had not enforced MFA in their Microsoft 365 environment",{"data":24738,"marks":24739,"value":24740,"nodeType":864},{},[]," (",{"data":24742,"content":24744,"nodeType":883},{"uri":24743},"https://www.s-rminform.com/cyber-insights-report-2026",[24745],{"data":24746,"marks":24747,"value":24749,"nodeType":864},{},[24748],{"type":1455},"S-RM Cyber Insights 2026",{"data":24751,"marks":24752,"value":24753,"nodeType":864},{},[],") — and the gap is larger still once you consider shadow SaaS.","Top 10 Browser Problems IB3",{"sys":24756,"__typename":1740,"content":24757,"name":24778,"title":59},{"id":4195},{"json":24758},{"data":24759,"content":24760,"nodeType":856},{},[24761],{"data":24762,"content":24763,"nodeType":860},{},[24764,24767,24774],{"data":24765,"marks":24766,"value":21,"nodeType":864},{},[],{"data":24768,"content":24769,"nodeType":883},{"uri":8195},[24770],{"data":24771,"marks":24772,"value":12985,"nodeType":864},{},[24773],{"type":1455},{"data":24775,"marks":24776,"value":24777,"nodeType":864},{},[],", a novel technique discovered by Push researchers when we intercepted a live campaign attributed to Russian state-linked APT29, is a notable exception: it is fully browser-native with no endpoint component, using a manipulated OAuth consent flow rather than clipboard-injected malware. ConsentFix is better understood as an OAuth attack than a malware delivery technique — it signals the direction of travel as attackers seek to eliminate the endpoint detection surface entirely and operate purely within browser-native mechanisms like OAuth. ","Top 10 Browser Problems IB4",{"sys":24780,"__typename":1740,"content":24781,"name":24792,"title":59},{"id":4259},{"json":24782},{"data":24783,"content":24784,"nodeType":856},{},[24785],{"data":24786,"content":24787,"nodeType":860},{},[24788],{"data":24789,"marks":24790,"value":24791,"nodeType":864},{},[],"Enterprise AI platforms — Claude, ChatGPT Enterprise, Microsoft Copilot, Gemini for Workspace — increasingly provide native prompt logging and DLP controls on their enterprise plans, and these are richer and more reliable for sanctioned tools than browser session-layer monitoring. The right architecture is complementary: use the browser to enforce which AI tools employees can access and ensure they reach the corporate tenant rather than a personal account, then rely on platform-native controls to govern activity within that environment.","Top 10 Browser Problems IB5",{"sys":24794,"__typename":1740,"content":24795,"name":24835,"title":59},{"id":4367},{"json":24796},{"data":24797,"content":24798,"nodeType":856},{},[24799],{"data":24800,"content":24801,"nodeType":860},{},[24802,24806,24811,24815,24820,24824,24831],{"data":24803,"marks":24804,"value":24805,"nodeType":864},{},[],"The 2025 Verizon DBIR found ",{"data":24807,"marks":24808,"value":24810,"nodeType":864},{},[24809],{"type":899},"54% of ransomware attacks traced back to infostealer-enabled credential theft",{"data":24812,"marks":24813,"value":24814,"nodeType":864},{},[],". Microsoft reports ",{"data":24816,"marks":24817,"value":24819,"nodeType":864},{},[24818],{"type":899},"39,000 session token attacks per day",{"data":24821,"marks":24822,"value":24823,"nodeType":864},{},[],", the majority sourced from infostealer-harvested cookies. The",{"data":24825,"content":24826,"nodeType":883},{"uri":3751},[24827],{"data":24828,"marks":24829,"value":24830,"nodeType":864},{},[]," Snowflake breach",{"data":24832,"marks":24833,"value":24834,"nodeType":864},{},[]," we mentioned earlier was powered entirely by infostealer-harvested credentials: stolen years earlier, never rotated, and used to authenticate directly to tenants that lacked MFA. More than 80% of compromised accounts had prior credential exposure. The Okta breach followed the same pattern, beginning with an infostealer on an engineer's personal device harvesting credentials synced to their personal Google profile on a corporate browser. ","Top 10 Browser Problems IB6",{"items":24837},[],{},"The top 10 security problems you can solve in the browser",{"items":24841},[24842,25350,26131],{"__typename":2059,"sys":24843,"content":24844,"title":21964,"synopsis":21965,"hashTags":59,"publishedDate":21966,"slug":21967,"tagsCollection":25340,"authorsCollection":25346},{"id":21389},{"json":24845},{"data":24846,"content":24847,"nodeType":856},{},[24848,24863,24869,24875,24880,24883,24890,24903,24909,24914,24920,24995,25001,25006,25012,25017,25020,25027,25037,25043,25053,25056,25063,25076,25082,25088,25091,25098,25104,25117,25122,25135,25141,25147,25153,25166,25172,25175,25182,25188,25201,25207,25210,25217,25230,25236,25252,25262,25265,25272,25285,25291,25297,25303,25309,25312,25318,25324],{"data":24849,"content":24850,"nodeType":860},{},[24851,24854,24860],{"data":24852,"marks":24853,"value":2761,"nodeType":864},{},[],{"data":24855,"content":24856,"nodeType":883},{"uri":21402},[24857],{"data":24858,"marks":24859,"value":21407,"nodeType":864},{},[],{"data":24861,"marks":24862,"value":21411,"nodeType":864},{},[],{"data":24864,"content":24865,"nodeType":860},{},[24866],{"data":24867,"marks":24868,"value":21418,"nodeType":864},{},[],{"data":24870,"content":24871,"nodeType":860},{},[24872],{"data":24873,"marks":24874,"value":21425,"nodeType":864},{},[],{"data":24876,"content":24879,"nodeType":996},{"target":24877},{"sys":24878},{"id":21430,"type":1001,"linkType":1002},[],{"data":24881,"content":24882,"nodeType":1005},{},[],{"data":24884,"content":24885,"nodeType":1009},{},[24886],{"data":24887,"marks":24888,"value":21442,"nodeType":864},{},[24889],{"type":899},{"data":24891,"content":24892,"nodeType":860},{},[24893,24896,24900],{"data":24894,"marks":24895,"value":21449,"nodeType":864},{},[],{"data":24897,"marks":24898,"value":21454,"nodeType":864},{},[24899],{"type":899},{"data":24901,"marks":24902,"value":21458,"nodeType":864},{},[],{"data":24904,"content":24905,"nodeType":860},{},[24906],{"data":24907,"marks":24908,"value":21465,"nodeType":864},{},[],{"data":24910,"content":24913,"nodeType":996},{"target":24911},{"sys":24912},{"id":21470,"type":1001,"linkType":1002},[],{"data":24915,"content":24916,"nodeType":860},{},[24917],{"data":24918,"marks":24919,"value":21478,"nodeType":864},{},[],{"data":24921,"content":24922,"nodeType":941},{},[24923,24932,24941,24950,24959,24968,24977,24986],{"data":24924,"content":24925,"nodeType":945},{},[24926],{"data":24927,"content":24928,"nodeType":860},{},[24929],{"data":24930,"marks":24931,"value":21491,"nodeType":864},{},[],{"data":24933,"content":24934,"nodeType":945},{},[24935],{"data":24936,"content":24937,"nodeType":860},{},[24938],{"data":24939,"marks":24940,"value":21501,"nodeType":864},{},[],{"data":24942,"content":24943,"nodeType":945},{},[24944],{"data":24945,"content":24946,"nodeType":860},{},[24947],{"data":24948,"marks":24949,"value":21511,"nodeType":864},{},[],{"data":24951,"content":24952,"nodeType":945},{},[24953],{"data":24954,"content":24955,"nodeType":860},{},[24956],{"data":24957,"marks":24958,"value":21521,"nodeType":864},{},[],{"data":24960,"content":24961,"nodeType":945},{},[24962],{"data":24963,"content":24964,"nodeType":860},{},[24965],{"data":24966,"marks":24967,"value":21531,"nodeType":864},{},[],{"data":24969,"content":24970,"nodeType":945},{},[24971],{"data":24972,"content":24973,"nodeType":860},{},[24974],{"data":24975,"marks":24976,"value":21541,"nodeType":864},{},[],{"data":24978,"content":24979,"nodeType":945},{},[24980],{"data":24981,"content":24982,"nodeType":860},{},[24983],{"data":24984,"marks":24985,"value":21551,"nodeType":864},{},[],{"data":24987,"content":24988,"nodeType":945},{},[24989],{"data":24990,"content":24991,"nodeType":860},{},[24992],{"data":24993,"marks":24994,"value":21561,"nodeType":864},{},[],{"data":24996,"content":24997,"nodeType":860},{},[24998],{"data":24999,"marks":25000,"value":21568,"nodeType":864},{},[],{"data":25002,"content":25005,"nodeType":996},{"target":25003},{"sys":25004},{"id":21573,"type":1001,"linkType":1002},[],{"data":25007,"content":25008,"nodeType":860},{},[25009],{"data":25010,"marks":25011,"value":21581,"nodeType":864},{},[],{"data":25013,"content":25016,"nodeType":996},{"target":25014},{"sys":25015},{"id":21586,"type":1001,"linkType":1002},[],{"data":25018,"content":25019,"nodeType":1005},{},[],{"data":25021,"content":25022,"nodeType":1009},{},[25023],{"data":25024,"marks":25025,"value":21598,"nodeType":864},{},[25026],{"type":899},{"data":25028,"content":25029,"nodeType":860},{},[25030,25034],{"data":25031,"marks":25032,"value":21606,"nodeType":864},{},[25033],{"type":899},{"data":25035,"marks":25036,"value":21610,"nodeType":864},{},[],{"data":25038,"content":25039,"nodeType":860},{},[25040],{"data":25041,"marks":25042,"value":21617,"nodeType":864},{},[],{"data":25044,"content":25045,"nodeType":860},{},[25046,25050],{"data":25047,"marks":25048,"value":21625,"nodeType":864},{},[25049],{"type":899},{"data":25051,"marks":25052,"value":21629,"nodeType":864},{},[],{"data":25054,"content":25055,"nodeType":1005},{},[],{"data":25057,"content":25058,"nodeType":1009},{},[25059],{"data":25060,"marks":25061,"value":21640,"nodeType":864},{},[25062],{"type":899},{"data":25064,"content":25065,"nodeType":860},{},[25066,25069,25073],{"data":25067,"marks":25068,"value":21647,"nodeType":864},{},[],{"data":25070,"marks":25071,"value":21652,"nodeType":864},{},[25072],{"type":899},{"data":25074,"marks":25075,"value":21656,"nodeType":864},{},[],{"data":25077,"content":25078,"nodeType":860},{},[25079],{"data":25080,"marks":25081,"value":21663,"nodeType":864},{},[],{"data":25083,"content":25084,"nodeType":860},{},[25085],{"data":25086,"marks":25087,"value":21670,"nodeType":864},{},[],{"data":25089,"content":25090,"nodeType":1005},{},[],{"data":25092,"content":25093,"nodeType":1009},{},[25094],{"data":25095,"marks":25096,"value":21681,"nodeType":864},{},[25097],{"type":899},{"data":25099,"content":25100,"nodeType":860},{},[25101],{"data":25102,"marks":25103,"value":21688,"nodeType":864},{},[],{"data":25105,"content":25106,"nodeType":860},{},[25107,25110,25114],{"data":25108,"marks":25109,"value":21695,"nodeType":864},{},[],{"data":25111,"marks":25112,"value":21700,"nodeType":864},{},[25113],{"type":899},{"data":25115,"marks":25116,"value":21704,"nodeType":864},{},[],{"data":25118,"content":25121,"nodeType":996},{"target":25119},{"sys":25120},{"id":21709,"type":1001,"linkType":1002},[],{"data":25123,"content":25124,"nodeType":860},{},[25125,25128,25132],{"data":25126,"marks":25127,"value":21717,"nodeType":864},{},[],{"data":25129,"marks":25130,"value":21722,"nodeType":864},{},[25131],{"type":899},{"data":25133,"marks":25134,"value":21726,"nodeType":864},{},[],{"data":25136,"content":25137,"nodeType":860},{},[25138],{"data":25139,"marks":25140,"value":21733,"nodeType":864},{},[],{"data":25142,"content":25143,"nodeType":860},{},[25144],{"data":25145,"marks":25146,"value":21740,"nodeType":864},{},[],{"data":25148,"content":25149,"nodeType":860},{},[25150],{"data":25151,"marks":25152,"value":21747,"nodeType":864},{},[],{"data":25154,"content":25155,"nodeType":860},{},[25156,25159,25163],{"data":25157,"marks":25158,"value":21754,"nodeType":864},{},[],{"data":25160,"marks":25161,"value":21759,"nodeType":864},{},[25162],{"type":899},{"data":25164,"marks":25165,"value":21763,"nodeType":864},{},[],{"data":25167,"content":25168,"nodeType":860},{},[25169],{"data":25170,"marks":25171,"value":21770,"nodeType":864},{},[],{"data":25173,"content":25174,"nodeType":1005},{},[],{"data":25176,"content":25177,"nodeType":1009},{},[25178],{"data":25179,"marks":25180,"value":21781,"nodeType":864},{},[25181],{"type":899},{"data":25183,"content":25184,"nodeType":860},{},[25185],{"data":25186,"marks":25187,"value":21788,"nodeType":864},{},[],{"data":25189,"content":25190,"nodeType":860},{},[25191,25194,25198],{"data":25192,"marks":25193,"value":21795,"nodeType":864},{},[],{"data":25195,"marks":25196,"value":21800,"nodeType":864},{},[25197],{"type":899},{"data":25199,"marks":25200,"value":21804,"nodeType":864},{},[],{"data":25202,"content":25203,"nodeType":860},{},[25204],{"data":25205,"marks":25206,"value":21811,"nodeType":864},{},[],{"data":25208,"content":25209,"nodeType":1005},{},[],{"data":25211,"content":25212,"nodeType":1009},{},[25213],{"data":25214,"marks":25215,"value":21822,"nodeType":864},{},[25216],{"type":899},{"data":25218,"content":25219,"nodeType":860},{},[25220,25223,25227],{"data":25221,"marks":25222,"value":21829,"nodeType":864},{},[],{"data":25224,"marks":25225,"value":21834,"nodeType":864},{},[25226],{"type":899},{"data":25228,"marks":25229,"value":21838,"nodeType":864},{},[],{"data":25231,"content":25232,"nodeType":860},{},[25233],{"data":25234,"marks":25235,"value":21845,"nodeType":864},{},[],{"data":25237,"content":25238,"nodeType":860},{},[25239,25242,25249],{"data":25240,"marks":25241,"value":21852,"nodeType":864},{},[],{"data":25243,"content":25244,"nodeType":883},{"uri":12928},[25245],{"data":25246,"marks":25247,"value":21860,"nodeType":864},{},[25248],{"type":1455},{"data":25250,"marks":25251,"value":21864,"nodeType":864},{},[],{"data":25253,"content":25254,"nodeType":860},{},[25255,25258],{"data":25256,"marks":25257,"value":21871,"nodeType":864},{},[],{"data":25259,"marks":25260,"value":21876,"nodeType":864},{},[25261],{"type":899},{"data":25263,"content":25264,"nodeType":1005},{},[],{"data":25266,"content":25267,"nodeType":1009},{},[25268],{"data":25269,"marks":25270,"value":21887,"nodeType":864},{},[25271],{"type":899},{"data":25273,"content":25274,"nodeType":860},{},[25275,25278,25282],{"data":25276,"marks":25277,"value":21894,"nodeType":864},{},[],{"data":25279,"marks":25280,"value":21899,"nodeType":864},{},[25281],{"type":899},{"data":25283,"marks":25284,"value":21903,"nodeType":864},{},[],{"data":25286,"content":25287,"nodeType":860},{},[25288],{"data":25289,"marks":25290,"value":21910,"nodeType":864},{},[],{"data":25292,"content":25293,"nodeType":860},{},[25294],{"data":25295,"marks":25296,"value":21917,"nodeType":864},{},[],{"data":25298,"content":25299,"nodeType":860},{},[25300],{"data":25301,"marks":25302,"value":21924,"nodeType":864},{},[],{"data":25304,"content":25305,"nodeType":860},{},[25306],{"data":25307,"marks":25308,"value":21931,"nodeType":864},{},[],{"data":25310,"content":25311,"nodeType":1005},{},[],{"data":25313,"content":25314,"nodeType":860},{},[25315],{"data":25316,"marks":25317,"value":21941,"nodeType":864},{},[],{"data":25319,"content":25320,"nodeType":860},{},[25321],{"data":25322,"marks":25323,"value":1689,"nodeType":864},{},[],{"data":25325,"content":25326,"nodeType":860},{},[25327,25330,25337],{"data":25328,"marks":25329,"value":21,"nodeType":864},{},[],{"data":25331,"content":25332,"nodeType":883},{"uri":1700},[25333],{"data":25334,"marks":25335,"value":15017,"nodeType":864},{},[25336],{"type":1455},{"data":25338,"marks":25339,"value":2719,"nodeType":864},{},[],{"items":25341},[25342,25344],{"sys":25343,"name":297},{"id":2732},{"sys":25345,"name":2729},{"id":2728},{"items":25347},[25348],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":25349},{"url":2740},{"__typename":2059,"sys":25351,"content":25353,"title":26118,"synopsis":26119,"hashTags":59,"publishedDate":21966,"slug":26120,"tagsCollection":26121,"authorsCollection":26127},{"id":25352},"2V130uMePtxAaefYQAKInb",{"json":25354},{"data":25355,"content":25356,"nodeType":856},{},[25357,25363,25370,25377,25384,25387,25395,25402,25414,25426,25431,25438,25441,25449,25456,25462,25469,25476,25585,25592,25595,25603,25610,25673,25689,25695,25702,25705,25713,25720,25728,25735,25742,25772,25779,25787,25794,25801,25808,25816,25823,25830,25837,25840,25848,25860,25867,25874,25882,25889,25896,25904,25911,25974,25990,26008,26016,26023,26031,26038,26045,26052,26058,26066,26073,26080,26085,26092,26099,26106,26112],{"data":25358,"content":25362,"nodeType":996},{"target":25359},{"sys":25360},{"id":25361,"type":1001,"linkType":1002},"5CPZ96xixlhgh6oqQ2rfmO",[],{"data":25364,"content":25365,"nodeType":860},{},[25366],{"data":25367,"marks":25368,"value":25369,"nodeType":864},{},[],"When a security team evaluates browser security solutions, they're usually asking the right question: “How do we protect our users as they work in the browser?”",{"data":25371,"content":25372,"nodeType":860},{},[25373],{"data":25374,"marks":25375,"value":25376,"nodeType":864},{},[],"But the answer they get from many vendors is shaped by a fundamentally different threat model — one that treats the browser as a piece of software to be hardened against exploitation, rather than as the arena where your users’ identities get stolen.",{"data":25378,"content":25379,"nodeType":860},{},[25380],{"data":25381,"marks":25382,"value":25383,"nodeType":864},{},[],"This distinction has enormous consequences for your security posture and the return you can expect from your investment in a new solution.",{"data":25385,"content":25386,"nodeType":1005},{},[],{"data":25388,"content":25389,"nodeType":1009},{},[25390],{"data":25391,"marks":25392,"value":25394,"nodeType":864},{},[25393],{"type":899},"Two different problems, dressed the same",{"data":25396,"content":25397,"nodeType":860},{},[25398],{"data":25399,"marks":25400,"value":25401,"nodeType":864},{},[],"When it comes to protecting users as they work in the browser, security tools typically fall into one of two camps:",{"data":25403,"content":25404,"nodeType":860},{},[25405,25410],{"data":25406,"marks":25407,"value":25409,"nodeType":864},{},[25408],{"type":899},"The first camp:",{"data":25411,"marks":25412,"value":25413,"nodeType":864},{},[]," represented by solutions like Seraphic (now CrowdStrike) — is built around the threat of attacking the browser itself. The architecture is designed to scramble the browser’s JavaScript runtime and prevent exploits from detonating and breaking out of the browser sandbox. This is browser hardening: defending the browser as software against exploitation by attackers who want to compromise the underlying device.",{"data":25415,"content":25416,"nodeType":860},{},[25417,25422],{"data":25418,"marks":25419,"value":25421,"nodeType":864},{},[25420],{"type":899},"The second camp:",{"data":25423,"marks":25424,"value":25425,"nodeType":864},{},[]," and the one Push Security occupies uniquely, focuses on what happens inside the browser when a user is working normally. Phishing pages harvesting credentials. Session tokens being stolen. Malicious OAuth applications being granted access through social engineering. Adversary-in-the-middle proxies intercepting authentication flows. These attacks don't exploit the browser. They exploit the human — and now agents — using it via the browser's legitimate capabilities (think of it as LOTL, browser edition).",{"data":25427,"content":25430,"nodeType":996},{"target":25428},{"sys":25429},{"id":21573,"type":1001,"linkType":1002},[],{"data":25432,"content":25433,"nodeType":860},{},[25434],{"data":25435,"marks":25436,"value":25437,"nodeType":864},{},[],"The question for any security team evaluating this space: which of these threat models presents the greatest risks to my organization?",{"data":25439,"content":25440,"nodeType":1005},{},[],{"data":25442,"content":25443,"nodeType":1009},{},[25444],{"data":25445,"marks":25446,"value":25448,"nodeType":864},{},[25447],{"type":899},"How organizations are actually being breached",{"data":25450,"content":25451,"nodeType":860},{},[25452],{"data":25453,"marks":25454,"value":25455,"nodeType":864},{},[],"Let's look at the major breach campaigns of the last three years without the marketing filter and a pattern emerges immediately. Scattered Spider and its successors breached MGM Resorts, Caesars, M&S, JLR, and Salesforce customers — not through browser exploits, but through social engineering, phishing and Adversary-in-the-Middle attacks that stole session tokens and SSO credentials. ",{"data":25457,"content":25461,"nodeType":996},{"target":25458},{"sys":25459},{"id":25460,"type":1001,"linkType":1002},"2qIMTiyyIsQFAyGJ9Ikyej",[],{"data":25463,"content":25464,"nodeType":860},{},[25465],{"data":25466,"marks":25467,"value":25468,"nodeType":864},{},[],"In every case, the attack happened in the browser — using stolen identities to log into legitimate cloud services — not on the browser through exploitation of the browser engine itself.",{"data":25470,"content":25471,"nodeType":860},{},[25472],{"data":25473,"marks":25474,"value":25475,"nodeType":864},{},[],"The data from major threat intelligence sources is unambiguous:",{"data":25477,"content":25478,"nodeType":941},{},[25479,25498,25517,25536,25555,25570],{"data":25480,"content":25481,"nodeType":945},{},[25482],{"data":25483,"content":25484,"nodeType":860},{},[25485,25489,25494],{"data":25486,"marks":25487,"value":25488,"nodeType":864},{},[],"Identity weaknesses played a material role in ",{"data":25490,"marks":25491,"value":25493,"nodeType":864},{},[25492],{"type":899},"almost 90% of Unit 42 incident response investigations",{"data":25495,"marks":25496,"value":25497,"nodeType":864},{},[]," (Palo Alto Networks Unit 42 IR Report)",{"data":25499,"content":25500,"nodeType":945},{},[25501],{"data":25502,"content":25503,"nodeType":860},{},[25504,25508,25513],{"data":25505,"marks":25506,"value":25507,"nodeType":864},{},[],"Credential abuse and phishing combined accounted for ",{"data":25509,"marks":25510,"value":25512,"nodeType":864},{},[25511],{"type":899},"38% of all breaches",{"data":25514,"marks":25515,"value":25516,"nodeType":864},{},[],", making identity the single largest breach vector (Verizon DBIR 2025)",{"data":25518,"content":25519,"nodeType":945},{},[25520],{"data":25521,"content":25522,"nodeType":860},{},[25523,25527,25532],{"data":25524,"marks":25525,"value":25526,"nodeType":864},{},[],"Cloud-conscious intrusions — attackers using stolen identities to access cloud services — rose ",{"data":25528,"marks":25529,"value":25531,"nodeType":864},{},[25530],{"type":899},"37% in 2025",{"data":25533,"marks":25534,"value":25535,"nodeType":864},{},[],", up 266% among state-nexus actors (CrowdStrike 2026 Global Threat Report)",{"data":25537,"content":25538,"nodeType":945},{},[25539],{"data":25540,"content":25541,"nodeType":860},{},[25542,25546,25551],{"data":25543,"marks":25544,"value":25545,"nodeType":864},{},[],"In cloud-related incidents, identity issues drove initial access in ",{"data":25547,"marks":25548,"value":25550,"nodeType":864},{},[25549],{"type":899},"83% of cases",{"data":25552,"marks":25553,"value":25554,"nodeType":864},{},[]," (Mandiant / Google Cloud Threat Horizons H1 2026)",{"data":25556,"content":25557,"nodeType":945},{},[25558],{"data":25559,"content":25560,"nodeType":860},{},[25561,25566],{"data":25562,"marks":25563,"value":25565,"nodeType":864},{},[25564],{"type":899},"82% of attack detections are now malware-free",{"data":25567,"marks":25568,"value":25569,"nodeType":864},{},[]," — they don't touch the endpoint and abuse legitimate access and functionality (CrowdStrike 2026 Global Threat Report)",{"data":25571,"content":25572,"nodeType":945},{},[25573],{"data":25574,"content":25575,"nodeType":860},{},[25576,25581],{"data":25577,"marks":25578,"value":25580,"nodeType":864},{},[25579],{"type":899},"49% of organizations",{"data":25582,"marks":25583,"value":25584,"nodeType":864},{},[]," suffered a successful browser-based attack in the last 12 months (Omdia 2026)",{"data":25586,"content":25587,"nodeType":860},{},[25588],{"data":25589,"marks":25590,"value":25591,"nodeType":864},{},[],"These aren't edge cases. This is now the primary attack playbook.",{"data":25593,"content":25594,"nodeType":1005},{},[],{"data":25596,"content":25597,"nodeType":1312},{},[25598],{"data":25599,"marks":25600,"value":25602,"nodeType":864},{},[25601],{"type":899},"The economics of attack choice",{"data":25604,"content":25605,"nodeType":860},{},[25606],{"data":25607,"marks":25608,"value":25609,"nodeType":864},{},[],"Attackers are rational actors. They pick the cheapest, most reliable path to their objective. The economics of browser exploitation versus identity theft tell the whole story:",{"data":25611,"content":25612,"nodeType":941},{},[25613,25628,25643,25658],{"data":25614,"content":25615,"nodeType":945},{},[25616],{"data":25617,"content":25618,"nodeType":860},{},[25619,25623],{"data":25620,"marks":25621,"value":25622,"nodeType":864},{},[],"Chrome sandbox RCE exploit (bug bounty value): ",{"data":25624,"marks":25625,"value":25627,"nodeType":864},{},[25626],{"type":899},"$250,000",{"data":25629,"content":25630,"nodeType":945},{},[25631],{"data":25632,"content":25633,"nodeType":860},{},[25634,25638],{"data":25635,"marks":25636,"value":25637,"nodeType":864},{},[],"IAB-provided IdP admin account: ",{"data":25639,"marks":25640,"value":25642,"nodeType":864},{},[25641],{"type":899},"~$3,000",{"data":25644,"content":25645,"nodeType":945},{},[25646],{"data":25647,"content":25648,"nodeType":860},{},[25649,25653],{"data":25650,"marks":25651,"value":25652,"nodeType":864},{},[],"1-year phishing kit rental (PhaaS): ",{"data":25654,"marks":25655,"value":25657,"nodeType":864},{},[25656],{"type":899},"~$1,000",{"data":25659,"content":25660,"nodeType":945},{},[25661],{"data":25662,"content":25663,"nodeType":860},{},[25664,25668],{"data":25665,"marks":25666,"value":25667,"nodeType":864},{},[],"Bulk stolen credential list: ",{"data":25669,"marks":25670,"value":25672,"nodeType":864},{},[25671],{"type":899},"~$15",{"data":25674,"content":25675,"nodeType":860},{},[25676,25680,25685],{"data":25677,"marks":25678,"value":25679,"nodeType":864},{},[],"Browser zero-days accounted for just ",{"data":25681,"marks":25682,"value":25684,"nodeType":864},{},[25683],{"type":899},"9% of all zero-days reported to Google in 2025",{"data":25686,"marks":25687,"value":25688,"nodeType":864},{},[]," — described by Google's own researchers as a \"historic low.\" Chrome's sandbox architecture, site isolation, and hardware-backed security features are the result of years of sustained hardening investment. When a browser vulnerability is discovered, Google typically deploys a patch within days.",{"data":25690,"content":25694,"nodeType":996},{"target":25691},{"sys":25692},{"id":25693,"type":1001,"linkType":1002},"5XWKHTT5J06yWcgZIOL95t",[],{"data":25696,"content":25697,"nodeType":860},{},[25698],{"data":25699,"marks":25700,"value":25701,"nodeType":864},{},[],"The bottom line: browser exploits are extraordinarily expensive to develop, increasingly difficult to execute reliably against a hardened modern browser, and patched rapidly when discovered. In sharp contrast, identity attacks are cheap to run, highly scalable, and have a low technical barrier to adoption — that’s why they’re responsible for the overwhelming majority of enterprise breaches. Attackers have voted with their resources.",{"data":25703,"content":25704,"nodeType":1005},{},[],{"data":25706,"content":25707,"nodeType":1009},{},[25708],{"data":25709,"marks":25710,"value":25712,"nodeType":864},{},[25711],{"type":899},"What you're actually buying with each vendor",{"data":25714,"content":25715,"nodeType":860},{},[25716],{"data":25717,"marks":25718,"value":25719,"nodeType":864},{},[],"Understanding the core architectural choice each vendor has made helps decode what their solution can and cannot protect you from.",{"data":25721,"content":25722,"nodeType":1312},{},[25723],{"data":25724,"marks":25725,"value":25727,"nodeType":864},{},[25726],{"type":899},"Seraphic (CrowdStrike)",{"data":25729,"content":25730,"nodeType":860},{},[25731],{"data":25732,"marks":25733,"value":25734,"nodeType":864},{},[],"Seraphic's architecture is built to inject into the browser's JavaScript runtime at the OS layer, scrambling browser internals to prevent exploits from executing. This is a technically sophisticated approach to a technically interesting problem that is, by every threat intelligence measure, not the problem causing enterprise breaches at scale.",{"data":25736,"content":25737,"nodeType":860},{},[25738],{"data":25739,"marks":25740,"value":25741,"nodeType":864},{},[],"Beyond the threat model mismatch, there are structural concerns with the approach itself. Injecting an agent into the browser's JS runtime is a technique with well-documented stability consequences. This is the same approach antivirus vendors have used for years, often at the cost of system stability. Seraphic now runs alongside the CrowdStrike Falcon sensor on managed devices, combining two heavyweight agents on the same machine. For any organization with CrowdStrike already deployed, the question isn't theoretical: how has that combination been validated in production environments?",{"data":25743,"content":25744,"nodeType":860},{},[25745,25749,25756,25760,25768],{"data":25746,"marks":25747,"value":25748,"nodeType":864},{},[],"There's also the managed-device limitation. Seraphic requires a kernel-level agent, which means it loses meaningful capability on unmanaged devices, BYOD machines, and contractor endpoints. This is not a niche concern: according to ",{"data":25750,"content":25751,"nodeType":883},{"uri":2561},[25752],{"data":25753,"marks":25754,"value":25755,"nodeType":864},{},[],"Omdia's 2026 browser security survey",{"data":25757,"marks":25758,"value":25759,"nodeType":864},{},[],", 32% of users access corporate applications from unmanaged devices at least occasionally. Agent-based solutions are blind to nearly a third of your actual attack surface by design. The Okta breach began on a support engineer's personal device, where ",{"data":25761,"content":25762,"nodeType":883},{"uri":18212},[25763],{"data":25764,"marks":25765,"value":25767,"nodeType":864},{},[25766],{"type":1455},"corporate credentials had synced",{"data":25769,"marks":25770,"value":25771,"nodeType":864},{},[]," via Chrome's built-in profile sync. No agent, no visibility.",{"data":25773,"content":25774,"nodeType":860},{},[25775],{"data":25776,"marks":25777,"value":25778,"nodeType":864},{},[],"Teams evaluating Seraphic today are also buying into an integration roadmap, not a shipped capability. The acquisition by CrowdStrike closed in early 2026. The work of wiring browser telemetry into Falcon Fusion and correlating it with endpoint signals is currently a promise, not a production feature.",{"data":25780,"content":25781,"nodeType":1312},{},[25782],{"data":25783,"marks":25784,"value":25786,"nodeType":864},{},[25785],{"type":899},"SquareX (Zscaler)",{"data":25788,"content":25789,"nodeType":860},{},[25790],{"data":25791,"marks":25792,"value":25793,"nodeType":864},{},[],"SquareX's core capability is sandboxing suspicious file downloads inside disposable browser containers before they reach the endpoint. This is a legitimate approach to a real but declining problem. 82% of attack detections are now malware-free (CrowdStrike 2026 Global Threat Report) — attacks don't arrive as files to be sandboxed, they arrive as authenticated sessions. And the delivery channel shift makes the picture even starker: across Push's customer base, 1 in 3 phishing payloads are now delivered outside of email entirely — via social media, ads, and messaging platforms — and 4 in 5 ClickFix payloads arrive through search engines, not email. The threat that SquareX was architecturally designed to address is a shrinking share of the actual attack surface, and it's shrinking fast.",{"data":25795,"content":25796,"nodeType":860},{},[25797],{"data":25798,"marks":25799,"value":25800,"nodeType":864},{},[],"Zscaler already has sandboxing built into ZIA. For an existing Zscaler customer evaluating SquareX, the honest question is: what does this add beyond some extension analysis capability and what you already have? The AiTM phishing campaign that stole your user's credentials and accessed your cloud applications generates no malicious file, triggers no sandbox, and produces no network signal for Zscaler's traffic inspection to catch — because it happened entirely inside a browser session using legitimate authentication flows.",{"data":25802,"content":25803,"nodeType":860},{},[25804],{"data":25805,"marks":25806,"value":25807,"nodeType":864},{},[],"The acquisition also raises product focus questions. Being absorbed into a network-centric platform means SquareX is now optimized for Zscaler's priorities, not for standalone browser detection and response. Teams that care about investigation, threat hunting, and incident response should ask specifically what SquareX adds in those workflows under Zscaler ownership.",{"data":25809,"content":25810,"nodeType":1312},{},[25811],{"data":25812,"marks":25813,"value":25815,"nodeType":864},{},[25814],{"type":899},"LayerX",{"data":25817,"content":25818,"nodeType":860},{},[25819],{"data":25820,"marks":25821,"value":25822,"nodeType":864},{},[],"LayerX is primarily a policy enforcement and risk scoring platform focused on internal governance — controlling which applications employees access, what data moves through the browser, and whether behavior complies with internal rules.",{"data":25824,"content":25825,"nodeType":860},{},[25826],{"data":25827,"marks":25828,"value":25829,"nodeType":864},{},[],"Push Security covers that ground too. Push provides full visibility over AI tool usage, shadow SaaS, unmanaged identities, and data loss vectors — including sensitive data submitted through AI prompts, file uploads to personal cloud destinations, and OAuth grants to third-party applications. The same browser telemetry that detects external attacks also surfaces insider risks and powers DLP controls and compliance audit evidence, all from a single extension.",{"data":25831,"content":25832,"nodeType":860},{},[25833],{"data":25834,"marks":25835,"value":25836,"nodeType":864},{},[],"The critical difference is that Push goes significantly further. Where LayerX scores risk and enforces policy, Push detects active external attack techniques in real time: AiTM phishing kits as they execute, session tokens being stolen, ClickFix lures through behavioral analysis of page structure. These are the attacks causing the most damaging breaches today, and they don't surface on a risk score until after the damage is done. Push addresses both the governance problem and the external threat problem from the same platform. LayerX addresses only the first.",{"data":25838,"content":25839,"nodeType":1005},{},[],{"data":25841,"content":25842,"nodeType":1009},{},[25843],{"data":25844,"marks":25845,"value":25847,"nodeType":864},{},[25846],{"type":899},"Securing the organization via the browser: Push Security",{"data":25849,"content":25850,"nodeType":860},{},[25851,25856],{"data":25852,"marks":25853,"value":25855,"nodeType":864},{},[25854],{"type":899},"Push Security is built on a different architectural premise:",{"data":25857,"marks":25858,"value":25859,"nodeType":864},{},[]," the browser is not primarily a piece of software to harden against exploitation. It is the primary workplace, the primary SaaS access point, and the arena where the majority of modern identity attacks play out. The goal is to secure the organization via the browser — not just to secure the browser itself.",{"data":25861,"content":25862,"nodeType":860},{},[25863],{"data":25864,"marks":25865,"value":25866,"nodeType":864},{},[],"This means Push's detection surface is built around the attacks that are actually causing breaches: adversary-in-the-middle phishing, ClickFix and its many variants, credential stuffing against shadow identities, session token theft and replay, OAuth consent abuse, and the full spectrum of identity-based initial access techniques that dominate the modern threat landscape.",{"data":25868,"content":25869,"nodeType":860},{},[25870],{"data":25871,"marks":25872,"value":25873,"nodeType":864},{},[],"The deployment model reflects the threat model. Push deploys as a lightweight browser extension — no kernel-level agent, no device dependency, no migration to a new browser. It works on managed and unmanaged devices, across every traditional, enterprise and AI browser where employees are doing work and attackers are targeting them. The operational overhead is minimal by design: Push has been deployed to 100,000 users in under one hour during normal business hours.",{"data":25875,"content":25876,"nodeType":1312},{},[25877],{"data":25878,"marks":25879,"value":25881,"nodeType":864},{},[25880],{"type":899},"Detection philosophy: targeting what attackers can't change",{"data":25883,"content":25884,"nodeType":860},{},[25885],{"data":25886,"marks":25887,"value":25888,"nodeType":864},{},[],"Push's detection approach targets attacker TTPs rather than indicators of compromise that attackers can rotate in minutes. 95% of attacks detected by Push used some form of bot protection service — meaning the specific domain and IP were deliberately obscured. If your primary detection relies on blocklists, recent reports tell us that 89% of phishing domains will evade you: because they're active for less than two days, they can be spun up, down, and replaced faster than blocklists can keep up.",{"data":25890,"content":25891,"nodeType":860},{},[25892],{"data":25893,"marks":25894,"value":25895,"nodeType":864},{},[],"Behavioral detection of the attack technique — the AiTM relay structure, the credential entry on a cloned login page, the anomalous session context — remains valid regardless of what domain the attack is hosted on or which PhaaS kit was used to build it.",{"data":25897,"content":25898,"nodeType":1312},{},[25899],{"data":25900,"marks":25901,"value":25903,"nodeType":864},{},[25902],{"type":899},"Measuring the identity attack surface (it's bigger than you realize)",{"data":25905,"content":25906,"nodeType":860},{},[25907],{"data":25908,"marks":25909,"value":25910,"nodeType":864},{},[],"Because Push has visibility into actual login behavior across thousands of organizations, it can quantify the attack surface that identity-based attacks exploit. Of the last million logins observed by Push:",{"data":25912,"content":25913,"nodeType":941},{},[25914,25929,25944,25959],{"data":25915,"content":25916,"nodeType":945},{},[25917],{"data":25918,"content":25919,"nodeType":860},{},[25920,25925],{"data":25921,"marks":25922,"value":25924,"nodeType":864},{},[25923],{"type":899},"15 corporate identities were identified per employee",{"data":25926,"marks":25927,"value":25928,"nodeType":864},{},[]," used to access cloud apps",{"data":25930,"content":25931,"nodeType":945},{},[25932],{"data":25933,"content":25934,"nodeType":860},{},[25935,25940],{"data":25936,"marks":25937,"value":25939,"nodeType":864},{},[25938],{"type":899},"1 in 4",{"data":25941,"marks":25942,"value":25943,"nodeType":864},{},[]," were password logins, not SSO",{"data":25945,"content":25946,"nodeType":945},{},[25947],{"data":25948,"content":25949,"nodeType":860},{},[25950,25955],{"data":25951,"marks":25952,"value":25954,"nodeType":864},{},[25953],{"type":899},"2 in 5",{"data":25956,"marks":25957,"value":25958,"nodeType":864},{},[]," were not protected by MFA",{"data":25960,"content":25961,"nodeType":945},{},[25962],{"data":25963,"content":25964,"nodeType":860},{},[25965,25970],{"data":25966,"marks":25967,"value":25969,"nodeType":864},{},[25968],{"type":899},"1 in 5",{"data":25971,"marks":25972,"value":25973,"nodeType":864},{},[]," used a weak, breached, or reused password",{"data":25975,"content":25976,"nodeType":860},{},[25977,25981,25986],{"data":25978,"marks":25979,"value":25980,"nodeType":864},{},[],"And it's not just login hygiene. Across Push's customer base, ",{"data":25982,"marks":25983,"value":25985,"nodeType":864},{},[25984],{"type":899},"46%+ of browser extensions in corporate environments have the permission combinations required for direct account takeover via session theft if they are malicious or compromised by an attacker",{"data":25987,"marks":25988,"value":25989,"nodeType":864},{},[],". Most organizations have no inventory of what's running in their employees' browsers, let alone visibility into what those extensions can access.",{"data":25991,"content":25992,"nodeType":860},{},[25993,25997,26004],{"data":25994,"marks":25995,"value":25996,"nodeType":864},{},[],"These aren't theoretical vulnerabilities. They're the specific weaknesses that browser-native identity attacks are designed to exploit. ",{"data":25998,"content":25999,"nodeType":883},{"uri":3210},[26000],{"data":26001,"marks":26002,"value":26003,"nodeType":864},{},[],"This visibility turns browser security from a reactive posture into a proactive one",{"data":26005,"marks":26006,"value":26007,"nodeType":864},{},[]," — you can see and remediate the identity weaknesses before an attacker exploits them, not just detect the attack while it's in progress.",{"data":26009,"content":26010,"nodeType":1312},{},[26011],{"data":26012,"marks":26013,"value":26015,"nodeType":864},{},[26014],{"type":899},"The ROI case",{"data":26017,"content":26018,"nodeType":860},{},[26019],{"data":26020,"marks":26021,"value":26022,"nodeType":864},{},[],"The ROI question for any security investment is: what quantum of real risk does this tool address, at what cost in money and operational friction?",{"data":26024,"content":26025,"nodeType":860},{},[26026],{"data":26027,"marks":26028,"value":26030,"nodeType":864},{},[26029],{"type":899},"That calculation looks very different depending on your threat model.",{"data":26032,"content":26033,"nodeType":860},{},[26034],{"data":26035,"marks":26036,"value":26037,"nodeType":864},{},[],"A solution focused on browser engine exploits and sandbox escapes is defending against an attack category that represents a tiny fraction of actual enterprise breaches, requires extraordinary attacker resources to execute, and is increasingly mitigated by browser vendors themselves through hardening and rapid patching. Chrome's automatic update cycle means that even when a browser vulnerability is discovered and disclosed, it is typically in front of users as a patch within days. The defenders here are Google, Mozilla, and Microsoft — with multi-billion dollar security teams and full access to the browser internals.",{"data":26039,"content":26040,"nodeType":860},{},[26041],{"data":26042,"marks":26043,"value":26044,"nodeType":864},{},[],"A solution focused on identity attacks via the browser — phishing, credential theft, session hijacking, OAuth abuse, malicious browser extensions — is defending against the primary cause of enterprise breaches, one that is accelerating (cloud-conscious intrusions up 37% in 2025, browser-based attacks increasing at 68% of organizations over the past two years per Omdia) and increasingly automated through PhaaS infrastructure that gives low-skill attackers enterprise-grade capability for $1,000 a year.",{"data":26046,"content":26047,"nodeType":860},{},[26048],{"data":26049,"marks":26050,"value":26051,"nodeType":864},{},[],"There's also a forward-looking dimension. The threat landscape isn't moving toward more browser exploitation. It's moving further into identity abuse. AI-powered phishing lowers the social engineering barrier. Agentic browsers will automate credential stuffing and account takeover at a scale that wasn't previously possible. And attackers are already adapting to authentication improvements: device code phishing has increased 37x since the start of 2026, a technique specifically designed to circumvent passkeys by bypassing the authentication flow entirely — the attacker never encounters a login page. The investment in identity-centric browser detection compounds over time as the attack surface evolves in the same direction.",{"data":26053,"content":26057,"nodeType":996},{"target":26054},{"sys":26055},{"id":26056,"type":1001,"linkType":1002},"cQ6WPV2NMYvDMZXifqzK1",[],{"data":26059,"content":26060,"nodeType":1312},{},[26061],{"data":26062,"marks":26063,"value":26065,"nodeType":864},{},[26064],{"type":899},"The verdict",{"data":26067,"content":26068,"nodeType":860},{},[26069],{"data":26070,"marks":26071,"value":26072,"nodeType":864},{},[],"Browser security is a real and growing priority — according to Omdia Research, it is now a top-five priority for 88% of security leaders and the top priority for 26% of them. 85% expect their browser security spending to increase over the next 12–24 months. The question isn't whether to invest. It's what to invest in.",{"data":26074,"content":26075,"nodeType":860},{},[26076],{"data":26077,"marks":26078,"value":26079,"nodeType":864},{},[],"The browser is where your users work, where attackers target them, and where the identity attacks causing the majority of enterprise breaches play out. But not all browser security investments address the same problem.",{"data":26081,"content":26084,"nodeType":996},{"target":26082},{"sys":26083},{"id":12852,"type":1001,"linkType":1002},[],{"data":26086,"content":26087,"nodeType":860},{},[26088],{"data":26089,"marks":26090,"value":26091,"nodeType":864},{},[],"Solutions like Seraphic are built to defend against a browser being exploited by an attacker trying to break out of the sandbox — an attack that represents a historic low as a share of enterprise incidents, and one that Google's own hardening and rapid patching increasingly mitigates automatically. SquareX is built around malware sandboxing — a legitimate but declining share of the initial access landscape, and a capability Zscaler's existing customers already partially have. LayerX focuses on internal governance rather than external threats.",{"data":26093,"content":26094,"nodeType":860},{},[26095],{"data":26096,"marks":26097,"value":26098,"nodeType":864},{},[],"Push Security is built to defend against the attacks that are behind the major breaches hitting the headlines: identity theft, credential abuse, session hijacking, and the full identity attack kill chain that plays out inside the browser every time an attacker logs in as your user. Every major threat intelligence report points to these as the primary breach vectors. The economics of attack choice guarantee they'll remain so.",{"data":26100,"content":26101,"nodeType":860},{},[26102],{"data":26103,"marks":26104,"value":26105,"nodeType":864},{},[],"The security team that deploys Push gets the greatest coverage of the highest-impact threats, on managed and unmanaged devices, with the lightest operational footprint. That is the browser security investment that moves the needle on real organizational risk — not the browser security investment that defends the software nobody's actually attacking.",{"data":26107,"content":26111,"nodeType":996},{"target":26108},{"sys":26109},{"id":26110,"type":1001,"linkType":1002},"3a2sEWgWKZulGLCFfODwk0",[],{"data":26113,"content":26114,"nodeType":860},{},[26115],{"data":26116,"marks":26117,"value":21,"nodeType":864},{},[],"How to avoid the browser security buyer's trap","Securing the browser vs. securing the organization via the browser — what's the difference?","how-to-avoid-the-browser-security-buyers-trap",{"items":26122},[26123,26125],{"sys":26124,"name":297},{"id":2732},{"sys":26126,"name":2729},{"id":2728},{"items":26128},[26129],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":26130},{"url":4881},{"__typename":2059,"sys":26132,"content":26133,"title":23465,"synopsis":23466,"hashTags":59,"publishedDate":23467,"slug":23468,"tagsCollection":26563,"authorsCollection":26569},{"id":22959},{"json":26134},{"data":26135,"content":26136,"nodeType":856},{},[26137,26144,26168,26173,26179,26194,26207,26210,26217,26230,26246,26266,26271,26284,26308,26313,26318,26331,26334,26341,26347,26354,26370,26383,26390,26412,26418,26425,26449,26455,26462,26468,26473,26476,26483,26489,26496,26501,26504,26511,26517,26523,26529,26539,26542,26548],{"data":26138,"content":26139,"nodeType":1009},{},[26140],{"data":26141,"marks":26142,"value":22971,"nodeType":864},{},[26143],{"type":899},{"data":26145,"content":26146,"nodeType":860},{},[26147,26150,26156,26159,26165],{"data":26148,"marks":26149,"value":22978,"nodeType":864},{},[],{"data":26151,"content":26152,"nodeType":883},{"uri":22981},[26153],{"data":26154,"marks":26155,"value":22986,"nodeType":864},{},[],{"data":26157,"marks":26158,"value":22990,"nodeType":864},{},[],{"data":26160,"content":26161,"nodeType":883},{"uri":22993},[26162],{"data":26163,"marks":26164,"value":22998,"nodeType":864},{},[],{"data":26166,"marks":26167,"value":23002,"nodeType":864},{},[],{"data":26169,"content":26172,"nodeType":996},{"target":26170},{"sys":26171},{"id":23007,"type":1001,"linkType":1002},[],{"data":26174,"content":26175,"nodeType":860},{},[26176],{"data":26177,"marks":26178,"value":23015,"nodeType":864},{},[],{"data":26180,"content":26181,"nodeType":860},{},[26182,26185,26191],{"data":26183,"marks":26184,"value":23022,"nodeType":864},{},[],{"data":26186,"content":26187,"nodeType":883},{"uri":23025},[26188],{"data":26189,"marks":26190,"value":23030,"nodeType":864},{},[],{"data":26192,"marks":26193,"value":23034,"nodeType":864},{},[],{"data":26195,"content":26196,"nodeType":860},{},[26197,26200,26204],{"data":26198,"marks":26199,"value":23041,"nodeType":864},{},[],{"data":26201,"marks":26202,"value":23046,"nodeType":864},{},[26203],{"type":899},{"data":26205,"marks":26206,"value":2924,"nodeType":864},{},[],{"data":26208,"content":26209,"nodeType":1005},{},[],{"data":26211,"content":26212,"nodeType":1009},{},[26213],{"data":26214,"marks":26215,"value":23060,"nodeType":864},{},[26216],{"type":899},{"data":26218,"content":26219,"nodeType":860},{},[26220,26223,26227],{"data":26221,"marks":26222,"value":23067,"nodeType":864},{},[],{"data":26224,"marks":26225,"value":23072,"nodeType":864},{},[26226],{"type":2246},{"data":26228,"marks":26229,"value":2924,"nodeType":864},{},[],{"data":26231,"content":26232,"nodeType":860},{},[26233,26236,26243],{"data":26234,"marks":26235,"value":23082,"nodeType":864},{},[],{"data":26237,"content":26238,"nodeType":883},{"uri":8804},[26239],{"data":26240,"marks":26241,"value":23090,"nodeType":864},{},[26242],{"type":1455},{"data":26244,"marks":26245,"value":23094,"nodeType":864},{},[],{"data":26247,"content":26248,"nodeType":860},{},[26249,26252,26256,26259,26263],{"data":26250,"marks":26251,"value":23101,"nodeType":864},{},[],{"data":26253,"marks":26254,"value":23106,"nodeType":864},{},[26255],{"type":899},{"data":26257,"marks":26258,"value":23110,"nodeType":864},{},[],{"data":26260,"marks":26261,"value":23115,"nodeType":864},{},[26262],{"type":2246},{"data":26264,"marks":26265,"value":23119,"nodeType":864},{},[],{"data":26267,"content":26270,"nodeType":996},{"target":26268},{"sys":26269},{"id":23124,"type":1001,"linkType":1002},[],{"data":26272,"content":26273,"nodeType":860},{},[26274,26277,26281],{"data":26275,"marks":26276,"value":23132,"nodeType":864},{},[],{"data":26278,"marks":26279,"value":23137,"nodeType":864},{},[26280],{"type":899},{"data":26282,"marks":26283,"value":23141,"nodeType":864},{},[],{"data":26285,"content":26286,"nodeType":860},{},[26287,26290,26296,26299,26305],{"data":26288,"marks":26289,"value":23148,"nodeType":864},{},[],{"data":26291,"content":26292,"nodeType":883},{"uri":23151},[26293],{"data":26294,"marks":26295,"value":23156,"nodeType":864},{},[],{"data":26297,"marks":26298,"value":23160,"nodeType":864},{},[],{"data":26300,"content":26301,"nodeType":883},{"uri":13067},[26302],{"data":26303,"marks":26304,"value":23167,"nodeType":864},{},[],{"data":26306,"marks":26307,"value":1774,"nodeType":864},{},[],{"data":26309,"content":26312,"nodeType":996},{"target":26310},{"sys":26311},{"id":23175,"type":1001,"linkType":1002},[],{"data":26314,"content":26317,"nodeType":996},{"target":26315},{"sys":26316},{"id":23181,"type":1001,"linkType":1002},[],{"data":26319,"content":26320,"nodeType":860},{},[26321,26324,26328],{"data":26322,"marks":26323,"value":23189,"nodeType":864},{},[],{"data":26325,"marks":26326,"value":23194,"nodeType":864},{},[26327],{"type":899},{"data":26329,"marks":26330,"value":23198,"nodeType":864},{},[],{"data":26332,"content":26333,"nodeType":1005},{},[],{"data":26335,"content":26336,"nodeType":1009},{},[26337],{"data":26338,"marks":26339,"value":23209,"nodeType":864},{},[26340],{"type":899},{"data":26342,"content":26343,"nodeType":860},{},[26344],{"data":26345,"marks":26346,"value":23216,"nodeType":864},{},[],{"data":26348,"content":26349,"nodeType":1312},{},[26350],{"data":26351,"marks":26352,"value":23224,"nodeType":864},{},[26353],{"type":899},{"data":26355,"content":26356,"nodeType":860},{},[26357,26360,26367],{"data":26358,"marks":26359,"value":21,"nodeType":864},{},[],{"data":26361,"content":26362,"nodeType":883},{"uri":4103},[26363],{"data":26364,"marks":26365,"value":23238,"nodeType":864},{},[26366],{"type":1455},{"data":26368,"marks":26369,"value":23242,"nodeType":864},{},[],{"data":26371,"content":26372,"nodeType":860},{},[26373,26376,26380],{"data":26374,"marks":26375,"value":23249,"nodeType":864},{},[],{"data":26377,"marks":26378,"value":23254,"nodeType":864},{},[26379],{"type":899},{"data":26381,"marks":26382,"value":23258,"nodeType":864},{},[],{"data":26384,"content":26385,"nodeType":1312},{},[26386],{"data":26387,"marks":26388,"value":288,"nodeType":864},{},[26389],{"type":899},{"data":26391,"content":26392,"nodeType":860},{},[26393,26397,26405,26409],{"data":26394,"marks":26395,"value":21,"nodeType":864},{},[26396],{"type":899},{"data":26398,"content":26399,"nodeType":883},{"uri":2411},[26400],{"data":26401,"marks":26402,"value":23281,"nodeType":864},{},[26403,26404],{"type":1455},{"type":899},{"data":26406,"marks":26407,"value":23286,"nodeType":864},{},[26408],{"type":899},{"data":26410,"marks":26411,"value":23290,"nodeType":864},{},[],{"data":26413,"content":26414,"nodeType":860},{},[26415],{"data":26416,"marks":26417,"value":23297,"nodeType":864},{},[],{"data":26419,"content":26420,"nodeType":1312},{},[26421],{"data":26422,"marks":26423,"value":23305,"nodeType":864},{},[26424],{"type":899},{"data":26426,"content":26427,"nodeType":860},{},[26428,26431,26437,26440,26446],{"data":26429,"marks":26430,"value":23312,"nodeType":864},{},[],{"data":26432,"content":26433,"nodeType":883},{"uri":14681},[26434],{"data":26435,"marks":26436,"value":23319,"nodeType":864},{},[],{"data":26438,"marks":26439,"value":23323,"nodeType":864},{},[],{"data":26441,"content":26442,"nodeType":883},{"uri":3237},[26443],{"data":26444,"marks":26445,"value":23330,"nodeType":864},{},[],{"data":26447,"marks":26448,"value":23334,"nodeType":864},{},[],{"data":26450,"content":26451,"nodeType":860},{},[26452],{"data":26453,"marks":26454,"value":23341,"nodeType":864},{},[],{"data":26456,"content":26457,"nodeType":1312},{},[26458],{"data":26459,"marks":26460,"value":23349,"nodeType":864},{},[26461],{"type":899},{"data":26463,"content":26464,"nodeType":860},{},[26465],{"data":26466,"marks":26467,"value":23356,"nodeType":864},{},[],{"data":26469,"content":26472,"nodeType":996},{"target":26470},{"sys":26471},{"id":23361,"type":1001,"linkType":1002},[],{"data":26474,"content":26475,"nodeType":1005},{},[],{"data":26477,"content":26478,"nodeType":1009},{},[26479],{"data":26480,"marks":26481,"value":23373,"nodeType":864},{},[26482],{"type":899},{"data":26484,"content":26485,"nodeType":860},{},[26486],{"data":26487,"marks":26488,"value":23380,"nodeType":864},{},[],{"data":26490,"content":26491,"nodeType":860},{},[26492],{"data":26493,"marks":26494,"value":23388,"nodeType":864},{},[26495],{"type":899},{"data":26497,"content":26500,"nodeType":996},{"target":26498},{"sys":26499},{"id":23393,"type":1001,"linkType":1002},[],{"data":26502,"content":26503,"nodeType":1005},{},[],{"data":26505,"content":26506,"nodeType":1312},{},[26507],{"data":26508,"marks":26509,"value":23405,"nodeType":864},{},[26510],{"type":899},{"data":26512,"content":26513,"nodeType":860},{},[26514],{"data":26515,"marks":26516,"value":23412,"nodeType":864},{},[],{"data":26518,"content":26519,"nodeType":860},{},[26520],{"data":26521,"marks":26522,"value":23419,"nodeType":864},{},[],{"data":26524,"content":26525,"nodeType":860},{},[26526],{"data":26527,"marks":26528,"value":23426,"nodeType":864},{},[],{"data":26530,"content":26531,"nodeType":860},{},[26532,26536],{"data":26533,"marks":26534,"value":23434,"nodeType":864},{},[26535],{"type":899},{"data":26537,"marks":26538,"value":23438,"nodeType":864},{},[],{"data":26540,"content":26541,"nodeType":1005},{},[],{"data":26543,"content":26544,"nodeType":860},{},[26545],{"data":26546,"marks":26547,"value":4855,"nodeType":864},{},[],{"data":26549,"content":26550,"nodeType":860},{},[26551,26554,26560],{"data":26552,"marks":26553,"value":23454,"nodeType":864},{},[],{"data":26555,"content":26556,"nodeType":883},{"uri":23457},[26557],{"data":26558,"marks":26559,"value":15017,"nodeType":864},{},[],{"data":26561,"marks":26562,"value":2719,"nodeType":864},{},[],{"items":26564},[26565,26567],{"sys":26566,"name":2729},{"id":2728},{"sys":26568,"name":342},{"id":15029},{"items":26570},[26571],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":26572},{"url":3625},"blog/the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value",{"json":26575},{"data":26576,"content":26577,"nodeType":856},{},[26578],{"data":26579,"content":26580,"nodeType":860},{},[26581],{"data":26582,"marks":26583,"value":26584,"nodeType":864},{},[],"Getting a clear picture of which solution is right for your team means understanding what problem you want to solve, and identifying if the browser is the best place to solve that problem. To help you navigate this, we've ranked the security problems you can solve in the browser by security value and browser fit.",{"id":3628,"publishedAt":26586},"2026-08-12T11:52:50.048Z",{"items":26588},[26589,26591],{"sys":26590,"name":297},{"id":2732},{"sys":26592,"name":2729},{"id":2728},{"items":26594},[26595,26597,26599,26601,26603,26605,26607,26609,26611,26613,26615,26617,26619,26621,26623,26625,26627,26629,26631,26633,26635,26637,26639,26641,26643],{"sys":26596,"name":297,"slug":298,"tier":31},{"id":294},{"sys":26598,"name":413,"slug":414,"tier":31},{"id":410},{"sys":26600,"name":279,"slug":280,"tier":31},{"id":276},{"sys":26602,"name":519,"slug":520,"tier":31},{"id":516},{"sys":26604,"name":235,"slug":236,"tier":31},{"id":232},{"sys":26606,"name":342,"slug":343,"tier":31},{"id":339},{"sys":26608,"name":545,"slug":546,"tier":31},{"id":542},{"sys":26610,"name":261,"slug":262,"tier":45},{"id":258},{"sys":26612,"name":589,"slug":590,"tier":45},{"id":586},{"sys":26614,"name":288,"slug":289,"tier":45},{"id":285},{"sys":26616,"name":484,"slug":485,"tier":45},{"id":481},{"sys":26618,"name":422,"slug":423,"tier":45},{"id":419},{"sys":26620,"name":502,"slug":503,"tier":45},{"id":499},{"sys":26622,"name":333,"slug":334,"tier":45},{"id":330},{"sys":26624,"name":395,"slug":396,"tier":45},{"id":392},{"sys":26626,"name":457,"slug":458,"tier":45},{"id":454},{"sys":26628,"name":315,"slug":316,"tier":45},{"id":312},{"sys":26630,"name":324,"slug":325,"tier":45},{"id":321},{"sys":26632,"name":571,"slug":572,"tier":45},{"id":568},{"sys":26634,"name":368,"slug":369,"tier":45},{"id":365},{"sys":26636,"name":580,"slug":581,"tier":45},{"id":577},{"sys":26638,"name":252,"slug":253,"tier":45},{"id":249},{"sys":26640,"name":475,"slug":476,"tier":45},{"id":472},{"sys":26642,"name":440,"slug":441,"tier":45},{"id":437},{"sys":26644,"name":633,"slug":634,"tier":45},{"id":630},"eheGEg-9k5C4bph8PtOCjFzhTfglI3HL0C87-kCdH4c",{"id":26647,"title":21964,"authorsCollection":26648,"content":26653,"extension":228,"faqItemsCollection":27270,"faqTitle":59,"featured":6,"hashTags":59,"meta":27272,"metaTitle":27273,"ogImage":59,"postType":6981,"publishedDate":21966,"relatedBlogPostsCollection":27274,"slug":21967,"stem":29223,"subtitle":59,"summary":29224,"synopsis":21965,"sys":29235,"tagsCollection":29237,"topicsCollection":29243,"__hash__":29283},"blog/blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market.json",{"items":26649},[26650],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":26651,"profilePicture":26652},[17240],{"url":2740},{"json":26654,"links":27149},{"data":26655,"content":26656,"nodeType":856},{},[26657,26672,26678,26684,26689,26692,26699,26712,26718,26723,26729,26804,26810,26815,26821,26826,26829,26836,26846,26852,26862,26865,26872,26885,26891,26897,26900,26907,26913,26926,26931,26944,26950,26956,26962,26975,26981,26984,26991,26997,27010,27016,27019,27026,27039,27045,27061,27071,27074,27081,27094,27100,27106,27112,27118,27121,27127,27133],{"data":26658,"content":26659,"nodeType":860},{},[26660,26663,26669],{"data":26661,"marks":26662,"value":2761,"nodeType":864},{},[],{"data":26664,"content":26665,"nodeType":883},{"uri":21402},[26666],{"data":26667,"marks":26668,"value":21407,"nodeType":864},{},[],{"data":26670,"marks":26671,"value":21411,"nodeType":864},{},[],{"data":26673,"content":26674,"nodeType":860},{},[26675],{"data":26676,"marks":26677,"value":21418,"nodeType":864},{},[],{"data":26679,"content":26680,"nodeType":860},{},[26681],{"data":26682,"marks":26683,"value":21425,"nodeType":864},{},[],{"data":26685,"content":26688,"nodeType":996},{"target":26686},{"sys":26687},{"id":21430,"type":1001,"linkType":1002},[],{"data":26690,"content":26691,"nodeType":1005},{},[],{"data":26693,"content":26694,"nodeType":1009},{},[26695],{"data":26696,"marks":26697,"value":21442,"nodeType":864},{},[26698],{"type":899},{"data":26700,"content":26701,"nodeType":860},{},[26702,26705,26709],{"data":26703,"marks":26704,"value":21449,"nodeType":864},{},[],{"data":26706,"marks":26707,"value":21454,"nodeType":864},{},[26708],{"type":899},{"data":26710,"marks":26711,"value":21458,"nodeType":864},{},[],{"data":26713,"content":26714,"nodeType":860},{},[26715],{"data":26716,"marks":26717,"value":21465,"nodeType":864},{},[],{"data":26719,"content":26722,"nodeType":996},{"target":26720},{"sys":26721},{"id":21470,"type":1001,"linkType":1002},[],{"data":26724,"content":26725,"nodeType":860},{},[26726],{"data":26727,"marks":26728,"value":21478,"nodeType":864},{},[],{"data":26730,"content":26731,"nodeType":941},{},[26732,26741,26750,26759,26768,26777,26786,26795],{"data":26733,"content":26734,"nodeType":945},{},[26735],{"data":26736,"content":26737,"nodeType":860},{},[26738],{"data":26739,"marks":26740,"value":21491,"nodeType":864},{},[],{"data":26742,"content":26743,"nodeType":945},{},[26744],{"data":26745,"content":26746,"nodeType":860},{},[26747],{"data":26748,"marks":26749,"value":21501,"nodeType":864},{},[],{"data":26751,"content":26752,"nodeType":945},{},[26753],{"data":26754,"content":26755,"nodeType":860},{},[26756],{"data":26757,"marks":26758,"value":21511,"nodeType":864},{},[],{"data":26760,"content":26761,"nodeType":945},{},[26762],{"data":26763,"content":26764,"nodeType":860},{},[26765],{"data":26766,"marks":26767,"value":21521,"nodeType":864},{},[],{"data":26769,"content":26770,"nodeType":945},{},[26771],{"data":26772,"content":26773,"nodeType":860},{},[26774],{"data":26775,"marks":26776,"value":21531,"nodeType":864},{},[],{"data":26778,"content":26779,"nodeType":945},{},[26780],{"data":26781,"content":26782,"nodeType":860},{},[26783],{"data":26784,"marks":26785,"value":21541,"nodeType":864},{},[],{"data":26787,"content":26788,"nodeType":945},{},[26789],{"data":26790,"content":26791,"nodeType":860},{},[26792],{"data":26793,"marks":26794,"value":21551,"nodeType":864},{},[],{"data":26796,"content":26797,"nodeType":945},{},[26798],{"data":26799,"content":26800,"nodeType":860},{},[26801],{"data":26802,"marks":26803,"value":21561,"nodeType":864},{},[],{"data":26805,"content":26806,"nodeType":860},{},[26807],{"data":26808,"marks":26809,"value":21568,"nodeType":864},{},[],{"data":26811,"content":26814,"nodeType":996},{"target":26812},{"sys":26813},{"id":21573,"type":1001,"linkType":1002},[],{"data":26816,"content":26817,"nodeType":860},{},[26818],{"data":26819,"marks":26820,"value":21581,"nodeType":864},{},[],{"data":26822,"content":26825,"nodeType":996},{"target":26823},{"sys":26824},{"id":21586,"type":1001,"linkType":1002},[],{"data":26827,"content":26828,"nodeType":1005},{},[],{"data":26830,"content":26831,"nodeType":1009},{},[26832],{"data":26833,"marks":26834,"value":21598,"nodeType":864},{},[26835],{"type":899},{"data":26837,"content":26838,"nodeType":860},{},[26839,26843],{"data":26840,"marks":26841,"value":21606,"nodeType":864},{},[26842],{"type":899},{"data":26844,"marks":26845,"value":21610,"nodeType":864},{},[],{"data":26847,"content":26848,"nodeType":860},{},[26849],{"data":26850,"marks":26851,"value":21617,"nodeType":864},{},[],{"data":26853,"content":26854,"nodeType":860},{},[26855,26859],{"data":26856,"marks":26857,"value":21625,"nodeType":864},{},[26858],{"type":899},{"data":26860,"marks":26861,"value":21629,"nodeType":864},{},[],{"data":26863,"content":26864,"nodeType":1005},{},[],{"data":26866,"content":26867,"nodeType":1009},{},[26868],{"data":26869,"marks":26870,"value":21640,"nodeType":864},{},[26871],{"type":899},{"data":26873,"content":26874,"nodeType":860},{},[26875,26878,26882],{"data":26876,"marks":26877,"value":21647,"nodeType":864},{},[],{"data":26879,"marks":26880,"value":21652,"nodeType":864},{},[26881],{"type":899},{"data":26883,"marks":26884,"value":21656,"nodeType":864},{},[],{"data":26886,"content":26887,"nodeType":860},{},[26888],{"data":26889,"marks":26890,"value":21663,"nodeType":864},{},[],{"data":26892,"content":26893,"nodeType":860},{},[26894],{"data":26895,"marks":26896,"value":21670,"nodeType":864},{},[],{"data":26898,"content":26899,"nodeType":1005},{},[],{"data":26901,"content":26902,"nodeType":1009},{},[26903],{"data":26904,"marks":26905,"value":21681,"nodeType":864},{},[26906],{"type":899},{"data":26908,"content":26909,"nodeType":860},{},[26910],{"data":26911,"marks":26912,"value":21688,"nodeType":864},{},[],{"data":26914,"content":26915,"nodeType":860},{},[26916,26919,26923],{"data":26917,"marks":26918,"value":21695,"nodeType":864},{},[],{"data":26920,"marks":26921,"value":21700,"nodeType":864},{},[26922],{"type":899},{"data":26924,"marks":26925,"value":21704,"nodeType":864},{},[],{"data":26927,"content":26930,"nodeType":996},{"target":26928},{"sys":26929},{"id":21709,"type":1001,"linkType":1002},[],{"data":26932,"content":26933,"nodeType":860},{},[26934,26937,26941],{"data":26935,"marks":26936,"value":21717,"nodeType":864},{},[],{"data":26938,"marks":26939,"value":21722,"nodeType":864},{},[26940],{"type":899},{"data":26942,"marks":26943,"value":21726,"nodeType":864},{},[],{"data":26945,"content":26946,"nodeType":860},{},[26947],{"data":26948,"marks":26949,"value":21733,"nodeType":864},{},[],{"data":26951,"content":26952,"nodeType":860},{},[26953],{"data":26954,"marks":26955,"value":21740,"nodeType":864},{},[],{"data":26957,"content":26958,"nodeType":860},{},[26959],{"data":26960,"marks":26961,"value":21747,"nodeType":864},{},[],{"data":26963,"content":26964,"nodeType":860},{},[26965,26968,26972],{"data":26966,"marks":26967,"value":21754,"nodeType":864},{},[],{"data":26969,"marks":26970,"value":21759,"nodeType":864},{},[26971],{"type":899},{"data":26973,"marks":26974,"value":21763,"nodeType":864},{},[],{"data":26976,"content":26977,"nodeType":860},{},[26978],{"data":26979,"marks":26980,"value":21770,"nodeType":864},{},[],{"data":26982,"content":26983,"nodeType":1005},{},[],{"data":26985,"content":26986,"nodeType":1009},{},[26987],{"data":26988,"marks":26989,"value":21781,"nodeType":864},{},[26990],{"type":899},{"data":26992,"content":26993,"nodeType":860},{},[26994],{"data":26995,"marks":26996,"value":21788,"nodeType":864},{},[],{"data":26998,"content":26999,"nodeType":860},{},[27000,27003,27007],{"data":27001,"marks":27002,"value":21795,"nodeType":864},{},[],{"data":27004,"marks":27005,"value":21800,"nodeType":864},{},[27006],{"type":899},{"data":27008,"marks":27009,"value":21804,"nodeType":864},{},[],{"data":27011,"content":27012,"nodeType":860},{},[27013],{"data":27014,"marks":27015,"value":21811,"nodeType":864},{},[],{"data":27017,"content":27018,"nodeType":1005},{},[],{"data":27020,"content":27021,"nodeType":1009},{},[27022],{"data":27023,"marks":27024,"value":21822,"nodeType":864},{},[27025],{"type":899},{"data":27027,"content":27028,"nodeType":860},{},[27029,27032,27036],{"data":27030,"marks":27031,"value":21829,"nodeType":864},{},[],{"data":27033,"marks":27034,"value":21834,"nodeType":864},{},[27035],{"type":899},{"data":27037,"marks":27038,"value":21838,"nodeType":864},{},[],{"data":27040,"content":27041,"nodeType":860},{},[27042],{"data":27043,"marks":27044,"value":21845,"nodeType":864},{},[],{"data":27046,"content":27047,"nodeType":860},{},[27048,27051,27058],{"data":27049,"marks":27050,"value":21852,"nodeType":864},{},[],{"data":27052,"content":27053,"nodeType":883},{"uri":12928},[27054],{"data":27055,"marks":27056,"value":21860,"nodeType":864},{},[27057],{"type":1455},{"data":27059,"marks":27060,"value":21864,"nodeType":864},{},[],{"data":27062,"content":27063,"nodeType":860},{},[27064,27067],{"data":27065,"marks":27066,"value":21871,"nodeType":864},{},[],{"data":27068,"marks":27069,"value":21876,"nodeType":864},{},[27070],{"type":899},{"data":27072,"content":27073,"nodeType":1005},{},[],{"data":27075,"content":27076,"nodeType":1009},{},[27077],{"data":27078,"marks":27079,"value":21887,"nodeType":864},{},[27080],{"type":899},{"data":27082,"content":27083,"nodeType":860},{},[27084,27087,27091],{"data":27085,"marks":27086,"value":21894,"nodeType":864},{},[],{"data":27088,"marks":27089,"value":21899,"nodeType":864},{},[27090],{"type":899},{"data":27092,"marks":27093,"value":21903,"nodeType":864},{},[],{"data":27095,"content":27096,"nodeType":860},{},[27097],{"data":27098,"marks":27099,"value":21910,"nodeType":864},{},[],{"data":27101,"content":27102,"nodeType":860},{},[27103],{"data":27104,"marks":27105,"value":21917,"nodeType":864},{},[],{"data":27107,"content":27108,"nodeType":860},{},[27109],{"data":27110,"marks":27111,"value":21924,"nodeType":864},{},[],{"data":27113,"content":27114,"nodeType":860},{},[27115],{"data":27116,"marks":27117,"value":21931,"nodeType":864},{},[],{"data":27119,"content":27120,"nodeType":1005},{},[],{"data":27122,"content":27123,"nodeType":860},{},[27124],{"data":27125,"marks":27126,"value":21941,"nodeType":864},{},[],{"data":27128,"content":27129,"nodeType":860},{},[27130],{"data":27131,"marks":27132,"value":1689,"nodeType":864},{},[],{"data":27134,"content":27135,"nodeType":860},{},[27136,27139,27146],{"data":27137,"marks":27138,"value":21,"nodeType":864},{},[],{"data":27140,"content":27141,"nodeType":883},{"uri":1700},[27142],{"data":27143,"marks":27144,"value":15017,"nodeType":864},{},[27145],{"type":1455},{"data":27147,"marks":27148,"value":2719,"nodeType":864},{},[],{"entries":27150},{"hyperlink":27151,"inline":27152,"block":27153},[],[],[27154,27162,27199,27203,27232],{"sys":27155,"__typename":1724,"title":27156,"caption":27157,"layoutMode":59,"file":27158},{"id":21430},"Omdia report key stats infographic","Headline stats from the latest Omdia report.",{"url":27159,"width":27160,"height":27161},"https://images.ctfassets.net/y1cdw1ablpvd/62TiADpvI65W2gT7RQwlOU/a4aaad376574b1cd963fc0afa5e2942d/omdia-browser-security-infographic_2x__2_.png",1700,1434,{"sys":27163,"__typename":1740,"content":27164,"name":27198,"title":59},{"id":21470},{"json":27165},{"nodeType":856,"data":27166,"content":27167},{},[27168],{"nodeType":860,"data":27169,"content":27170},{},[27171,27175,27182,27186,27194],{"nodeType":864,"value":27172,"marks":27173,"data":27174},"The evidence here isn’t just statistics. The real-world breaches attributed to ",[],{},{"nodeType":883,"data":27176,"content":27177},{"uri":18024},[27178],{"nodeType":864,"value":18027,"marks":27179,"data":27181},[27180],{"type":1455},{},{"nodeType":864,"value":27183,"marks":27184,"data":27185},", including the ",[],{},{"nodeType":883,"data":27187,"content":27188},{"uri":4082},[27189],{"nodeType":864,"value":27190,"marks":27191,"data":27193},"ShinyHunters-branded 2026 hacking spree",[27192],{"type":1455},{},{"nodeType":864,"value":27195,"marks":27196,"data":27197},", clearly underline the real-world threat. ",[],{},"Omdia report IB1",{"sys":27200,"__typename":1717,"type":1718,"ctaText":27201,"buttonLabel":27202,"buttonColour":1721,"buttonUrl":12790},{"id":21573},"Get our latest technical whitepaper to learn about the state of browser-based attacks in 2026 (no sign-up required).","Download Now",{"sys":27204,"__typename":1740,"content":27205,"name":27231,"title":59},{"id":21586},{"json":27206},{"data":27207,"content":27208,"nodeType":856},{},[27209],{"data":27210,"content":27211,"nodeType":860},{},[27212,27216,27227],{"data":27213,"marks":27214,"value":27215,"nodeType":864},{},[],"It's worth noting that AiTM — now the dominant phishing technique in the wild,",{"data":27217,"content":27218,"nodeType":883},{"uri":8804},[27219,27222],{"data":27220,"marks":27221,"value":1171,"nodeType":864},{},[],{"data":27223,"marks":27224,"value":27226,"nodeType":864},{},[27225],{"type":1455},"responsible for 62% of phishing blocked by Microsoft",{"data":27228,"marks":27229,"value":27230,"nodeType":864},{},[]," — shows up at just 17% in Omdia's data. That likely reflects a recognition gap rather than low prevalence: most organizations lack the browser-layer visibility to distinguish an AiTM reverse-proxy attack from a conventional phishing page, which means the real AiTM figure is probably buried inside the 40% who reported phishing generally.","Omdia report IB2",{"sys":27233,"__typename":1740,"content":27234,"name":27269,"title":59},{"id":21709},{"json":27235},{"nodeType":856,"data":27236,"content":27237},{},[27238],{"nodeType":860,"data":27239,"content":27240},{},[27241,27245,27253,27257,27265],{"nodeType":864,"value":27242,"marks":27243,"data":27244},"This is something we’re seeing extensively in the wild. Just about every phishing kit we encounter today is packed with signs of AI use. You can see our ",[],{},{"nodeType":883,"data":27246,"content":27247},{"uri":14133},[27248],{"nodeType":864,"value":27249,"marks":27250,"data":27252},"recent analysis of the Doko’s Panel real-time vishing + AitM kit",[27251],{"type":1455},{},{"nodeType":864,"value":27254,"marks":27255,"data":27256}," for one example of this. AI development of kits and tools is rapidly driving down the time for attackers to adopt and scale new capabilities — the ",[],{},{"nodeType":883,"data":27258,"content":27259},{"uri":3259},[27260],{"nodeType":864,"value":27261,"marks":27262,"data":27264},"37x increase in device code phishing in 2026",[27263],{"type":1455},{},{"nodeType":864,"value":27266,"marks":27267,"data":27268}," being another indicator of this (we've observed heavy AI tool use across multiple kits and campaigns, with the EvilTokens kit gaining particular notoriety for its abuse of the Railway platform's AI features).",[],{},"Omdia report IB3",{"items":27271},[],{},"7 things Omdia's latest report tells us about the SEB market",{"items":27275},[27276,27948,28390],{"__typename":2059,"sys":27277,"content":27278,"title":26118,"synopsis":26119,"hashTags":59,"publishedDate":21966,"slug":26120,"tagsCollection":27938,"authorsCollection":27944},{"id":25352},{"json":27279},{"data":27280,"content":27281,"nodeType":856},{},[27282,27287,27293,27299,27305,27308,27315,27321,27331,27341,27346,27352,27355,27362,27368,27373,27379,27385,27478,27484,27487,27494,27500,27555,27568,27573,27579,27582,27589,27595,27602,27608,27614,27639,27645,27652,27658,27664,27670,27677,27683,27689,27695,27698,27705,27715,27721,27727,27734,27740,27746,27753,27759,27814,27827,27842,27849,27855,27862,27868,27874,27880,27885,27892,27898,27904,27909,27915,27921,27927,27932],{"data":27283,"content":27286,"nodeType":996},{"target":27284},{"sys":27285},{"id":25361,"type":1001,"linkType":1002},[],{"data":27288,"content":27289,"nodeType":860},{},[27290],{"data":27291,"marks":27292,"value":25369,"nodeType":864},{},[],{"data":27294,"content":27295,"nodeType":860},{},[27296],{"data":27297,"marks":27298,"value":25376,"nodeType":864},{},[],{"data":27300,"content":27301,"nodeType":860},{},[27302],{"data":27303,"marks":27304,"value":25383,"nodeType":864},{},[],{"data":27306,"content":27307,"nodeType":1005},{},[],{"data":27309,"content":27310,"nodeType":1009},{},[27311],{"data":27312,"marks":27313,"value":25394,"nodeType":864},{},[27314],{"type":899},{"data":27316,"content":27317,"nodeType":860},{},[27318],{"data":27319,"marks":27320,"value":25401,"nodeType":864},{},[],{"data":27322,"content":27323,"nodeType":860},{},[27324,27328],{"data":27325,"marks":27326,"value":25409,"nodeType":864},{},[27327],{"type":899},{"data":27329,"marks":27330,"value":25413,"nodeType":864},{},[],{"data":27332,"content":27333,"nodeType":860},{},[27334,27338],{"data":27335,"marks":27336,"value":25421,"nodeType":864},{},[27337],{"type":899},{"data":27339,"marks":27340,"value":25425,"nodeType":864},{},[],{"data":27342,"content":27345,"nodeType":996},{"target":27343},{"sys":27344},{"id":21573,"type":1001,"linkType":1002},[],{"data":27347,"content":27348,"nodeType":860},{},[27349],{"data":27350,"marks":27351,"value":25437,"nodeType":864},{},[],{"data":27353,"content":27354,"nodeType":1005},{},[],{"data":27356,"content":27357,"nodeType":1009},{},[27358],{"data":27359,"marks":27360,"value":25448,"nodeType":864},{},[27361],{"type":899},{"data":27363,"content":27364,"nodeType":860},{},[27365],{"data":27366,"marks":27367,"value":25455,"nodeType":864},{},[],{"data":27369,"content":27372,"nodeType":996},{"target":27370},{"sys":27371},{"id":25460,"type":1001,"linkType":1002},[],{"data":27374,"content":27375,"nodeType":860},{},[27376],{"data":27377,"marks":27378,"value":25468,"nodeType":864},{},[],{"data":27380,"content":27381,"nodeType":860},{},[27382],{"data":27383,"marks":27384,"value":25475,"nodeType":864},{},[],{"data":27386,"content":27387,"nodeType":941},{},[27388,27404,27420,27436,27452,27465],{"data":27389,"content":27390,"nodeType":945},{},[27391],{"data":27392,"content":27393,"nodeType":860},{},[27394,27397,27401],{"data":27395,"marks":27396,"value":25488,"nodeType":864},{},[],{"data":27398,"marks":27399,"value":25493,"nodeType":864},{},[27400],{"type":899},{"data":27402,"marks":27403,"value":25497,"nodeType":864},{},[],{"data":27405,"content":27406,"nodeType":945},{},[27407],{"data":27408,"content":27409,"nodeType":860},{},[27410,27413,27417],{"data":27411,"marks":27412,"value":25507,"nodeType":864},{},[],{"data":27414,"marks":27415,"value":25512,"nodeType":864},{},[27416],{"type":899},{"data":27418,"marks":27419,"value":25516,"nodeType":864},{},[],{"data":27421,"content":27422,"nodeType":945},{},[27423],{"data":27424,"content":27425,"nodeType":860},{},[27426,27429,27433],{"data":27427,"marks":27428,"value":25526,"nodeType":864},{},[],{"data":27430,"marks":27431,"value":25531,"nodeType":864},{},[27432],{"type":899},{"data":27434,"marks":27435,"value":25535,"nodeType":864},{},[],{"data":27437,"content":27438,"nodeType":945},{},[27439],{"data":27440,"content":27441,"nodeType":860},{},[27442,27445,27449],{"data":27443,"marks":27444,"value":25545,"nodeType":864},{},[],{"data":27446,"marks":27447,"value":25550,"nodeType":864},{},[27448],{"type":899},{"data":27450,"marks":27451,"value":25554,"nodeType":864},{},[],{"data":27453,"content":27454,"nodeType":945},{},[27455],{"data":27456,"content":27457,"nodeType":860},{},[27458,27462],{"data":27459,"marks":27460,"value":25565,"nodeType":864},{},[27461],{"type":899},{"data":27463,"marks":27464,"value":25569,"nodeType":864},{},[],{"data":27466,"content":27467,"nodeType":945},{},[27468],{"data":27469,"content":27470,"nodeType":860},{},[27471,27475],{"data":27472,"marks":27473,"value":25580,"nodeType":864},{},[27474],{"type":899},{"data":27476,"marks":27477,"value":25584,"nodeType":864},{},[],{"data":27479,"content":27480,"nodeType":860},{},[27481],{"data":27482,"marks":27483,"value":25591,"nodeType":864},{},[],{"data":27485,"content":27486,"nodeType":1005},{},[],{"data":27488,"content":27489,"nodeType":1312},{},[27490],{"data":27491,"marks":27492,"value":25602,"nodeType":864},{},[27493],{"type":899},{"data":27495,"content":27496,"nodeType":860},{},[27497],{"data":27498,"marks":27499,"value":25609,"nodeType":864},{},[],{"data":27501,"content":27502,"nodeType":941},{},[27503,27516,27529,27542],{"data":27504,"content":27505,"nodeType":945},{},[27506],{"data":27507,"content":27508,"nodeType":860},{},[27509,27512],{"data":27510,"marks":27511,"value":25622,"nodeType":864},{},[],{"data":27513,"marks":27514,"value":25627,"nodeType":864},{},[27515],{"type":899},{"data":27517,"content":27518,"nodeType":945},{},[27519],{"data":27520,"content":27521,"nodeType":860},{},[27522,27525],{"data":27523,"marks":27524,"value":25637,"nodeType":864},{},[],{"data":27526,"marks":27527,"value":25642,"nodeType":864},{},[27528],{"type":899},{"data":27530,"content":27531,"nodeType":945},{},[27532],{"data":27533,"content":27534,"nodeType":860},{},[27535,27538],{"data":27536,"marks":27537,"value":25652,"nodeType":864},{},[],{"data":27539,"marks":27540,"value":25657,"nodeType":864},{},[27541],{"type":899},{"data":27543,"content":27544,"nodeType":945},{},[27545],{"data":27546,"content":27547,"nodeType":860},{},[27548,27551],{"data":27549,"marks":27550,"value":25667,"nodeType":864},{},[],{"data":27552,"marks":27553,"value":25672,"nodeType":864},{},[27554],{"type":899},{"data":27556,"content":27557,"nodeType":860},{},[27558,27561,27565],{"data":27559,"marks":27560,"value":25679,"nodeType":864},{},[],{"data":27562,"marks":27563,"value":25684,"nodeType":864},{},[27564],{"type":899},{"data":27566,"marks":27567,"value":25688,"nodeType":864},{},[],{"data":27569,"content":27572,"nodeType":996},{"target":27570},{"sys":27571},{"id":25693,"type":1001,"linkType":1002},[],{"data":27574,"content":27575,"nodeType":860},{},[27576],{"data":27577,"marks":27578,"value":25701,"nodeType":864},{},[],{"data":27580,"content":27581,"nodeType":1005},{},[],{"data":27583,"content":27584,"nodeType":1009},{},[27585],{"data":27586,"marks":27587,"value":25712,"nodeType":864},{},[27588],{"type":899},{"data":27590,"content":27591,"nodeType":860},{},[27592],{"data":27593,"marks":27594,"value":25719,"nodeType":864},{},[],{"data":27596,"content":27597,"nodeType":1312},{},[27598],{"data":27599,"marks":27600,"value":25727,"nodeType":864},{},[27601],{"type":899},{"data":27603,"content":27604,"nodeType":860},{},[27605],{"data":27606,"marks":27607,"value":25734,"nodeType":864},{},[],{"data":27609,"content":27610,"nodeType":860},{},[27611],{"data":27612,"marks":27613,"value":25741,"nodeType":864},{},[],{"data":27615,"content":27616,"nodeType":860},{},[27617,27620,27626,27629,27636],{"data":27618,"marks":27619,"value":25748,"nodeType":864},{},[],{"data":27621,"content":27622,"nodeType":883},{"uri":2561},[27623],{"data":27624,"marks":27625,"value":25755,"nodeType":864},{},[],{"data":27627,"marks":27628,"value":25759,"nodeType":864},{},[],{"data":27630,"content":27631,"nodeType":883},{"uri":18212},[27632],{"data":27633,"marks":27634,"value":25767,"nodeType":864},{},[27635],{"type":1455},{"data":27637,"marks":27638,"value":25771,"nodeType":864},{},[],{"data":27640,"content":27641,"nodeType":860},{},[27642],{"data":27643,"marks":27644,"value":25778,"nodeType":864},{},[],{"data":27646,"content":27647,"nodeType":1312},{},[27648],{"data":27649,"marks":27650,"value":25786,"nodeType":864},{},[27651],{"type":899},{"data":27653,"content":27654,"nodeType":860},{},[27655],{"data":27656,"marks":27657,"value":25793,"nodeType":864},{},[],{"data":27659,"content":27660,"nodeType":860},{},[27661],{"data":27662,"marks":27663,"value":25800,"nodeType":864},{},[],{"data":27665,"content":27666,"nodeType":860},{},[27667],{"data":27668,"marks":27669,"value":25807,"nodeType":864},{},[],{"data":27671,"content":27672,"nodeType":1312},{},[27673],{"data":27674,"marks":27675,"value":25815,"nodeType":864},{},[27676],{"type":899},{"data":27678,"content":27679,"nodeType":860},{},[27680],{"data":27681,"marks":27682,"value":25822,"nodeType":864},{},[],{"data":27684,"content":27685,"nodeType":860},{},[27686],{"data":27687,"marks":27688,"value":25829,"nodeType":864},{},[],{"data":27690,"content":27691,"nodeType":860},{},[27692],{"data":27693,"marks":27694,"value":25836,"nodeType":864},{},[],{"data":27696,"content":27697,"nodeType":1005},{},[],{"data":27699,"content":27700,"nodeType":1009},{},[27701],{"data":27702,"marks":27703,"value":25847,"nodeType":864},{},[27704],{"type":899},{"data":27706,"content":27707,"nodeType":860},{},[27708,27712],{"data":27709,"marks":27710,"value":25855,"nodeType":864},{},[27711],{"type":899},{"data":27713,"marks":27714,"value":25859,"nodeType":864},{},[],{"data":27716,"content":27717,"nodeType":860},{},[27718],{"data":27719,"marks":27720,"value":25866,"nodeType":864},{},[],{"data":27722,"content":27723,"nodeType":860},{},[27724],{"data":27725,"marks":27726,"value":25873,"nodeType":864},{},[],{"data":27728,"content":27729,"nodeType":1312},{},[27730],{"data":27731,"marks":27732,"value":25881,"nodeType":864},{},[27733],{"type":899},{"data":27735,"content":27736,"nodeType":860},{},[27737],{"data":27738,"marks":27739,"value":25888,"nodeType":864},{},[],{"data":27741,"content":27742,"nodeType":860},{},[27743],{"data":27744,"marks":27745,"value":25895,"nodeType":864},{},[],{"data":27747,"content":27748,"nodeType":1312},{},[27749],{"data":27750,"marks":27751,"value":25903,"nodeType":864},{},[27752],{"type":899},{"data":27754,"content":27755,"nodeType":860},{},[27756],{"data":27757,"marks":27758,"value":25910,"nodeType":864},{},[],{"data":27760,"content":27761,"nodeType":941},{},[27762,27775,27788,27801],{"data":27763,"content":27764,"nodeType":945},{},[27765],{"data":27766,"content":27767,"nodeType":860},{},[27768,27772],{"data":27769,"marks":27770,"value":25924,"nodeType":864},{},[27771],{"type":899},{"data":27773,"marks":27774,"value":25928,"nodeType":864},{},[],{"data":27776,"content":27777,"nodeType":945},{},[27778],{"data":27779,"content":27780,"nodeType":860},{},[27781,27785],{"data":27782,"marks":27783,"value":25939,"nodeType":864},{},[27784],{"type":899},{"data":27786,"marks":27787,"value":25943,"nodeType":864},{},[],{"data":27789,"content":27790,"nodeType":945},{},[27791],{"data":27792,"content":27793,"nodeType":860},{},[27794,27798],{"data":27795,"marks":27796,"value":25954,"nodeType":864},{},[27797],{"type":899},{"data":27799,"marks":27800,"value":25958,"nodeType":864},{},[],{"data":27802,"content":27803,"nodeType":945},{},[27804],{"data":27805,"content":27806,"nodeType":860},{},[27807,27811],{"data":27808,"marks":27809,"value":25969,"nodeType":864},{},[27810],{"type":899},{"data":27812,"marks":27813,"value":25973,"nodeType":864},{},[],{"data":27815,"content":27816,"nodeType":860},{},[27817,27820,27824],{"data":27818,"marks":27819,"value":25980,"nodeType":864},{},[],{"data":27821,"marks":27822,"value":25985,"nodeType":864},{},[27823],{"type":899},{"data":27825,"marks":27826,"value":25989,"nodeType":864},{},[],{"data":27828,"content":27829,"nodeType":860},{},[27830,27833,27839],{"data":27831,"marks":27832,"value":25996,"nodeType":864},{},[],{"data":27834,"content":27835,"nodeType":883},{"uri":3210},[27836],{"data":27837,"marks":27838,"value":26003,"nodeType":864},{},[],{"data":27840,"marks":27841,"value":26007,"nodeType":864},{},[],{"data":27843,"content":27844,"nodeType":1312},{},[27845],{"data":27846,"marks":27847,"value":26015,"nodeType":864},{},[27848],{"type":899},{"data":27850,"content":27851,"nodeType":860},{},[27852],{"data":27853,"marks":27854,"value":26022,"nodeType":864},{},[],{"data":27856,"content":27857,"nodeType":860},{},[27858],{"data":27859,"marks":27860,"value":26030,"nodeType":864},{},[27861],{"type":899},{"data":27863,"content":27864,"nodeType":860},{},[27865],{"data":27866,"marks":27867,"value":26037,"nodeType":864},{},[],{"data":27869,"content":27870,"nodeType":860},{},[27871],{"data":27872,"marks":27873,"value":26044,"nodeType":864},{},[],{"data":27875,"content":27876,"nodeType":860},{},[27877],{"data":27878,"marks":27879,"value":26051,"nodeType":864},{},[],{"data":27881,"content":27884,"nodeType":996},{"target":27882},{"sys":27883},{"id":26056,"type":1001,"linkType":1002},[],{"data":27886,"content":27887,"nodeType":1312},{},[27888],{"data":27889,"marks":27890,"value":26065,"nodeType":864},{},[27891],{"type":899},{"data":27893,"content":27894,"nodeType":860},{},[27895],{"data":27896,"marks":27897,"value":26072,"nodeType":864},{},[],{"data":27899,"content":27900,"nodeType":860},{},[27901],{"data":27902,"marks":27903,"value":26079,"nodeType":864},{},[],{"data":27905,"content":27908,"nodeType":996},{"target":27906},{"sys":27907},{"id":12852,"type":1001,"linkType":1002},[],{"data":27910,"content":27911,"nodeType":860},{},[27912],{"data":27913,"marks":27914,"value":26091,"nodeType":864},{},[],{"data":27916,"content":27917,"nodeType":860},{},[27918],{"data":27919,"marks":27920,"value":26098,"nodeType":864},{},[],{"data":27922,"content":27923,"nodeType":860},{},[27924],{"data":27925,"marks":27926,"value":26105,"nodeType":864},{},[],{"data":27928,"content":27931,"nodeType":996},{"target":27929},{"sys":27930},{"id":26110,"type":1001,"linkType":1002},[],{"data":27933,"content":27934,"nodeType":860},{},[27935],{"data":27936,"marks":27937,"value":21,"nodeType":864},{},[],{"items":27939},[27940,27942],{"sys":27941,"name":297},{"id":2732},{"sys":27943,"name":2729},{"id":2728},{"items":27945},[27946],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":27947},{"url":4881},{"__typename":2059,"sys":27949,"content":27950,"title":23465,"synopsis":23466,"hashTags":59,"publishedDate":23467,"slug":23468,"tagsCollection":28380,"authorsCollection":28386},{"id":22959},{"json":27951},{"data":27952,"content":27953,"nodeType":856},{},[27954,27961,27985,27990,27996,28011,28024,28027,28034,28047,28063,28083,28088,28101,28125,28130,28135,28148,28151,28158,28164,28171,28187,28200,28207,28229,28235,28242,28266,28272,28279,28285,28290,28293,28300,28306,28313,28318,28321,28328,28334,28340,28346,28356,28359,28365],{"data":27955,"content":27956,"nodeType":1009},{},[27957],{"data":27958,"marks":27959,"value":22971,"nodeType":864},{},[27960],{"type":899},{"data":27962,"content":27963,"nodeType":860},{},[27964,27967,27973,27976,27982],{"data":27965,"marks":27966,"value":22978,"nodeType":864},{},[],{"data":27968,"content":27969,"nodeType":883},{"uri":22981},[27970],{"data":27971,"marks":27972,"value":22986,"nodeType":864},{},[],{"data":27974,"marks":27975,"value":22990,"nodeType":864},{},[],{"data":27977,"content":27978,"nodeType":883},{"uri":22993},[27979],{"data":27980,"marks":27981,"value":22998,"nodeType":864},{},[],{"data":27983,"marks":27984,"value":23002,"nodeType":864},{},[],{"data":27986,"content":27989,"nodeType":996},{"target":27987},{"sys":27988},{"id":23007,"type":1001,"linkType":1002},[],{"data":27991,"content":27992,"nodeType":860},{},[27993],{"data":27994,"marks":27995,"value":23015,"nodeType":864},{},[],{"data":27997,"content":27998,"nodeType":860},{},[27999,28002,28008],{"data":28000,"marks":28001,"value":23022,"nodeType":864},{},[],{"data":28003,"content":28004,"nodeType":883},{"uri":23025},[28005],{"data":28006,"marks":28007,"value":23030,"nodeType":864},{},[],{"data":28009,"marks":28010,"value":23034,"nodeType":864},{},[],{"data":28012,"content":28013,"nodeType":860},{},[28014,28017,28021],{"data":28015,"marks":28016,"value":23041,"nodeType":864},{},[],{"data":28018,"marks":28019,"value":23046,"nodeType":864},{},[28020],{"type":899},{"data":28022,"marks":28023,"value":2924,"nodeType":864},{},[],{"data":28025,"content":28026,"nodeType":1005},{},[],{"data":28028,"content":28029,"nodeType":1009},{},[28030],{"data":28031,"marks":28032,"value":23060,"nodeType":864},{},[28033],{"type":899},{"data":28035,"content":28036,"nodeType":860},{},[28037,28040,28044],{"data":28038,"marks":28039,"value":23067,"nodeType":864},{},[],{"data":28041,"marks":28042,"value":23072,"nodeType":864},{},[28043],{"type":2246},{"data":28045,"marks":28046,"value":2924,"nodeType":864},{},[],{"data":28048,"content":28049,"nodeType":860},{},[28050,28053,28060],{"data":28051,"marks":28052,"value":23082,"nodeType":864},{},[],{"data":28054,"content":28055,"nodeType":883},{"uri":8804},[28056],{"data":28057,"marks":28058,"value":23090,"nodeType":864},{},[28059],{"type":1455},{"data":28061,"marks":28062,"value":23094,"nodeType":864},{},[],{"data":28064,"content":28065,"nodeType":860},{},[28066,28069,28073,28076,28080],{"data":28067,"marks":28068,"value":23101,"nodeType":864},{},[],{"data":28070,"marks":28071,"value":23106,"nodeType":864},{},[28072],{"type":899},{"data":28074,"marks":28075,"value":23110,"nodeType":864},{},[],{"data":28077,"marks":28078,"value":23115,"nodeType":864},{},[28079],{"type":2246},{"data":28081,"marks":28082,"value":23119,"nodeType":864},{},[],{"data":28084,"content":28087,"nodeType":996},{"target":28085},{"sys":28086},{"id":23124,"type":1001,"linkType":1002},[],{"data":28089,"content":28090,"nodeType":860},{},[28091,28094,28098],{"data":28092,"marks":28093,"value":23132,"nodeType":864},{},[],{"data":28095,"marks":28096,"value":23137,"nodeType":864},{},[28097],{"type":899},{"data":28099,"marks":28100,"value":23141,"nodeType":864},{},[],{"data":28102,"content":28103,"nodeType":860},{},[28104,28107,28113,28116,28122],{"data":28105,"marks":28106,"value":23148,"nodeType":864},{},[],{"data":28108,"content":28109,"nodeType":883},{"uri":23151},[28110],{"data":28111,"marks":28112,"value":23156,"nodeType":864},{},[],{"data":28114,"marks":28115,"value":23160,"nodeType":864},{},[],{"data":28117,"content":28118,"nodeType":883},{"uri":13067},[28119],{"data":28120,"marks":28121,"value":23167,"nodeType":864},{},[],{"data":28123,"marks":28124,"value":1774,"nodeType":864},{},[],{"data":28126,"content":28129,"nodeType":996},{"target":28127},{"sys":28128},{"id":23175,"type":1001,"linkType":1002},[],{"data":28131,"content":28134,"nodeType":996},{"target":28132},{"sys":28133},{"id":23181,"type":1001,"linkType":1002},[],{"data":28136,"content":28137,"nodeType":860},{},[28138,28141,28145],{"data":28139,"marks":28140,"value":23189,"nodeType":864},{},[],{"data":28142,"marks":28143,"value":23194,"nodeType":864},{},[28144],{"type":899},{"data":28146,"marks":28147,"value":23198,"nodeType":864},{},[],{"data":28149,"content":28150,"nodeType":1005},{},[],{"data":28152,"content":28153,"nodeType":1009},{},[28154],{"data":28155,"marks":28156,"value":23209,"nodeType":864},{},[28157],{"type":899},{"data":28159,"content":28160,"nodeType":860},{},[28161],{"data":28162,"marks":28163,"value":23216,"nodeType":864},{},[],{"data":28165,"content":28166,"nodeType":1312},{},[28167],{"data":28168,"marks":28169,"value":23224,"nodeType":864},{},[28170],{"type":899},{"data":28172,"content":28173,"nodeType":860},{},[28174,28177,28184],{"data":28175,"marks":28176,"value":21,"nodeType":864},{},[],{"data":28178,"content":28179,"nodeType":883},{"uri":4103},[28180],{"data":28181,"marks":28182,"value":23238,"nodeType":864},{},[28183],{"type":1455},{"data":28185,"marks":28186,"value":23242,"nodeType":864},{},[],{"data":28188,"content":28189,"nodeType":860},{},[28190,28193,28197],{"data":28191,"marks":28192,"value":23249,"nodeType":864},{},[],{"data":28194,"marks":28195,"value":23254,"nodeType":864},{},[28196],{"type":899},{"data":28198,"marks":28199,"value":23258,"nodeType":864},{},[],{"data":28201,"content":28202,"nodeType":1312},{},[28203],{"data":28204,"marks":28205,"value":288,"nodeType":864},{},[28206],{"type":899},{"data":28208,"content":28209,"nodeType":860},{},[28210,28214,28222,28226],{"data":28211,"marks":28212,"value":21,"nodeType":864},{},[28213],{"type":899},{"data":28215,"content":28216,"nodeType":883},{"uri":2411},[28217],{"data":28218,"marks":28219,"value":23281,"nodeType":864},{},[28220,28221],{"type":1455},{"type":899},{"data":28223,"marks":28224,"value":23286,"nodeType":864},{},[28225],{"type":899},{"data":28227,"marks":28228,"value":23290,"nodeType":864},{},[],{"data":28230,"content":28231,"nodeType":860},{},[28232],{"data":28233,"marks":28234,"value":23297,"nodeType":864},{},[],{"data":28236,"content":28237,"nodeType":1312},{},[28238],{"data":28239,"marks":28240,"value":23305,"nodeType":864},{},[28241],{"type":899},{"data":28243,"content":28244,"nodeType":860},{},[28245,28248,28254,28257,28263],{"data":28246,"marks":28247,"value":23312,"nodeType":864},{},[],{"data":28249,"content":28250,"nodeType":883},{"uri":14681},[28251],{"data":28252,"marks":28253,"value":23319,"nodeType":864},{},[],{"data":28255,"marks":28256,"value":23323,"nodeType":864},{},[],{"data":28258,"content":28259,"nodeType":883},{"uri":3237},[28260],{"data":28261,"marks":28262,"value":23330,"nodeType":864},{},[],{"data":28264,"marks":28265,"value":23334,"nodeType":864},{},[],{"data":28267,"content":28268,"nodeType":860},{},[28269],{"data":28270,"marks":28271,"value":23341,"nodeType":864},{},[],{"data":28273,"content":28274,"nodeType":1312},{},[28275],{"data":28276,"marks":28277,"value":23349,"nodeType":864},{},[28278],{"type":899},{"data":28280,"content":28281,"nodeType":860},{},[28282],{"data":28283,"marks":28284,"value":23356,"nodeType":864},{},[],{"data":28286,"content":28289,"nodeType":996},{"target":28287},{"sys":28288},{"id":23361,"type":1001,"linkType":1002},[],{"data":28291,"content":28292,"nodeType":1005},{},[],{"data":28294,"content":28295,"nodeType":1009},{},[28296],{"data":28297,"marks":28298,"value":23373,"nodeType":864},{},[28299],{"type":899},{"data":28301,"content":28302,"nodeType":860},{},[28303],{"data":28304,"marks":28305,"value":23380,"nodeType":864},{},[],{"data":28307,"content":28308,"nodeType":860},{},[28309],{"data":28310,"marks":28311,"value":23388,"nodeType":864},{},[28312],{"type":899},{"data":28314,"content":28317,"nodeType":996},{"target":28315},{"sys":28316},{"id":23393,"type":1001,"linkType":1002},[],{"data":28319,"content":28320,"nodeType":1005},{},[],{"data":28322,"content":28323,"nodeType":1312},{},[28324],{"data":28325,"marks":28326,"value":23405,"nodeType":864},{},[28327],{"type":899},{"data":28329,"content":28330,"nodeType":860},{},[28331],{"data":28332,"marks":28333,"value":23412,"nodeType":864},{},[],{"data":28335,"content":28336,"nodeType":860},{},[28337],{"data":28338,"marks":28339,"value":23419,"nodeType":864},{},[],{"data":28341,"content":28342,"nodeType":860},{},[28343],{"data":28344,"marks":28345,"value":23426,"nodeType":864},{},[],{"data":28347,"content":28348,"nodeType":860},{},[28349,28353],{"data":28350,"marks":28351,"value":23434,"nodeType":864},{},[28352],{"type":899},{"data":28354,"marks":28355,"value":23438,"nodeType":864},{},[],{"data":28357,"content":28358,"nodeType":1005},{},[],{"data":28360,"content":28361,"nodeType":860},{},[28362],{"data":28363,"marks":28364,"value":4855,"nodeType":864},{},[],{"data":28366,"content":28367,"nodeType":860},{},[28368,28371,28377],{"data":28369,"marks":28370,"value":23454,"nodeType":864},{},[],{"data":28372,"content":28373,"nodeType":883},{"uri":23457},[28374],{"data":28375,"marks":28376,"value":15017,"nodeType":864},{},[],{"data":28378,"marks":28379,"value":2719,"nodeType":864},{},[],{"items":28381},[28382,28384],{"sys":28383,"name":2729},{"id":2728},{"sys":28385,"name":342},{"id":15029},{"items":28387},[28388],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":28389},{"url":3625},{"__typename":2059,"sys":28391,"content":28392,"title":22943,"synopsis":22944,"hashTags":59,"publishedDate":22945,"slug":22946,"tagsCollection":29213,"authorsCollection":29219},{"id":21980},{"json":28393},{"data":28394,"content":28395,"nodeType":856},{},[28396,28418,28442,28475,28508,28513,28523,28526,28533,28575,28581,28600,28605,28608,28615,28639,28645,28652,28657,28660,28667,28673,28688,28694,28727,28733,28736,28743,28758,28800,28803,28810,28825,28840,28847,28853,28863,28873,28883,28893,28908,28915,28921,28924,28930,28936,28951,28954,28961,28976,29207],{"data":28397,"content":28398,"nodeType":860},{},[28399,28402,28408,28411,28415],{"data":28400,"marks":28401,"value":21991,"nodeType":864},{},[],{"data":28403,"content":28404,"nodeType":883},{"uri":18024},[28405],{"data":28406,"marks":28407,"value":18027,"nodeType":864},{},[],{"data":28409,"marks":28410,"value":22001,"nodeType":864},{},[],{"data":28412,"marks":28413,"value":22006,"nodeType":864},{},[28414],{"type":899},{"data":28416,"marks":28417,"value":22010,"nodeType":864},{},[],{"data":28419,"content":28420,"nodeType":860},{},[28421,28424,28430,28433,28439],{"data":28422,"marks":28423,"value":22017,"nodeType":864},{},[],{"data":28425,"content":28426,"nodeType":883},{"uri":22020},[28427],{"data":28428,"marks":28429,"value":22025,"nodeType":864},{},[],{"data":28431,"marks":28432,"value":22029,"nodeType":864},{},[],{"data":28434,"content":28435,"nodeType":883},{"uri":22032},[28436],{"data":28437,"marks":28438,"value":22037,"nodeType":864},{},[],{"data":28440,"marks":28441,"value":22041,"nodeType":864},{},[],{"data":28443,"content":28444,"nodeType":860},{},[28445,28448,28454,28457,28463,28466,28472],{"data":28446,"marks":28447,"value":22048,"nodeType":864},{},[],{"data":28449,"content":28450,"nodeType":883},{"uri":22051},[28451],{"data":28452,"marks":28453,"value":22056,"nodeType":864},{},[],{"data":28455,"marks":28456,"value":22060,"nodeType":864},{},[],{"data":28458,"content":28459,"nodeType":883},{"uri":22063},[28460],{"data":28461,"marks":28462,"value":22068,"nodeType":864},{},[],{"data":28464,"marks":28465,"value":22072,"nodeType":864},{},[],{"data":28467,"content":28468,"nodeType":883},{"uri":18562},[28469],{"data":28470,"marks":28471,"value":22079,"nodeType":864},{},[],{"data":28473,"marks":28474,"value":22083,"nodeType":864},{},[],{"data":28476,"content":28477,"nodeType":860},{},[28478,28481,28487,28490,28496,28499,28505],{"data":28479,"marks":28480,"value":22090,"nodeType":864},{},[],{"data":28482,"content":28483,"nodeType":883},{"uri":22093},[28484],{"data":28485,"marks":28486,"value":22098,"nodeType":864},{},[],{"data":28488,"marks":28489,"value":22102,"nodeType":864},{},[],{"data":28491,"content":28492,"nodeType":883},{"uri":22105},[28493],{"data":28494,"marks":28495,"value":22110,"nodeType":864},{},[],{"data":28497,"marks":28498,"value":22114,"nodeType":864},{},[],{"data":28500,"content":28501,"nodeType":883},{"uri":22117},[28502],{"data":28503,"marks":28504,"value":22122,"nodeType":864},{},[],{"data":28506,"marks":28507,"value":22126,"nodeType":864},{},[],{"data":28509,"content":28512,"nodeType":996},{"target":28510},{"sys":28511},{"id":22131,"type":1001,"linkType":1002},[],{"data":28514,"content":28515,"nodeType":860},{},[28516,28520],{"data":28517,"marks":28518,"value":22140,"nodeType":864},{},[28519],{"type":899},{"data":28521,"marks":28522,"value":22144,"nodeType":864},{},[],{"data":28524,"content":28525,"nodeType":1005},{},[],{"data":28527,"content":28528,"nodeType":1009},{},[28529],{"data":28530,"marks":28531,"value":22155,"nodeType":864},{},[28532],{"type":899},{"data":28534,"content":28535,"nodeType":860},{},[28536,28539,28545,28548,28554,28557,28563,28566,28572],{"data":28537,"marks":28538,"value":22162,"nodeType":864},{},[],{"data":28540,"content":28541,"nodeType":883},{"uri":22165},[28542],{"data":28543,"marks":28544,"value":22170,"nodeType":864},{},[],{"data":28546,"marks":28547,"value":12989,"nodeType":864},{},[],{"data":28549,"content":28550,"nodeType":883},{"uri":22176},[28551],{"data":28552,"marks":28553,"value":22181,"nodeType":864},{},[],{"data":28555,"marks":28556,"value":22185,"nodeType":864},{},[],{"data":28558,"content":28559,"nodeType":883},{"uri":22063},[28560],{"data":28561,"marks":28562,"value":22192,"nodeType":864},{},[],{"data":28564,"marks":28565,"value":22196,"nodeType":864},{},[],{"data":28567,"content":28568,"nodeType":883},{"uri":14133},[28569],{"data":28570,"marks":28571,"value":22203,"nodeType":864},{},[],{"data":28573,"marks":28574,"value":2924,"nodeType":864},{},[],{"data":28576,"content":28577,"nodeType":860},{},[28578],{"data":28579,"marks":28580,"value":22213,"nodeType":864},{},[],{"data":28582,"content":28583,"nodeType":860},{},[28584,28587,28593,28596],{"data":28585,"marks":28586,"value":22220,"nodeType":864},{},[],{"data":28588,"content":28589,"nodeType":883},{"uri":14133},[28590],{"data":28591,"marks":28592,"value":22227,"nodeType":864},{},[],{"data":28594,"marks":28595,"value":22231,"nodeType":864},{},[],{"data":28597,"marks":28598,"value":22236,"nodeType":864},{},[28599],{"type":899},{"data":28601,"content":28604,"nodeType":996},{"target":28602},{"sys":28603},{"id":22241,"type":1001,"linkType":1002},[],{"data":28606,"content":28607,"nodeType":1005},{},[],{"data":28609,"content":28610,"nodeType":1009},{},[28611],{"data":28612,"marks":28613,"value":22253,"nodeType":864},{},[28614],{"type":899},{"data":28616,"content":28617,"nodeType":860},{},[28618,28621,28627,28630,28636],{"data":28619,"marks":28620,"value":2761,"nodeType":864},{},[],{"data":28622,"content":28623,"nodeType":883},{"uri":22262},[28624],{"data":28625,"marks":28626,"value":22267,"nodeType":864},{},[],{"data":28628,"marks":28629,"value":22271,"nodeType":864},{},[],{"data":28631,"content":28632,"nodeType":883},{"uri":18562},[28633],{"data":28634,"marks":28635,"value":22278,"nodeType":864},{},[],{"data":28637,"marks":28638,"value":22282,"nodeType":864},{},[],{"data":28640,"content":28641,"nodeType":860},{},[28642],{"data":28643,"marks":28644,"value":22289,"nodeType":864},{},[],{"data":28646,"content":28647,"nodeType":860},{},[28648],{"data":28649,"marks":28650,"value":22297,"nodeType":864},{},[28651],{"type":899},{"data":28653,"content":28656,"nodeType":996},{"target":28654},{"sys":28655},{"id":22302,"type":1001,"linkType":1002},[],{"data":28658,"content":28659,"nodeType":1005},{},[],{"data":28661,"content":28662,"nodeType":1009},{},[28663],{"data":28664,"marks":28665,"value":22314,"nodeType":864},{},[28666],{"type":899},{"data":28668,"content":28669,"nodeType":860},{},[28670],{"data":28671,"marks":28672,"value":22321,"nodeType":864},{},[],{"data":28674,"content":28675,"nodeType":860},{},[28676,28679,28685],{"data":28677,"marks":28678,"value":2761,"nodeType":864},{},[],{"data":28680,"content":28681,"nodeType":883},{"uri":22330},[28682],{"data":28683,"marks":28684,"value":22335,"nodeType":864},{},[],{"data":28686,"marks":28687,"value":22339,"nodeType":864},{},[],{"data":28689,"content":28690,"nodeType":860},{},[28691],{"data":28692,"marks":28693,"value":22346,"nodeType":864},{},[],{"data":28695,"content":28696,"nodeType":860},{},[28697,28700,28706,28709,28715,28718,28724],{"data":28698,"marks":28699,"value":22353,"nodeType":864},{},[],{"data":28701,"content":28702,"nodeType":883},{"uri":22356},[28703],{"data":28704,"marks":28705,"value":22361,"nodeType":864},{},[],{"data":28707,"marks":28708,"value":22365,"nodeType":864},{},[],{"data":28710,"content":28711,"nodeType":883},{"uri":22368},[28712],{"data":28713,"marks":28714,"value":22373,"nodeType":864},{},[],{"data":28716,"marks":28717,"value":22377,"nodeType":864},{},[],{"data":28719,"content":28720,"nodeType":883},{"uri":4103},[28721],{"data":28722,"marks":28723,"value":18123,"nodeType":864},{},[],{"data":28725,"marks":28726,"value":22387,"nodeType":864},{},[],{"data":28728,"content":28729,"nodeType":860},{},[28730],{"data":28731,"marks":28732,"value":22394,"nodeType":864},{},[],{"data":28734,"content":28735,"nodeType":1005},{},[],{"data":28737,"content":28738,"nodeType":1009},{},[28739],{"data":28740,"marks":28741,"value":22405,"nodeType":864},{},[28742],{"type":899},{"data":28744,"content":28745,"nodeType":860},{},[28746,28749,28755],{"data":28747,"marks":28748,"value":22412,"nodeType":864},{},[],{"data":28750,"content":28751,"nodeType":883},{"uri":22415},[28752],{"data":28753,"marks":28754,"value":22420,"nodeType":864},{},[],{"data":28756,"marks":28757,"value":22424,"nodeType":864},{},[],{"data":28759,"content":28760,"nodeType":860},{},[28761,28764,28770,28773,28779,28782,28788,28791,28797],{"data":28762,"marks":28763,"value":22431,"nodeType":864},{},[],{"data":28765,"content":28766,"nodeType":883},{"uri":22434},[28767],{"data":28768,"marks":28769,"value":22439,"nodeType":864},{},[],{"data":28771,"marks":28772,"value":22443,"nodeType":864},{},[],{"data":28774,"content":28775,"nodeType":883},{"uri":22446},[28776],{"data":28777,"marks":28778,"value":22451,"nodeType":864},{},[],{"data":28780,"marks":28781,"value":22455,"nodeType":864},{},[],{"data":28783,"content":28784,"nodeType":883},{"uri":22458},[28785],{"data":28786,"marks":28787,"value":22463,"nodeType":864},{},[],{"data":28789,"marks":28790,"value":22467,"nodeType":864},{},[],{"data":28792,"content":28793,"nodeType":883},{"uri":22470},[28794],{"data":28795,"marks":28796,"value":22475,"nodeType":864},{},[],{"data":28798,"marks":28799,"value":22479,"nodeType":864},{},[],{"data":28801,"content":28802,"nodeType":1005},{},[],{"data":28804,"content":28805,"nodeType":1009},{},[28806],{"data":28807,"marks":28808,"value":22490,"nodeType":864},{},[28809],{"type":899},{"data":28811,"content":28812,"nodeType":860},{},[28813,28816,28822],{"data":28814,"marks":28815,"value":22497,"nodeType":864},{},[],{"data":28817,"content":28818,"nodeType":883},{"uri":3259},[28819],{"data":28820,"marks":28821,"value":22504,"nodeType":864},{},[],{"data":28823,"marks":28824,"value":22508,"nodeType":864},{},[],{"data":28826,"content":28827,"nodeType":860},{},[28828,28831,28837],{"data":28829,"marks":28830,"value":22515,"nodeType":864},{},[],{"data":28832,"content":28833,"nodeType":883},{"uri":22518},[28834],{"data":28835,"marks":28836,"value":315,"nodeType":864},{},[],{"data":28838,"marks":28839,"value":22526,"nodeType":864},{},[],{"data":28841,"content":28842,"nodeType":1312},{},[28843],{"data":28844,"marks":28845,"value":8788,"nodeType":864},{},[28846],{"type":899},{"data":28848,"content":28849,"nodeType":860},{},[28850],{"data":28851,"marks":28852,"value":22540,"nodeType":864},{},[],{"data":28854,"content":28855,"nodeType":860},{},[28856,28860],{"data":28857,"marks":28858,"value":22548,"nodeType":864},{},[28859],{"type":899},{"data":28861,"marks":28862,"value":22552,"nodeType":864},{},[],{"data":28864,"content":28865,"nodeType":860},{},[28866,28870],{"data":28867,"marks":28868,"value":22560,"nodeType":864},{},[28869],{"type":899},{"data":28871,"marks":28872,"value":22564,"nodeType":864},{},[],{"data":28874,"content":28875,"nodeType":860},{},[28876,28880],{"data":28877,"marks":28878,"value":22572,"nodeType":864},{},[28879],{"type":899},{"data":28881,"marks":28882,"value":22576,"nodeType":864},{},[],{"data":28884,"content":28885,"nodeType":860},{},[28886,28890],{"data":28887,"marks":28888,"value":22584,"nodeType":864},{},[28889],{"type":899},{"data":28891,"marks":28892,"value":22588,"nodeType":864},{},[],{"data":28894,"content":28895,"nodeType":860},{},[28896,28899,28905],{"data":28897,"marks":28898,"value":21,"nodeType":864},{},[],{"data":28900,"content":28901,"nodeType":883},{"uri":22597},[28902],{"data":28903,"marks":28904,"value":22602,"nodeType":864},{},[],{"data":28906,"marks":28907,"value":21,"nodeType":864},{},[],{"data":28909,"content":28910,"nodeType":1312},{},[28911],{"data":28912,"marks":28913,"value":22613,"nodeType":864},{},[28914],{"type":899},{"data":28916,"content":28917,"nodeType":860},{},[28918],{"data":28919,"marks":28920,"value":22620,"nodeType":864},{},[],{"data":28922,"content":28923,"nodeType":1005},{},[],{"data":28925,"content":28926,"nodeType":860},{},[28927],{"data":28928,"marks":28929,"value":4855,"nodeType":864},{},[],{"data":28931,"content":28932,"nodeType":860},{},[28933],{"data":28934,"marks":28935,"value":1689,"nodeType":864},{},[],{"data":28937,"content":28938,"nodeType":860},{},[28939,28942,28948],{"data":28940,"marks":28941,"value":21,"nodeType":864},{},[],{"data":28943,"content":28944,"nodeType":883},{"uri":15655},[28945],{"data":28946,"marks":28947,"value":1703,"nodeType":864},{},[],{"data":28949,"marks":28950,"value":21,"nodeType":864},{},[],{"data":28952,"content":28953,"nodeType":1005},{},[],{"data":28955,"content":28956,"nodeType":1009},{},[28957],{"data":28958,"marks":28959,"value":22661,"nodeType":864},{},[28960],{"type":899},{"data":28962,"content":28963,"nodeType":860},{},[28964,28967,28973],{"data":28965,"marks":28966,"value":22668,"nodeType":864},{},[],{"data":28968,"content":28969,"nodeType":883},{"uri":18024},[28970],{"data":28971,"marks":28972,"value":22675,"nodeType":864},{},[],{"data":28974,"marks":28975,"value":22679,"nodeType":864},{},[],{"data":28977,"content":28978,"nodeType":4845},{},[28979,29022,29078,29121,29164],{"data":28980,"content":28981,"nodeType":4581},{},[28982,28992,29002,29012],{"data":28983,"content":28984,"nodeType":4569},{},[28985],{"data":28986,"content":28987,"nodeType":860},{},[28988],{"data":28989,"marks":28990,"value":22696,"nodeType":864},{},[28991],{"type":899},{"data":28993,"content":28994,"nodeType":4569},{},[28995],{"data":28996,"content":28997,"nodeType":860},{},[28998],{"data":28999,"marks":29000,"value":22707,"nodeType":864},{},[29001],{"type":899},{"data":29003,"content":29004,"nodeType":4569},{},[29005],{"data":29006,"content":29007,"nodeType":860},{},[29008],{"data":29009,"marks":29010,"value":22718,"nodeType":864},{},[29011],{"type":899},{"data":29013,"content":29014,"nodeType":4569},{},[29015],{"data":29016,"content":29017,"nodeType":860},{},[29018],{"data":29019,"marks":29020,"value":22729,"nodeType":864},{},[29021],{"type":899},{"data":29023,"content":29024,"nodeType":4581},{},[29025,29045,29054,29063],{"data":29026,"content":29027,"nodeType":4569},{},[29028],{"data":29029,"content":29030,"nodeType":860},{},[29031,29035,29038,29042],{"data":29032,"marks":29033,"value":22743,"nodeType":864},{},[29034],{"type":899},{"data":29036,"marks":29037,"value":22747,"nodeType":864},{},[],{"data":29039,"marks":29040,"value":22752,"nodeType":864},{},[29041],{"type":899},{"data":29043,"marks":29044,"value":22756,"nodeType":864},{},[],{"data":29046,"content":29047,"nodeType":4569},{},[29048],{"data":29049,"content":29050,"nodeType":860},{},[29051],{"data":29052,"marks":29053,"value":22766,"nodeType":864},{},[],{"data":29055,"content":29056,"nodeType":4569},{},[29057],{"data":29058,"content":29059,"nodeType":860},{},[29060],{"data":29061,"marks":29062,"value":22776,"nodeType":864},{},[],{"data":29064,"content":29065,"nodeType":4569},{},[29066,29072],{"data":29067,"content":29068,"nodeType":860},{},[29069],{"data":29070,"marks":29071,"value":22786,"nodeType":864},{},[],{"data":29073,"content":29074,"nodeType":860},{},[29075],{"data":29076,"marks":29077,"value":22793,"nodeType":864},{},[],{"data":29079,"content":29080,"nodeType":4581},{},[29081,29094,29103,29112],{"data":29082,"content":29083,"nodeType":4569},{},[29084],{"data":29085,"content":29086,"nodeType":860},{},[29087,29091],{"data":29088,"marks":29089,"value":22807,"nodeType":864},{},[29090],{"type":899},{"data":29092,"marks":29093,"value":22811,"nodeType":864},{},[],{"data":29095,"content":29096,"nodeType":4569},{},[29097],{"data":29098,"content":29099,"nodeType":860},{},[29100],{"data":29101,"marks":29102,"value":22821,"nodeType":864},{},[],{"data":29104,"content":29105,"nodeType":4569},{},[29106],{"data":29107,"content":29108,"nodeType":860},{},[29109],{"data":29110,"marks":29111,"value":22831,"nodeType":864},{},[],{"data":29113,"content":29114,"nodeType":4569},{},[29115],{"data":29116,"content":29117,"nodeType":860},{},[29118],{"data":29119,"marks":29120,"value":22841,"nodeType":864},{},[],{"data":29122,"content":29123,"nodeType":4581},{},[29124,29137,29146,29155],{"data":29125,"content":29126,"nodeType":4569},{},[29127],{"data":29128,"content":29129,"nodeType":860},{},[29130,29134],{"data":29131,"marks":29132,"value":22855,"nodeType":864},{},[29133],{"type":899},{"data":29135,"marks":29136,"value":22859,"nodeType":864},{},[],{"data":29138,"content":29139,"nodeType":4569},{},[29140],{"data":29141,"content":29142,"nodeType":860},{},[29143],{"data":29144,"marks":29145,"value":22869,"nodeType":864},{},[],{"data":29147,"content":29148,"nodeType":4569},{},[29149],{"data":29150,"content":29151,"nodeType":860},{},[29152],{"data":29153,"marks":29154,"value":22879,"nodeType":864},{},[],{"data":29156,"content":29157,"nodeType":4569},{},[29158],{"data":29159,"content":29160,"nodeType":860},{},[29161],{"data":29162,"marks":29163,"value":22889,"nodeType":864},{},[],{"data":29165,"content":29166,"nodeType":4581},{},[29167,29180,29189,29198],{"data":29168,"content":29169,"nodeType":4569},{},[29170],{"data":29171,"content":29172,"nodeType":860},{},[29173,29177],{"data":29174,"marks":29175,"value":22903,"nodeType":864},{},[29176],{"type":899},{"data":29178,"marks":29179,"value":22907,"nodeType":864},{},[],{"data":29181,"content":29182,"nodeType":4569},{},[29183],{"data":29184,"content":29185,"nodeType":860},{},[29186],{"data":29187,"marks":29188,"value":22766,"nodeType":864},{},[],{"data":29190,"content":29191,"nodeType":4569},{},[29192],{"data":29193,"content":29194,"nodeType":860},{},[29195],{"data":29196,"marks":29197,"value":22926,"nodeType":864},{},[],{"data":29199,"content":29200,"nodeType":4569},{},[29201],{"data":29202,"content":29203,"nodeType":860},{},[29204],{"data":29205,"marks":29206,"value":22936,"nodeType":864},{},[],{"data":29208,"content":29209,"nodeType":860},{},[29210],{"data":29211,"marks":29212,"value":21,"nodeType":864},{},[],{"items":29214},[29215,29217],{"sys":29216,"name":15033},{"id":15032},{"sys":29218,"name":342},{"id":15029},{"items":29220},[29221],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":29222},{"url":2740},"blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market",{"json":29225},{"data":29226,"content":29227,"nodeType":856},{},[29228],{"data":29229,"content":29230,"nodeType":860},{},[29231],{"data":29232,"marks":29233,"value":29234,"nodeType":864},{},[],"New research from Omdia has put hard numbers behind something security teams have been feeling for the past two years: the browser has become the primary attack surface in the enterprise, organizations are investing accordingly, and the results are already measurable.",{"id":21389,"publishedAt":29236},"2026-08-12T11:52:51.573Z",{"items":29238},[29239,29241],{"sys":29240,"name":297},{"id":2732},{"sys":29242,"name":2729},{"id":2728},{"items":29244},[29245,29247,29249,29251,29253,29255,29257,29259,29261,29263,29265,29267,29269,29271,29273,29275,29277,29279,29281],{"sys":29246,"name":297,"slug":298,"tier":31},{"id":294},{"sys":29248,"name":642,"slug":643,"tier":31},{"id":639},{"sys":29250,"name":279,"slug":280,"tier":31},{"id":276},{"sys":29252,"name":519,"slug":520,"tier":31},{"id":516},{"sys":29254,"name":413,"slug":414,"tier":31},{"id":410},{"sys":29256,"name":235,"slug":236,"tier":31},{"id":232},{"sys":29258,"name":386,"slug":387,"tier":45},{"id":383},{"sys":29260,"name":580,"slug":581,"tier":45},{"id":577},{"sys":29262,"name":261,"slug":262,"tier":45},{"id":258},{"sys":29264,"name":324,"slug":325,"tier":45},{"id":321},{"sys":29266,"name":571,"slug":572,"tier":45},{"id":568},{"sys":29268,"name":288,"slug":289,"tier":45},{"id":285},{"sys":29270,"name":368,"slug":369,"tier":45},{"id":365},{"sys":29272,"name":315,"slug":316,"tier":45},{"id":312},{"sys":29274,"name":360,"slug":361,"tier":45},{"id":357},{"sys":29276,"name":252,"slug":253,"tier":45},{"id":249},{"sys":29278,"name":511,"slug":512,"tier":45},{"id":508},{"sys":29280,"name":624,"slug":625,"tier":45},{"id":621},{"sys":29282,"name":244,"slug":245,"tier":45},{"id":241},"R6qLSR-i1d8ltg2tNiiwocbWu7Y3b4pT4C_MTKlUwec",{"id":29285,"title":26118,"authorsCollection":29286,"content":29291,"extension":228,"faqItemsCollection":30069,"faqTitle":59,"featured":6,"hashTags":59,"meta":30071,"metaTitle":30072,"ogImage":59,"postType":6981,"publishedDate":21966,"relatedBlogPostsCollection":30073,"slug":26120,"stem":32301,"subtitle":59,"summary":32302,"synopsis":26119,"sys":32313,"tagsCollection":32315,"topicsCollection":32321,"__hash__":32369},"blog/blog/how-to-avoid-the-browser-security-buyers-trap.json",{"items":29287},[29288],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":29289,"profilePicture":29290},[23559],{"url":4881},{"json":29292,"links":29951},{"data":29293,"content":29294,"nodeType":856},{},[29295,29300,29306,29312,29318,29321,29328,29334,29344,29354,29359,29365,29368,29375,29381,29386,29392,29398,29491,29497,29500,29507,29513,29568,29581,29586,29592,29595,29602,29608,29615,29621,29627,29652,29658,29665,29671,29677,29683,29690,29696,29702,29708,29711,29718,29728,29734,29740,29747,29753,29759,29766,29772,29827,29840,29855,29862,29868,29875,29881,29887,29893,29898,29905,29911,29917,29922,29928,29934,29940,29945],{"data":29296,"content":29299,"nodeType":996},{"target":29297},{"sys":29298},{"id":25361,"type":1001,"linkType":1002},[],{"data":29301,"content":29302,"nodeType":860},{},[29303],{"data":29304,"marks":29305,"value":25369,"nodeType":864},{},[],{"data":29307,"content":29308,"nodeType":860},{},[29309],{"data":29310,"marks":29311,"value":25376,"nodeType":864},{},[],{"data":29313,"content":29314,"nodeType":860},{},[29315],{"data":29316,"marks":29317,"value":25383,"nodeType":864},{},[],{"data":29319,"content":29320,"nodeType":1005},{},[],{"data":29322,"content":29323,"nodeType":1009},{},[29324],{"data":29325,"marks":29326,"value":25394,"nodeType":864},{},[29327],{"type":899},{"data":29329,"content":29330,"nodeType":860},{},[29331],{"data":29332,"marks":29333,"value":25401,"nodeType":864},{},[],{"data":29335,"content":29336,"nodeType":860},{},[29337,29341],{"data":29338,"marks":29339,"value":25409,"nodeType":864},{},[29340],{"type":899},{"data":29342,"marks":29343,"value":25413,"nodeType":864},{},[],{"data":29345,"content":29346,"nodeType":860},{},[29347,29351],{"data":29348,"marks":29349,"value":25421,"nodeType":864},{},[29350],{"type":899},{"data":29352,"marks":29353,"value":25425,"nodeType":864},{},[],{"data":29355,"content":29358,"nodeType":996},{"target":29356},{"sys":29357},{"id":21573,"type":1001,"linkType":1002},[],{"data":29360,"content":29361,"nodeType":860},{},[29362],{"data":29363,"marks":29364,"value":25437,"nodeType":864},{},[],{"data":29366,"content":29367,"nodeType":1005},{},[],{"data":29369,"content":29370,"nodeType":1009},{},[29371],{"data":29372,"marks":29373,"value":25448,"nodeType":864},{},[29374],{"type":899},{"data":29376,"content":29377,"nodeType":860},{},[29378],{"data":29379,"marks":29380,"value":25455,"nodeType":864},{},[],{"data":29382,"content":29385,"nodeType":996},{"target":29383},{"sys":29384},{"id":25460,"type":1001,"linkType":1002},[],{"data":29387,"content":29388,"nodeType":860},{},[29389],{"data":29390,"marks":29391,"value":25468,"nodeType":864},{},[],{"data":29393,"content":29394,"nodeType":860},{},[29395],{"data":29396,"marks":29397,"value":25475,"nodeType":864},{},[],{"data":29399,"content":29400,"nodeType":941},{},[29401,29417,29433,29449,29465,29478],{"data":29402,"content":29403,"nodeType":945},{},[29404],{"data":29405,"content":29406,"nodeType":860},{},[29407,29410,29414],{"data":29408,"marks":29409,"value":25488,"nodeType":864},{},[],{"data":29411,"marks":29412,"value":25493,"nodeType":864},{},[29413],{"type":899},{"data":29415,"marks":29416,"value":25497,"nodeType":864},{},[],{"data":29418,"content":29419,"nodeType":945},{},[29420],{"data":29421,"content":29422,"nodeType":860},{},[29423,29426,29430],{"data":29424,"marks":29425,"value":25507,"nodeType":864},{},[],{"data":29427,"marks":29428,"value":25512,"nodeType":864},{},[29429],{"type":899},{"data":29431,"marks":29432,"value":25516,"nodeType":864},{},[],{"data":29434,"content":29435,"nodeType":945},{},[29436],{"data":29437,"content":29438,"nodeType":860},{},[29439,29442,29446],{"data":29440,"marks":29441,"value":25526,"nodeType":864},{},[],{"data":29443,"marks":29444,"value":25531,"nodeType":864},{},[29445],{"type":899},{"data":29447,"marks":29448,"value":25535,"nodeType":864},{},[],{"data":29450,"content":29451,"nodeType":945},{},[29452],{"data":29453,"content":29454,"nodeType":860},{},[29455,29458,29462],{"data":29456,"marks":29457,"value":25545,"nodeType":864},{},[],{"data":29459,"marks":29460,"value":25550,"nodeType":864},{},[29461],{"type":899},{"data":29463,"marks":29464,"value":25554,"nodeType":864},{},[],{"data":29466,"content":29467,"nodeType":945},{},[29468],{"data":29469,"content":29470,"nodeType":860},{},[29471,29475],{"data":29472,"marks":29473,"value":25565,"nodeType":864},{},[29474],{"type":899},{"data":29476,"marks":29477,"value":25569,"nodeType":864},{},[],{"data":29479,"content":29480,"nodeType":945},{},[29481],{"data":29482,"content":29483,"nodeType":860},{},[29484,29488],{"data":29485,"marks":29486,"value":25580,"nodeType":864},{},[29487],{"type":899},{"data":29489,"marks":29490,"value":25584,"nodeType":864},{},[],{"data":29492,"content":29493,"nodeType":860},{},[29494],{"data":29495,"marks":29496,"value":25591,"nodeType":864},{},[],{"data":29498,"content":29499,"nodeType":1005},{},[],{"data":29501,"content":29502,"nodeType":1312},{},[29503],{"data":29504,"marks":29505,"value":25602,"nodeType":864},{},[29506],{"type":899},{"data":29508,"content":29509,"nodeType":860},{},[29510],{"data":29511,"marks":29512,"value":25609,"nodeType":864},{},[],{"data":29514,"content":29515,"nodeType":941},{},[29516,29529,29542,29555],{"data":29517,"content":29518,"nodeType":945},{},[29519],{"data":29520,"content":29521,"nodeType":860},{},[29522,29525],{"data":29523,"marks":29524,"value":25622,"nodeType":864},{},[],{"data":29526,"marks":29527,"value":25627,"nodeType":864},{},[29528],{"type":899},{"data":29530,"content":29531,"nodeType":945},{},[29532],{"data":29533,"content":29534,"nodeType":860},{},[29535,29538],{"data":29536,"marks":29537,"value":25637,"nodeType":864},{},[],{"data":29539,"marks":29540,"value":25642,"nodeType":864},{},[29541],{"type":899},{"data":29543,"content":29544,"nodeType":945},{},[29545],{"data":29546,"content":29547,"nodeType":860},{},[29548,29551],{"data":29549,"marks":29550,"value":25652,"nodeType":864},{},[],{"data":29552,"marks":29553,"value":25657,"nodeType":864},{},[29554],{"type":899},{"data":29556,"content":29557,"nodeType":945},{},[29558],{"data":29559,"content":29560,"nodeType":860},{},[29561,29564],{"data":29562,"marks":29563,"value":25667,"nodeType":864},{},[],{"data":29565,"marks":29566,"value":25672,"nodeType":864},{},[29567],{"type":899},{"data":29569,"content":29570,"nodeType":860},{},[29571,29574,29578],{"data":29572,"marks":29573,"value":25679,"nodeType":864},{},[],{"data":29575,"marks":29576,"value":25684,"nodeType":864},{},[29577],{"type":899},{"data":29579,"marks":29580,"value":25688,"nodeType":864},{},[],{"data":29582,"content":29585,"nodeType":996},{"target":29583},{"sys":29584},{"id":25693,"type":1001,"linkType":1002},[],{"data":29587,"content":29588,"nodeType":860},{},[29589],{"data":29590,"marks":29591,"value":25701,"nodeType":864},{},[],{"data":29593,"content":29594,"nodeType":1005},{},[],{"data":29596,"content":29597,"nodeType":1009},{},[29598],{"data":29599,"marks":29600,"value":25712,"nodeType":864},{},[29601],{"type":899},{"data":29603,"content":29604,"nodeType":860},{},[29605],{"data":29606,"marks":29607,"value":25719,"nodeType":864},{},[],{"data":29609,"content":29610,"nodeType":1312},{},[29611],{"data":29612,"marks":29613,"value":25727,"nodeType":864},{},[29614],{"type":899},{"data":29616,"content":29617,"nodeType":860},{},[29618],{"data":29619,"marks":29620,"value":25734,"nodeType":864},{},[],{"data":29622,"content":29623,"nodeType":860},{},[29624],{"data":29625,"marks":29626,"value":25741,"nodeType":864},{},[],{"data":29628,"content":29629,"nodeType":860},{},[29630,29633,29639,29642,29649],{"data":29631,"marks":29632,"value":25748,"nodeType":864},{},[],{"data":29634,"content":29635,"nodeType":883},{"uri":2561},[29636],{"data":29637,"marks":29638,"value":25755,"nodeType":864},{},[],{"data":29640,"marks":29641,"value":25759,"nodeType":864},{},[],{"data":29643,"content":29644,"nodeType":883},{"uri":18212},[29645],{"data":29646,"marks":29647,"value":25767,"nodeType":864},{},[29648],{"type":1455},{"data":29650,"marks":29651,"value":25771,"nodeType":864},{},[],{"data":29653,"content":29654,"nodeType":860},{},[29655],{"data":29656,"marks":29657,"value":25778,"nodeType":864},{},[],{"data":29659,"content":29660,"nodeType":1312},{},[29661],{"data":29662,"marks":29663,"value":25786,"nodeType":864},{},[29664],{"type":899},{"data":29666,"content":29667,"nodeType":860},{},[29668],{"data":29669,"marks":29670,"value":25793,"nodeType":864},{},[],{"data":29672,"content":29673,"nodeType":860},{},[29674],{"data":29675,"marks":29676,"value":25800,"nodeType":864},{},[],{"data":29678,"content":29679,"nodeType":860},{},[29680],{"data":29681,"marks":29682,"value":25807,"nodeType":864},{},[],{"data":29684,"content":29685,"nodeType":1312},{},[29686],{"data":29687,"marks":29688,"value":25815,"nodeType":864},{},[29689],{"type":899},{"data":29691,"content":29692,"nodeType":860},{},[29693],{"data":29694,"marks":29695,"value":25822,"nodeType":864},{},[],{"data":29697,"content":29698,"nodeType":860},{},[29699],{"data":29700,"marks":29701,"value":25829,"nodeType":864},{},[],{"data":29703,"content":29704,"nodeType":860},{},[29705],{"data":29706,"marks":29707,"value":25836,"nodeType":864},{},[],{"data":29709,"content":29710,"nodeType":1005},{},[],{"data":29712,"content":29713,"nodeType":1009},{},[29714],{"data":29715,"marks":29716,"value":25847,"nodeType":864},{},[29717],{"type":899},{"data":29719,"content":29720,"nodeType":860},{},[29721,29725],{"data":29722,"marks":29723,"value":25855,"nodeType":864},{},[29724],{"type":899},{"data":29726,"marks":29727,"value":25859,"nodeType":864},{},[],{"data":29729,"content":29730,"nodeType":860},{},[29731],{"data":29732,"marks":29733,"value":25866,"nodeType":864},{},[],{"data":29735,"content":29736,"nodeType":860},{},[29737],{"data":29738,"marks":29739,"value":25873,"nodeType":864},{},[],{"data":29741,"content":29742,"nodeType":1312},{},[29743],{"data":29744,"marks":29745,"value":25881,"nodeType":864},{},[29746],{"type":899},{"data":29748,"content":29749,"nodeType":860},{},[29750],{"data":29751,"marks":29752,"value":25888,"nodeType":864},{},[],{"data":29754,"content":29755,"nodeType":860},{},[29756],{"data":29757,"marks":29758,"value":25895,"nodeType":864},{},[],{"data":29760,"content":29761,"nodeType":1312},{},[29762],{"data":29763,"marks":29764,"value":25903,"nodeType":864},{},[29765],{"type":899},{"data":29767,"content":29768,"nodeType":860},{},[29769],{"data":29770,"marks":29771,"value":25910,"nodeType":864},{},[],{"data":29773,"content":29774,"nodeType":941},{},[29775,29788,29801,29814],{"data":29776,"content":29777,"nodeType":945},{},[29778],{"data":29779,"content":29780,"nodeType":860},{},[29781,29785],{"data":29782,"marks":29783,"value":25924,"nodeType":864},{},[29784],{"type":899},{"data":29786,"marks":29787,"value":25928,"nodeType":864},{},[],{"data":29789,"content":29790,"nodeType":945},{},[29791],{"data":29792,"content":29793,"nodeType":860},{},[29794,29798],{"data":29795,"marks":29796,"value":25939,"nodeType":864},{},[29797],{"type":899},{"data":29799,"marks":29800,"value":25943,"nodeType":864},{},[],{"data":29802,"content":29803,"nodeType":945},{},[29804],{"data":29805,"content":29806,"nodeType":860},{},[29807,29811],{"data":29808,"marks":29809,"value":25954,"nodeType":864},{},[29810],{"type":899},{"data":29812,"marks":29813,"value":25958,"nodeType":864},{},[],{"data":29815,"content":29816,"nodeType":945},{},[29817],{"data":29818,"content":29819,"nodeType":860},{},[29820,29824],{"data":29821,"marks":29822,"value":25969,"nodeType":864},{},[29823],{"type":899},{"data":29825,"marks":29826,"value":25973,"nodeType":864},{},[],{"data":29828,"content":29829,"nodeType":860},{},[29830,29833,29837],{"data":29831,"marks":29832,"value":25980,"nodeType":864},{},[],{"data":29834,"marks":29835,"value":25985,"nodeType":864},{},[29836],{"type":899},{"data":29838,"marks":29839,"value":25989,"nodeType":864},{},[],{"data":29841,"content":29842,"nodeType":860},{},[29843,29846,29852],{"data":29844,"marks":29845,"value":25996,"nodeType":864},{},[],{"data":29847,"content":29848,"nodeType":883},{"uri":3210},[29849],{"data":29850,"marks":29851,"value":26003,"nodeType":864},{},[],{"data":29853,"marks":29854,"value":26007,"nodeType":864},{},[],{"data":29856,"content":29857,"nodeType":1312},{},[29858],{"data":29859,"marks":29860,"value":26015,"nodeType":864},{},[29861],{"type":899},{"data":29863,"content":29864,"nodeType":860},{},[29865],{"data":29866,"marks":29867,"value":26022,"nodeType":864},{},[],{"data":29869,"content":29870,"nodeType":860},{},[29871],{"data":29872,"marks":29873,"value":26030,"nodeType":864},{},[29874],{"type":899},{"data":29876,"content":29877,"nodeType":860},{},[29878],{"data":29879,"marks":29880,"value":26037,"nodeType":864},{},[],{"data":29882,"content":29883,"nodeType":860},{},[29884],{"data":29885,"marks":29886,"value":26044,"nodeType":864},{},[],{"data":29888,"content":29889,"nodeType":860},{},[29890],{"data":29891,"marks":29892,"value":26051,"nodeType":864},{},[],{"data":29894,"content":29897,"nodeType":996},{"target":29895},{"sys":29896},{"id":26056,"type":1001,"linkType":1002},[],{"data":29899,"content":29900,"nodeType":1312},{},[29901],{"data":29902,"marks":29903,"value":26065,"nodeType":864},{},[29904],{"type":899},{"data":29906,"content":29907,"nodeType":860},{},[29908],{"data":29909,"marks":29910,"value":26072,"nodeType":864},{},[],{"data":29912,"content":29913,"nodeType":860},{},[29914],{"data":29915,"marks":29916,"value":26079,"nodeType":864},{},[],{"data":29918,"content":29921,"nodeType":996},{"target":29919},{"sys":29920},{"id":12852,"type":1001,"linkType":1002},[],{"data":29923,"content":29924,"nodeType":860},{},[29925],{"data":29926,"marks":29927,"value":26091,"nodeType":864},{},[],{"data":29929,"content":29930,"nodeType":860},{},[29931],{"data":29932,"marks":29933,"value":26098,"nodeType":864},{},[],{"data":29935,"content":29936,"nodeType":860},{},[29937],{"data":29938,"marks":29939,"value":26105,"nodeType":864},{},[],{"data":29941,"content":29944,"nodeType":996},{"target":29942},{"sys":29943},{"id":26110,"type":1001,"linkType":1002},[],{"data":29946,"content":29947,"nodeType":860},{},[29948],{"data":29949,"marks":29950,"value":21,"nodeType":864},{},[],{"entries":29952},{"hyperlink":29953,"inline":29954,"block":29955},[],[],[29956,29982,29984,30020,30043,30057,30065],{"sys":29957,"__typename":1740,"content":29958,"name":29981,"title":59},{"id":25361},{"json":29959},{"nodeType":856,"data":29960,"content":29961},{},[29962,29974],{"nodeType":860,"data":29963,"content":29964},{},[29965,29970],{"nodeType":864,"value":29966,"marks":29967,"data":29969},"TL;DR:",[29968],{"type":899},{},{"nodeType":864,"value":29971,"marks":29972,"data":29973}," Not all browser security investments address the same threat. Seraphic (Crowdstrike) focuses on browser exploitation, SquareX (ZScaler) on malware sandboxing, LayerX on internal governance. None of these address the attacks that are actually causing the most damaging breaches today: identity theft, credential abuse, and session hijacking that play out entirely inside the browser using legitimate authentication flows. Push Security is built specifically for that threat model — delivering the greatest coverage against the most damaging attacks, without the user friction, operational management burden, or stability risks associated with other solutions.",[],{},{"nodeType":860,"data":29975,"content":29976},{},[29977],{"nodeType":864,"value":29978,"marks":29979,"data":29980},"\n",[],{},"Browser security buyer's trap IB1",{"sys":29983,"__typename":1717,"type":1718,"ctaText":27201,"buttonLabel":27202,"buttonColour":1721,"buttonUrl":12790},{"id":21573},{"sys":29985,"__typename":1740,"content":29986,"name":30019,"title":59},{"id":25460},{"json":29987},{"data":29988,"content":29989,"nodeType":856},{},[29990],{"data":29991,"content":29992,"nodeType":860},{},[29993,29997,30004,30007,30015],{"data":29994,"marks":29995,"value":29996,"nodeType":864},{},[],"You can read about ",{"data":29998,"content":29999,"nodeType":883},{"uri":18024},[30000],{"data":30001,"marks":30002,"value":18027,"nodeType":864},{},[30003],{"type":1455},{"data":30005,"marks":30006,"value":902,"nodeType":864},{},[],{"data":30008,"content":30009,"nodeType":883},{"uri":4082},[30010],{"data":30011,"marks":30012,"value":30014,"nodeType":864},{},[30013],{"type":1455},"ShinyHunters’ 2026 campaigns and TTPs",{"data":30016,"marks":30017,"value":30018,"nodeType":864},{},[]," in our dedicated blog posts. ","Browser security buyer's trap IB2",{"sys":30021,"__typename":1740,"content":30022,"name":30042,"title":59},{"id":25693},{"json":30023},{"data":30024,"content":30025,"nodeType":856},{},[30026],{"data":30027,"content":30028,"nodeType":860},{},[30029,30033,30038],{"data":30030,"marks":30031,"value":30032,"nodeType":864},{},[],"It's worth heading off the obvious counterargument: ",{"data":30034,"marks":30035,"value":30037,"nodeType":864},{},[30036],{"type":899},"won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? ",{"data":30039,"marks":30040,"value":30041,"nodeType":864},{},[],"Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development. ","Browser security buyer's trap IB3",{"sys":30044,"__typename":1740,"content":30045,"name":30056,"title":59},{"id":26056},{"json":30046},{"nodeType":856,"data":30047,"content":30048},{},[30049],{"nodeType":860,"data":30050,"content":30051},{},[30052],{"nodeType":864,"value":30053,"marks":30054,"data":30055},"Solutions optimized for browser exploitation are defending against a shrinking attack category. Browser vendors are very good at closing those vulnerabilities, quickly. The ROI trajectory points the wrong way.",[],{},"Browser security buyer's trap IB4",{"sys":30058,"__typename":1724,"title":30059,"caption":30060,"layoutMode":59,"file":30061},{"id":12852},"Comparing ease of deployment x security value for browser security solutions","Comparing ease of deployment x security value for browser security solutions.",{"url":30062,"width":30063,"height":30064},"https://images.ctfassets.net/y1cdw1ablpvd/4z1RAFROesqaBF4H3qR8yu/1e21a68602402773bfa843fd0208d4ca/Screenshot_2026-07-27_at_10.36.43.png",1408,952,{"sys":30066,"__typename":1717,"type":1718,"ctaText":30067,"buttonLabel":30068,"buttonColour":1721,"buttonUrl":15655},{"id":26110},"Ready to learn more about Push? Book a demo with one of our team. ","Book a Demo",{"items":30070},[],{},"Solving for attacks that happen in, not on the browser",{"items":30074},[30075,31026,31859],{"__typename":2059,"sys":30076,"content":30078,"title":31012,"synopsis":31013,"hashTags":59,"publishedDate":31014,"slug":31015,"tagsCollection":31016,"authorsCollection":31022},{"id":30077},"1jfqiWQlL6qkn3i9yjNbFB",{"json":30079},{"data":30080,"content":30081,"nodeType":856},{},[30082,30089,30109,30121,30128,30136,30143,30165,30172,30179,30186,30198,30204,30207,30215,30231,30251,30362,30367,30374,30380,30388,30395,30407,30414,30420,30427,30451,30458,30465,30471,30474,30482,30489,30497,30504,30520,30527,30534,30542,30549,30556,30564,30571,30578,30581,30589,30596,30604,30611,30618,30625,30632,30640,30647,30679,30686,30693,30699,30706,30714,30721,30799,30805,30813,30829,30836,30842,30849,30865,30868,30876,30883,30890,30896,30903,30947,30954,30961,30968,30974,30977,30984,30990,30996],{"data":30083,"content":30084,"nodeType":860},{},[30085],{"data":30086,"marks":30087,"value":30088,"nodeType":864},{},[],"In March, our threat hunting engine flagged something it hadn’t seen before.",{"data":30090,"content":30091,"nodeType":860},{},[30092,30096,30105],{"data":30093,"marks":30094,"value":30095,"nodeType":864},{},[],"Our research team had already been tracking the growing use of ",{"data":30097,"content":30101,"nodeType":5064},{"target":30098},{"sys":30099},{"id":30100,"type":1001,"linkType":1002},"2U6QpQ9rkY8x5ES48okHZB",[30102],{"data":30103,"marks":30104,"value":441,"nodeType":864},{},[],{"data":30106,"marks":30107,"value":30108,"nodeType":864},{},[]," tied to phishing campaigns. Malvertising frequently targets users via Google Search results, inserting malicious ads or redirects in place of legitimate ads, and using the familiar context of the search results page to trick users into clicking.",{"data":30110,"content":30111,"nodeType":860},{},[30112,30116],{"data":30113,"marks":30114,"value":30115,"nodeType":864},{},[],"To defend Push customers against this threat, we needed a way to spot malicious activity arising from clicking on Google ads. ",{"data":30117,"marks":30118,"value":30120,"nodeType":864},{},[30119],{"type":2246},"But how to separate signal from noise?",{"data":30122,"content":30123,"nodeType":860},{},[30124],{"data":30125,"marks":30126,"value":30127,"nodeType":864},{},[],"Our hunt combined the skills of human researchers and AI agents to find 12 meaningful results from trillions of browser events visible to the Push extension across our install base.",{"data":30129,"content":30130,"nodeType":860},{},[30131],{"data":30132,"marks":30133,"value":30135,"nodeType":864},{},[30134],{"type":899},"Of those, one was novel. ",{"data":30137,"content":30138,"nodeType":860},{},[30139],{"data":30140,"marks":30141,"value":30142,"nodeType":864},{},[],"A user had searched for NotebookLM, clicked a paid Google ad, and gotten redirected to a page impersonating NotebookLM. The page itself was just a facade fronting a Cloudflare Pages-hosted phishing kit with a WebAssembly C2 connector. To the user, it looked like a completely on-brand NotebookLM page, and if they had run the fake install prompt, they would have installed malware. (Note: NotebookLM doesn’t even require a local install, but the page was convincing enough — and AI platforms are changing so quickly — that the lure was extremely believable.)",{"data":30144,"content":30145,"nodeType":860},{},[30146,30151,30161],{"data":30147,"marks":30148,"value":30150,"nodeType":864},{},[30149],{"type":899},"We had found our first in-the-wild ",{"data":30152,"content":30156,"nodeType":5064},{"target":30153},{"sys":30154},{"id":30155,"type":1001,"linkType":1002},"7bG71Eo43crbIHKzczooVS",[30157],{"data":30158,"marks":30159,"value":14952,"nodeType":864},{},[30160],{"type":899},{"data":30162,"marks":30163,"value":2924,"nodeType":864},{},[30164],{"type":899},{"data":30166,"content":30167,"nodeType":860},{},[30168],{"data":30169,"marks":30170,"value":30171,"nodeType":864},{},[],"Within minutes, our analysis agents created detections, and researchers shipped a new detection to every Push customer. ",{"data":30173,"content":30174,"nodeType":860},{},[30175],{"data":30176,"marks":30177,"value":30178,"nodeType":864},{},[],"Eighteen months ago, it would have taken a human analyst days or even weeks to unpack the attack, comb through web requests, de-obfuscate web code, trace JavaScript execution, and extract signals of tactics, techniques, and procedures (TTPs) beyond short-lived single-use IOCs like domain name, then get their work coded up as a detection and deployed to customers. ",{"data":30180,"content":30181,"nodeType":860},{},[30182],{"data":30183,"marks":30184,"value":30185,"nodeType":864},{},[],"That was viable when new tools or techniques showed up once or twice a quarter. It doesn’t stand a chance when attack evolutions occur weekly or even daily. That’s the reality now with AI-generated adversary tools.",{"data":30187,"content":30188,"nodeType":860},{},[30189,30194],{"data":30190,"marks":30191,"value":30193,"nodeType":864},{},[30192],{"type":899},"So, can AI agents replace human threat researchers?",{"data":30195,"marks":30196,"value":30197,"nodeType":864},{},[]," That’s the wrong question. Can AI agents massively scale the expertise of a seasoned human threat hunter without getting bored of repetitive tasks, missing pertinent but easily overlooked details, or creating operational siloes dependent on one person’s knowledge — and do its work continuously across trillions of data points? Yes, absolutely.",{"data":30199,"content":30203,"nodeType":996},{"target":30200},{"sys":30201},{"id":30202,"type":1001,"linkType":1002},"3OiZ7BrViCTTMmHUAbloEt",[],{"data":30205,"content":30206,"nodeType":1005},{},[],{"data":30208,"content":30209,"nodeType":1009},{},[30210],{"data":30211,"marks":30212,"value":30214,"nodeType":864},{},[30213],{"type":899},"Why scaling browser threat detection requires more than more analysts",{"data":30216,"content":30217,"nodeType":860},{},[30218,30222,30227],{"data":30219,"marks":30220,"value":30221,"nodeType":864},{},[],"Already this year, we’ve ",{"data":30223,"marks":30224,"value":30226,"nodeType":864},{},[30225],{"type":899},"tripled",{"data":30228,"marks":30229,"value":30230,"nodeType":864},{},[]," the cumulative number of detections shipped to Push customers using this pipeline. That output points to the first problem we set out to solve by employing AI agents: Scaling our research team’s considerable expertise.",{"data":30232,"content":30233,"nodeType":860},{},[30234,30238,30247],{"data":30235,"marks":30236,"value":30237,"nodeType":864},{},[],"Push’s R&D team are experts at understanding and unpacking modern browser-based attacks. This is essential when you consider how quickly attacks themselves are evolving. When we created the ",{"data":30239,"content":30243,"nodeType":5064},{"target":30240},{"sys":30241},{"id":30242,"type":1001,"linkType":1002},"211Dd0EIrXPOFpvRgs0fEE",[30244],{"data":30245,"marks":30246,"value":13008,"nodeType":864},{},[],{"data":30248,"marks":30249,"value":30250,"nodeType":864},{},[]," in 2023 (then called the SaaS Attacks Matrix), many of the ideas in it were theoretical. Not anymore. ",{"data":30252,"content":30253,"nodeType":941},{},[30254,30264,30288],{"data":30255,"content":30256,"nodeType":945},{},[30257],{"data":30258,"content":30259,"nodeType":860},{},[30260],{"data":30261,"marks":30262,"value":30263,"nodeType":864},{},[],"We’ve tracked the rise of AiTM phish kits from their status as MFA-bypassing novelties to the emergence of an entire criminal ecosystem built around increasingly sophisticated Phishing-as-a-Service tools. ",{"data":30265,"content":30266,"nodeType":945},{},[30267],{"data":30268,"content":30269,"nodeType":860},{},[30270,30274,30284],{"data":30271,"marks":30272,"value":30273,"nodeType":864},{},[],"We imagined the simple but effective power of using device code authorization for phishing three years ago; in the last few months, we’ve detected a 37x increase in ",{"data":30275,"content":30279,"nodeType":5064},{"target":30276},{"sys":30277},{"id":30278,"type":1001,"linkType":1002},"5DmCqTU2Tg4adYScA5vT2x",[30280],{"data":30281,"marks":30282,"value":30283,"nodeType":864},{},[],"device code phishing attacks",{"data":30285,"marks":30286,"value":30287,"nodeType":864},{},[]," across our install base. ",{"data":30289,"content":30290,"nodeType":945},{},[30291],{"data":30292,"content":30293,"nodeType":860},{},[30294,30298,30307,30311,30320,30324,30334,30337,30345,30348,30358],{"data":30295,"marks":30296,"value":30297,"nodeType":864},{},[],"We were also the first to detect a novel post-authorization attack we dubbed ",{"data":30299,"content":30303,"nodeType":5064},{"target":30300},{"sys":30301},{"id":30302,"type":1001,"linkType":1002},"71EaaK7lfl6bQBbkAU0qjv",[30304],{"data":30305,"marks":30306,"value":12985,"nodeType":864},{},[],{"data":30308,"marks":30309,"value":30310,"nodeType":864},{},[]," that combines OAuth consent phishing and ClickFix-style user prompts; reported on the rise of the ridiculously simple yet effective ",{"data":30312,"content":30315,"nodeType":5064},{"target":30313},{"sys":30314},{"id":30155,"type":1001,"linkType":1002},[30316],{"data":30317,"marks":30318,"value":30319,"nodeType":864},{},[],"InstallFix technique",{"data":30321,"marks":30322,"value":30323,"nodeType":864},{},[]," described earlier; and detected an array of other ",{"data":30325,"content":30329,"nodeType":5064},{"target":30326},{"sys":30327},{"id":30328,"type":1001,"linkType":1002},"2YmiesBvJHGw4wiKEKzLUq",[30330],{"data":30331,"marks":30332,"value":30333,"nodeType":864},{},[],"creative",{"data":30335,"marks":30336,"value":1171,"nodeType":864},{},[],{"data":30338,"content":30341,"nodeType":5064},{"target":30339},{"sys":30340},{"id":30100,"type":1001,"linkType":1002},[30342],{"data":30343,"marks":30344,"value":520,"nodeType":864},{},[],{"data":30346,"marks":30347,"value":1171,"nodeType":864},{},[],{"data":30349,"content":30353,"nodeType":5064},{"target":30350},{"sys":30351},{"id":30352,"type":1001,"linkType":1002},"6Zosy4SU0LpjlaSWX75peb",[30354],{"data":30355,"marks":30356,"value":30357,"nodeType":864},{},[],"campaigns",{"data":30359,"marks":30360,"value":30361,"nodeType":864},{},[]," tied to malvertising scams.",{"data":30363,"content":30366,"nodeType":996},{"target":30364},{"sys":30365},{"id":20883,"type":1001,"linkType":1002},[],{"data":30368,"content":30369,"nodeType":860},{},[30370],{"data":30371,"marks":30372,"value":30373,"nodeType":864},{},[],"With an agentic approach, we could scale this expertise and reduce the time it takes to go from technique discovery to production-ready detection. This speed is critical now because adversaries are also using AI tools to do their work, exploding the number of trivial-to-rotate indicators of compromise and overwhelming existing detection workflows that lack an equivalent machine speed.",{"data":30375,"content":30379,"nodeType":996},{"target":30376},{"sys":30377},{"id":30378,"type":1001,"linkType":1002},"1u00uFbC4xsvP9lqahXbgD",[],{"data":30381,"content":30382,"nodeType":1312},{},[30383],{"data":30384,"marks":30385,"value":30387,"nodeType":864},{},[30386],{"type":899},"Scaling behavioral detections, not just making bigger blocklists",{"data":30389,"content":30390,"nodeType":860},{},[30391],{"data":30392,"marks":30393,"value":30394,"nodeType":864},{},[],"But output numbers alone don’t tell the story of successful detections. That’s the other problem we set out to solve at scale: Most secure browser solutions rely on detection logic based on blocking known-bad indicators like domains, IPs, and URLs.",{"data":30396,"content":30397,"nodeType":860},{},[30398,30403],{"data":30399,"marks":30400,"value":30402,"nodeType":864},{},[30401],{"type":899},"If your solution offers 1,000 detections, and they’re all based on known-bad indicators that are easily rotated, then you’ve got 1,000 detections that worked once and will likely never fire again. ",{"data":30404,"marks":30405,"value":30406,"nodeType":864},{},[],"They certainly won’t catch subtle adaptations in adversary techniques that don’t rely on infrastructure changes, which are easy for attackers to swap anyway. ",{"data":30408,"content":30409,"nodeType":860},{},[30410],{"data":30411,"marks":30412,"value":30413,"nodeType":864},{},[],"Push does it differently. Our detection engine is focused on hunting for tactics, techniques, and procedures: the behavioral fingerprints of an attack, not just the infrastructure it runs on. ",{"data":30415,"content":30419,"nodeType":996},{"target":30416},{"sys":30417},{"id":30418,"type":1001,"linkType":1002},"5jR3YVUiusHGnXDOyrgYpr",[],{"data":30421,"content":30422,"nodeType":860},{},[30423],{"data":30424,"marks":30425,"value":30426,"nodeType":864},{},[],"Instead of blocking based on known-bad domains, URLs, and IPs, our detections are built around user-level and page-level behaviors like what scripts load, how redirects behave, what events fire, what actions a user takes and what happens next, etc. (In fact, Push detections don’t even use any infrastructure-based IOCs, though customers can write their own custom detections if they have a specific IOC they’re keeping an eye on.)",{"data":30428,"content":30429,"nodeType":860},{},[30430,30435,30446],{"data":30431,"marks":30432,"value":30434,"nodeType":864},{},[30433],{"type":899},"All the detections we write would survive infrastructure rotation by adversaries, and many of our existing detections have caught never-before-seen evolutions in TTPs. That’s because we focus on the top of the ",{"data":30436,"content":30440,"nodeType":5064},{"target":30437},{"sys":30438},{"id":30439,"type":1001,"linkType":1002},"1qegIy4rMdm5XZXnIEoKpE",[30441],{"data":30442,"marks":30443,"value":30445,"nodeType":864},{},[30444],{"type":899},"Pyramid of Pain",{"data":30447,"marks":30448,"value":30450,"nodeType":864},{},[30449],{"type":899},", the indicators that are hardest for attackers to change.",{"data":30452,"content":30453,"nodeType":860},{},[30454],{"data":30455,"marks":30456,"value":30457,"nodeType":864},{},[],"This focus on detecting TTPs has always been our approach. But with the acceleration in both attack types and the ease with which adversaries rotate infrastructure, we needed to build capabilities that scaled our knowledge. ",{"data":30459,"content":30460,"nodeType":860},{},[30461],{"data":30462,"marks":30463,"value":30464,"nodeType":864},{},[],"We did this not by replacing researchers, but by continuously activating their expertise. You can hear what our CEO and Co-founder Adam had to say about this below. ",{"data":30466,"content":30470,"nodeType":996},{"target":30467},{"sys":30468},{"id":30469,"type":1001,"linkType":1002},"C9gr4nF3f6CW45Aol9xij",[],{"data":30472,"content":30473,"nodeType":1005},{},[],{"data":30475,"content":30476,"nodeType":1009},{},[30477],{"data":30478,"marks":30479,"value":30481,"nodeType":864},{},[30480],{"type":899},"Core principles for agentic threat hunting",{"data":30483,"content":30484,"nodeType":860},{},[30485],{"data":30486,"marks":30487,"value":30488,"nodeType":864},{},[],"Three principles make Push's agentic threat hunting and detection engineering pipeline work:",{"data":30490,"content":30491,"nodeType":1312},{},[30492],{"data":30493,"marks":30494,"value":30496,"nodeType":864},{},[30495],{"type":899},"Context matters more than custom models",{"data":30498,"content":30499,"nodeType":860},{},[30500],{"data":30501,"marks":30502,"value":30503,"nodeType":864},{},[],"We’re not AI researchers; we’re security researchers — we aren't trying to compete in building the most intelligent models. And in our view, AI models are quickly becoming commoditized like cloud infrastructure, anyway. Luckily, the commercial models today already excel at understanding web code. We just need to harness their power with our expertise.",{"data":30505,"content":30506,"nodeType":860},{},[30507,30511,30516],{"data":30508,"marks":30509,"value":30510,"nodeType":864},{},[],"So at Push, we use a variety of commercial AI models and tools in complementary ways. What matters most is the telemetry they analyze, and that’s where Push’s existing product infrastructure shines: We’re already deployed into over ",{"data":30512,"marks":30513,"value":30515,"nodeType":864},{},[30514],{"type":899},"3 million browsers worldwide",{"data":30517,"marks":30518,"value":30519,"nodeType":864},{},[],", and the Push browser extension includes a component that operates as a flight recorder to locally record everything that matters inside a browser session.",{"data":30521,"content":30522,"nodeType":860},{},[30523],{"data":30524,"marks":30525,"value":30526,"nodeType":864},{},[],"This universe of metadata — DOM elements, tab context, script execution, network traffic, user actions, credential entry, etc. — becomes the searchable corpus for hunts. Metadata is stored locally in users’ browsers and only queried during targeted threat hunts. ",{"data":30528,"content":30529,"nodeType":860},{},[30530],{"data":30531,"marks":30532,"value":30533,"nodeType":864},{},[],"This approach avoids dragnet collection of sensitive data. Instead, we focus on collecting metadata and distilling that into patterns and insights that provide context for agents to perform their analysis. This means that Push also does not train or fine-tune models on customer data.",{"data":30535,"content":30536,"nodeType":1312},{},[30537],{"data":30538,"marks":30539,"value":30541,"nodeType":864},{},[30540],{"type":899},"Agents are only as good as the context you give them. Good context is researcher-led",{"data":30543,"content":30544,"nodeType":860},{},[30545],{"data":30546,"marks":30547,"value":30548,"nodeType":864},{},[],"AI agents don’t know how to identify the TTPs of browser-based attacks until you give them the right context, and Push researchers have spent years unpacking these techniques and tools. Agents at Push consume our internal knowledge base of identified TTPs, and both humans and agents perform meta-analyses to check their work. The agents have access to large libraries of traces of human interactions with real phishing kits. This is a powerful dataset to build on.",{"data":30550,"content":30551,"nodeType":860},{},[30552],{"data":30553,"marks":30554,"value":30555,"nodeType":864},{},[],"When we don’t get the results we want from AI models, the question is “What context is it missing? What does our human team know that the agents don’t, and how can we give them that context — do they need data, tools, better workflows?” That closes the gap in performance and keeps quality high.",{"data":30557,"content":30558,"nodeType":1312},{},[30559],{"data":30560,"marks":30561,"value":30563,"nodeType":864},{},[30562],{"type":899},"Integrated architecture that makes agentic AI the throughput layer, not a bolt-on",{"data":30565,"content":30566,"nodeType":860},{},[30567],{"data":30568,"marks":30569,"value":30570,"nodeType":864},{},[],"The constraint we’re trying to break by using AI isn’t knowledge, it’s throughput. Our researchers deeply understand the techniques and tools. An agentic pipeline can apply that understanding continuously across millions of browsers and trillions of events, ingest new external signals, generate hunt hypotheses, triage results, and return only the findings that warrant escalation.",{"data":30572,"content":30573,"nodeType":860},{},[30574],{"data":30575,"marks":30576,"value":30577,"nodeType":864},{},[],"This approach relies on tight integration of our product and our agentic workflows. We’ll take a closer look at that in the next section.",{"data":30579,"content":30580,"nodeType":1005},{},[],{"data":30582,"content":30583,"nodeType":1009},{},[30584],{"data":30585,"marks":30586,"value":30588,"nodeType":864},{},[30587],{"type":899},"How the agentic detection pipeline runs",{"data":30590,"content":30591,"nodeType":860},{},[30592],{"data":30593,"marks":30594,"value":30595,"nodeType":864},{},[],"Now let’s look at how agentic threat detection actually works, and some of the emerging best practices we’ve identified. We'll cover two example hunts, one initiated autonomously by the agents themselves, and one by our research team. ",{"data":30597,"content":30598,"nodeType":1312},{},[30599],{"data":30600,"marks":30601,"value":30603,"nodeType":864},{},[30602],{"type":899},"Example 1: Autonomous threat hunt",{"data":30605,"content":30606,"nodeType":860},{},[30607],{"data":30608,"marks":30609,"value":30610,"nodeType":864},{},[],"Push’s threat hunting pipeline ingested context from research articles describing a new attack technique, and an agent developed hypotheses on what to hunt for across Push’s install base to identify instances of this attack. ",{"data":30612,"content":30613,"nodeType":860},{},[30614],{"data":30615,"marks":30616,"value":30617,"nodeType":864},{},[],"The agent crafted detection queries and then refined them to reduce false positives. The successful query ran across stored metadata and returned results, validating that there were zero false positives. ",{"data":30619,"content":30620,"nodeType":860},{},[30621],{"data":30622,"marks":30623,"value":30624,"nodeType":864},{},[],"The validated query became a scheduled job that runs on a regular cadence to monitor for potentially malicious signals. A triage agent then received any matches, did an initial analysis, and passed anything that looked suspicious to another agent to perform deeper analysis. This deep analysis agent wields the full investigative toolkit that a human researcher would — using Push’s internal knowledge base, domain age and registration analysis, URLScan and whois lookups, DOM image analysis, and contextual analysis of page-level and user-level behaviors, etc.",{"data":30626,"content":30627,"nodeType":860},{},[30628],{"data":30629,"marks":30630,"value":30631,"nodeType":864},{},[],"Within a few minutes, it can filter a thousand or more signals in a hunt trace down to a handful with meaning and provide an actionable assessment. Then, once the TTP was well-understood, other agents wrote and refined detections that can raise alerts for customers when an event of this type is seen. The Push platform immediately applies the customer’s configured security controls, such as blocking users from interacting with malicious pages.",{"data":30633,"content":30634,"nodeType":1312},{},[30635],{"data":30636,"marks":30637,"value":30639,"nodeType":864},{},[30638],{"type":899},"Example 2: Human-initiated threat hunt",{"data":30641,"content":30642,"nodeType":860},{},[30643],{"data":30644,"marks":30645,"value":30646,"nodeType":864},{},[],"Now, going back to the example from the beginning of the article: InstallFix. This hunt started with a thorny problem our research team needed to solve: How to detect bad things downstream of a user interacting with a Google ad? We needed a way to pinpoint the bad links from the good ones.",{"data":30648,"content":30649,"nodeType":860},{},[30650,30654,30659,30662,30667,30670,30675],{"data":30651,"marks":30652,"value":30653,"nodeType":864},{},[],"Our researchers collaborated with agents to formulate the right parameters for hunt queries, taking into account that good ads are normally bought by companies with marketing budgets, so therefore ads will be expected to redirect to pages hosted on custom domains, not shared domains like ",{"data":30655,"marks":30656,"value":30658,"nodeType":864},{},[30657],{"type":899},"*pages.dev",{"data":30660,"marks":30661,"value":3731,"nodeType":864},{},[],{"data":30663,"marks":30664,"value":30666,"nodeType":864},{},[30665],{"type":899},"*workers.dev",{"data":30668,"marks":30669,"value":3731,"nodeType":864},{},[],{"data":30671,"marks":30672,"value":30674,"nodeType":864},{},[30673],{"type":899},"*squarespace.com",{"data":30676,"marks":30677,"value":30678,"nodeType":864},{},[],", etc.",{"data":30680,"content":30681,"nodeType":860},{},[30682],{"data":30683,"marks":30684,"value":30685,"nodeType":864},{},[],"Our AI agents already understood key TTPs that indicated potential maliciousness on a page: password prompts, file downloads, OAuth integrations, clipboard copies, and similar user prompts that are frequently abused.",{"data":30687,"content":30688,"nodeType":860},{},[30689],{"data":30690,"marks":30691,"value":30692,"nodeType":864},{},[],"The agent ran several queries that returned matching browsing traces — the term we use for sequences of events in a session or tab context — where the user clicked a Google ad, was redirected to a page on a shared hosting domain, and then clicked a button to copy content to their clipboard.",{"data":30694,"content":30698,"nodeType":996},{"target":30695},{"sys":30696},{"id":30697,"type":1001,"linkType":1002},"4IWOrWuvbwzWRJUkINiwKH",[],{"data":30700,"content":30701,"nodeType":860},{},[30702],{"data":30703,"marks":30704,"value":30705,"nodeType":864},{},[],"We got back high-fidelity findings and then tuned the query into a continuous detection that leveraged existing detection logic around related techniques. This process also effectively back-tests new detections, so we know we’re not going to generate a lot of false positives. Result: A new detection against a new technique, plus several improvements to existing detections.",{"data":30707,"content":30708,"nodeType":1312},{},[30709],{"data":30710,"marks":30711,"value":30713,"nodeType":864},{},[30712],{"type":899},"What infrastructure is needed for agentic threat hunting?",{"data":30715,"content":30716,"nodeType":860},{},[30717],{"data":30718,"marks":30719,"value":30720,"nodeType":864},{},[],"Both of these examples illustrate the end-to-end workflows supported by this pipeline. From an infrastructure perspective, you can think about the pipeline as composed of:",{"data":30722,"content":30723,"nodeType":941},{},[30724,30739,30754,30769,30784],{"data":30725,"content":30726,"nodeType":945},{},[30727],{"data":30728,"content":30729,"nodeType":860},{},[30730,30735],{"data":30731,"marks":30732,"value":30734,"nodeType":864},{},[30733],{"type":899},"A flight recorder: ",{"data":30736,"marks":30737,"value":30738,"nodeType":864},{},[],"The Push extension-powered capability that collects and locally stores browser event metadata from users’ browsers.",{"data":30740,"content":30741,"nodeType":945},{},[30742],{"data":30743,"content":30744,"nodeType":860},{},[30745,30750],{"data":30746,"marks":30747,"value":30749,"nodeType":864},{},[30748],{"type":899},"A knowledge base:",{"data":30751,"marks":30752,"value":30753,"nodeType":864},{},[]," Structured knowledge about what Push knows about TTPs and its existing body of detection logic, as well as externally sourced signals of new attack trends.",{"data":30755,"content":30756,"nodeType":945},{},[30757],{"data":30758,"content":30759,"nodeType":860},{},[30760,30765],{"data":30761,"marks":30762,"value":30764,"nodeType":864},{},[30763],{"type":899},"Agents as tools: ",{"data":30766,"marks":30767,"value":30768,"nodeType":864},{},[],"Role-segmented agents that work as a team to triage, investigate, develop hunt queries, return analyses, write detections, and review each others’ work for completeness and accuracy.",{"data":30770,"content":30771,"nodeType":945},{},[30772],{"data":30773,"content":30774,"nodeType":860},{},[30775,30780],{"data":30776,"marks":30777,"value":30779,"nodeType":864},{},[30778],{"type":899},"Humans in the loop: ",{"data":30781,"marks":30782,"value":30783,"nodeType":864},{},[],"Human researchers who collaborate with agents to initiate hunts and tune detections.",{"data":30785,"content":30786,"nodeType":945},{},[30787],{"data":30788,"content":30789,"nodeType":860},{},[30790,30795],{"data":30791,"marks":30792,"value":30794,"nodeType":864},{},[30793],{"type":899},"Platform controls: ",{"data":30796,"marks":30797,"value":30798,"nodeType":864},{},[],"The Push administrator-configured controls that specify how to respond to detected events like AiTM phishing, tuneable by scope, user groups, browser profiles, apps, etc.",{"data":30800,"content":30804,"nodeType":996},{"target":30801},{"sys":30802},{"id":30803,"type":1001,"linkType":1002},"7FY0vCBUXOt4vnudFuKALC",[],{"data":30806,"content":30807,"nodeType":1312},{},[30808],{"data":30809,"marks":30810,"value":30812,"nodeType":864},{},[30811],{"type":899},"What are the best practices for agentic threat detection?",{"data":30814,"content":30815,"nodeType":860},{},[30816,30820,30825],{"data":30817,"marks":30818,"value":30819,"nodeType":864},{},[],"To be effective, agents must specialize and focus. This is the ",{"data":30821,"marks":30822,"value":30824,"nodeType":864},{},[30823],{"type":899},"agents as tools",{"data":30826,"marks":30827,"value":30828,"nodeType":864},{},[]," concept. When we’re asking AI agents to take massive amounts of data and make a high-level decision about a signal in observed browser events, they must work as a team, finding intelligent ways to condense information without losing important context or hallucinating.",{"data":30830,"content":30831,"nodeType":860},{},[30832],{"data":30833,"marks":30834,"value":30835,"nodeType":864},{},[],"Creating a hierarchy of agent jobs — including agents to perform meta-analyses to catch mistakes and verify conclusions — makes the agents effective by giving them a manageable focus that controls the size of context windows.",{"data":30837,"content":30841,"nodeType":996},{"target":30838},{"sys":30839},{"id":30840,"type":1001,"linkType":1002},"3fzJCknMUmh4Z7YnhBSbsT",[],{"data":30843,"content":30844,"nodeType":860},{},[30845],{"data":30846,"marks":30847,"value":30848,"nodeType":864},{},[],"Creating an agentic workflow requires operationalizing your internal knowledge in a repeatable and trustworthy way. Sharing rich context from human discoveries is the key to getting the best results out of agents. ",{"data":30850,"content":30851,"nodeType":860},{},[30852,30856,30861],{"data":30853,"marks":30854,"value":30855,"nodeType":864},{},[],"It's vital too that the agent uses ",{"data":30857,"marks":30858,"value":30860,"nodeType":864},{},[30859],{"type":899},"privacy-preserving methods and infrastructure.",{"data":30862,"marks":30863,"value":30864,"nodeType":864},{},[]," The Push agent is designed to respect customer and user privacy while enabling high-fidelity detections. We do this by collecting broad browser metadata but storing it locally in users’ browsers and only querying that metadata during active threat hunting investigations.",{"data":30866,"content":30867,"nodeType":1005},{},[],{"data":30869,"content":30870,"nodeType":1009},{},[30871],{"data":30872,"marks":30873,"value":30875,"nodeType":864},{},[30874],{"type":899},"The compounding effect and how it benefits Push customers",{"data":30877,"content":30878,"nodeType":860},{},[30879],{"data":30880,"marks":30881,"value":30882,"nodeType":864},{},[],"At Push, we think about our detection capability as two learning loops with a compounding effect: An inner loop that serves as our real-time detection and response engine for known attacker techniques, and an outer loop that is the continuous learning our agents do as they hunt for new threats, analyze emerging behaviors, and create new detections. ",{"data":30884,"content":30885,"nodeType":860},{},[30886],{"data":30887,"marks":30888,"value":30889,"nodeType":864},{},[],"The outer loop feeds the inner loop, and vice versa.",{"data":30891,"content":30895,"nodeType":996},{"target":30892},{"sys":30893},{"id":30894,"type":1001,"linkType":1002},"1Jjqll7IIX2QRxN37gjFMH",[],{"data":30897,"content":30898,"nodeType":860},{},[30899],{"data":30900,"marks":30901,"value":30902,"nodeType":864},{},[],"Customers benefit from this approach because it means they:",{"data":30904,"content":30905,"nodeType":941},{},[30906,30927,30937],{"data":30907,"content":30908,"nodeType":945},{},[30909],{"data":30910,"content":30911,"nodeType":860},{},[30912,30916,30923],{"data":30913,"marks":30914,"value":30915,"nodeType":864},{},[],"Regularly receive ready-made detections against both known and emerging browser-based threats, without having to write their own detections. (Push also provides the ability to write your own ",{"data":30917,"content":30919,"nodeType":883},{"uri":30918},"/help/audience/engineering/resources/custom-detections",[30920],{"data":30921,"marks":30922,"value":1578,"nodeType":864},{},[],{"data":30924,"marks":30925,"value":30926,"nodeType":864},{},[],", too, for environment-specific use cases.)",{"data":30928,"content":30929,"nodeType":945},{},[30930],{"data":30931,"content":30932,"nodeType":860},{},[30933],{"data":30934,"marks":30935,"value":30936,"nodeType":864},{},[],"Can configure Push’s response actions based on their security goals and environment. Agents act as the threat-hunting and detection engineering team; Push customers set the thresholds for how they want to respond. For example, customers can use Push controls to block all AiTM phishing attacks (or even carve out exceptions for their own incident responders to be able to visit malicious pages with just a warning), and agents continually feed new indicators into detection logic for that class of attack.",{"data":30938,"content":30939,"nodeType":945},{},[30940],{"data":30941,"content":30942,"nodeType":860},{},[30943],{"data":30944,"marks":30945,"value":30946,"nodeType":864},{},[],"Get pre-digested and actionable intelligence from every detection, with extremely high fidelity.",{"data":30948,"content":30949,"nodeType":860},{},[30950],{"data":30951,"marks":30952,"value":30953,"nodeType":864},{},[],"This all equates to your own advanced browser threat protection, without requiring the specialized in-house expertise we’ve spent years building.",{"data":30955,"content":30956,"nodeType":860},{},[30957],{"data":30958,"marks":30959,"value":30960,"nodeType":864},{},[],"If you’re a Push customer, you already know that we regularly collaborate with security teams to identify and refine detection use cases, and assist with investigations. In the past few months alone, we’ve worked closely with teams targeted by device code phishing, and InstallFix and ClickFix campaigns, among others. ",{"data":30962,"content":30963,"nodeType":860},{},[30964],{"data":30965,"marks":30966,"value":30967,"nodeType":864},{},[],"If you’re not a customer and are curious about how Push’s agentic threat hunting and detection engineering capabilities can address your use cases, please get in touch.",{"data":30969,"content":30973,"nodeType":996},{"target":30970},{"sys":30971},{"id":30972,"type":1001,"linkType":1002},"607jrBjlD1vtcbkDfD04DE",[],{"data":30975,"content":30976,"nodeType":1005},{},[],{"data":30978,"content":30979,"nodeType":1009},{},[30980],{"data":30981,"marks":30982,"value":5063,"nodeType":864},{},[30983],{"type":899},{"data":30985,"content":30986,"nodeType":860},{},[30987],{"data":30988,"marks":30989,"value":1682,"nodeType":864},{},[],{"data":30991,"content":30992,"nodeType":860},{},[30993],{"data":30994,"marks":30995,"value":1689,"nodeType":864},{},[],{"data":30997,"content":30998,"nodeType":860},{},[30999,31002,31009],{"data":31000,"marks":31001,"value":2707,"nodeType":864},{},[],{"data":31003,"content":31005,"nodeType":883},{"uri":31004},"/demo",[31006],{"data":31007,"marks":31008,"value":2715,"nodeType":864},{},[],{"data":31010,"marks":31011,"value":2719,"nodeType":864},{},[],"Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline","How we built an end-to-end threat hunting and detection engineering capability at Push that uses AI agents as a force multiplier.","2026-05-12T00:00:00.000Z","can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",{"items":31017},[31018,31020],{"sys":31019,"name":15033},{"id":15032},{"sys":31021,"name":342},{"id":15029},{"items":31023},[31024],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":31025},{"url":853},{"__typename":2059,"sys":31027,"content":31028,"title":22943,"synopsis":22944,"hashTags":59,"publishedDate":22945,"slug":22946,"tagsCollection":31849,"authorsCollection":31855},{"id":21980},{"json":31029},{"data":31030,"content":31031,"nodeType":856},{},[31032,31054,31078,31111,31144,31149,31159,31162,31169,31211,31217,31236,31241,31244,31251,31275,31281,31288,31293,31296,31303,31309,31324,31330,31363,31369,31372,31379,31394,31436,31439,31446,31461,31476,31483,31489,31499,31509,31519,31529,31544,31551,31557,31560,31566,31572,31587,31590,31597,31612,31843],{"data":31033,"content":31034,"nodeType":860},{},[31035,31038,31044,31047,31051],{"data":31036,"marks":31037,"value":21991,"nodeType":864},{},[],{"data":31039,"content":31040,"nodeType":883},{"uri":18024},[31041],{"data":31042,"marks":31043,"value":18027,"nodeType":864},{},[],{"data":31045,"marks":31046,"value":22001,"nodeType":864},{},[],{"data":31048,"marks":31049,"value":22006,"nodeType":864},{},[31050],{"type":899},{"data":31052,"marks":31053,"value":22010,"nodeType":864},{},[],{"data":31055,"content":31056,"nodeType":860},{},[31057,31060,31066,31069,31075],{"data":31058,"marks":31059,"value":22017,"nodeType":864},{},[],{"data":31061,"content":31062,"nodeType":883},{"uri":22020},[31063],{"data":31064,"marks":31065,"value":22025,"nodeType":864},{},[],{"data":31067,"marks":31068,"value":22029,"nodeType":864},{},[],{"data":31070,"content":31071,"nodeType":883},{"uri":22032},[31072],{"data":31073,"marks":31074,"value":22037,"nodeType":864},{},[],{"data":31076,"marks":31077,"value":22041,"nodeType":864},{},[],{"data":31079,"content":31080,"nodeType":860},{},[31081,31084,31090,31093,31099,31102,31108],{"data":31082,"marks":31083,"value":22048,"nodeType":864},{},[],{"data":31085,"content":31086,"nodeType":883},{"uri":22051},[31087],{"data":31088,"marks":31089,"value":22056,"nodeType":864},{},[],{"data":31091,"marks":31092,"value":22060,"nodeType":864},{},[],{"data":31094,"content":31095,"nodeType":883},{"uri":22063},[31096],{"data":31097,"marks":31098,"value":22068,"nodeType":864},{},[],{"data":31100,"marks":31101,"value":22072,"nodeType":864},{},[],{"data":31103,"content":31104,"nodeType":883},{"uri":18562},[31105],{"data":31106,"marks":31107,"value":22079,"nodeType":864},{},[],{"data":31109,"marks":31110,"value":22083,"nodeType":864},{},[],{"data":31112,"content":31113,"nodeType":860},{},[31114,31117,31123,31126,31132,31135,31141],{"data":31115,"marks":31116,"value":22090,"nodeType":864},{},[],{"data":31118,"content":31119,"nodeType":883},{"uri":22093},[31120],{"data":31121,"marks":31122,"value":22098,"nodeType":864},{},[],{"data":31124,"marks":31125,"value":22102,"nodeType":864},{},[],{"data":31127,"content":31128,"nodeType":883},{"uri":22105},[31129],{"data":31130,"marks":31131,"value":22110,"nodeType":864},{},[],{"data":31133,"marks":31134,"value":22114,"nodeType":864},{},[],{"data":31136,"content":31137,"nodeType":883},{"uri":22117},[31138],{"data":31139,"marks":31140,"value":22122,"nodeType":864},{},[],{"data":31142,"marks":31143,"value":22126,"nodeType":864},{},[],{"data":31145,"content":31148,"nodeType":996},{"target":31146},{"sys":31147},{"id":22131,"type":1001,"linkType":1002},[],{"data":31150,"content":31151,"nodeType":860},{},[31152,31156],{"data":31153,"marks":31154,"value":22140,"nodeType":864},{},[31155],{"type":899},{"data":31157,"marks":31158,"value":22144,"nodeType":864},{},[],{"data":31160,"content":31161,"nodeType":1005},{},[],{"data":31163,"content":31164,"nodeType":1009},{},[31165],{"data":31166,"marks":31167,"value":22155,"nodeType":864},{},[31168],{"type":899},{"data":31170,"content":31171,"nodeType":860},{},[31172,31175,31181,31184,31190,31193,31199,31202,31208],{"data":31173,"marks":31174,"value":22162,"nodeType":864},{},[],{"data":31176,"content":31177,"nodeType":883},{"uri":22165},[31178],{"data":31179,"marks":31180,"value":22170,"nodeType":864},{},[],{"data":31182,"marks":31183,"value":12989,"nodeType":864},{},[],{"data":31185,"content":31186,"nodeType":883},{"uri":22176},[31187],{"data":31188,"marks":31189,"value":22181,"nodeType":864},{},[],{"data":31191,"marks":31192,"value":22185,"nodeType":864},{},[],{"data":31194,"content":31195,"nodeType":883},{"uri":22063},[31196],{"data":31197,"marks":31198,"value":22192,"nodeType":864},{},[],{"data":31200,"marks":31201,"value":22196,"nodeType":864},{},[],{"data":31203,"content":31204,"nodeType":883},{"uri":14133},[31205],{"data":31206,"marks":31207,"value":22203,"nodeType":864},{},[],{"data":31209,"marks":31210,"value":2924,"nodeType":864},{},[],{"data":31212,"content":31213,"nodeType":860},{},[31214],{"data":31215,"marks":31216,"value":22213,"nodeType":864},{},[],{"data":31218,"content":31219,"nodeType":860},{},[31220,31223,31229,31232],{"data":31221,"marks":31222,"value":22220,"nodeType":864},{},[],{"data":31224,"content":31225,"nodeType":883},{"uri":14133},[31226],{"data":31227,"marks":31228,"value":22227,"nodeType":864},{},[],{"data":31230,"marks":31231,"value":22231,"nodeType":864},{},[],{"data":31233,"marks":31234,"value":22236,"nodeType":864},{},[31235],{"type":899},{"data":31237,"content":31240,"nodeType":996},{"target":31238},{"sys":31239},{"id":22241,"type":1001,"linkType":1002},[],{"data":31242,"content":31243,"nodeType":1005},{},[],{"data":31245,"content":31246,"nodeType":1009},{},[31247],{"data":31248,"marks":31249,"value":22253,"nodeType":864},{},[31250],{"type":899},{"data":31252,"content":31253,"nodeType":860},{},[31254,31257,31263,31266,31272],{"data":31255,"marks":31256,"value":2761,"nodeType":864},{},[],{"data":31258,"content":31259,"nodeType":883},{"uri":22262},[31260],{"data":31261,"marks":31262,"value":22267,"nodeType":864},{},[],{"data":31264,"marks":31265,"value":22271,"nodeType":864},{},[],{"data":31267,"content":31268,"nodeType":883},{"uri":18562},[31269],{"data":31270,"marks":31271,"value":22278,"nodeType":864},{},[],{"data":31273,"marks":31274,"value":22282,"nodeType":864},{},[],{"data":31276,"content":31277,"nodeType":860},{},[31278],{"data":31279,"marks":31280,"value":22289,"nodeType":864},{},[],{"data":31282,"content":31283,"nodeType":860},{},[31284],{"data":31285,"marks":31286,"value":22297,"nodeType":864},{},[31287],{"type":899},{"data":31289,"content":31292,"nodeType":996},{"target":31290},{"sys":31291},{"id":22302,"type":1001,"linkType":1002},[],{"data":31294,"content":31295,"nodeType":1005},{},[],{"data":31297,"content":31298,"nodeType":1009},{},[31299],{"data":31300,"marks":31301,"value":22314,"nodeType":864},{},[31302],{"type":899},{"data":31304,"content":31305,"nodeType":860},{},[31306],{"data":31307,"marks":31308,"value":22321,"nodeType":864},{},[],{"data":31310,"content":31311,"nodeType":860},{},[31312,31315,31321],{"data":31313,"marks":31314,"value":2761,"nodeType":864},{},[],{"data":31316,"content":31317,"nodeType":883},{"uri":22330},[31318],{"data":31319,"marks":31320,"value":22335,"nodeType":864},{},[],{"data":31322,"marks":31323,"value":22339,"nodeType":864},{},[],{"data":31325,"content":31326,"nodeType":860},{},[31327],{"data":31328,"marks":31329,"value":22346,"nodeType":864},{},[],{"data":31331,"content":31332,"nodeType":860},{},[31333,31336,31342,31345,31351,31354,31360],{"data":31334,"marks":31335,"value":22353,"nodeType":864},{},[],{"data":31337,"content":31338,"nodeType":883},{"uri":22356},[31339],{"data":31340,"marks":31341,"value":22361,"nodeType":864},{},[],{"data":31343,"marks":31344,"value":22365,"nodeType":864},{},[],{"data":31346,"content":31347,"nodeType":883},{"uri":22368},[31348],{"data":31349,"marks":31350,"value":22373,"nodeType":864},{},[],{"data":31352,"marks":31353,"value":22377,"nodeType":864},{},[],{"data":31355,"content":31356,"nodeType":883},{"uri":4103},[31357],{"data":31358,"marks":31359,"value":18123,"nodeType":864},{},[],{"data":31361,"marks":31362,"value":22387,"nodeType":864},{},[],{"data":31364,"content":31365,"nodeType":860},{},[31366],{"data":31367,"marks":31368,"value":22394,"nodeType":864},{},[],{"data":31370,"content":31371,"nodeType":1005},{},[],{"data":31373,"content":31374,"nodeType":1009},{},[31375],{"data":31376,"marks":31377,"value":22405,"nodeType":864},{},[31378],{"type":899},{"data":31380,"content":31381,"nodeType":860},{},[31382,31385,31391],{"data":31383,"marks":31384,"value":22412,"nodeType":864},{},[],{"data":31386,"content":31387,"nodeType":883},{"uri":22415},[31388],{"data":31389,"marks":31390,"value":22420,"nodeType":864},{},[],{"data":31392,"marks":31393,"value":22424,"nodeType":864},{},[],{"data":31395,"content":31396,"nodeType":860},{},[31397,31400,31406,31409,31415,31418,31424,31427,31433],{"data":31398,"marks":31399,"value":22431,"nodeType":864},{},[],{"data":31401,"content":31402,"nodeType":883},{"uri":22434},[31403],{"data":31404,"marks":31405,"value":22439,"nodeType":864},{},[],{"data":31407,"marks":31408,"value":22443,"nodeType":864},{},[],{"data":31410,"content":31411,"nodeType":883},{"uri":22446},[31412],{"data":31413,"marks":31414,"value":22451,"nodeType":864},{},[],{"data":31416,"marks":31417,"value":22455,"nodeType":864},{},[],{"data":31419,"content":31420,"nodeType":883},{"uri":22458},[31421],{"data":31422,"marks":31423,"value":22463,"nodeType":864},{},[],{"data":31425,"marks":31426,"value":22467,"nodeType":864},{},[],{"data":31428,"content":31429,"nodeType":883},{"uri":22470},[31430],{"data":31431,"marks":31432,"value":22475,"nodeType":864},{},[],{"data":31434,"marks":31435,"value":22479,"nodeType":864},{},[],{"data":31437,"content":31438,"nodeType":1005},{},[],{"data":31440,"content":31441,"nodeType":1009},{},[31442],{"data":31443,"marks":31444,"value":22490,"nodeType":864},{},[31445],{"type":899},{"data":31447,"content":31448,"nodeType":860},{},[31449,31452,31458],{"data":31450,"marks":31451,"value":22497,"nodeType":864},{},[],{"data":31453,"content":31454,"nodeType":883},{"uri":3259},[31455],{"data":31456,"marks":31457,"value":22504,"nodeType":864},{},[],{"data":31459,"marks":31460,"value":22508,"nodeType":864},{},[],{"data":31462,"content":31463,"nodeType":860},{},[31464,31467,31473],{"data":31465,"marks":31466,"value":22515,"nodeType":864},{},[],{"data":31468,"content":31469,"nodeType":883},{"uri":22518},[31470],{"data":31471,"marks":31472,"value":315,"nodeType":864},{},[],{"data":31474,"marks":31475,"value":22526,"nodeType":864},{},[],{"data":31477,"content":31478,"nodeType":1312},{},[31479],{"data":31480,"marks":31481,"value":8788,"nodeType":864},{},[31482],{"type":899},{"data":31484,"content":31485,"nodeType":860},{},[31486],{"data":31487,"marks":31488,"value":22540,"nodeType":864},{},[],{"data":31490,"content":31491,"nodeType":860},{},[31492,31496],{"data":31493,"marks":31494,"value":22548,"nodeType":864},{},[31495],{"type":899},{"data":31497,"marks":31498,"value":22552,"nodeType":864},{},[],{"data":31500,"content":31501,"nodeType":860},{},[31502,31506],{"data":31503,"marks":31504,"value":22560,"nodeType":864},{},[31505],{"type":899},{"data":31507,"marks":31508,"value":22564,"nodeType":864},{},[],{"data":31510,"content":31511,"nodeType":860},{},[31512,31516],{"data":31513,"marks":31514,"value":22572,"nodeType":864},{},[31515],{"type":899},{"data":31517,"marks":31518,"value":22576,"nodeType":864},{},[],{"data":31520,"content":31521,"nodeType":860},{},[31522,31526],{"data":31523,"marks":31524,"value":22584,"nodeType":864},{},[31525],{"type":899},{"data":31527,"marks":31528,"value":22588,"nodeType":864},{},[],{"data":31530,"content":31531,"nodeType":860},{},[31532,31535,31541],{"data":31533,"marks":31534,"value":21,"nodeType":864},{},[],{"data":31536,"content":31537,"nodeType":883},{"uri":22597},[31538],{"data":31539,"marks":31540,"value":22602,"nodeType":864},{},[],{"data":31542,"marks":31543,"value":21,"nodeType":864},{},[],{"data":31545,"content":31546,"nodeType":1312},{},[31547],{"data":31548,"marks":31549,"value":22613,"nodeType":864},{},[31550],{"type":899},{"data":31552,"content":31553,"nodeType":860},{},[31554],{"data":31555,"marks":31556,"value":22620,"nodeType":864},{},[],{"data":31558,"content":31559,"nodeType":1005},{},[],{"data":31561,"content":31562,"nodeType":860},{},[31563],{"data":31564,"marks":31565,"value":4855,"nodeType":864},{},[],{"data":31567,"content":31568,"nodeType":860},{},[31569],{"data":31570,"marks":31571,"value":1689,"nodeType":864},{},[],{"data":31573,"content":31574,"nodeType":860},{},[31575,31578,31584],{"data":31576,"marks":31577,"value":21,"nodeType":864},{},[],{"data":31579,"content":31580,"nodeType":883},{"uri":15655},[31581],{"data":31582,"marks":31583,"value":1703,"nodeType":864},{},[],{"data":31585,"marks":31586,"value":21,"nodeType":864},{},[],{"data":31588,"content":31589,"nodeType":1005},{},[],{"data":31591,"content":31592,"nodeType":1009},{},[31593],{"data":31594,"marks":31595,"value":22661,"nodeType":864},{},[31596],{"type":899},{"data":31598,"content":31599,"nodeType":860},{},[31600,31603,31609],{"data":31601,"marks":31602,"value":22668,"nodeType":864},{},[],{"data":31604,"content":31605,"nodeType":883},{"uri":18024},[31606],{"data":31607,"marks":31608,"value":22675,"nodeType":864},{},[],{"data":31610,"marks":31611,"value":22679,"nodeType":864},{},[],{"data":31613,"content":31614,"nodeType":4845},{},[31615,31658,31714,31757,31800],{"data":31616,"content":31617,"nodeType":4581},{},[31618,31628,31638,31648],{"data":31619,"content":31620,"nodeType":4569},{},[31621],{"data":31622,"content":31623,"nodeType":860},{},[31624],{"data":31625,"marks":31626,"value":22696,"nodeType":864},{},[31627],{"type":899},{"data":31629,"content":31630,"nodeType":4569},{},[31631],{"data":31632,"content":31633,"nodeType":860},{},[31634],{"data":31635,"marks":31636,"value":22707,"nodeType":864},{},[31637],{"type":899},{"data":31639,"content":31640,"nodeType":4569},{},[31641],{"data":31642,"content":31643,"nodeType":860},{},[31644],{"data":31645,"marks":31646,"value":22718,"nodeType":864},{},[31647],{"type":899},{"data":31649,"content":31650,"nodeType":4569},{},[31651],{"data":31652,"content":31653,"nodeType":860},{},[31654],{"data":31655,"marks":31656,"value":22729,"nodeType":864},{},[31657],{"type":899},{"data":31659,"content":31660,"nodeType":4581},{},[31661,31681,31690,31699],{"data":31662,"content":31663,"nodeType":4569},{},[31664],{"data":31665,"content":31666,"nodeType":860},{},[31667,31671,31674,31678],{"data":31668,"marks":31669,"value":22743,"nodeType":864},{},[31670],{"type":899},{"data":31672,"marks":31673,"value":22747,"nodeType":864},{},[],{"data":31675,"marks":31676,"value":22752,"nodeType":864},{},[31677],{"type":899},{"data":31679,"marks":31680,"value":22756,"nodeType":864},{},[],{"data":31682,"content":31683,"nodeType":4569},{},[31684],{"data":31685,"content":31686,"nodeType":860},{},[31687],{"data":31688,"marks":31689,"value":22766,"nodeType":864},{},[],{"data":31691,"content":31692,"nodeType":4569},{},[31693],{"data":31694,"content":31695,"nodeType":860},{},[31696],{"data":31697,"marks":31698,"value":22776,"nodeType":864},{},[],{"data":31700,"content":31701,"nodeType":4569},{},[31702,31708],{"data":31703,"content":31704,"nodeType":860},{},[31705],{"data":31706,"marks":31707,"value":22786,"nodeType":864},{},[],{"data":31709,"content":31710,"nodeType":860},{},[31711],{"data":31712,"marks":31713,"value":22793,"nodeType":864},{},[],{"data":31715,"content":31716,"nodeType":4581},{},[31717,31730,31739,31748],{"data":31718,"content":31719,"nodeType":4569},{},[31720],{"data":31721,"content":31722,"nodeType":860},{},[31723,31727],{"data":31724,"marks":31725,"value":22807,"nodeType":864},{},[31726],{"type":899},{"data":31728,"marks":31729,"value":22811,"nodeType":864},{},[],{"data":31731,"content":31732,"nodeType":4569},{},[31733],{"data":31734,"content":31735,"nodeType":860},{},[31736],{"data":31737,"marks":31738,"value":22821,"nodeType":864},{},[],{"data":31740,"content":31741,"nodeType":4569},{},[31742],{"data":31743,"content":31744,"nodeType":860},{},[31745],{"data":31746,"marks":31747,"value":22831,"nodeType":864},{},[],{"data":31749,"content":31750,"nodeType":4569},{},[31751],{"data":31752,"content":31753,"nodeType":860},{},[31754],{"data":31755,"marks":31756,"value":22841,"nodeType":864},{},[],{"data":31758,"content":31759,"nodeType":4581},{},[31760,31773,31782,31791],{"data":31761,"content":31762,"nodeType":4569},{},[31763],{"data":31764,"content":31765,"nodeType":860},{},[31766,31770],{"data":31767,"marks":31768,"value":22855,"nodeType":864},{},[31769],{"type":899},{"data":31771,"marks":31772,"value":22859,"nodeType":864},{},[],{"data":31774,"content":31775,"nodeType":4569},{},[31776],{"data":31777,"content":31778,"nodeType":860},{},[31779],{"data":31780,"marks":31781,"value":22869,"nodeType":864},{},[],{"data":31783,"content":31784,"nodeType":4569},{},[31785],{"data":31786,"content":31787,"nodeType":860},{},[31788],{"data":31789,"marks":31790,"value":22879,"nodeType":864},{},[],{"data":31792,"content":31793,"nodeType":4569},{},[31794],{"data":31795,"content":31796,"nodeType":860},{},[31797],{"data":31798,"marks":31799,"value":22889,"nodeType":864},{},[],{"data":31801,"content":31802,"nodeType":4581},{},[31803,31816,31825,31834],{"data":31804,"content":31805,"nodeType":4569},{},[31806],{"data":31807,"content":31808,"nodeType":860},{},[31809,31813],{"data":31810,"marks":31811,"value":22903,"nodeType":864},{},[31812],{"type":899},{"data":31814,"marks":31815,"value":22907,"nodeType":864},{},[],{"data":31817,"content":31818,"nodeType":4569},{},[31819],{"data":31820,"content":31821,"nodeType":860},{},[31822],{"data":31823,"marks":31824,"value":22766,"nodeType":864},{},[],{"data":31826,"content":31827,"nodeType":4569},{},[31828],{"data":31829,"content":31830,"nodeType":860},{},[31831],{"data":31832,"marks":31833,"value":22926,"nodeType":864},{},[],{"data":31835,"content":31836,"nodeType":4569},{},[31837],{"data":31838,"content":31839,"nodeType":860},{},[31840],{"data":31841,"marks":31842,"value":22936,"nodeType":864},{},[],{"data":31844,"content":31845,"nodeType":860},{},[31846],{"data":31847,"marks":31848,"value":21,"nodeType":864},{},[],{"items":31850},[31851,31853],{"sys":31852,"name":15033},{"id":15032},{"sys":31854,"name":342},{"id":15029},{"items":31856},[31857],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":31858},{"url":2740},{"__typename":2059,"sys":31860,"content":31861,"title":23465,"synopsis":23466,"hashTags":59,"publishedDate":23467,"slug":23468,"tagsCollection":32291,"authorsCollection":32297},{"id":22959},{"json":31862},{"data":31863,"content":31864,"nodeType":856},{},[31865,31872,31896,31901,31907,31922,31935,31938,31945,31958,31974,31994,31999,32012,32036,32041,32046,32059,32062,32069,32075,32082,32098,32111,32118,32140,32146,32153,32177,32183,32190,32196,32201,32204,32211,32217,32224,32229,32232,32239,32245,32251,32257,32267,32270,32276],{"data":31866,"content":31867,"nodeType":1009},{},[31868],{"data":31869,"marks":31870,"value":22971,"nodeType":864},{},[31871],{"type":899},{"data":31873,"content":31874,"nodeType":860},{},[31875,31878,31884,31887,31893],{"data":31876,"marks":31877,"value":22978,"nodeType":864},{},[],{"data":31879,"content":31880,"nodeType":883},{"uri":22981},[31881],{"data":31882,"marks":31883,"value":22986,"nodeType":864},{},[],{"data":31885,"marks":31886,"value":22990,"nodeType":864},{},[],{"data":31888,"content":31889,"nodeType":883},{"uri":22993},[31890],{"data":31891,"marks":31892,"value":22998,"nodeType":864},{},[],{"data":31894,"marks":31895,"value":23002,"nodeType":864},{},[],{"data":31897,"content":31900,"nodeType":996},{"target":31898},{"sys":31899},{"id":23007,"type":1001,"linkType":1002},[],{"data":31902,"content":31903,"nodeType":860},{},[31904],{"data":31905,"marks":31906,"value":23015,"nodeType":864},{},[],{"data":31908,"content":31909,"nodeType":860},{},[31910,31913,31919],{"data":31911,"marks":31912,"value":23022,"nodeType":864},{},[],{"data":31914,"content":31915,"nodeType":883},{"uri":23025},[31916],{"data":31917,"marks":31918,"value":23030,"nodeType":864},{},[],{"data":31920,"marks":31921,"value":23034,"nodeType":864},{},[],{"data":31923,"content":31924,"nodeType":860},{},[31925,31928,31932],{"data":31926,"marks":31927,"value":23041,"nodeType":864},{},[],{"data":31929,"marks":31930,"value":23046,"nodeType":864},{},[31931],{"type":899},{"data":31933,"marks":31934,"value":2924,"nodeType":864},{},[],{"data":31936,"content":31937,"nodeType":1005},{},[],{"data":31939,"content":31940,"nodeType":1009},{},[31941],{"data":31942,"marks":31943,"value":23060,"nodeType":864},{},[31944],{"type":899},{"data":31946,"content":31947,"nodeType":860},{},[31948,31951,31955],{"data":31949,"marks":31950,"value":23067,"nodeType":864},{},[],{"data":31952,"marks":31953,"value":23072,"nodeType":864},{},[31954],{"type":2246},{"data":31956,"marks":31957,"value":2924,"nodeType":864},{},[],{"data":31959,"content":31960,"nodeType":860},{},[31961,31964,31971],{"data":31962,"marks":31963,"value":23082,"nodeType":864},{},[],{"data":31965,"content":31966,"nodeType":883},{"uri":8804},[31967],{"data":31968,"marks":31969,"value":23090,"nodeType":864},{},[31970],{"type":1455},{"data":31972,"marks":31973,"value":23094,"nodeType":864},{},[],{"data":31975,"content":31976,"nodeType":860},{},[31977,31980,31984,31987,31991],{"data":31978,"marks":31979,"value":23101,"nodeType":864},{},[],{"data":31981,"marks":31982,"value":23106,"nodeType":864},{},[31983],{"type":899},{"data":31985,"marks":31986,"value":23110,"nodeType":864},{},[],{"data":31988,"marks":31989,"value":23115,"nodeType":864},{},[31990],{"type":2246},{"data":31992,"marks":31993,"value":23119,"nodeType":864},{},[],{"data":31995,"content":31998,"nodeType":996},{"target":31996},{"sys":31997},{"id":23124,"type":1001,"linkType":1002},[],{"data":32000,"content":32001,"nodeType":860},{},[32002,32005,32009],{"data":32003,"marks":32004,"value":23132,"nodeType":864},{},[],{"data":32006,"marks":32007,"value":23137,"nodeType":864},{},[32008],{"type":899},{"data":32010,"marks":32011,"value":23141,"nodeType":864},{},[],{"data":32013,"content":32014,"nodeType":860},{},[32015,32018,32024,32027,32033],{"data":32016,"marks":32017,"value":23148,"nodeType":864},{},[],{"data":32019,"content":32020,"nodeType":883},{"uri":23151},[32021],{"data":32022,"marks":32023,"value":23156,"nodeType":864},{},[],{"data":32025,"marks":32026,"value":23160,"nodeType":864},{},[],{"data":32028,"content":32029,"nodeType":883},{"uri":13067},[32030],{"data":32031,"marks":32032,"value":23167,"nodeType":864},{},[],{"data":32034,"marks":32035,"value":1774,"nodeType":864},{},[],{"data":32037,"content":32040,"nodeType":996},{"target":32038},{"sys":32039},{"id":23175,"type":1001,"linkType":1002},[],{"data":32042,"content":32045,"nodeType":996},{"target":32043},{"sys":32044},{"id":23181,"type":1001,"linkType":1002},[],{"data":32047,"content":32048,"nodeType":860},{},[32049,32052,32056],{"data":32050,"marks":32051,"value":23189,"nodeType":864},{},[],{"data":32053,"marks":32054,"value":23194,"nodeType":864},{},[32055],{"type":899},{"data":32057,"marks":32058,"value":23198,"nodeType":864},{},[],{"data":32060,"content":32061,"nodeType":1005},{},[],{"data":32063,"content":32064,"nodeType":1009},{},[32065],{"data":32066,"marks":32067,"value":23209,"nodeType":864},{},[32068],{"type":899},{"data":32070,"content":32071,"nodeType":860},{},[32072],{"data":32073,"marks":32074,"value":23216,"nodeType":864},{},[],{"data":32076,"content":32077,"nodeType":1312},{},[32078],{"data":32079,"marks":32080,"value":23224,"nodeType":864},{},[32081],{"type":899},{"data":32083,"content":32084,"nodeType":860},{},[32085,32088,32095],{"data":32086,"marks":32087,"value":21,"nodeType":864},{},[],{"data":32089,"content":32090,"nodeType":883},{"uri":4103},[32091],{"data":32092,"marks":32093,"value":23238,"nodeType":864},{},[32094],{"type":1455},{"data":32096,"marks":32097,"value":23242,"nodeType":864},{},[],{"data":32099,"content":32100,"nodeType":860},{},[32101,32104,32108],{"data":32102,"marks":32103,"value":23249,"nodeType":864},{},[],{"data":32105,"marks":32106,"value":23254,"nodeType":864},{},[32107],{"type":899},{"data":32109,"marks":32110,"value":23258,"nodeType":864},{},[],{"data":32112,"content":32113,"nodeType":1312},{},[32114],{"data":32115,"marks":32116,"value":288,"nodeType":864},{},[32117],{"type":899},{"data":32119,"content":32120,"nodeType":860},{},[32121,32125,32133,32137],{"data":32122,"marks":32123,"value":21,"nodeType":864},{},[32124],{"type":899},{"data":32126,"content":32127,"nodeType":883},{"uri":2411},[32128],{"data":32129,"marks":32130,"value":23281,"nodeType":864},{},[32131,32132],{"type":1455},{"type":899},{"data":32134,"marks":32135,"value":23286,"nodeType":864},{},[32136],{"type":899},{"data":32138,"marks":32139,"value":23290,"nodeType":864},{},[],{"data":32141,"content":32142,"nodeType":860},{},[32143],{"data":32144,"marks":32145,"value":23297,"nodeType":864},{},[],{"data":32147,"content":32148,"nodeType":1312},{},[32149],{"data":32150,"marks":32151,"value":23305,"nodeType":864},{},[32152],{"type":899},{"data":32154,"content":32155,"nodeType":860},{},[32156,32159,32165,32168,32174],{"data":32157,"marks":32158,"value":23312,"nodeType":864},{},[],{"data":32160,"content":32161,"nodeType":883},{"uri":14681},[32162],{"data":32163,"marks":32164,"value":23319,"nodeType":864},{},[],{"data":32166,"marks":32167,"value":23323,"nodeType":864},{},[],{"data":32169,"content":32170,"nodeType":883},{"uri":3237},[32171],{"data":32172,"marks":32173,"value":23330,"nodeType":864},{},[],{"data":32175,"marks":32176,"value":23334,"nodeType":864},{},[],{"data":32178,"content":32179,"nodeType":860},{},[32180],{"data":32181,"marks":32182,"value":23341,"nodeType":864},{},[],{"data":32184,"content":32185,"nodeType":1312},{},[32186],{"data":32187,"marks":32188,"value":23349,"nodeType":864},{},[32189],{"type":899},{"data":32191,"content":32192,"nodeType":860},{},[32193],{"data":32194,"marks":32195,"value":23356,"nodeType":864},{},[],{"data":32197,"content":32200,"nodeType":996},{"target":32198},{"sys":32199},{"id":23361,"type":1001,"linkType":1002},[],{"data":32202,"content":32203,"nodeType":1005},{},[],{"data":32205,"content":32206,"nodeType":1009},{},[32207],{"data":32208,"marks":32209,"value":23373,"nodeType":864},{},[32210],{"type":899},{"data":32212,"content":32213,"nodeType":860},{},[32214],{"data":32215,"marks":32216,"value":23380,"nodeType":864},{},[],{"data":32218,"content":32219,"nodeType":860},{},[32220],{"data":32221,"marks":32222,"value":23388,"nodeType":864},{},[32223],{"type":899},{"data":32225,"content":32228,"nodeType":996},{"target":32226},{"sys":32227},{"id":23393,"type":1001,"linkType":1002},[],{"data":32230,"content":32231,"nodeType":1005},{},[],{"data":32233,"content":32234,"nodeType":1312},{},[32235],{"data":32236,"marks":32237,"value":23405,"nodeType":864},{},[32238],{"type":899},{"data":32240,"content":32241,"nodeType":860},{},[32242],{"data":32243,"marks":32244,"value":23412,"nodeType":864},{},[],{"data":32246,"content":32247,"nodeType":860},{},[32248],{"data":32249,"marks":32250,"value":23419,"nodeType":864},{},[],{"data":32252,"content":32253,"nodeType":860},{},[32254],{"data":32255,"marks":32256,"value":23426,"nodeType":864},{},[],{"data":32258,"content":32259,"nodeType":860},{},[32260,32264],{"data":32261,"marks":32262,"value":23434,"nodeType":864},{},[32263],{"type":899},{"data":32265,"marks":32266,"value":23438,"nodeType":864},{},[],{"data":32268,"content":32269,"nodeType":1005},{},[],{"data":32271,"content":32272,"nodeType":860},{},[32273],{"data":32274,"marks":32275,"value":4855,"nodeType":864},{},[],{"data":32277,"content":32278,"nodeType":860},{},[32279,32282,32288],{"data":32280,"marks":32281,"value":23454,"nodeType":864},{},[],{"data":32283,"content":32284,"nodeType":883},{"uri":23457},[32285],{"data":32286,"marks":32287,"value":15017,"nodeType":864},{},[],{"data":32289,"marks":32290,"value":2719,"nodeType":864},{},[],{"items":32292},[32293,32295],{"sys":32294,"name":2729},{"id":2728},{"sys":32296,"name":342},{"id":15029},{"items":32298},[32299],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":32300},{"url":3625},"blog/how-to-avoid-the-browser-security-buyers-trap",{"json":32303},{"data":32304,"content":32305,"nodeType":856},{},[32306],{"data":32307,"content":32308,"nodeType":860},{},[32309],{"data":32310,"marks":32311,"value":32312,"nodeType":864},{},[],"Securing the browser vs. securing the organization via the browser — what's the difference? Most browser security solutions defend against the browser being hacked, but these aren't the attacks that are actually leading to major breaches. ",{"id":25352,"publishedAt":32314},"2026-08-13T09:35:09.806Z",{"items":32316},[32317,32319],{"sys":32318,"name":297},{"id":2732},{"sys":32320,"name":2729},{"id":2728},{"items":32322},[32323,32325,32327,32329,32331,32333,32335,32337,32339,32341,32343,32345,32347,32349,32351,32353,32355,32357,32359,32361,32363,32365,32367],{"sys":32324,"name":297,"slug":298,"tier":31},{"id":294},{"sys":32326,"name":279,"slug":280,"tier":31},{"id":276},{"sys":32328,"name":413,"slug":414,"tier":31},{"id":410},{"sys":32330,"name":519,"slug":520,"tier":31},{"id":516},{"sys":32332,"name":342,"slug":343,"tier":31},{"id":339},{"sys":32334,"name":386,"slug":387,"tier":45},{"id":383},{"sys":32336,"name":511,"slug":512,"tier":45},{"id":508},{"sys":32338,"name":261,"slug":262,"tier":45},{"id":258},{"sys":32340,"name":571,"slug":572,"tier":45},{"id":568},{"sys":32342,"name":333,"slug":334,"tier":45},{"id":330},{"sys":32344,"name":324,"slug":325,"tier":45},{"id":321},{"sys":32346,"name":484,"slug":485,"tier":45},{"id":481},{"sys":32348,"name":315,"slug":316,"tier":45},{"id":312},{"sys":32350,"name":360,"slug":361,"tier":45},{"id":357},{"sys":32352,"name":395,"slug":396,"tier":45},{"id":392},{"sys":32354,"name":589,"slug":590,"tier":45},{"id":586},{"sys":32356,"name":288,"slug":289,"tier":45},{"id":285},{"sys":32358,"name":502,"slug":503,"tier":45},{"id":499},{"sys":32360,"name":457,"slug":458,"tier":45},{"id":454},{"sys":32362,"name":377,"slug":378,"tier":45},{"id":374},{"sys":32364,"name":624,"slug":625,"tier":45},{"id":621},{"sys":32366,"name":368,"slug":369,"tier":45},{"id":365},{"sys":32368,"name":244,"slug":245,"tier":45},{"id":241},"5C3_54ldAqXGDnFfNyrEkB5PAE-NWpPCxwC0yi4pkDk",{"id":32371,"title":32372,"authorsCollection":32373,"content":32378,"extension":228,"faqItemsCollection":32804,"faqTitle":59,"featured":6,"hashTags":59,"meta":32806,"metaTitle":32807,"ogImage":32808,"postType":32809,"publishedDate":32810,"relatedBlogPostsCollection":32811,"slug":34842,"stem":34843,"subtitle":59,"summary":34844,"synopsis":34855,"sys":34856,"tagsCollection":34859,"topicsCollection":34865,"__hash__":34877},"blog/blog/stop-users-saving-corp-creds-into-personal-password-managers.json","Don’t let attackers find the keys to your kingdom in a personal password manager",{"items":32374},[32375],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":32376,"profilePicture":32377},[23559],{"url":4881},{"json":32379,"links":32748},{"data":32380,"content":32381,"nodeType":856},{},[32382,32388,32391,32398,32405,32430,32433,32440,32447,32454,32474,32481,32484,32491,32498,32505,32512,32519,32552,32558,32591,32597,32600,32607,32614,32621,32627,32634,32640,32647,32650,32657,32672,32678,32685,32708,32711,32718,32736,32742],{"data":32383,"content":32387,"nodeType":996},{"target":32384},{"sys":32385},{"id":32386,"type":1001,"linkType":1002},"2qUzJLoMtI3Uaf3ooGw582",[],{"data":32389,"content":32390,"nodeType":1005},{},[],{"data":32392,"content":32393,"nodeType":1009},{},[32394],{"data":32395,"marks":32396,"value":32397,"nodeType":864},{},[],"Which password managers are my employees using?",{"data":32399,"content":32400,"nodeType":860},{},[32401],{"data":32402,"marks":32403,"value":32404,"nodeType":864},{},[],"Tens of millions of people now use password managers, both at work and at home. And it probably won’t come as much of a surprise that most of Push’s security-savvy customers also provide their users with a corporate password manager. ",{"data":32406,"content":32407,"nodeType":860},{},[32408,32412,32417,32421,32426],{"data":32409,"marks":32410,"value":32411,"nodeType":864},{},[],"Up until now, Push has been able to show you whether or not your employees are using ",{"data":32413,"marks":32414,"value":32416,"nodeType":864},{},[32415],{"type":1455},"a",{"data":32418,"marks":32419,"value":32420,"nodeType":864},{},[]," password manager to log into their work apps. But now, we can actually show you ",{"data":32422,"marks":32423,"value":32425,"nodeType":864},{},[32424],{"type":1455},"which",{"data":32427,"marks":32428,"value":32429,"nodeType":864},{},[]," password managers they’re using.",{"data":32431,"content":32432,"nodeType":1005},{},[],{"data":32434,"content":32435,"nodeType":1009},{},[32436],{"data":32437,"marks":32438,"value":32439,"nodeType":864},{},[],"There’s more than first meets the eye with this detection   ",{"data":32441,"content":32442,"nodeType":860},{},[32443],{"data":32444,"marks":32445,"value":32446,"nodeType":864},{},[],"There’s a couple of reasons why you’ll want to know which password managers your employees are using.",{"data":32448,"content":32449,"nodeType":860},{},[32450],{"data":32451,"marks":32452,"value":32453,"nodeType":864},{},[],"The obvious one is to make sure all your employees are using, and benefiting from, the password manager you're providing them with. They’re not cheap and you’ll want to get the best bang for your buck. ",{"data":32455,"content":32456,"nodeType":860},{},[32457,32461,32470],{"data":32458,"marks":32459,"value":32460,"nodeType":864},{},[],"The second reason speaks to a specific concern a lot of security teams have around attackers compromising users’ personal password managers containing corporate passwords, and then being able to pivot into the organization's corporate environment. This is a very valid concern given ",{"data":32462,"content":32464,"nodeType":883},{"uri":32463},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/",[32465],{"data":32466,"marks":32467,"value":32469,"nodeType":864},{},[32468],{"type":1455},"the rise in attacks using infostealers",{"data":32471,"marks":32472,"value":32473,"nodeType":864},{},[]," following the Snowflake breach earlier this year. ",{"data":32475,"content":32476,"nodeType":860},{},[32477],{"data":32478,"marks":32479,"value":32480,"nodeType":864},{},[],"Using this feature, you can now detect which password managers are storing credentials for your most sensitive systems and stop this attack scenario from happening.   ",{"data":32482,"content":32483,"nodeType":1005},{},[],{"data":32485,"content":32486,"nodeType":1009},{},[32487],{"data":32488,"marks":32489,"value":32490,"nodeType":864},{},[],"Why corporate passwords in personal password managers is a big no-no",{"data":32492,"content":32493,"nodeType":860},{},[32494],{"data":32495,"marks":32496,"value":32497,"nodeType":864},{},[],"Remote working, BYOD, and users having both personal and professional accounts on the same platforms (Google, Microsoft etc.) have all blurred the line between people’s work lives and their home lives. It’s not uncommon for one to spill over into the other, and one place we see evidence of this is in password managers. ",{"data":32499,"content":32500,"nodeType":860},{},[32501],{"data":32502,"marks":32503,"value":32504,"nodeType":864},{},[],"Creds for personal accounts end up getting stored in corporate password managers, and corporate creds end up getting stored in personal password managers. ",{"data":32506,"content":32507,"nodeType":860},{},[32508],{"data":32509,"marks":32510,"value":32511,"nodeType":864},{},[],"The big risk when the latter happens is that a sensitive corporate asset (a users’ Microsoft account password for example) is effectively being exfiltrated out of the corporate environment by the user, and placed out of reach of your security team. ",{"data":32513,"content":32514,"nodeType":860},{},[32515],{"data":32516,"marks":32517,"value":32518,"nodeType":864},{},[],"This creates new opportunities for attackers: ",{"data":32520,"content":32521,"nodeType":941},{},[32522,32532,32542],{"data":32523,"content":32524,"nodeType":945},{},[32525],{"data":32526,"content":32527,"nodeType":860},{},[32528],{"data":32529,"marks":32530,"value":32531,"nodeType":864},{},[],"Your average user’s personal laptop isn't going to be as well protected as their company laptop. So they offer an easier target for attackers using traditional endpoint compromise techniques. ",{"data":32533,"content":32534,"nodeType":945},{},[32535],{"data":32536,"content":32537,"nodeType":860},{},[32538],{"data":32539,"marks":32540,"value":32541,"nodeType":864},{},[],"An attacker can compromise a personal laptop with infostealer malware that targets password managers in the browser. If corporate credentials are stored in that personal password manager then they are also going to be stolen. ",{"data":32543,"content":32544,"nodeType":945},{},[32545],{"data":32546,"content":32547,"nodeType":860},{},[32548],{"data":32549,"marks":32550,"value":32551,"nodeType":864},{},[],"Now the attacker is in possession of the user's Microsoft account credentials, they can potentially pivot from a personal laptop to one of your organization's core platforms over the internet.  ",{"data":32553,"content":32557,"nodeType":996},{"target":32554},{"sys":32555},{"id":32556,"type":1001,"linkType":1002},"Dw05IslqXVN5unTFuvTZV",[],{"data":32559,"content":32560,"nodeType":1312},{},[32561,32565,32570,32574,32579,32583,32588],{"data":32562,"marks":32563,"value":32564,"nodeType":864},{},[],"Using Push, you can now make sure that sensitive ",{"data":32566,"marks":32567,"value":32569,"nodeType":864},{},[32568],{"type":1455},"corporate credentials",{"data":32571,"marks":32572,"value":32573,"nodeType":864},{},[]," stay in your ",{"data":32575,"marks":32576,"value":32578,"nodeType":864},{},[32577],{"type":1455},"corporate password manager",{"data":32580,"marks":32581,"value":32582,"nodeType":864},{},[]," and don’t leave your ",{"data":32584,"marks":32585,"value":32587,"nodeType":864},{},[32586],{"type":1455},"corporate environment.",{"data":32589,"marks":32590,"value":1171,"nodeType":864},{},[],{"data":32592,"content":32596,"nodeType":996},{"target":32593},{"sys":32594},{"id":32595,"type":1001,"linkType":1002},"27d7qit3k7ETS9lemJexIJ",[],{"data":32598,"content":32599,"nodeType":1005},{},[],{"data":32601,"content":32602,"nodeType":1009},{},[32603],{"data":32604,"marks":32605,"value":32606,"nodeType":864},{},[],"All powered by the Push browser extension",{"data":32608,"content":32609,"nodeType":860},{},[32610],{"data":32611,"marks":32612,"value":32613,"nodeType":864},{},[],"Push detects which password managers your employees are using with our browser extension. It observes all your employees logins using their work identities. The telemetry the browser extension generates shows you what employees are logging into, when they’re logging in, how they’re logging in, and if any aspect of that login process is risky or potentially malicious. ",{"data":32615,"content":32616,"nodeType":860},{},[32617],{"data":32618,"marks":32619,"value":32620,"nodeType":864},{},[],"The password managers (and browsers with built-in password managers) supported by this detection are: ",{"data":32622,"content":32626,"nodeType":996},{"target":32623},{"sys":32624},{"id":32625,"type":1001,"linkType":1002},"7q3CYLPpBhEGyCeP4S0bzJ",[],{"data":32628,"content":32629,"nodeType":860},{},[32630],{"data":32631,"marks":32632,"value":32633,"nodeType":864},{},[],"When a login using one of those password managers is observed by Push, it appears in your events feed. This data can be sent to your SIEM using Push’s webhooks. ",{"data":32635,"content":32639,"nodeType":996},{"target":32636},{"sys":32637},{"id":32638,"type":1001,"linkType":1002},"qDRJ7CYd81L4RUHQBuHvQ",[],{"data":32641,"content":32642,"nodeType":860},{},[32643],{"data":32644,"marks":32645,"value":32646,"nodeType":864},{},[],"The password manager user will also appear on the corresponding account on the accounts page. Here you can see every workforce account and the login methods used to access them. ",{"data":32648,"content":32649,"nodeType":1005},{},[],{"data":32651,"content":32652,"nodeType":1009},{},[32653],{"data":32654,"marks":32655,"value":32656,"nodeType":864},{},[],"Bonus feature — detecting clipboard pasting",{"data":32658,"content":32659,"nodeType":860},{},[32660,32664,32669],{"data":32661,"marks":32662,"value":32663,"nodeType":864},{},[],"The eagle-eyed among you might have seen that in the list of supported “password managers” is one called ",{"data":32665,"marks":32666,"value":32668,"nodeType":864},{},[32667],{"type":899},"Clipboard paste",{"data":32670,"marks":32671,"value":12800,"nodeType":864},{},[],{"data":32673,"content":32677,"nodeType":996},{"target":32674},{"sys":32675},{"id":32676,"type":1001,"linkType":1002},"2ApsFXkrSznhT7cJqSOAIV",[],{"data":32679,"content":32680,"nodeType":860},{},[32681],{"data":32682,"marks":32683,"value":32684,"nodeType":864},{},[],"You’ll see this when we observe users pasting a password into the password field. This detection is really useful for a couple of reasons:",{"data":32686,"content":32687,"nodeType":941},{},[32688,32698],{"data":32689,"content":32690,"nodeType":945},{},[32691],{"data":32692,"content":32693,"nodeType":860},{},[32694],{"data":32695,"marks":32696,"value":32697,"nodeType":864},{},[],"Copying passwords from a password manager and pasting them into a login page is bad practice. Password managers typically also store which page the password is for so they won't auto-populate on a phishing page. Pasting your password manually makes you more susceptible to being phished.",{"data":32699,"content":32700,"nodeType":945},{},[32701],{"data":32702,"content":32703,"nodeType":860},{},[32704],{"data":32705,"marks":32706,"value":32707,"nodeType":864},{},[],"Or, it could indicate that the user is storing their passwords in a notes app, word doc, spreadsheet etc. Obviously these are all low hanging fruit for any attacker so you want to get the user to move their passwords into their password manager and set fire to whatever doc they had been using. ",{"data":32709,"content":32710,"nodeType":1005},{},[],{"data":32712,"content":32713,"nodeType":1009},{},[32714],{"data":32715,"marks":32716,"value":32717,"nodeType":864},{},[],"Try it out for yourself",{"data":32719,"content":32720,"nodeType":860},{},[32721,32725,32733],{"data":32722,"marks":32723,"value":32724,"nodeType":864},{},[],"If you have any question about this feature or any other of our detection use cases, ",{"data":32726,"content":32727,"nodeType":883},{"uri":15655},[32728],{"data":32729,"marks":32730,"value":32732,"nodeType":864},{},[32731],{"type":1455},"book a meeting with one of our team",{"data":32734,"marks":32735,"value":2924,"nodeType":864},{},[],{"data":32737,"content":32741,"nodeType":996},{"target":32738},{"sys":32739},{"id":32740,"type":1001,"linkType":1002},"6iKFd9Qys2SSuNqKVQB7ka",[],{"data":32743,"content":32744,"nodeType":860},{},[32745],{"data":32746,"marks":32747,"value":21,"nodeType":864},{},[],{"entries":32749},{"hyperlink":32750,"inline":32751,"block":32752},[],[],[32753,32762,32770,32776,32784,32792,32799],{"sys":32754,"__typename":32755,"title":32756,"youTubeUrl":32757,"imagePlaceholder":32758},{"id":32386},"ExternalVideo","Introducing password manager detection","https://youtu.be/C2K9mC0l5OE",{"url":32759,"width":32760,"height":32761},"https://images.ctfassets.net/y1cdw1ablpvd/26HeKBjajOqfwJGorMx7kv/5a35a72eaf0ffe1fd0bdd10882e17ec0/Slide_Front_Cover__11_.png",1920,1080,{"sys":32763,"__typename":1724,"title":32764,"caption":32765,"layoutMode":59,"file":32766},{"id":32556},"Compromised personal laptop to corporate breach","How a compromised personal device can lead to a corporate breach",{"url":32767,"width":32768,"height":32769},"https://images.ctfassets.net/y1cdw1ablpvd/6YBsnrEMlIe9XoTLr3cXJw/06246d9876bde6d6493e941d7a3932ed/image1.png",1738,974,{"sys":32771,"__typename":1724,"title":32772,"caption":32772,"layoutMode":59,"file":32773},{"id":32595},"Corporate winning",{"url":32774,"width":801,"height":32775},"https://images.ctfassets.net/y1cdw1ablpvd/2lS0tkYG7oxf8xoFt44Glx/a112ce96916de88a879efdfb88b94268/image3_1.png",404,{"sys":32777,"__typename":1724,"title":32778,"caption":32779,"layoutMode":59,"file":32780},{"id":32625},"Supported password managers","Password managers supported by Push",{"url":32781,"width":32782,"height":32783},"https://images.ctfassets.net/y1cdw1ablpvd/5DkzjxFQpufDgAl7tu4Haw/87c1ccc8324a4f02febdb9690bc780a2/image_402__1_.png",402,699,{"sys":32785,"__typename":1724,"title":32786,"caption":32787,"layoutMode":59,"file":32788},{"id":32638},"Password manager code snippet","Data can be sent to your SIEM using Push's webhooks",{"url":32789,"width":32790,"height":32791},"https://images.ctfassets.net/y1cdw1ablpvd/3VqfW6YWvnLTSgts4Z5k4H/39ec6f33f4309e8bfd7caba0e2240d42/image4.png",968,1048,{"sys":32793,"__typename":1724,"title":32668,"caption":32794,"layoutMode":59,"file":32795},{"id":32676},"Did you spot it?",{"url":32796,"width":32797,"height":32798},"https://images.ctfassets.net/y1cdw1ablpvd/1UHpSMAOgHteweWjrZTTfA/f9a6ea24b240ce90b51ad409ab7ee763/image_403.png",622,69,{"sys":32800,"__typename":1717,"type":32801,"ctaText":32802,"buttonLabel":32803,"buttonColour":1721,"buttonUrl":59},{"id":32740},"Demo","Learn how Push can help you secure identities across your org","Book a demo!",{"items":32805},[],{},"Stop users saving corp creds into personal password managers",{"url":32767},"product-feature","2024-11-05T00:00:00.000Z",{"items":32812},[32813,33339,33671],{"__typename":2059,"sys":32814,"content":32816,"title":33325,"synopsis":33326,"hashTags":59,"publishedDate":33327,"slug":33328,"tagsCollection":33329,"authorsCollection":33335},{"id":32815},"3N6eBccHWWc3cZWTZsaJVV",{"json":32817},{"data":32818,"content":32819,"nodeType":856},{},[32820,32853,32873,32880,32887,32890,32898,32905,32930,32937,32943,32950,32957,32990,32993,33001,33008,33028,33031,33039,33046,33053,33059,33077,33080,33088,33105,33112,33119,33139,33142,33150,33157,33164,33171,33174,33182,33189,33209,33216,33223,33230,33237,33244,33247,33255,33262,33305],{"data":32821,"content":32822,"nodeType":860},{},[32823,32827,32836,32840,32849],{"data":32824,"marks":32825,"value":32826,"nodeType":864},{},[],"We’ve been shouting about the risk posed by account takeover attacks on third party apps since we first released the ",{"data":32828,"content":32830,"nodeType":883},{"uri":32829},"https://github.com/pushsecurity/saas-attacks",[32831],{"data":32832,"marks":32833,"value":32835,"nodeType":864},{},[32834],{"type":1455},"SaaS attack matrix",{"data":32837,"marks":32838,"value":32839,"nodeType":864},{},[]," in early 2023. 18 months later (and with some encouragement from the success of the ",{"data":32841,"content":32843,"nodeType":883},{"uri":32842},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[32844],{"data":32845,"marks":32846,"value":32848,"nodeType":864},{},[32847],{"type":1455},"attacks on Snowflake customers",{"data":32850,"marks":32851,"value":32852,"nodeType":864},{},[],") it feels like the security community has woken up to the risk — and attackers likewise have sensed the opportunity. ",{"data":32854,"content":32855,"nodeType":860},{},[32856,32860,32869],{"data":32857,"marks":32858,"value":32859,"nodeType":864},{},[],"Last week, it emerged that ",{"data":32861,"content":32863,"nodeType":883},{"uri":32862},"https://medium.com/@moblig/how-i-accessed-microsofts-servicenow-exposing-all-microsoft-employee-emails-chat-support-5f8d535eb63b",[32864],{"data":32865,"marks":32866,"value":32868,"nodeType":864},{},[32867],{"type":1455},"bug bounty hunters were able to use stolen credentials from a TI platform to Microsoft’s ServiceNow tenant",{"data":32870,"marks":32871,"value":32872,"nodeType":864},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails. ",{"data":32874,"content":32875,"nodeType":860},{},[32876],{"data":32877,"marks":32878,"value":32879,"nodeType":864},{},[],"But this isn’t specifically a Microsoft problem. The researcher could have picked from a long list of potential targets. If even Microsoft with their vast security resources can be caught off guard by this, what chance do other organizations have? If anything, it illustrates the scale of the challenge facing organizations when it comes to securing their identity surface. ",{"data":32881,"content":32882,"nodeType":860},{},[32883],{"data":32884,"marks":32885,"value":32886,"nodeType":864},{},[],"Let’s take a closer look at what we can learn from this attack — and what it tells us about the direction that identity attacks are (rapidly) heading in. ",{"data":32888,"content":32889,"nodeType":1005},{},[],{"data":32891,"content":32892,"nodeType":1009},{},[32893],{"data":32894,"marks":32895,"value":32897,"nodeType":864},{},[32896],{"type":899},"Taking over ServiceNow accounts through credential stuffing (via infostealers)",{"data":32899,"content":32900,"nodeType":860},{},[32901],{"data":32902,"marks":32903,"value":32904,"nodeType":864},{},[],"A bug bounty hunter was able to compromise Microsoft’s ServiceNow account using stolen credentials from historical infostealer infections, found using a commercial TI feed. ",{"data":32906,"content":32907,"nodeType":860},{},[32908,32912,32917,32921,32926],{"data":32909,"marks":32910,"value":32911,"nodeType":864},{},[],"The researcher was able to enumerate a login page for Microsoft at ",{"data":32913,"marks":32914,"value":32916,"nodeType":864},{},[32915],{"type":1455},"microsoft.servicenow.com/login.do",{"data":32918,"marks":32919,"value":32920,"nodeType":864},{},[],", with the /login.do meaning that ",{"data":32922,"marks":32923,"value":32925,"nodeType":864},{},[32924],{"type":899},"SSO was enabled but not enforced",{"data":32927,"marks":32928,"value":32929,"nodeType":864},{},[],". At this point, the attacker was able to authenticate using the stolen credentials only (as the target account lacked MFA).",{"data":32931,"content":32932,"nodeType":860},{},[32933],{"data":32934,"marks":32935,"value":32936,"nodeType":864},{},[],"After logging in they were presented with a blank UI. However, because they now had an authenticated session, they were able to switch to the REST API, and subsequently access two key endpoints through which they were able to collect and exfiltrate sensitive data including 1,000s of support ticket attachments, over 250,000+ employee emails, and an xlsx file with historical ticket submissions to the MSRC team. ",{"data":32938,"content":32942,"nodeType":996},{"target":32939},{"sys":32940},{"id":32941,"type":1001,"linkType":1002},"1Q2cL7mJhQUx1it0tU3MhJ",[],{"data":32944,"content":32945,"nodeType":860},{},[32946],{"data":32947,"marks":32948,"value":32949,"nodeType":864},{},[],"Naturally, at this point the researcher ended their attack and sought out a bounty for their efforts. ",{"data":32951,"content":32952,"nodeType":860},{},[32953],{"data":32954,"marks":32955,"value":32956,"nodeType":864},{},[],"But a real attacker wouldn’t have stopped there. Immediately, you’d be thinking:",{"data":32958,"content":32959,"nodeType":941},{},[32960,32970,32980],{"data":32961,"content":32962,"nodeType":945},{},[32963],{"data":32964,"content":32965,"nodeType":860},{},[32966],{"data":32967,"marks":32968,"value":32969,"nodeType":864},{},[],"How many other organizations are likely impacted by this issue? Are there other credentials that correspond with these exposed login pages available online? ",{"data":32971,"content":32972,"nodeType":945},{},[32973],{"data":32974,"content":32975,"nodeType":860},{},[32976],{"data":32977,"marks":32978,"value":32979,"nodeType":864},{},[],"Are there any ways that I could turn this access into a privileged account takeover? Would I be able to access even more information that way? ",{"data":32981,"content":32982,"nodeType":945},{},[32983],{"data":32984,"content":32985,"nodeType":860},{},[32986],{"data":32987,"marks":32988,"value":32989,"nodeType":864},{},[],"How could this data be used to conduct further attacks? Would other criminal groups pay me for this information if I don’t want to do this myself? ",{"data":32991,"content":32992,"nodeType":1005},{},[],{"data":32994,"content":32995,"nodeType":1009},{},[32996],{"data":32997,"marks":32998,"value":33000,"nodeType":864},{},[32999],{"type":899},"This isn’t just a Microsoft problem",{"data":33002,"content":33003,"nodeType":860},{},[33004],{"data":33005,"marks":33006,"value":33007,"nodeType":864},{},[],"It seems unlikely that only Microsoft is affected here. Other ServiceNow tenants could have been taken over using the same approach. Other company credentials could be (will be) available online.",{"data":33009,"content":33010,"nodeType":860},{},[33011,33015,33024],{"data":33012,"marks":33013,"value":33014,"nodeType":864},{},[],"Using straightforward ",{"data":33016,"content":33018,"nodeType":883},{"uri":33017},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/subdomain_tenant_discovery/description.md",[33019],{"data":33020,"marks":33021,"value":33023,"nodeType":864},{},[33022],{"type":1455},"tenant enumeration techniques",{"data":33025,"marks":33026,"value":33027,"nodeType":864},{},[]," and the list of ServiceNow named customers, it’s very easy to identify different customer tenants. And spending a few minutes using the same credential feed as the researcher, I found multiple organizations with many more breached credentials available linked to the same login.do page. ",{"data":33029,"content":33030,"nodeType":1005},{},[],{"data":33032,"content":33033,"nodeType":1009},{},[33034],{"data":33035,"marks":33036,"value":33038,"nodeType":864},{},[33037],{"type":899},"Similarities with Snowflake",{"data":33040,"content":33041,"nodeType":860},{},[33042],{"data":33043,"marks":33044,"value":33045,"nodeType":864},{},[],"There are no prizes for connecting this attack path with the infamous attacks on Snowflake customers earlier this year, which resulted in 165+ victims, and hundreds of millions of breached customer records. ",{"data":33047,"content":33048,"nodeType":860},{},[33049],{"data":33050,"marks":33051,"value":33052,"nodeType":864},{},[],"The Snowflake attack path was startlingly similar, and gives us a feel for what this attack could have turned into if conducted by a real attacker. ",{"data":33054,"content":33058,"nodeType":996},{"target":33055},{"sys":33056},{"id":33057,"type":1001,"linkType":1002},"2J92gFLs1wAAGC4nQTaiWu",[],{"data":33060,"content":33061,"nodeType":860},{},[33062,33066,33074],{"data":33063,"marks":33064,"value":33065,"nodeType":864},{},[],"Both attacks began with stolen credentials breached in historical infostealer infections. In Snowflake’s case, 80% of the credentials used were connected to infostealer infections dating back to 2020, ",{"data":33067,"content":33068,"nodeType":883},{"uri":22415},[33069],{"data":33070,"marks":33071,"value":33073,"nodeType":864},{},[33072],{"type":1455},"according to Mandiant",{"data":33075,"marks":33076,"value":12800,"nodeType":864},{},[],{"data":33078,"content":33079,"nodeType":1005},{},[],{"data":33081,"content":33082,"nodeType":1009},{},[33083],{"data":33084,"marks":33085,"value":33087,"nodeType":864},{},[33086],{"type":899},"Ghost logins strike again",{"data":33089,"content":33090,"nodeType":860},{},[33091,33094,33101],{"data":33092,"marks":33093,"value":21,"nodeType":864},{},[],{"data":33095,"content":33096,"nodeType":883},{"uri":13067},[33097],{"data":33098,"marks":33099,"value":395,"nodeType":864},{},[33100],{"type":1455},{"data":33102,"marks":33103,"value":33104,"nodeType":864},{},[]," are one of the leading factors in successful credential stuffing attacks. Simply put, ghost logins are often-forgotten local logins that are tricky for security teams to manage and secure.  ",{"data":33106,"content":33107,"nodeType":860},{},[33108],{"data":33109,"marks":33110,"value":33111,"nodeType":864},{},[],"Ghost logins are a problem for security teams because they often lack best practice security configurations, with things like weak, previously breached, and reused passwords — and no MFA. ",{"data":33113,"content":33114,"nodeType":860},{},[33115],{"data":33116,"marks":33117,"value":33118,"nodeType":864},{},[],"Many organizations think that by migrating an app to use SSO, where they’ve enforced MFA at the IdP level, it’s job done. However, this usually doesn’t eliminate previously created local accounts, meaning they need to be manually unset. But because organizations often lack app-level visibility of account configuration and login methods (it’s simply not provided by most app vendors) these accounts can fly under the radar for extended periods — often until situations like this when they are compromised. ",{"data":33120,"content":33121,"nodeType":860},{},[33122,33126,33135],{"data":33123,"marks":33124,"value":33125,"nodeType":864},{},[],"Ghost logins were a particular problem in the Snowflake attacks because MFA could not be globally enforced at the time of the incident. This meant that local accounts would need to be manually unset using the SQL interface — which unhelpfully ",{"data":33127,"content":33129,"nodeType":883},{"uri":33128},"https://pushsecurity.com/resources/video/demonstrating-ghost-logins-in-snowflake-and-how-to-remediate-them/",[33130],{"data":33131,"marks":33132,"value":33134,"nodeType":864},{},[33133],{"type":1455},"provided inaccurate information about the account status and took extended periods of time to update",{"data":33136,"marks":33137,"value":33138,"nodeType":864},{},[]," after a change had been made, creating uncertainty and confusion for responders. But this is just one example of many illustrating how difficult in-app identity management can be. ",{"data":33140,"content":33141,"nodeType":1005},{},[],{"data":33143,"content":33144,"nodeType":1009},{},[33145],{"data":33146,"marks":33147,"value":33149,"nodeType":864},{},[33148],{"type":899},"So what?",{"data":33151,"content":33152,"nodeType":860},{},[33153],{"data":33154,"marks":33155,"value":33156,"nodeType":864},{},[],"If we hadn’t realized it yet, attacks targeting third-party business apps are everywhere. It’s not just the flavor of the month — it’s here to stay. ",{"data":33158,"content":33159,"nodeType":860},{},[33160],{"data":33161,"marks":33162,"value":33163,"nodeType":864},{},[],"This is because it’s so easy for attackers to monetize these compromises. Log into app > dump data > profit. ",{"data":33165,"content":33166,"nodeType":860},{},[33167],{"data":33168,"marks":33169,"value":33170,"nodeType":864},{},[],"And the easiest way to achieve this isn’t through complex software exploits, it’s through identity attacks. In the ServiceNow case, using public information (that was available to the security team too) to log into an app. It’s too easy.",{"data":33172,"content":33173,"nodeType":1005},{},[],{"data":33175,"content":33176,"nodeType":1009},{},[33177],{"data":33178,"marks":33179,"value":33181,"nodeType":864},{},[33180],{"type":899},"Identity attacks are misunderstood",{"data":33183,"content":33184,"nodeType":860},{},[33185],{"data":33186,"marks":33187,"value":33188,"nodeType":864},{},[],"The researcher notes that, despite the severity of the bug, it wasn’t paid out under the MSRC bug bounty scheme. And while this is perhaps not a classic software exploit, you can’t argue about the risk it poses. This is just as impactful as any classic vulnerability, if not more so — because the technical barrier to entry is so much lower. ",{"data":33190,"content":33191,"nodeType":860},{},[33192,33196,33205],{"data":33193,"marks":33194,"value":33195,"nodeType":864},{},[],"Pat Gray of the Risky Biz podcast ",{"data":33197,"content":33199,"nodeType":883},{"uri":33198},"https://risky.biz/RB766/",[33200],{"data":33201,"marks":33202,"value":33204,"nodeType":864},{},[33203],{"type":1455},"said of another recent disclosure",{"data":33206,"marks":33207,"value":33208,"nodeType":864},{},[],", where a 15 year-old researcher was able to turn a Zendesk ‘feature’ into hijacking Apple SSO to log into downstream SaaS, that there’s a lack of imagination in understanding how these third-party apps can be abused by an attacker. I’d tend to agree here.",{"data":33210,"content":33211,"nodeType":860},{},[33212],{"data":33213,"marks":33214,"value":33215,"nodeType":864},{},[],"Part of the challenge here is perhaps a lack of awareness of just how severe these issues are. Certainly in the Zendesk case, the initial disclosure (email spoofing) was thrown out, but when it was demonstrated that it could be used to take over downstream apps like Slack, affected companies were happy to pay up, and Zendesk (via HackerOne) got back in touch. ",{"data":33217,"content":33218,"nodeType":860},{},[33219],{"data":33220,"marks":33221,"value":33222,"nodeType":864},{},[],"If I were the researcher, I would have considered reporting this issue to ServiceNow too, not just Microsoft — as it undoubtedly affects many organizations. Yes, the fact that Microsoft credentials were accessible online is a Microsoft problem, but given the potential spread of organizations also susceptible to this attack, does the vendor not have a responsibility to help mitigate these attacks? I would hope that ServiceNow have contacted their customers to be cautious of experiencing an increase in credential stuffing attacks in the near future at the very least. ",{"data":33224,"content":33225,"nodeType":860},{},[33226],{"data":33227,"marks":33228,"value":33229,"nodeType":864},{},[],"There’s clearly a need for better security-by-default from SaaS vendors — things like mandatory MFA enforcement would be a good start. Because there are simply too many apps, and too many accounts to manage — and no effective centralized way of managing them across your SaaS inventory. ",{"data":33231,"content":33232,"nodeType":860},{},[33233],{"data":33234,"marks":33235,"value":33236,"nodeType":864},{},[],"It makes you wonder how many other apps are impacted by ‘on by default’ configurations that can be abused in ways we just don’t know about yet. Partly because nobody is really looking — bug bounties aren’t being paid out, and I know of only a handful of forward-thinking security consultancies conducting any real offensive security testing with their clients in this space. ",{"data":33238,"content":33239,"nodeType":860},{},[33240],{"data":33241,"marks":33242,"value":33243,"nodeType":864},{},[],"We are also reminded, again and again, that credential stuffing attacks are as effective as ever. Despite the investment in SSO, MFA, and all of the identity management and hygiene tools that organizations have nowadays, attackers and researchers keep finding gaps.  ",{"data":33245,"content":33246,"nodeType":1005},{},[],{"data":33248,"content":33249,"nodeType":1009},{},[33250],{"data":33251,"marks":33252,"value":33254,"nodeType":864},{},[33253],{"type":899},"What can you do about it? ",{"data":33256,"content":33257,"nodeType":860},{},[33258],{"data":33259,"marks":33260,"value":33261,"nodeType":864},{},[],"The most important step is to acknowledge the severity of the threat — and the ways that expected controls are failing.",{"data":33263,"content":33264,"nodeType":941},{},[33265,33275,33285,33295],{"data":33266,"content":33267,"nodeType":945},{},[33268],{"data":33269,"content":33270,"nodeType":860},{},[33271],{"data":33272,"marks":33273,"value":33274,"nodeType":864},{},[],"There will almost always be gaps in any organization’s identity security perimeter, simply because it’s almost impossible to have the required visibility — even if you’re Microsoft with your vast security resources.",{"data":33276,"content":33277,"nodeType":945},{},[33278],{"data":33279,"content":33280,"nodeType":860},{},[33281],{"data":33282,"marks":33283,"value":33284,"nodeType":864},{},[],"There will always be ways to abuse app features and configurations, and we’ve barely begun to scratch the surface of what’s now possible in the world of connected SaaS.",{"data":33286,"content":33287,"nodeType":945},{},[33288],{"data":33289,"content":33290,"nodeType":860},{},[33291],{"data":33292,"marks":33293,"value":33294,"nodeType":864},{},[],"These attacks are very difficult to intercept once an attacker is active inside an app, because there’s very little meaningful visibility. ",{"data":33296,"content":33297,"nodeType":945},{},[33298],{"data":33299,"content":33300,"nodeType":860},{},[33301],{"data":33302,"marks":33303,"value":33304,"nodeType":864},{},[],"Once they’re inside, the attack can be over incredibly quickly, and can be repeated across app tenants for maximum impact (again, just look at Snowflake). ",{"data":33306,"content":33307,"nodeType":860},{},[33308,33312,33321],{"data":33309,"marks":33310,"value":33311,"nodeType":864},{},[],"At Push, we’re focused primarily on detecting and intercepting account takeover for these reasons — it’s your earliest opportunity, and for many attacks it’s also your last. If you want to learn more, ",{"data":33313,"content":33315,"nodeType":883},{"uri":33314},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/",[33316],{"data":33317,"marks":33318,"value":33320,"nodeType":864},{},[33319],{"type":1455},"check out our recent design philosophy blog",{"data":33322,"marks":33323,"value":33324,"nodeType":864},{},[]," discussing why we’re shifting detection left to focus on account takeover.  ","What we can learn from the recent ServiceNow/Microsoft disclosure","Account takeover on third-party apps is the flavor of the month for security researchers — what can we learn from it? ","2024-11-01T00:00:00.000Z","learning-from-the-servicenow-disclosure",{"items":33330},[33331,33333],{"sys":33332,"name":15033},{"id":15032},{"sys":33334,"name":297},{"id":2732},{"items":33336},[33337],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":33338},{"url":2740},{"__typename":2059,"sys":33340,"content":33342,"title":33657,"synopsis":33658,"hashTags":59,"publishedDate":33659,"slug":33660,"tagsCollection":33661,"authorsCollection":33667},{"id":33341},"4bYO5rVy9n2OO3vtMVQeda",{"json":33343},{"data":33344,"content":33345,"nodeType":856},{},[33346,33353,33371,33387,33394,33401,33404,33411,33418,33471,33478,33484,33487,33494,33501,33508,33515,33522,33539,33545,33552,33559,33575,33581,33588,33595,33602,33609,33616,33619,33626,33645,33651],{"data":33347,"content":33348,"nodeType":1009},{},[33349],{"data":33350,"marks":33351,"value":33352,"nodeType":864},{},[],"All phishing eventually leads to the browser",{"data":33354,"content":33355,"nodeType":860},{},[33356,33360,33368],{"data":33357,"marks":33358,"value":33359,"nodeType":864},{},[],"The best attack detection methods are those that focus on ",{"data":33361,"content":33362,"nodeType":883},{"uri":14279},[33363],{"data":33364,"marks":33365,"value":33367,"nodeType":864},{},[33366],{"type":1455},"detecting indicators that are difficult for attackers to change or obfuscate",{"data":33369,"marks":33370,"value":12800,"nodeType":864},{},[],{"data":33372,"content":33373,"nodeType":860},{},[33374,33378,33383],{"data":33375,"marks":33376,"value":33377,"nodeType":864},{},[],"For a credential phishing attack to succeed, the victim ",{"data":33379,"marks":33380,"value":33382,"nodeType":864},{},[33381],{"type":1455},"has",{"data":33384,"marks":33385,"value":33386,"nodeType":864},{},[]," to enter their password into a webpage. There’s no two-ways about it, attackers cannot change this. ",{"data":33388,"content":33389,"nodeType":860},{},[33390],{"data":33391,"marks":33392,"value":33393,"nodeType":864},{},[],"So it stands to reason that, if you can detect this user behavior, and block them from entering their password, then you can stop phishing. ",{"data":33395,"content":33396,"nodeType":860},{},[33397],{"data":33398,"marks":33399,"value":33400,"nodeType":864},{},[],"This is exactly what Push does.",{"data":33402,"content":33403,"nodeType":1005},{},[],{"data":33405,"content":33406,"nodeType":1312},{},[33407],{"data":33408,"marks":33409,"value":33410,"nodeType":864},{},[],"Most anti-phishing tools are easily bypassed",{"data":33412,"content":33413,"nodeType":860},{},[33414],{"data":33415,"marks":33416,"value":33417,"nodeType":864},{},[],"Other anti-phishing tools rely on detecting elements of the attack that attackers can change and hide, such as domains or the webpage contents. Attackers use tricks to evade these detection, like:",{"data":33419,"content":33420,"nodeType":941},{},[33421,33431,33441,33451,33461],{"data":33422,"content":33423,"nodeType":945},{},[33424],{"data":33425,"content":33426,"nodeType":860},{},[33427],{"data":33428,"marks":33429,"value":33430,"nodeType":864},{},[],"Using Cloudflare Workers to block automatic analysis of their phishing site",{"data":33432,"content":33433,"nodeType":945},{},[33434],{"data":33435,"content":33436,"nodeType":860},{},[33437],{"data":33438,"marks":33439,"value":33440,"nodeType":864},{},[],"Hacking a Wordpress blog to get a reputable domain that passes domain checks ",{"data":33442,"content":33443,"nodeType":945},{},[33444],{"data":33445,"content":33446,"nodeType":860},{},[33447],{"data":33448,"marks":33449,"value":33450,"nodeType":864},{},[],"Using redirects and rotating the URLs delivered to the victim to bypass link analysis",{"data":33452,"content":33453,"nodeType":945},{},[33454],{"data":33455,"content":33456,"nodeType":860},{},[33457],{"data":33458,"marks":33459,"value":33460,"nodeType":864},{},[],"Randomizing the HTML title for the web page to bypass blocklists ",{"data":33462,"content":33463,"nodeType":945},{},[33464],{"data":33465,"content":33466,"nodeType":860},{},[33467],{"data":33468,"marks":33469,"value":33470,"nodeType":864},{},[],"One-time phishing links that only work the first time they are clicked",{"data":33472,"content":33473,"nodeType":860},{},[33474],{"data":33475,"marks":33476,"value":33477,"nodeType":864},{},[],"Push is putting an end to this game of cat and mouse, by keeping it really simple; you can’t phish someone who can’t put their password into a phishing page. ",{"data":33479,"content":33483,"nodeType":996},{"target":33480},{"sys":33481},{"id":33482,"type":1001,"linkType":1002},"6AwOZSpqaChmeksnj4SyWE",[],{"data":33485,"content":33486,"nodeType":1005},{},[],{"data":33488,"content":33489,"nodeType":1312},{},[33490],{"data":33491,"marks":33492,"value":33493,"nodeType":864},{},[],"Domain-binding passwords",{"data":33495,"content":33496,"nodeType":860},{},[33497],{"data":33498,"marks":33499,"value":33500,"nodeType":864},{},[],"If you’re familiar with how passkeys are domain-bound, then think of what Push does as domain-binding passwords. We pin the password to its legitimate domain(s) and then don’t allow it to be entered into any webpage on any other domain. ",{"data":33502,"content":33503,"nodeType":860},{},[33504],{"data":33505,"marks":33506,"value":33507,"nodeType":864},{},[],"But just because you’ve stopped your users from being phished doesn’t mean you don’t want to know when attackers are attempting to phish your users and how. ",{"data":33509,"content":33510,"nodeType":860},{},[33511],{"data":33512,"marks":33513,"value":33514,"nodeType":864},{},[],"Push still inspects webpages to see if attackers are rendering cloned app login pages in the browser or if known AitM and BitM toolkits are being used. This way you don’t lose visibility of the unsuccessful attacks that are targeting your users. Think of it as a handy second and third layer of defense.",{"data":33516,"content":33517,"nodeType":860},{},[33518],{"data":33519,"marks":33520,"value":33521,"nodeType":864},{},[],"Lets run through a quick before and after example:",{"data":33523,"content":33524,"nodeType":1312},{},[33525,33529,33535],{"data":33526,"marks":33527,"value":33528,"nodeType":864},{},[],"Scenario 1: An attacker attempts to phish an employee that ",{"data":33530,"marks":33531,"value":33534,"nodeType":864},{},[33532,33533],{"type":1455},{"type":899},"doesn’t",{"data":33536,"marks":33537,"value":33538,"nodeType":864},{},[]," have Push deployed to their browser.",{"data":33540,"content":33544,"nodeType":996},{"target":33541},{"sys":33542},{"id":33543,"type":1001,"linkType":1002},"2CbGMUSJsP1mNeHkmpLl6N",[],{"data":33546,"content":33547,"nodeType":860},{},[33548],{"data":33549,"marks":33550,"value":33551,"nodeType":864},{},[],"Here, an attacker hacks a Wordpress blog to get a reputable domain and then runs a phishing toolkit on the webpage. They email one of your employees a link to it. Your SWG / email scanning solution inspects it in a sandbox but the phish kit detects this and redirects to a benign site so that it passes the inspection. ",{"data":33553,"content":33554,"nodeType":860},{},[33555],{"data":33556,"marks":33557,"value":33558,"nodeType":864},{},[],"Your user gets the email with the link and is now free to interact with the phishing page. They enter their credentials plus MFA code into the page and voila! The attacker steals them and is able to compromise the user’s account.  ",{"data":33560,"content":33561,"nodeType":1312},{},[33562,33566,33571],{"data":33563,"marks":33564,"value":33565,"nodeType":864},{},[],"Scenario 2: An attacker attempts to phish an employee that ",{"data":33567,"marks":33568,"value":3053,"nodeType":864},{},[33569,33570],{"type":1455},{"type":899},{"data":33572,"marks":33573,"value":33574,"nodeType":864},{},[]," have Push deployed to their browser. ",{"data":33576,"content":33580,"nodeType":996},{"target":33577},{"sys":33578},{"id":33579,"type":1001,"linkType":1002},"77smnID1woCfFJrJPyTvKY",[],{"data":33582,"content":33583,"nodeType":860},{},[33584],{"data":33585,"marks":33586,"value":33587,"nodeType":864},{},[],"This time, the attacker uses the same phishing toolkit and domain from the first example. But in reality, they don’t have to send it to your employee using email, instead, they could use LinkedIn messenger, Slack, Teams, or any application that allows employees to communicate with each other. ",{"data":33589,"content":33590,"nodeType":860},{},[33591],{"data":33592,"marks":33593,"value":33594,"nodeType":864},{},[],"Like before, the user receives the link, opens it and starts to enter their credentials into the webpage. This time though, the Push browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page.",{"data":33596,"content":33597,"nodeType":860},{},[33598],{"data":33599,"marks":33600,"value":33601,"nodeType":864},{},[],"The first detection Push makes is checking that the password the user is entering matches the domain that password is pinned to. Since it doesn't match, based on this detection alone the user is automatically redirected to a blocking page. An important point to make here is that the password never leaves the user’s browser and the check is made using a shortened salted hash of the password.   ",{"data":33603,"content":33604,"nodeType":860},{},[33605],{"data":33606,"marks":33607,"value":33608,"nodeType":864},{},[],"The second detection Push makes is that the rendered web app is using a cloned app login page. The third detection is that a phishing toolkit is running in the web app code. ",{"data":33610,"content":33611,"nodeType":860},{},[33612],{"data":33613,"marks":33614,"value":33615,"nodeType":864},{},[],"In this particular scenario these second and third detections serve as useful context for understanding the nature of the phishing attack. But both will still redirect to a blocking page if they are triggered in isolation of the other phishing detections. ",{"data":33617,"content":33618,"nodeType":1005},{},[],{"data":33620,"content":33621,"nodeType":1009},{},[33622],{"data":33623,"marks":33624,"value":33625,"nodeType":864},{},[],"We don’t just stop phishing attacks",{"data":33627,"content":33628,"nodeType":860},{},[33629,33633,33641],{"data":33630,"marks":33631,"value":33632,"nodeType":864},{},[],"We also detect other identity-related attack techniques used to compromise user accounts. That includes credential stuffing, password spraying and session hijacking using stolen session tokens. If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":33634,"content":33635,"nodeType":883},{"uri":15655},[33636],{"data":33637,"marks":33638,"value":33640,"nodeType":864},{},[33639],{"type":1455},"book some time with one of our team",{"data":33642,"marks":33643,"value":33644,"nodeType":864},{},[],".  ",{"data":33646,"content":33650,"nodeType":996},{"target":33647},{"sys":33648},{"id":33649,"type":1001,"linkType":1002},"2JSmYDaiAciOx7Z1MRuJlA",[],{"data":33652,"content":33653,"nodeType":860},{},[33654],{"data":33655,"marks":33656,"value":21,"nodeType":864},{},[],"Detecting and blocking phishing attacks in the browser","How Push detects and blocks phishing attempts in the browser – explained in less than two minutes. ","2024-10-23T00:00:00.000Z","detecting-and-blocking-phishing-attacks-in-the-browser",{"items":33662},[33663,33665],{"sys":33664,"name":15033},{"id":15032},{"sys":33666,"name":342},{"id":15029},{"items":33668},[33669],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":33670},{"url":4881},{"__typename":2059,"sys":33672,"content":33674,"title":34828,"synopsis":34829,"hashTags":59,"publishedDate":34830,"slug":34831,"tagsCollection":34832,"authorsCollection":34838},{"id":33673},"4OrixXXLxRmSDxa7PF9gfM",{"json":33675},{"data":33676,"content":33677,"nodeType":856},{},[33678,33709,33721,33737,33744,33751,33754,33761,33768,33902,33909,33916,34010,34017,34024,34077,34084,34107,34164,34167,34174,34193,34213,34220,34239,34246,34258,34261,34268,34275,34323,34330,34337,34355,34358,34365,34372,34379,34398,34405,34412,34419,34439,34446,34453,34460,34467,34486,34493,34500,34507,34514,34546,34552,34555,34562,34569,34575,34582,34589,34612,34619,34626,34669,34685,34705,34711,34718,34725,34732,34764,34809,34816,34822],{"data":33679,"content":33680,"nodeType":860},{},[33681,33685,33694,33697,33705],{"data":33682,"marks":33683,"value":33684,"nodeType":864},{},[],"Infostealer malware seems to be grabbing the headlines right now. It’s easy to see why, too, after laying claim to one of the ",{"data":33686,"content":33688,"nodeType":883},{"uri":33687},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[33689],{"data":33690,"marks":33691,"value":33693,"nodeType":864},{},[33692],{"type":1455},"biggest breaches in history",{"data":33695,"marks":33696,"value":3748,"nodeType":864},{},[],{"data":33698,"content":33699,"nodeType":883},{"uri":32842},[33700],{"data":33701,"marks":33702,"value":33704,"nodeType":864},{},[33703],{"type":1455},"recent attacks on Snowflake customers",{"data":33706,"marks":33707,"value":33708,"nodeType":864},{},[]," saw ~165 businesses compromised using stolen credentials, resulting in millions of breached customer records, with the full impact still emerging. ",{"data":33710,"content":33711,"nodeType":860},{},[33712,33716],{"data":33713,"marks":33714,"value":33715,"nodeType":864},{},[],"Notably, ",{"data":33717,"marks":33718,"value":33720,"nodeType":864},{},[33719],{"type":899},"80% of the credentials used to access Snowflake customer accounts had found their way online after being stolen in infostealer infections – dating back as early as 2020. ",{"data":33722,"content":33723,"nodeType":860},{},[33724,33728,33733],{"data":33725,"marks":33726,"value":33727,"nodeType":864},{},[],"The Snowflake situation is a reminder of how lucrative stolen credentials can be for attackers – and how the cybercrime ecosystem has tilted as a result. As the saying goes nowadays, ",{"data":33729,"marks":33730,"value":33732,"nodeType":864},{},[33731],{"type":899},"hackers don’t hack in, they log in",{"data":33734,"marks":33735,"value":33736,"nodeType":864},{},[],". Stolen credentials are the lowest hanging fruit available to attackers, and their appetite (and the ecosystem needed to feed it) is insatiable. As an attacker, the prospect of picking up access to a major enterprise for just $10 or less (or even for free) is hard to resist – why wouldn’t you buy a ticket and take the gamble?  ",{"data":33738,"content":33739,"nodeType":860},{},[33740],{"data":33741,"marks":33742,"value":33743,"nodeType":864},{},[],"Infostealers are a huge part of the shift toward identity attacks. Along with phishing, infostealers are the primary mechanism for attackers to harvest credentials. Unlike phishing, infostealers can collect a large number of credentials (and other helpful data saved in the browser) in one fell swoop. But, they do have limitations. For example, you would expect any credible EDR to detect and block these attacks. And yet, the success of the attacks on Snowflake customers show us that gaps are being found and exploited.  ",{"data":33745,"content":33746,"nodeType":860},{},[33747],{"data":33748,"marks":33749,"value":33750,"nodeType":864},{},[],"In this article, we’ll look at the history of infostealers, how they work, and what the trends show us about how the cybercrime ecosystem is leaning into the opportunity they present.    ",{"data":33752,"content":33753,"nodeType":1005},{},[],{"data":33755,"content":33756,"nodeType":1009},{},[33757],{"data":33758,"marks":33759,"value":33760,"nodeType":864},{},[],"The state of infostealers today",{"data":33762,"content":33763,"nodeType":860},{},[33764],{"data":33765,"marks":33766,"value":33767,"nodeType":864},{},[],"Infostealers, and the mass credential harvesting they enable, are a big part of the rise in identity attacks. The stats support this, as:",{"data":33769,"content":33770,"nodeType":941},{},[33771,33794,33816,33838,33859,33880],{"data":33772,"content":33773,"nodeType":945},{},[33774],{"data":33775,"content":33776,"nodeType":860},{},[33777,33781,33790],{"data":33778,"marks":33779,"value":33780,"nodeType":864},{},[],"One million new stealer logs are distributed every month, with an estimated 3-5% containing credentials and session cookies to corporate IT environments (",{"data":33782,"content":33784,"nodeType":883},{"uri":33783},"https://www.bleepingcomputer.com/news/security/single-sign-on-and-the-cybercrime-ecosystem/",[33785],{"data":33786,"marks":33787,"value":33789,"nodeType":864},{},[33788],{"type":1455},"Flare",{"data":33791,"marks":33792,"value":33793,"nodeType":864},{},[],").",{"data":33795,"content":33796,"nodeType":945},{},[33797],{"data":33798,"content":33799,"nodeType":860},{},[33800,33804,33813],{"data":33801,"marks":33802,"value":33803,"nodeType":864},{},[],"Infostealer activity increased by 266% in 2023, while the number of attacks featuring valid credentials saw a 71% increase year-over-year (",{"data":33805,"content":33807,"nodeType":883},{"uri":33806},"https://www.ibm.com/downloads/cas/L0GKXDWJ",[33808],{"data":33809,"marks":33810,"value":33812,"nodeType":864},{},[33811],{"type":1455},"IBM",{"data":33814,"marks":33815,"value":33793,"nodeType":864},{},[],{"data":33817,"content":33818,"nodeType":945},{},[33819],{"data":33820,"content":33821,"nodeType":860},{},[33822,33826,33835],{"data":33823,"marks":33824,"value":33825,"nodeType":864},{},[],"147,000 token replay attacks were detected by Microsoft in 2023, an 111% increase year-over-year (",{"data":33827,"content":33829,"nodeType":883},{"uri":33828},"https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700",[33830],{"data":33831,"marks":33832,"value":33834,"nodeType":864},{},[33833],{"type":1455},"Microsoft",{"data":33836,"marks":33837,"value":18222,"nodeType":864},{},[],{"data":33839,"content":33840,"nodeType":945},{},[33841],{"data":33842,"content":33843,"nodeType":860},{},[33844,33848,33856],{"data":33845,"marks":33846,"value":33847,"nodeType":864},{},[],"Over 1000 credentials are posted online per day, per marketplace with an average sale price of $10, and 65% posted less than one day after being collected (",{"data":33849,"content":33850,"nodeType":883},{"uri":4408},[33851],{"data":33852,"marks":33853,"value":33855,"nodeType":864},{},[33854],{"type":1455},"Verizon",{"data":33857,"marks":33858,"value":33793,"nodeType":864},{},[],{"data":33860,"content":33861,"nodeType":945},{},[33862],{"data":33863,"content":33864,"nodeType":860},{},[33865,33869,33877],{"data":33866,"marks":33867,"value":33868,"nodeType":864},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":33870,"content":33872,"nodeType":883},{"uri":33871},"https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/",[33873],{"data":33874,"marks":33875,"value":33876,"nodeType":864},{},[],"Sophos",{"data":33878,"marks":33879,"value":33793,"nodeType":864},{},[],{"data":33881,"content":33882,"nodeType":945},{},[33883],{"data":33884,"content":33885,"nodeType":860},{},[33886,33890,33899],{"data":33887,"marks":33888,"value":33889,"nodeType":864},{},[],"Attacks on session cookies happen at the same order of magnitude as password-based attacks (",{"data":33891,"content":33893,"nodeType":883},{"uri":33892},"https://github.com/WICG/dbsc/issues/13#issuecomment-1977657864",[33894],{"data":33895,"marks":33896,"value":33898,"nodeType":864},{},[33897],{"type":1455},"Google",{"data":33900,"marks":33901,"value":33793,"nodeType":864},{},[],{"data":33903,"content":33904,"nodeType":1312},{},[33905],{"data":33906,"marks":33907,"value":33908,"nodeType":864},{},[],"How did we get here?",{"data":33910,"content":33911,"nodeType":860},{},[33912],{"data":33913,"marks":33914,"value":33915,"nodeType":864},{},[],"Let’s go back to the beginning. When they first emerged, infostealers were designed to steal online banking and credit card information. The most notable early example comes from as far back as 2006 with the ZeuS trojan. After the ZeuS source code was leaked in March 2011, the creation of multiple variants boosted the popularity of this type of malware and inspired the development of infostealers with increasingly sophisticated capabilities.",{"data":33917,"content":33918,"nodeType":860},{},[33919,33923,33932,33936,33945,33949,33958,33961,33970,33973,33982,33985,33994,33997,34006],{"data":33920,"marks":33921,"value":33922,"nodeType":864},{},[],"Modern infostealers rose to prominence in around 2018 with the emergence of ",{"data":33924,"content":33926,"nodeType":883},{"uri":33925},"https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer",[33927],{"data":33928,"marks":33929,"value":33931,"nodeType":864},{},[33930],{"type":1455},"Arkei",{"data":33933,"marks":33934,"value":33935,"nodeType":864},{},[],", which quickly spawned the more popular ",{"data":33937,"content":33939,"nodeType":883},{"uri":33938},"https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar",[33940],{"data":33941,"marks":33942,"value":33944,"nodeType":864},{},[33943],{"type":1455},"Vidar",{"data":33946,"marks":33947,"value":33948,"nodeType":864},{},[]," stealer. Today, some of the most popular families are ",{"data":33950,"content":33952,"nodeType":883},{"uri":33951},"https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro",[33953],{"data":33954,"marks":33955,"value":33957,"nodeType":864},{},[33956],{"type":1455},"RisePro",{"data":33959,"marks":33960,"value":3731,"nodeType":864},{},[],{"data":33962,"content":33964,"nodeType":883},{"uri":33963},"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer",[33965],{"data":33966,"marks":33967,"value":33969,"nodeType":864},{},[33968],{"type":1455},"RedLine",{"data":33971,"marks":33972,"value":3731,"nodeType":864},{},[],{"data":33974,"content":33976,"nodeType":883},{"uri":33975},"https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc",[33977],{"data":33978,"marks":33979,"value":33981,"nodeType":864},{},[33980],{"type":1455},"StealC",{"data":33983,"marks":33984,"value":3731,"nodeType":864},{},[],{"data":33986,"content":33988,"nodeType":883},{"uri":33987},"https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon",[33989],{"data":33990,"marks":33991,"value":33993,"nodeType":864},{},[33992],{"type":1455},"Raccoon",{"data":33995,"marks":33996,"value":2232,"nodeType":864},{},[],{"data":33998,"content":34000,"nodeType":883},{"uri":33999},"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma",[34001],{"data":34002,"marks":34003,"value":34005,"nodeType":864},{},[34004],{"type":1455},"Lumma",{"data":34007,"marks":34008,"value":34009,"nodeType":864},{},[],", with new variants and families appearing all the time. ",{"data":34011,"content":34012,"nodeType":860},{},[34013],{"data":34014,"marks":34015,"value":34016,"nodeType":864},{},[],"Infostealers are used by all manner of threat actors of varying levels of sophistication. For larger groups with sufficient resources, the creation of new, custom stealers and malware packages is a common tactic to attempt to evade detection. ",{"data":34018,"content":34019,"nodeType":860},{},[34020],{"data":34021,"marks":34022,"value":34023,"nodeType":864},{},[],"But despite all the variants, infostealers do have common capabilities and characteristics, such as:",{"data":34025,"content":34026,"nodeType":941},{},[34027,34037,34047,34057,34067],{"data":34028,"content":34029,"nodeType":945},{},[34030],{"data":34031,"content":34032,"nodeType":860},{},[34033],{"data":34034,"marks":34035,"value":34036,"nodeType":864},{},[],"Extracting information from the browsers of a compromised device, such as passwords, cookies, autofill information, downloaded file information.",{"data":34038,"content":34039,"nodeType":945},{},[34040],{"data":34041,"content":34042,"nodeType":860},{},[34043],{"data":34044,"marks":34045,"value":34046,"nodeType":864},{},[],"Snapshotting the desktop and system inventory, with details such as the username, location data, hardware configuration, and information regarding installed security software.",{"data":34048,"content":34049,"nodeType":945},{},[34050],{"data":34051,"content":34052,"nodeType":860},{},[34053],{"data":34054,"marks":34055,"value":34056,"nodeType":864},{},[],"Sending stolen data back to a C2 server.",{"data":34058,"content":34059,"nodeType":945},{},[34060],{"data":34061,"content":34062,"nodeType":860},{},[34063],{"data":34064,"marks":34065,"value":34066,"nodeType":864},{},[],"Facilitating the deployment of additional tools and malware as part of a package. ",{"data":34068,"content":34069,"nodeType":945},{},[34070],{"data":34071,"content":34072,"nodeType":860},{},[34073],{"data":34074,"marks":34075,"value":34076,"nodeType":864},{},[],"Often (but not always) self-terminating once complete, leaving little trace on the victim machine and no ongoing behavior that might be detected. ",{"data":34078,"content":34079,"nodeType":860},{},[34080],{"data":34081,"marks":34082,"value":34083,"nodeType":864},{},[],"Infostealers are distributed in similar ways to other types of malware, such as:",{"data":34085,"content":34086,"nodeType":941},{},[34087,34097],{"data":34088,"content":34089,"nodeType":945},{},[34090],{"data":34091,"content":34092,"nodeType":860},{},[34093],{"data":34094,"marks":34095,"value":34096,"nodeType":864},{},[],"Delivery of malicious executable files via phishing emails or by having a victim download content from a malicious website. ",{"data":34098,"content":34099,"nodeType":945},{},[34100],{"data":34101,"content":34102,"nodeType":860},{},[34103],{"data":34104,"marks":34105,"value":34106,"nodeType":864},{},[],"‘Drive-by’ style attacks where the victim has only to visit an infected website.",{"data":34108,"content":34109,"nodeType":860},{},[34110,34114,34123,34126,34135,34138,34147,34151,34160],{"data":34111,"marks":34112,"value":34113,"nodeType":864},{},[],"They’re typically spread via malvertising, P2P downloads, and deceptive software download sites. ",{"data":34115,"content":34117,"nodeType":883},{"uri":34116},"https://www.bleepingcomputer.com/news/security/fake-cheat-lures-gamers-into-spreading-infostealer-malware/",[34118],{"data":34119,"marks":34120,"value":34122,"nodeType":864},{},[34121],{"type":1455},"Gaming forums",{"data":34124,"marks":34125,"value":3731,"nodeType":864},{},[],{"data":34127,"content":34129,"nodeType":883},{"uri":34128},"https://cybersecuritynews.com/facebook-account-hijack-malware/",[34130],{"data":34131,"marks":34132,"value":34134,"nodeType":864},{},[34133],{"type":1455},"Facebook ads",{"data":34136,"marks":34137,"value":2232,"nodeType":864},{},[],{"data":34139,"content":34141,"nodeType":883},{"uri":34140},"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube",[34142],{"data":34143,"marks":34144,"value":34146,"nodeType":864},{},[34145],{"type":1455},"YouTube video descriptions",{"data":34148,"marks":34149,"value":34150,"nodeType":864},{},[]," are popular locations for malicious links, but recent examples also include ",{"data":34152,"content":34154,"nodeType":883},{"uri":34153},"https://www.bleepingcomputer.com/news/security/over-3-000-github-accounts-used-by-malware-distribution-service/",[34155],{"data":34156,"marks":34157,"value":34159,"nodeType":864},{},[34158],{"type":1455},"complex malware distribution networks on GitHub",{"data":34161,"marks":34162,"value":34163,"nodeType":864},{},[]," – such as the recent campaign from ‘Stargazer Goblin’ with more than 3,000 fake accounts creating and promoting hundreds of fake repositories to increase their apparent legitimacy and make them more likely to appear on GitHub's trending section.",{"data":34165,"content":34166,"nodeType":1005},{},[],{"data":34168,"content":34169,"nodeType":1009},{},[34170],{"data":34171,"marks":34172,"value":34173,"nodeType":864},{},[],"Infostealers are key to the cybercrime ecosystem",{"data":34175,"content":34176,"nodeType":860},{},[34177,34181,34189],{"data":34178,"marks":34179,"value":34180,"nodeType":864},{},[],"After being stolen, ",{"data":34182,"content":34183,"nodeType":883},{"uri":33783},[34184],{"data":34185,"marks":34186,"value":34188,"nodeType":864},{},[34187],{"type":1455},"infostealer data inevitably finds its way onto hacker forums and marketplaces",{"data":34190,"marks":34191,"value":34192,"nodeType":864},{},[],", both on the clearweb and darkweb. Popular infostealers have their own dedicated Telegram channels to advertise and sell stolen data. Private channels also exist, with the channel owner distributing tens of thousands of logs per week to a limited number of threat actors who pay $200-$400 for access to the channel. This allows them to get ‘first pick’ of stolen logs, which are later shared through public Telegram channels. ",{"data":34194,"content":34195,"nodeType":860},{},[34196,34200,34209],{"data":34197,"marks":34198,"value":34199,"nodeType":864},{},[],"Public data eventually makes its way onto services such as Have I Been Pwned (HIBP), which gives individuals and security teams some visibility of which credentials have been compromised. For example, ",{"data":34201,"content":34203,"nodeType":883},{"uri":34202},"https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/",[34204],{"data":34205,"marks":34206,"value":34208,"nodeType":864},{},[34207],{"type":1455},"in June, Troy Hunt (creator of HIBP) wrote",{"data":34210,"marks":34211,"value":34212,"nodeType":864},{},[]," about the impact of channels like Telegram and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":34214,"content":34215,"nodeType":860},{},[34216],{"data":34217,"marks":34218,"value":34219,"nodeType":864},{},[],"The cybercrime ecosystem is complex, with a developed supply chain and organizations fulfilling different roles as a result: from malware-as-a-service developers, to initial access brokers, to the operators that actually conduct the attacks (be they ransomware, data theft, etc.) – and many, many other roles in between. Sometimes, a single group and/or its affiliates will conduct the full chain, but this is far less common today. ",{"data":34221,"content":34222,"nodeType":860},{},[34223,34226,34235],{"data":34224,"marks":34225,"value":21,"nodeType":864},{},[],{"data":34227,"content":34229,"nodeType":883},{"uri":34228},"https://www.secureworks.com/research/the-growing-threat-from-infostealers",[34230],{"data":34231,"marks":34232,"value":34234,"nodeType":864},{},[34233],{"type":1455},"Infostealers are often sold by malware developers to other attackers as a monthly subscription service.",{"data":34236,"marks":34237,"value":34238,"nodeType":864},{},[]," The price can range from $50 to over $1,000 USD per month for access to a stealer command and control (C2) server operated by the developer. The service often features a range of support functions, including multiple ways to view, download, and share stolen data. Self-hosted stealer C2 servers are also available and are usually sold for a flat fee. ",{"data":34240,"content":34241,"nodeType":860},{},[34242],{"data":34243,"marks":34244,"value":34245,"nodeType":864},{},[],"There’s also evidence that there is an element of target coordination – with one marketplace, Russian Market, allowing users to ‘preorder’ credentials for a $1,000 USD deposit from 2022. ",{"data":34247,"content":34248,"nodeType":860},{},[34249,34254],{"data":34250,"marks":34251,"value":34253,"nodeType":864},{},[34252],{"type":899},"So what? Well, there's evidently an abundance of breached data already online, and attackers have the tools readily available to have this pile grow exponentially bigger and more useful.",{"data":34255,"marks":34256,"value":34257,"nodeType":864},{},[]," It’s also probably more coordinated than we like to admit – a particularly intimidating prospect in the wake of Snowflake, which will no doubt have many criminals smelling blood in the water. ",{"data":34259,"content":34260,"nodeType":1005},{},[],{"data":34262,"content":34263,"nodeType":1009},{},[34264],{"data":34265,"marks":34266,"value":34267,"nodeType":864},{},[],"How can stolen data be abused by attackers? ",{"data":34269,"content":34270,"nodeType":860},{},[34271],{"data":34272,"marks":34273,"value":34274,"nodeType":864},{},[],"It’s pretty obvious that attackers getting access to all of your passwords and session cookies is bad, but there is a clear value hierarchy from a corporate security perspective. So, from highest to lowest risk:",{"data":34276,"content":34277,"nodeType":941},{},[34278,34293,34308],{"data":34279,"content":34280,"nodeType":945},{},[34281],{"data":34282,"content":34283,"nodeType":860},{},[34284,34289],{"data":34285,"marks":34286,"value":34288,"nodeType":864},{},[34287],{"type":899},"Stolen session cookies",{"data":34290,"marks":34291,"value":34292,"nodeType":864},{},[]," simply need to be imported into an attacker’s browser to resume an active session on an app. That means access can be gained without needing to enter a username and password, or pass any MFA checks. ",{"data":34294,"content":34295,"nodeType":945},{},[34296],{"data":34297,"content":34298,"nodeType":860},{},[34299,34304],{"data":34300,"marks":34301,"value":34303,"nodeType":864},{},[34302],{"type":899},"Stolen usernames, passwords",{"data":34305,"marks":34306,"value":34307,"nodeType":864},{},[],", and login page URLs can be used to access any accounts that lack MFA. ",{"data":34309,"content":34310,"nodeType":945},{},[34311],{"data":34312,"content":34313,"nodeType":860},{},[34314,34319],{"data":34315,"marks":34316,"value":34318,"nodeType":864},{},[34317],{"type":899},"Stolen autofill data",{"data":34320,"marks":34321,"value":34322,"nodeType":864},{},[]," can be used to gather other valuable information that could be useful for impersonating the victim when speaking to social engineering IT support staff, for example to reset or remove MFA.",{"data":34324,"content":34325,"nodeType":860},{},[34326],{"data":34327,"marks":34328,"value":34329,"nodeType":864},{},[],"Naturally, stolen session cookies are the most valuable prize, but they are often valid for only a limited time before the user must re-authenticate, and active sessions can often be terminated by security admins. Unfortunately, it’s not that uncommon for sessions to last for up to a month, or even sometimes indefinitely.",{"data":34331,"content":34332,"nodeType":860},{},[34333],{"data":34334,"marks":34335,"value":34336,"nodeType":864},{},[],"Stolen usernames and passwords are a different story. As the Snowflake breaches demonstrate, passwords can remain valid for years after a breach, particularly in the world of SaaS apps where mandatory password rotation is not as common as for a user’s primary domain account.",{"data":34338,"content":34339,"nodeType":860},{},[34340,34344,34351],{"data":34341,"marks":34342,"value":34343,"nodeType":864},{},[],"There’s also the problem of ",{"data":34345,"content":34346,"nodeType":883},{"uri":13067},[34347],{"data":34348,"marks":34349,"value":23167,"nodeType":864},{},[34350],{"type":1455},{"data":34352,"marks":34353,"value":34354,"nodeType":864},{},[]," – where a local login with a username and password (and probably lacking MFA) can exist alongside other, more secure login methods such as SSO. Given the fact that many apps are self-adopted by users, these accounts continue to exist even when an app is subsequently added to SSO via the chosen IdP, meaning they can fly under the radar of security teams. ",{"data":34356,"content":34357,"nodeType":1005},{},[],{"data":34359,"content":34360,"nodeType":1009},{},[34361],{"data":34362,"marks":34363,"value":34364,"nodeType":864},{},[],"Should you be concerned about infostealers?",{"data":34366,"content":34367,"nodeType":860},{},[34368],{"data":34369,"marks":34370,"value":34371,"nodeType":864},{},[],"It’s commonly thought that infostealers are primarily a concern for unmanaged devices that lack security controls common to corporate IT, such as EDR. But there’s a couple of reasons why corporate users are also at risk:",{"data":34373,"content":34374,"nodeType":1312},{},[34375],{"data":34376,"marks":34377,"value":34378,"nodeType":864},{},[],"EDR can be bypassed",{"data":34380,"content":34381,"nodeType":860},{},[34382,34386,34395],{"data":34383,"marks":34384,"value":34385,"nodeType":864},{},[],"EDR is seen as the go-to solution for defending against infostealer malware. However, attackers are always looking for ways to get around security controls by obfuscating malicious behavior and evading signature-based checks. For example, ",{"data":34387,"content":34389,"nodeType":883},{"uri":34388},"https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html",[34390],{"data":34391,"marks":34392,"value":34394,"nodeType":864},{},[34393],{"type":1455},"a flaw in Microsoft Defender SmartScreen was recently exploited to deliver infostealer malware",{"data":34396,"marks":34397,"value":2924,"nodeType":864},{},[],{"data":34399,"content":34400,"nodeType":860},{},[34401],{"data":34402,"marks":34403,"value":34404,"nodeType":864},{},[],"Getting total coverage across your endpoint estate is notoriously difficult, if not totally unrealistic. Unless the malware is stopped on execution, then data will inevitably be stolen, and will continue to be taken until stopped (or it self-terminates). And once an attacker has stolen employee credentials or sessions, the credential stuffing and session hijacking attacks that come next won’t touch the endpoint. For those reasons, you can’t rely on EDR as a single line of defense against infostealers.",{"data":34406,"content":34407,"nodeType":1312},{},[34408],{"data":34409,"marks":34410,"value":34411,"nodeType":864},{},[],"Unmanaged devices such as BYOD or third-parties are vulnerable",{"data":34413,"content":34414,"nodeType":860},{},[34415],{"data":34416,"marks":34417,"value":34418,"nodeType":864},{},[],"Companies that support BYOD often have less secure configurations than those with fully managed devices. The same applies to third-party contractors, who often use their own devices to access company systems on a temporary basis. ",{"data":34420,"content":34421,"nodeType":860},{},[34422,34426,34435],{"data":34423,"marks":34424,"value":34425,"nodeType":864},{},[],"This issue was acutely felt in the Snowflake attacks: There is some suggestion that targeting key third-party suppliers – ",{"data":34427,"content":34429,"nodeType":883},{"uri":34428},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[34430],{"data":34431,"marks":34432,"value":34434,"nodeType":864},{},[34433],{"type":1455},"such as EPAM Systems, a software engineering firm and Snowflake ‘Elite Tier Partner’",{"data":34436,"marks":34437,"value":34438,"nodeType":864},{},[]," – yielded some of the access needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base – third-parties are a known weak point for red teamers, so it would be foolish to assume that attackers don’t also think this way. It’s possible too that EPAM were specifically targeted because of their Snowflake chops – adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online. ",{"data":34440,"content":34441,"nodeType":1312},{},[34442],{"data":34443,"marks":34444,"value":34445,"nodeType":864},{},[],"Browser profiles can be synced across devices, increasing the blast radius",{"data":34447,"content":34448,"nodeType":860},{},[34449],{"data":34450,"marks":34451,"value":34452,"nodeType":864},{},[],"It’s not uncommon for employees to access their personal email accounts from company devices. When accessing any browser, you are typically prompted to sign in with your account credentials (e.g. your Google account). If a user signs into a browser on a company device with a personal account, you’re usually prompted to sync your account across devices. This usually means that any saved passwords, search history, and settings are shared across devices. ",{"data":34454,"content":34455,"nodeType":860},{},[34456],{"data":34457,"marks":34458,"value":34459,"nodeType":864},{},[],"Naturally, this means that if a personal device is compromised where you’re also logged into the browser profile, then an infostealer will be able to harvest information saved into that profile across devices.",{"data":34461,"content":34462,"nodeType":860},{},[34463],{"data":34464,"marks":34465,"value":34466,"nodeType":864},{},[],"Even when using separate browser profiles for work and personal, it’s easy for the two to converge, or to slip into using the wrong profile. Accessing personal accounts (or at least synchronizing data across accounts) is usually a workplace policy violation, but it’s unfortunately all too common. ",{"data":34468,"content":34469,"nodeType":860},{},[34470,34474,34483],{"data":34471,"marks":34472,"value":34473,"nodeType":864},{},[],"Previous vulnerabilities have exacerbated this problem, such as ",{"data":34475,"content":34477,"nodeType":883},{"uri":34476},"https://thehackernews.com/2024/01/malware-using-google-multilogin-exploit.html",[34478],{"data":34479,"marks":34480,"value":34482,"nodeType":864},{},[34481],{"type":1455},"an exploit affecting Google MultiLogin to maintain access to synced accounts even after a password reset",{"data":34484,"marks":34485,"value":12800,"nodeType":864},{},[],{"data":34487,"content":34488,"nodeType":1312},{},[34489],{"data":34490,"marks":34491,"value":34492,"nodeType":864},{},[],"Are infostealers a bigger problem than credential phishing? ",{"data":34494,"content":34495,"nodeType":860},{},[34496],{"data":34497,"marks":34498,"value":34499,"nodeType":864},{},[],"The short answer is: No. The longer answer is: They are both part of the bigger problem of identity attacks, and attackers can wield both approaches simultaneously. ",{"data":34501,"content":34502,"nodeType":860},{},[34503],{"data":34504,"marks":34505,"value":34506,"nodeType":864},{},[],"While they are delivered to victims in similar ways to phishing links, most organizations are arguably better protected against infostealers than modern phishing attacks because endpoint security controls provide another layer of protection, in theory – whereas modern phishing attacks don’t necessarily involve the delivery of malware that executes on the device. ",{"data":34508,"content":34509,"nodeType":860},{},[34510],{"data":34511,"marks":34512,"value":34513,"nodeType":864},{},[],"Infostealers arguably provide more bang for the attacker’s buck, grabbing a stack of credentials and useful data in one go. In contrast, phishing is usually much more targeted, and involves the compromise of a narrower set of credentials – typically focusing on a particular site or app. ",{"data":34515,"content":34516,"nodeType":860},{},[34517,34521,34530,34534,34542],{"data":34518,"marks":34519,"value":34520,"nodeType":864},{},[],"It’s worth focusing on the TTP, not the particular tool being used: The attacker technique here is ",{"data":34522,"content":34524,"nodeType":883},{"uri":34523},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/session_cookie_theft/description.md",[34525],{"data":34526,"marks":34527,"value":34529,"nodeType":864},{},[34528],{"type":1455},"session cookie theft",{"data":34531,"marks":34532,"value":34533,"nodeType":864},{},[],", and subsequently session hijacking by importing the cookie into the attacker’s browser. Both infostealers and ",{"data":34535,"content":34537,"nodeType":883},{"uri":34536},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[34538],{"data":34539,"marks":34540,"value":34541,"nodeType":864},{},[],"modern phishing attacks",{"data":34543,"marks":34544,"value":34545,"nodeType":864},{},[]," involve the theft of session tokens, and so are valid means to achieve this end. In fact, there’s nothing to stop threat groups from employing both simultaneously.",{"data":34547,"content":34551,"nodeType":996},{"target":34548},{"sys":34549},{"id":34550,"type":1001,"linkType":1002},"7fil6aaQDFfJGYUnQ14k10",[],{"data":34553,"content":34554,"nodeType":1005},{},[],{"data":34556,"content":34557,"nodeType":1009},{},[34558],{"data":34559,"marks":34560,"value":34561,"nodeType":864},{},[],"Infostealers in action",{"data":34563,"content":34564,"nodeType":860},{},[34565],{"data":34566,"marks":34567,"value":34568,"nodeType":864},{},[],"Check out the video demo below to see the attack chain in action from the point of an infostealer compromise, showing session cookie theft, reimporting the cookies into the attacker's browser, and evading policy-based controls in M365. It also shows the targeting of downstream apps that are usually accessed via SSO in the context of both a Microsoft Entra and Okta compromise.",{"data":34570,"content":34574,"nodeType":996},{"target":34571},{"sys":34572},{"id":34573,"type":1001,"linkType":1002},"4J7LqqjQX2W52AbmcVmjUt",[],{"data":34576,"content":34577,"nodeType":1009},{},[34578],{"data":34579,"marks":34580,"value":34581,"nodeType":864},{},[],"What can organizations do about the infostealer threat? ",{"data":34583,"content":34584,"nodeType":860},{},[34585],{"data":34586,"marks":34587,"value":34588,"nodeType":864},{},[],"Security teams should have two main concerns:",{"data":34590,"content":34591,"nodeType":941},{},[34592,34602],{"data":34593,"content":34594,"nodeType":945},{},[34595],{"data":34596,"content":34597,"nodeType":860},{},[34598],{"data":34599,"marks":34600,"value":34601,"nodeType":864},{},[],"Data that is already out there from historical data dumps, but is still valid. ",{"data":34603,"content":34604,"nodeType":945},{},[34605],{"data":34606,"content":34607,"nodeType":860},{},[34608],{"data":34609,"marks":34610,"value":34611,"nodeType":864},{},[],"Data in private channels that attackers could use in the future, that you are blind to. ",{"data":34613,"content":34614,"nodeType":860},{},[34615],{"data":34616,"marks":34617,"value":34618,"nodeType":864},{},[],"As always, the root-cause of the problem is a lack of meaningful visibility of what apps your employees are using (including those outside your IdP) and whether the associated identities are configured securely. ",{"data":34620,"content":34621,"nodeType":860},{},[34622],{"data":34623,"marks":34624,"value":34625,"nodeType":864},{},[],"A layered, defense-in-depth approach is required to resolve the issue, by:",{"data":34627,"content":34628,"nodeType":941},{},[34629,34639,34649,34659],{"data":34630,"content":34631,"nodeType":945},{},[34632],{"data":34633,"content":34634,"nodeType":860},{},[34635],{"data":34636,"marks":34637,"value":34638,"nodeType":864},{},[],"Deploying MFA across all your identities and apps, including any local logins that can’t be put behind SSO. ",{"data":34640,"content":34641,"nodeType":945},{},[34642],{"data":34643,"content":34644,"nodeType":860},{},[34645],{"data":34646,"marks":34647,"value":34648,"nodeType":864},{},[],"Configuring time-limited session lifetimes for all apps to ensure that any stolen session tokens can only be used temporarily. ",{"data":34650,"content":34651,"nodeType":945},{},[34652],{"data":34653,"content":34654,"nodeType":860},{},[34655],{"data":34656,"marks":34657,"value":34658,"nodeType":864},{},[],"Ensuring that employees don’t access or synchronize personal accounts on their work devices, as well as limiting non-work activities on their work device as much as possible.",{"data":34660,"content":34661,"nodeType":945},{},[34662],{"data":34663,"content":34664,"nodeType":860},{},[34665],{"data":34666,"marks":34667,"value":34668,"nodeType":864},{},[],"Implementing a robust EDR/MDR solution to detect and respond to malware compromises on user devices. ",{"data":34670,"content":34671,"nodeType":860},{},[34672,34676,34681],{"data":34673,"marks":34674,"value":34675,"nodeType":864},{},[],"Organizations also have the option of investing in a commercial TI feed to detect and report data breaches affecting employees. But in our experience, these feeds contain ",{"data":34677,"marks":34678,"value":34680,"nodeType":864},{},[34679],{"type":899},"a lot ",{"data":34682,"marks":34683,"value":34684,"nodeType":864},{},[],"of false positives – so unless you have password visibility for employee accounts across apps, it’s going to waste a chunk of valuable time for you and your employees.",{"data":34686,"content":34687,"nodeType":860},{},[34688,34692,34701],{"data":34689,"marks":34690,"value":34691,"nodeType":864},{},[],"It would be remiss of us not to mention our recently released ",{"data":34693,"content":34695,"nodeType":883},{"uri":34694},"https://pushsecurity.com/blog/introducing-session-token-theft-detection-why-browser-is-best/",[34696],{"data":34697,"marks":34698,"value":34700,"nodeType":864},{},[34699],{"type":1455},"session token theft detection feature",{"data":34702,"marks":34703,"value":34704,"nodeType":864},{},[]," that identifies session token theft by adding telemetry to the user agent string – using the power of our browser agent to create a new high-fidelity signal for security teams. It can also be applied more generally to detect any session taking place in an unmanaged browser – so you can use it to spot unauthorized access to company apps in general, too.  ",{"data":34706,"content":34710,"nodeType":996},{"target":34707},{"sys":34708},{"id":34709,"type":1001,"linkType":1002},"3XgpqEGzZSD2J0uvnCg5D8",[],{"data":34712,"content":34713,"nodeType":1312},{},[34714],{"data":34715,"marks":34716,"value":34717,"nodeType":864},{},[],"What’s next for infostealers?",{"data":34719,"content":34720,"nodeType":860},{},[34721],{"data":34722,"marks":34723,"value":34724,"nodeType":864},{},[],"All the signs point to the fact that infostealers will continue being a useful tool in the attacker’s arsenal. The Snowflake attacks in particular are both a warning for defenders and encouragement for attackers. It's also a good reminder that while infostealers were once used to harvest things like VPN creds to pivot to the internal network, they're now largely used to target third-party services over the internet. ",{"data":34726,"content":34727,"nodeType":860},{},[34728],{"data":34729,"marks":34730,"value":34731,"nodeType":864},{},[],"To evade EDR, it’s likely that we’ll see a growing number of families and variants used by individual groups, or better ‘enterprise’ capabilities from malware-as-a-service vendors. ",{"data":34733,"content":34734,"nodeType":860},{},[34735,34739,34748,34752,34760],{"data":34736,"marks":34737,"value":34738,"nodeType":864},{},[],"One notable quirk is that, to date, infostealers have not really branched out from targeting browsers. Take the example of password manager apps – you would think this would be an obvious target, right? But, they’re not usually targeted (",{"data":34740,"content":34742,"nodeType":883},{"uri":34741},"https://securitysenses.com/posts/malware-targeting-password-managers",[34743],{"data":34744,"marks":34745,"value":34747,"nodeType":864},{},[34746],{"type":1455},"with some exceptions",{"data":34749,"marks":34750,"value":34751,"nodeType":864},{},[],"). And when they do, ",{"data":34753,"content":34754,"nodeType":883},{"uri":34741},[34755],{"data":34756,"marks":34757,"value":34759,"nodeType":864},{},[34758],{"type":1455},"they work by eavesdropping on the password manager’s browser extension in action",{"data":34761,"marks":34762,"value":34763,"nodeType":864},{},[]," – meaning they are intercepted one-at-a-time as the user uses them, rather than targeting the password manager directly and exporting the saved passwords all at once. It will be interesting to see whether these capabilities are added in the future. ",{"data":34765,"content":34766,"nodeType":860},{},[34767,34771,34780,34783,34792,34796,34805],{"data":34768,"marks":34769,"value":34770,"nodeType":864},{},[],"On the other hand, there are defensive security developments that could reduce the ability of attackers to leverage things like stolen session tokens, such as ",{"data":34772,"content":34774,"nodeType":883},{"uri":34773},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection",[34775],{"data":34776,"marks":34777,"value":34779,"nodeType":864},{},[34778],{"type":1455},"Microsoft’s token binding feature in Entra",{"data":34781,"marks":34782,"value":18896,"nodeType":864},{},[],{"data":34784,"content":34786,"nodeType":883},{"uri":34785},"https://blog.chromium.org/2024/04/fighting-cookie-theft-using-device.html",[34787],{"data":34788,"marks":34789,"value":34791,"nodeType":864},{},[34790],{"type":1455},"Google’s device bound session cookies",{"data":34793,"marks":34794,"value":34795,"nodeType":864},{},[],". Google also released an ",{"data":34797,"content":34799,"nodeType":883},{"uri":34798},"https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html?m=1",[34800],{"data":34801,"marks":34802,"value":34804,"nodeType":864},{},[34803],{"type":1455},"app-bound encryption feature",{"data":34806,"marks":34807,"value":34808,"nodeType":864},{},[],", which adds additional protection against infostealers attempting to steal browser data in Chrome if the underlying Windows device is compromised. ",{"data":34810,"content":34811,"nodeType":860},{},[34812],{"data":34813,"marks":34814,"value":34815,"nodeType":864},{},[],"That said, mature versions of these controls are still years away, and while session cookie theft is a key risk of infostealers, it’s not the only risk – so alternative controls and mitigations remain valuable to security teams in the present. ",{"data":34817,"content":34821,"nodeType":996},{"target":34818},{"sys":34819},{"id":34820,"type":1001,"linkType":1002},"5loTnpvwGD3kaKMXBp23hZ",[],{"data":34823,"content":34824,"nodeType":860},{},[34825],{"data":34826,"marks":34827,"value":21,"nodeType":864},{},[],"What the rise of infostealers says about identity attacks","What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks. ","2024-07-31T00:00:00.000Z","what-the-rise-of-infostealers-says-about-identity-attacks",{"items":34833},[34834,34836],{"sys":34835,"name":15033},{"id":15032},{"sys":34837,"name":342},{"id":15029},{"items":34839},[34840],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":34841},{"url":2740},"stop-users-saving-corp-creds-into-personal-password-managers","blog/stop-users-saving-corp-creds-into-personal-password-managers",{"json":34845},{"data":34846,"content":34847,"nodeType":856},{},[34848],{"data":34849,"content":34850,"nodeType":860},{},[34851],{"data":34852,"marks":34853,"value":34854,"nodeType":864},{},[],"Using Push, you can now see which password managers your employees are storing their work credentials in. Make sure sensitive corporate credentials don’t leave your corporate environment and end up in personal password managers.","Make sure sensitive corporate credentials don’t leave your corporate environment and end up in personal password managers with Push.",{"id":34857,"publishedAt":34858},"7uLeQ9twNl5RyNaWkkJNjd","2026-08-12T11:54:53.331Z",{"items":34860},[34861,34863],{"sys":34862,"name":5648},{"id":5647},{"sys":34864,"name":297},{"id":2732},{"items":34866},[34867,34869,34871,34873,34875],{"sys":34868,"name":413,"slug":414,"tier":31},{"id":410},{"sys":34870,"name":297,"slug":298,"tier":31},{"id":294},{"sys":34872,"name":502,"slug":503,"tier":45},{"id":499},{"sys":34874,"name":422,"slug":423,"tier":45},{"id":419},{"sys":34876,"name":368,"slug":369,"tier":45},{"id":365},"sboqOMRd91H3KLUsE_5tXJultwrvWBs3EB7N2PxXISY",{"id":34879,"title":34880,"authorsCollection":34881,"content":34891,"extension":228,"faqItemsCollection":35919,"faqTitle":59,"featured":6,"hashTags":59,"meta":35921,"metaTitle":35922,"ogImage":59,"postType":35923,"publishedDate":35924,"relatedBlogPostsCollection":35925,"slug":37655,"stem":37656,"subtitle":59,"summary":37657,"synopsis":34901,"sys":37668,"tagsCollection":37671,"topicsCollection":37677,"__hash__":37699},"blog/blog/nearly-invisible-attack-chain.json","The shadow workflow’s evil twin: A nearly invisible attack chain",{"items":34882},[34883],{"fullName":34884,"firstName":34885,"jobTitle":34886,"socialLinks":34887,"profilePicture":34889},"Luke Jennings","Luke","Vice President, R&D",[34888],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":34890},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg",{"json":34892,"links":35778},{"data":34893,"content":34894,"nodeType":856},{},[34895,34902,34909,34941,34948,34955,34975,34982,34989,34996,35026,35033,35040,35056,35063,35070,35104,35111,35118,35125,35132,35139,35145,35152,35159,35166,35174,35181,35201,35208,35215,35222,35229,35236,35243,35250,35257,35264,35270,35277,35297,35304,35323,35329,35335,35341,35348,35355,35362,35368,35374,35381,35388,35395,35402,35409,35415,35435,35455,35462,35468,35474,35481,35488,35495,35502,35525,35531,35537,35544,35551,35558,35569,35575,35582,35588,35594,35601,35608,35615,35621,35627,35634,35641,35757,35764,35771],{"data":34896,"content":34897,"nodeType":860},{},[34898],{"data":34899,"marks":34900,"value":34901,"nodeType":864},{},[],"In this article, we’re going to demonstrate how combining two of our favorite new SaaS attack techniques makes a simple, but very stealthy persistence approach.",{"data":34903,"content":34904,"nodeType":860},{},[34905],{"data":34906,"marks":34907,"value":34908,"nodeType":864},{},[],"—----",{"data":34910,"content":34911,"nodeType":860},{},[34912,34916,34923,34927,34938],{"data":34913,"marks":34914,"value":34915,"nodeType":864},{},[],"This is the second post in a series on attack chains formed by combining techniques in the ",{"data":34917,"content":34918,"nodeType":883},{"uri":32829},[34919],{"data":34920,"marks":34921,"value":32835,"nodeType":864},{},[34922],{"type":1455},{"data":34924,"marks":34925,"value":34926,"nodeType":864},{},[],". Last post we wrote about ",{"data":34928,"content":34932,"nodeType":5064},{"target":34929},{"sys":34930},{"id":34931,"type":1001,"linkType":1002},"3F96pyn4qqkbVctSOH69vm",[34933],{"data":34934,"marks":34935,"value":34937,"nodeType":864},{},[34936],{"type":1455},"SAMLjacking a poisoned tenant",{"data":34939,"marks":34940,"value":12800,"nodeType":864},{},[],{"data":34942,"content":34943,"nodeType":860},{},[34944],{"data":34945,"marks":34946,"value":34947,"nodeType":864},{},[],"This time we’ll be looking at combining shadow workflows with an evil twin integration for an especially sneaky and flexible method of persistence. We’ll be using Zapier integrating with Azure as our primary example. ",{"data":34949,"content":34950,"nodeType":1009},{},[34951],{"data":34952,"marks":34953,"value":34954,"nodeType":864},{},[],"What is a shadow workflow?",{"data":34956,"content":34957,"nodeType":860},{},[34958,34962,34971],{"data":34959,"marks":34960,"value":34961,"nodeType":864},{},[],"A ",{"data":34963,"content":34965,"nodeType":883},{"uri":34964},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[34966],{"data":34967,"marks":34968,"value":34970,"nodeType":864},{},[34969],{"type":1455},"shadow workflow ",{"data":34972,"marks":34973,"value":34974,"nodeType":864},{},[],"is a technique for using SaaS automation apps to provide a code execution-like method for conducting malicious actions from a legitimate source using OAuth integrations. This could be a daily export of files from shared cloud drives, automatic forwarding and deleting of emails, cloning instant messages, exporting user directories — basically anything that is possible using the target app’s API. ",{"data":34976,"content":34977,"nodeType":860},{},[34978],{"data":34979,"marks":34980,"value":34981,"nodeType":864},{},[],"The fact automation apps utilize OAuth integrations means they also function as a very effective method of maintaining persistence. Think of shadow workflows as the offensive PowerShell of the SaaS world. ",{"data":34983,"content":34984,"nodeType":1009},{},[34985],{"data":34986,"marks":34987,"value":34988,"nodeType":864},{},[],"What’s an evil twin integration?",{"data":34990,"content":34991,"nodeType":860},{},[34992],{"data":34993,"marks":34994,"value":34995,"nodeType":864},{},[],"Creating a new OAuth integration, even if using a legitimate SaaS application, could be viewed as suspicious if seen by a security team or the affected user. This is especially true if an account compromise is discovered and an IR team sees a consent for a new OAuth integration in the log that the compromised user does not recognize. ",{"data":34997,"content":34998,"nodeType":860},{},[34999,35003,35012,35016,35022],{"data":35000,"marks":35001,"value":35002,"nodeType":864},{},[],"An ",{"data":35004,"content":35006,"nodeType":883},{"uri":35005},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md",[35007],{"data":35008,"marks":35009,"value":35011,"nodeType":864},{},[35010],{"type":1455},"evil twin integration",{"data":35013,"marks":35014,"value":35015,"nodeType":864},{},[],", however, reduces the chances of discovery by reusing an existing ",{"data":35017,"marks":35018,"value":35021,"nodeType":864},{},[35019,35020],{"type":2246},{"type":899},"legitimate",{"data":35023,"marks":35024,"value":35025,"nodeType":864},{},[]," integration for malicious purposes.",{"data":35027,"content":35028,"nodeType":1009},{},[35029],{"data":35030,"marks":35031,"value":35032,"nodeType":864},{},[],"What’s the benefit of combining them?",{"data":35034,"content":35035,"nodeType":860},{},[35036],{"data":35037,"marks":35038,"value":35039,"nodeType":864},{},[],"While shadow workflows are incredibly powerful on their own, as malicious use of OAuth integrations becomes more common, security teams will start regularly checking for new, or unknown, integrations in response to security incidents. While automation apps are legitimate SaaS services, shadow workflow attacks could still raise question marks during incident response if it’s connected shortly after a compromise and/or if the affected user has no knowledge of it. ",{"data":35041,"content":35042,"nodeType":860},{},[35043,35047,35052],{"data":35044,"marks":35045,"value":35046,"nodeType":864},{},[],"Additionally, as use of security tools that ",{"data":35048,"marks":35049,"value":35051,"nodeType":864},{},[35050],{"type":1455},"provide visibility of OAuth integrations",{"data":35053,"marks":35054,"value":35055,"nodeType":864},{},[]," (check out our product) increases, it will become increasingly dangerous for an adversary to create a new OAuth integration. That’s because the target user and possibly even security teams may be notified.",{"data":35057,"content":35058,"nodeType":860},{},[35059],{"data":35060,"marks":35061,"value":35062,"nodeType":864},{},[],"This leads us on to evil twin integrations. Their power is in making use of existing integrations so they can avoid appearing as a new integration and getting flagged or sending alerts to security teams. That makes them much stealthier and increases the likelihood of a successful attack. ",{"data":35064,"content":35065,"nodeType":860},{},[35066],{"data":35067,"marks":35068,"value":35069,"nodeType":864},{},[],"There are three possibilities here that lead to two different levels of stealth for the attack:",{"data":35071,"content":35072,"nodeType":35103},{},[35073,35083,35093],{"data":35074,"content":35075,"nodeType":945},{},[35076],{"data":35077,"content":35078,"nodeType":860},{},[35079],{"data":35080,"marks":35081,"value":35082,"nodeType":864},{},[],"Medium stealth option: Making use of an automation app used legitimately by the organization, but not by the target user, specifically",{"data":35084,"content":35085,"nodeType":945},{},[35086],{"data":35087,"content":35088,"nodeType":860},{},[35089],{"data":35090,"marks":35091,"value":35092,"nodeType":864},{},[],"High stealth option 1: Making use of an automation app used legitimately by the target user themselves",{"data":35094,"content":35095,"nodeType":945},{},[35096],{"data":35097,"content":35098,"nodeType":860},{},[35099],{"data":35100,"marks":35101,"value":35102,"nodeType":864},{},[],"High stealth option 2: Making use of an automation app that has been granted admin consent","ordered-list",{"data":35105,"content":35106,"nodeType":1312},{},[35107],{"data":35108,"marks":35109,"value":35110,"nodeType":864},{},[],"Medium stealth option: Pre-existing use by organization",{"data":35112,"content":35113,"nodeType":860},{},[35114],{"data":35115,"marks":35116,"value":35117,"nodeType":864},{},[],"This option is by far the most likely option to be applicable in a real-world situation. Here’s how it works:",{"data":35119,"content":35120,"nodeType":860},{},[35121],{"data":35122,"marks":35123,"value":35124,"nodeType":864},{},[],"The consent for the targeted user will be new and will generate an audit event to show that, but the integration itself will not be new inside the organization and may even be formally approved by the security team already. This will help evade general detection mechanisms as it won’t be seen as a brand new integration at the organization level that requires careful scrutiny. It’s much harder to evaluate new consents on a per-user basis for existing integrations if the organization is of any significant size.",{"data":35126,"content":35127,"nodeType":860},{},[35128],{"data":35129,"marks":35130,"value":35131,"nodeType":864},{},[],"The downside, however, is that this attack stands a greater chance of detection if notifications are delivered directly to the affected user. Alternatively, if the original compromise is discovered, incident responders are more likely to discover this consent during an investigation. That’s because the affected user would know they aren’t using the automation app and incident responders are likely to explore logs showing consents to new OAuth integrations and permissions shortly after a successful compromise.",{"data":35133,"content":35134,"nodeType":860},{},[35135],{"data":35136,"marks":35137,"value":35138,"nodeType":864},{},[],"Using Azure as an example, while no new service principal is created in this case, the audit logs still show a new consent for the targeted user to the existing Zapier app: ",{"data":35140,"content":35144,"nodeType":996},{"target":35141},{"sys":35142},{"id":35143,"type":1001,"linkType":1002},"7m0E0sOulc348jhQguQLb1",[],{"data":35146,"content":35147,"nodeType":1312},{},[35148],{"data":35149,"marks":35150,"value":35151,"nodeType":864},{},[],"High stealth option 1: Pre-existing use by targeted user",{"data":35153,"content":35154,"nodeType":860},{},[35155],{"data":35156,"marks":35157,"value":35158,"nodeType":864},{},[],"This is the holy grail option, but is likely to require more luck in the real world. It requires that the target user is already using an automation app, which the adversary could compromise and utilize. If the compromised user has already consented to permissions useful to the adversary, such as access to sensitive data like email and file stores, then new malicious workflows can be created without requiring the user to consent to new permissions. ",{"data":35160,"content":35161,"nodeType":860},{},[35162],{"data":35163,"marks":35164,"value":35165,"nodeType":864},{},[],"Consequently, there will be no new integration observed at the organization level, no new user-specific consents for sensitive permissions and the target user would indicate they’re just using a legitimate app if questioned by incident responders. ",{"data":35167,"content":35168,"nodeType":860},{},[35169],{"data":35170,"marks":35171,"value":35173,"nodeType":864},{},[35172],{"type":899},"None of the three audit log entries shown above would be present in this scenario either.",{"data":35175,"content":35176,"nodeType":1312},{},[35177],{"data":35178,"marks":35179,"value":35180,"nodeType":864},{},[],"High stealth option 2: Azure admin consented app",{"data":35182,"content":35183,"nodeType":860},{},[35184,35188,35197],{"data":35185,"marks":35186,"value":35187,"nodeType":864},{},[],"There is a mixed scenario when permissions for an automation app (or any app you want to use for an evil twin integration) have been granted tenant-wide ",{"data":35189,"content":35191,"nodeType":883},{"uri":35190},"https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/user-admin-consent-overview#admin-consent",[35192],{"data":35193,"marks":35194,"value":35196,"nodeType":864},{},[35195],{"type":1455},"admin consent in Azure",{"data":35198,"marks":35199,"value":35200,"nodeType":864},{},[],". In this case, the administrator has effectively consented to permissions for all users, even if they aren’t currently active users of the app. ",{"data":35202,"content":35203,"nodeType":860},{},[35204],{"data":35205,"marks":35206,"value":35207,"nodeType":864},{},[],"This means when a new user integrates the app, it does not generate a new permission grant since it is effectively already granted. Consequently, the three log entries shown above would not be present in this scenario even if integrating the app for a user that has never used it before.",{"data":35209,"content":35210,"nodeType":860},{},[35211],{"data":35212,"marks":35213,"value":35214,"nodeType":864},{},[],"This gives the best level of flexibility for an adversary as they can avoid generating new permission grant logs for any user. However, it's not quite as stealthy as when the targeted user already makes use of the app as there is no history of legitimate app logins or activity for the user prior to the compromise to blend in with.",{"data":35216,"content":35217,"nodeType":1009},{},[35218],{"data":35219,"marks":35220,"value":35221,"nodeType":864},{},[],"An example attack - Zapier",{"data":35223,"content":35224,"nodeType":860},{},[35225],{"data":35226,"marks":35227,"value":35228,"nodeType":864},{},[],"In this case, we’re going to use Zapier as our automation app example and Azure as the primary target for integrations and there will be no admin consent involved. We’ll also be using Google Workspace for data exfiltration. There are many other examples we could have used here, though - Make.com, IFTTT, Retool, Tines, Microsoft Power Automate and many other SaaS apps have powerful automation and integration capabilities and could be used for similar purposes. ",{"data":35230,"content":35231,"nodeType":860},{},[35232],{"data":35233,"marks":35234,"value":35235,"nodeType":864},{},[],"Azure and Google Workspace are also obvious juicy targets for integrations, but automation apps support integrations with vast numbers of other SaaS applications,so there are many possible targets.",{"data":35237,"content":35238,"nodeType":860},{},[35239],{"data":35240,"marks":35241,"value":35242,"nodeType":864},{},[],"So, let’s say we’ve compromised a target user’s Azure account. Perhaps we have conducted a successful credential stuffing attack, a phishing attack including MFA code proxying or even achieved a traditional endpoint compromise and have stolen the user’s session tokens.",{"data":35244,"content":35245,"nodeType":860},{},[35246],{"data":35247,"marks":35248,"value":35249,"nodeType":864},{},[],"Whatever the case, we have temporary control of the user’s account, either until the session expires or the user changes their password. If the original compromise is detected, that could happen quickly, so we want to conduct some malicious actions to make use of the access while we have it and to also gain persistence so we maintain our access beyond a password change.",{"data":35251,"content":35252,"nodeType":860},{},[35253],{"data":35254,"marks":35255,"value":35256,"nodeType":864},{},[],"We want to use an automation app, but we’d prefer to be as stealthy as possible by also making it an evil twin integration. We’d like to see if the target user has existing integrations with any apps we’d like to use - especially an automation app for that high stealth option we mentioned above. ",{"data":35258,"content":35259,"nodeType":860},{},[35260],{"data":35261,"marks":35262,"value":35263,"nodeType":864},{},[],"We’ve created a video demo of the full attack below. A step by step write up with more detail then follows:",{"data":35265,"content":35269,"nodeType":996},{"target":35266},{"sys":35267},{"id":35268,"type":1001,"linkType":1002},"E1ZHBcjGLZAno0SRtJ3d3",[],{"data":35271,"content":35272,"nodeType":1009},{},[35273],{"data":35274,"marks":35275,"value":35276,"nodeType":864},{},[],"Step 1 - Enumerating potential targets",{"data":35278,"content":35279,"nodeType":860},{},[35280,35284,35293],{"data":35281,"marks":35282,"value":35283,"nodeType":864},{},[],"We could perform something as simple as an email search for evidence of sign-ups, but that won’t necessarily show us if actual OAuth integrations have been configured and what permissions are in use. What we really need is a way to perform an ",{"data":35285,"content":35287,"nodeType":883},{"uri":35286},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_token_enumeration/description.md",[35288],{"data":35289,"marks":35290,"value":35292,"nodeType":864},{},[35291],{"type":1455},"OAuth token enumeration",{"data":35294,"marks":35295,"value":35296,"nodeType":864},{},[]," attack.",{"data":35298,"content":35299,"nodeType":1312},{},[35300],{"data":35301,"marks":35302,"value":35303,"nodeType":864},{},[],"The first method: myapps.microsoft.com",{"data":35305,"content":35306,"nodeType":860},{},[35307,35311,35319],{"data":35308,"marks":35309,"value":35310,"nodeType":864},{},[],"Make use of ",{"data":35312,"content":35314,"nodeType":883},{"uri":35313},"https://myapps.microsoft.com",[35315],{"data":35316,"marks":35317,"value":35313,"nodeType":864},{},[35318],{"type":1455},{"data":35320,"marks":35321,"value":35322,"nodeType":864},{},[]," to see which apps are listed and which permissions have been granted. We can see Zapier is in use and the user has granted it access to their email and files, making it a great target.",{"data":35324,"content":35328,"nodeType":996},{"target":35325},{"sys":35326},{"id":35327,"type":1001,"linkType":1002},"6dDez7xRZjliEJR6DAkWHa",[],{"data":35330,"content":35334,"nodeType":996},{"target":35331},{"sys":35332},{"id":35333,"type":1001,"linkType":1002},"7M0imWv4n3z1RYQu3AdMF5",[],{"data":35336,"content":35340,"nodeType":996},{"target":35337},{"sys":35338},{"id":35339,"type":1001,"linkType":1002},"3fwFBK03tc5g064k0IyADO",[],{"data":35342,"content":35343,"nodeType":1312},{},[35344],{"data":35345,"marks":35346,"value":35347,"nodeType":864},{},[],"The second method: Microsoft’s graph API",{"data":35349,"content":35350,"nodeType":860},{},[35351],{"data":35352,"marks":35353,"value":35354,"nodeType":864},{},[],"\nMicrosoft’s graph API doesn’t make it possible to list out service principals without admin permissions, but you can enumerate individual OAuth permission grants and app role assignments for your own user account. ",{"data":35356,"content":35357,"nodeType":860},{},[35358],{"data":35359,"marks":35360,"value":35361,"nodeType":864},{},[],"The client ID listed for permission grants is actually the tenant-specific service principal ID, rather than the globally unique OAuth app ID, but the app role assignments call gives us the app display name. We can match up the IDs from the app role assignments with the OAuth permission grants to see which permissions have been granted to the given app. ",{"data":35363,"content":35367,"nodeType":996},{"target":35364},{"sys":35365},{"id":35366,"type":1001,"linkType":1002},"519mlRMbaZYBAVdSADwop7",[],{"data":35369,"content":35373,"nodeType":996},{"target":35370},{"sys":35371},{"id":35372,"type":1001,"linkType":1002},"3g4WBQBEvqx5mXXnZzZzUG",[],{"data":35375,"content":35376,"nodeType":1009},{},[35377],{"data":35378,"marks":35379,"value":35380,"nodeType":864},{},[],"Step 2 - Create shadow workflows",{"data":35382,"content":35383,"nodeType":860},{},[35384],{"data":35385,"marks":35386,"value":35387,"nodeType":864},{},[],"Ok, so we’ve figured out the user already makes use of Zapier and they’ve even already granted access to their email and files - that’s a juicy target we can’t turn down! So the next step is to create our own malicious workflows, or shadow workflows if you will, to get Zapier to do our dirty work for us.",{"data":35389,"content":35390,"nodeType":860},{},[35391],{"data":35392,"marks":35393,"value":35394,"nodeType":864},{},[],"First of all, we’ll see if we can scope out the user’s existing Zapier account to better understand the setup. Then we’ll create a new Zapier account and link it to the target user’s account that we’ve compromised. Here’s how that would work:",{"data":35396,"content":35397,"nodeType":1312},{},[35398],{"data":35399,"marks":35400,"value":35401,"nodeType":864},{},[],"Scope out the existing Zapier account",{"data":35403,"content":35404,"nodeType":860},{},[35405],{"data":35406,"marks":35407,"value":35408,"nodeType":864},{},[],"If the user uses SSO or social logins then we can login directly and, since we now control their Azure account, we can just log directly into their Zapier account!",{"data":35410,"content":35414,"nodeType":996},{"target":35411},{"sys":35412},{"id":35413,"type":1001,"linkType":1002},"5IgmxUEm6n19OBL1cSZVkr",[],{"data":35416,"content":35417,"nodeType":860},{},[35418,35422,35431],{"data":35419,"marks":35420,"value":35421,"nodeType":864},{},[],"Alternatively, if they have created a standard password account, then we might already know the password if it’s the same used for their Azure account. Otherwise, we could potentially make use of an ",{"data":35423,"content":35425,"nodeType":883},{"uri":35424},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/account_recovery/description.md",[35426],{"data":35427,"marks":35428,"value":35430,"nodeType":864},{},[35429],{"type":1455},"account recovery",{"data":35432,"marks":35433,"value":35434,"nodeType":864},{},[]," attack to gain access.",{"data":35436,"content":35437,"nodeType":860},{},[35438,35442,35451],{"data":35439,"marks":35440,"value":35441,"nodeType":864},{},[],"Once we have logged into their account, we can see their existing workflows and integrations. Technically, we could backdoor these or create new ones - a form of an ",{"data":35443,"content":35445,"nodeType":883},{"uri":35444},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/abuse_existing_oauth_integrations/description.md",[35446],{"data":35447,"marks":35448,"value":35450,"nodeType":864},{},[35449],{"type":1455},"abuse existing OAuth integrations",{"data":35452,"marks":35453,"value":35454,"nodeType":864},{},[]," attack. However, that runs the risk of the user discovering our shadow workflows and also almost certainly being locked out of the account during the next password change. ",{"data":35456,"content":35457,"nodeType":860},{},[35458],{"data":35459,"marks":35460,"value":35461,"nodeType":864},{},[],"Instead, we can stick to an evil twin integration from our own Zapier account, which we’ll create later.",{"data":35463,"content":35467,"nodeType":996},{"target":35464},{"sys":35465},{"id":35466,"type":1001,"linkType":1002},"2vhyTcVLq27QVa2HFFWBhH",[],{"data":35469,"content":35473,"nodeType":996},{"target":35470},{"sys":35471},{"id":35472,"type":1001,"linkType":1002},"3jPSdBPSQgigA4yKK1udCV",[],{"data":35475,"content":35476,"nodeType":860},{},[35477],{"data":35478,"marks":35479,"value":35480,"nodeType":864},{},[],"Now we can see what the user was actually using Zapier for — they’ve set up an integration with both Outlook and OneDrive so they can forward emails related to their business expenses to a folder in their OneDrive. Probably a time-saving hack, which we can take advantage of since it won’t be unusual to see Zapier regularly accessing their Outlook and OneDrive. That means our attack will be extra stealthy.",{"data":35482,"content":35483,"nodeType":1312},{},[35484],{"data":35485,"marks":35486,"value":35487,"nodeType":864},{},[],"Create our own malicious Zapier account",{"data":35489,"content":35490,"nodeType":860},{},[35491],{"data":35492,"marks":35493,"value":35494,"nodeType":864},{},[],"Given in this case we, at least temporarily, control the user’s Azure account there is nothing stopping us connecting this to our own malicious Zapier account completely separately from the user’s legitimate Zapier account. We then maintain full control over the Zapier account and the user will not be able to discover our shadow workflows as they won’t have any knowledge of our Zapier account: ",{"data":35496,"content":35497,"nodeType":860},{},[35498],{"data":35499,"marks":35500,"value":35501,"nodeType":864},{},[],"Let’s create our own shadow workflows:",{"data":35503,"content":35504,"nodeType":941},{},[35505,35515],{"data":35506,"content":35507,"nodeType":945},{},[35508],{"data":35509,"content":35510,"nodeType":860},{},[35511],{"data":35512,"marks":35513,"value":35514,"nodeType":864},{},[],"One that sends every new OneDrive file to our own separate Google Drive account. This allows us to maintain a complete view of the user’s files into the future. ",{"data":35516,"content":35517,"nodeType":945},{},[35518],{"data":35519,"content":35520,"nodeType":860},{},[35521],{"data":35522,"marks":35523,"value":35524,"nodeType":864},{},[],"And one to forward every new Outlook email to our own GMail account.",{"data":35526,"content":35530,"nodeType":996},{"target":35527},{"sys":35528},{"id":35529,"type":1001,"linkType":1002},"6eK8uNjPnkrfVjgFzl03SM",[],{"data":35532,"content":35536,"nodeType":996},{"target":35533},{"sys":35534},{"id":35535,"type":1001,"linkType":1002},"6xJvuS374tbflAoNmhnqYP",[],{"data":35538,"content":35539,"nodeType":860},{},[35540],{"data":35541,"marks":35542,"value":35543,"nodeType":864},{},[],"We can now see we are logged in with a separate GMail account, but have created shadow workflows to forward emails from the user’s Outlook to our GMail account and harvest files from their OneDrive to our Google Drive.",{"data":35545,"content":35546,"nodeType":860},{},[35547],{"data":35548,"marks":35549,"value":35550,"nodeType":864},{},[],"The major benefit of creating our own Zapier account for an evil twin integration is that once we are locked out of the target user’s account via a password change or otherwise, not only do our existing shadow workflows continue to operate via OAuth, but we are able to create new shadow workflows and reuse the existing OAuth connections. That’s the power of having full control of the Zapier account. ",{"data":35552,"content":35553,"nodeType":860},{},[35554],{"data":35555,"marks":35556,"value":35557,"nodeType":864},{},[],"One small downside to this approach is that creating the new OAuth integrations inside a new Zapier account generates an interactive login event for the Zapier integrations from the adversary’s IP address. This occurs due to creating integrations from the new Zapier account, but because the user has already consented to all the relevant permissions for Zapier’s own OAuth apps there are no audit logs for new consents or applications, just the login event itself. ",{"data":35559,"content":35560,"nodeType":860},{},[35561,35565],{"data":35562,"marks":35563,"value":35564,"nodeType":864},{},[],"However, determining that a successful login to an app a user legitimately uses is actually malicious in this case is obviously extremely difficult to build detection logic for.   ",{"data":35566,"marks":35567,"value":8415,"nodeType":864},{},[35568],{"type":2246},{"data":35570,"content":35574,"nodeType":996},{"target":35571},{"sys":35572},{"id":35573,"type":1001,"linkType":1002},"1oZBtlL8rNl7TjmfJqRjUG",[],{"data":35576,"content":35577,"nodeType":860},{},[35578],{"data":35579,"marks":35580,"value":35581,"nodeType":864},{},[],"Beyond the initial login events, the only evidence of malicious activity in the future will be from the activity logs showing the actions conducted by our shadow workflows every time they are triggered to run. For example, the following screenshots show that the Zapier Todo app (ClientAppId 29246358-1970-4d6d-bc75-acf34edc758b) has been seen both uploading a file and downloading a file: \n",{"data":35583,"content":35587,"nodeType":996},{"target":35584},{"sys":35585},{"id":35586,"type":1001,"linkType":1002},"2vYOSilB5W05aIHw2ZKqdC",[],{"data":35589,"content":35593,"nodeType":996},{"target":35590},{"sys":35591},{"id":35592,"type":1001,"linkType":1002},"2fFwrdFO25BwY4vI7EKMA0",[],{"data":35595,"content":35596,"nodeType":860},{},[35597],{"data":35598,"marks":35599,"value":35600,"nodeType":864},{},[],"The file upload in this case relates to the legitimate workflow and the file download relates to the shadow workflow. The IP addresses relate to Zapier’s legitimate infrastructure so really only a very thorough and specific investigation is going to be able to uncover that one of these events is malicious.",{"data":35602,"content":35603,"nodeType":1009},{},[35604],{"data":35605,"marks":35606,"value":35607,"nodeType":864},{},[],"Step 3 - Profit",{"data":35609,"content":35610,"nodeType":860},{},[35611],{"data":35612,"marks":35613,"value":35614,"nodeType":864},{},[],"Now we just need to sit back and let our shadow workflows do the work for us, 24/7 and from Zapier’s infrastructure via a legitimate OAuth integration. Here we can see files the user created in OneDrive and emails they received in Outlook mirrored to our own GMail and Google Drive via the magic of shadow workflows.",{"data":35616,"content":35620,"nodeType":996},{"target":35617},{"sys":35618},{"id":35619,"type":1001,"linkType":1002},"4lJBrdJLEVnhBUjgtGo8T1",[],{"data":35622,"content":35626,"nodeType":996},{"target":35623},{"sys":35624},{"id":35625,"type":1001,"linkType":1002},"azQ3IO0n4Idih5LDwOogV",[],{"data":35628,"content":35629,"nodeType":1009},{},[35630],{"data":35631,"marks":35632,"value":35633,"nodeType":864},{},[],"Impact",{"data":35635,"content":35636,"nodeType":860},{},[35637],{"data":35638,"marks":35639,"value":35640,"nodeType":864},{},[],"Ok, we’ve covered a lot of ground here so it’s worth taking a step back and considering the key impact points of this attack chain:",{"data":35642,"content":35643,"nodeType":941},{},[35644,35654,35664,35674,35684,35737,35747],{"data":35645,"content":35646,"nodeType":945},{},[35647],{"data":35648,"content":35649,"nodeType":860},{},[35650],{"data":35651,"marks":35652,"value":35653,"nodeType":864},{},[],"An adversary who has gained (temporary) access to a user account that supports OAuth integrations can use shadow workflows to execute malicious actions and to maintain persistence",{"data":35655,"content":35656,"nodeType":945},{},[35657],{"data":35658,"content":35659,"nodeType":860},{},[35660],{"data":35661,"marks":35662,"value":35663,"nodeType":864},{},[],"This access will continue even if the user changes their password or resets MFA",{"data":35665,"content":35666,"nodeType":945},{},[35667],{"data":35668,"content":35669,"nodeType":860},{},[35670],{"data":35671,"marks":35672,"value":35673,"nodeType":864},{},[],"Not only do existing shadow workflows continue to work after password changes, an adversary can continue to create new ones and reuse the existing integrations.",{"data":35675,"content":35676,"nodeType":945},{},[35677],{"data":35678,"content":35679,"nodeType":860},{},[35680],{"data":35681,"marks":35682,"value":35683,"nodeType":864},{},[],"Any relevant logs will show access via legitimate IP addresses and OAuth integrations for SaaS automation apps ",{"data":35685,"content":35686,"nodeType":945},{},[35687,35694],{"data":35688,"content":35689,"nodeType":860},{},[35690],{"data":35691,"marks":35692,"value":35693,"nodeType":864},{},[],"Automation apps are so flexible that an adversary can do pretty much anything - it’s basically the offensive PowerShell of the SaaS world. Just some examples:",{"data":35695,"content":35696,"nodeType":941},{},[35697,35707,35717,35727],{"data":35698,"content":35699,"nodeType":945},{},[35700],{"data":35701,"content":35702,"nodeType":860},{},[35703],{"data":35704,"marks":35705,"value":35706,"nodeType":864},{},[],"Monitor all emails and files the user creates",{"data":35708,"content":35709,"nodeType":945},{},[35710],{"data":35711,"content":35712,"nodeType":860},{},[35713],{"data":35714,"marks":35715,"value":35716,"nodeType":864},{},[],"Delete email security alerts before the user sees them",{"data":35718,"content":35719,"nodeType":945},{},[35720],{"data":35721,"content":35722,"nodeType":860},{},[35723],{"data":35724,"marks":35725,"value":35726,"nodeType":864},{},[],"Intercept password reset and passwordless login emails to access other apps",{"data":35728,"content":35729,"nodeType":945},{},[35730],{"data":35731,"content":35732,"nodeType":860},{},[35733],{"data":35734,"marks":35735,"value":35736,"nodeType":864},{},[],"Monitor instant messaging apps and use it to send targeted internal social engineering emails",{"data":35738,"content":35739,"nodeType":945},{},[35740],{"data":35741,"content":35742,"nodeType":860},{},[35743],{"data":35744,"marks":35745,"value":35746,"nodeType":864},{},[],"If targeted users are already using automation apps legitimately, it’s even more stealthy - you won’t even see any new integrations or permission grants appear as the user will have already granted these legitimately.",{"data":35748,"content":35749,"nodeType":945},{},[35750],{"data":35751,"content":35752,"nodeType":860},{},[35753],{"data":35754,"marks":35755,"value":35756,"nodeType":864},{},[],"If admin consent has been granted to the automation app, any user can be targeted without generating new permission grant logs even if they have never used the app.",{"data":35758,"content":35759,"nodeType":1009},{},[35760],{"data":35761,"marks":35762,"value":35763,"nodeType":864},{},[],"Conclusion",{"data":35765,"content":35766,"nodeType":860},{},[35767],{"data":35768,"marks":35769,"value":35770,"nodeType":864},{},[],"We have seen how two new SaaS-focused attack techniques can be combined into one more effective attack chain - in this case, a particularly nasty and stealthy persistence technique. This shows how even if a user compromise is detected very early, with password and MFA resets immediately issued, adversaries can maintain control over the account regardless.",{"data":35772,"content":35773,"nodeType":860},{},[35774],{"data":35775,"marks":35776,"value":35777,"nodeType":864},{},[],"This shows how even legitimate SaaS applications have incredibly powerful offensive use cases and very careful attention needs to be paid to integrations with highly sensitive permissions, even when they are approved and vetted applications. Incident response teams especially need to be well aware of these techniques when investigating potential user account compromises as persistence approaches can extend much further than endpoint implants and stolen passwords.",{"entries":35779},{"inline":35780,"hyperlink":35781,"block":35785},[],[35782],{"sys":35783,"__typename":2059,"title":34937,"slug":35784},{"id":34931},"samljacking-a-poisoned-tenant",[35786,35793,35801,35809,35817,35825,35833,35841,35849,35857,35864,35872,35880,35888,35896,35903,35911],{"sys":35787,"__typename":1724,"title":35788,"caption":35789,"layoutMode":59,"file":35790},{"id":35143},"Azure audit logs","Azure audit logs showing a new user consent for a Zapier integration already in use by other users inside the organization",{"url":35791,"width":1736,"height":35792},"https://images.ctfassets.net/y1cdw1ablpvd/7KXqNa7LYhg9RpMODcCOUA/cf5cc3c63c3fb23bf4db4fc687c52fef/image11.png",188,{"sys":35794,"__typename":32755,"title":35795,"youTubeUrl":35796,"imagePlaceholder":35797},{"id":35268},"SaaS Attacks: Shadow workflows + Evil twin integration demo","https://youtu.be/g2EITjjJH1s",{"url":35798,"width":35799,"height":35800},"https://images.ctfassets.net/y1cdw1ablpvd/2XKFsSaDVmUREXzFIFvdgs/41ff444655d2f740bf4c637ebea0e998/Screenshot_2023-09-11_at_10.25.12_AM.png",2996,1616,{"sys":35802,"__typename":1724,"title":35803,"caption":35804,"layoutMode":59,"file":35805},{"id":35327},"Apps used in Microsoft","Listing apps installed for the user from myapps.microsoft.com ",{"url":35806,"width":35807,"height":35808},"https://images.ctfassets.net/y1cdw1ablpvd/66ISP7TGcsDns9BPvJEz0V/70b5da6883efde3122cabd3c0c1f1eab/image3.png",1205,860,{"sys":35810,"__typename":1724,"title":35811,"caption":35812,"layoutMode":59,"file":35813},{"id":35333},"Zapier to do","Listing granted permissions for Zapier-related apps (1/2)",{"url":35814,"width":35815,"height":35816},"https://images.ctfassets.net/y1cdw1ablpvd/7lJRrtsR1GuWBGGk3d5FJ2/387c9f8f178e9a8c10e60f5b2ebf026b/image7.png",1108,546,{"sys":35818,"__typename":1724,"title":35819,"caption":35820,"layoutMode":59,"file":35821},{"id":35339},"Zapier-related app permissions","Listing granted permissions for Zapier-related apps (2/2)",{"url":35822,"width":35823,"height":35824},"https://images.ctfassets.net/y1cdw1ablpvd/9KWSW4Dyy0hfMCa8NzUsP/8bacb7994fd4668fc181c1d4ac190002/image8.png",1729,669,{"sys":35826,"__typename":1724,"title":35827,"caption":35828,"layoutMode":59,"file":35829},{"id":35366},"Finding a Zapier integration","Listing app role assignments and finding a Zapier integration",{"url":35830,"width":35831,"height":35832},"https://images.ctfassets.net/y1cdw1ablpvd/lkccBtCqQj594UJeRoStz/f4dd2c2deda29907c0e5ab3ed506b375/image4.png",774,430,{"sys":35834,"__typename":1724,"title":35835,"caption":35836,"layoutMode":59,"file":35837},{"id":35372},"Zapier integration OAuth permissions","Listing OAuth permission grants for the Zapier integration to confirm permissions",{"url":35838,"width":35839,"height":35840},"https://images.ctfassets.net/y1cdw1ablpvd/4eZco97TV404HaHoAnYGSA/04e5e66ae37fa8ee52418d5533437386/image15.png",1219,395,{"sys":35842,"__typename":1724,"title":35843,"caption":35844,"layoutMode":59,"file":35845},{"id":35413},"Zapier login via SSO","Login to Zapier via SSO or social login",{"url":35846,"width":35847,"height":35848},"https://images.ctfassets.net/y1cdw1ablpvd/57LigpMizflfTbTcfrcRwM/e81063c2a092be712cc180f1af1ee909/image10.png",1244,736,{"sys":35850,"__typename":1724,"title":35851,"caption":35852,"layoutMode":59,"file":35853},{"id":35466},"User's Zapier workflows","The user’s existing workflows, or “Zaps” in Zapier terminology",{"url":35854,"width":35855,"height":35856},"https://images.ctfassets.net/y1cdw1ablpvd/1HD2bnkcnGnc5YQAHHrvIa/08b1a537a9f63d0fb600d837eee1df25/image14.png",1426,382,{"sys":35858,"__typename":1724,"title":35859,"caption":35860,"layoutMode":59,"file":35861},{"id":35472},"Zapier integrations","The user’s connected apps, showing Outlook and OneDrive have already been integrated",{"url":35862,"width":35823,"height":35863},"https://images.ctfassets.net/y1cdw1ablpvd/4RII43nqlcqFT4E7QuGOGT/ef85aa394465906185bc52985f4b28e8/image2.png",532,{"sys":35865,"__typename":1724,"title":35866,"caption":35867,"layoutMode":59,"file":35868},{"id":35529},"Connecting our accounts","We have connected the user’s Outlook and OneDrive, as well as our own Gmail and Google Drive for exfiltration",{"url":35869,"width":35870,"height":35871},"https://images.ctfassets.net/y1cdw1ablpvd/7gmTTPtcrhbPDrQD1BId55/26c7fd0a5d1391bd5ec627c73af587db/image16.png",854,419,{"sys":35873,"__typename":1724,"title":35874,"caption":35875,"layoutMode":59,"file":35876},{"id":35535},"Our shadow workflows","Shadow workflows we have created to monitor the target user’s emails and files",{"url":35877,"width":35878,"height":35879},"https://images.ctfassets.net/y1cdw1ablpvd/ggCqvwRtNLcvBVqvZMEF0/a9b0b60c80c835f6dca01c1fc408df08/image12.png",1260,444,{"sys":35881,"__typename":1724,"title":35882,"caption":35883,"layoutMode":59,"file":35884},{"id":35573},"New sign-in events"," Interactive sign-in events caused by the new integrations with the new Zapier account",{"url":35885,"width":35886,"height":35887},"https://images.ctfassets.net/y1cdw1ablpvd/3W6qH6wxjm7fRRjuMeYtRD/779265dba840306f2002132abd24c060/image6.png",1256,148,{"sys":35889,"__typename":1724,"title":35890,"caption":35891,"layoutMode":59,"file":35892},{"id":35586},"What's shown in audit logs","Audit log showing the Zapier integration downloading a file - this is a result of the shadow workflow",{"url":35893,"width":35894,"height":35895},"https://images.ctfassets.net/y1cdw1ablpvd/ew0JDU7oER8cLZUxmyySV/cb39ead350b0704ac78b05c7c5445503/image9.png",569,535,{"sys":35897,"__typename":1724,"title":35898,"caption":35899,"layoutMode":59,"file":35900},{"id":35592},"Audit log showing file upload","Audit log showing the Zapier integration uploading a file - this is the result of the legitimate integration that forwards business expense emails",{"url":35901,"width":35894,"height":35902},"https://images.ctfassets.net/y1cdw1ablpvd/7uv04lFua20rYKyE9VsOv/a2893b9c5540e55732eb9acb62b79b0e/image5.png",609,{"sys":35904,"__typename":1724,"title":35905,"caption":35906,"layoutMode":59,"file":35907},{"id":35619},"Leaked doc in attacker's GDrive","Confidential document from OneDrive appears in Google Drive",{"url":35908,"width":35909,"height":35910},"https://images.ctfassets.net/y1cdw1ablpvd/5jwmXBmrQgA0fmHYn9CK4g/63a689ef0014f15f4cac05d47950e151/image13.png",1319,277,{"sys":35912,"__typename":1724,"title":35913,"caption":35914,"layoutMode":59,"file":35915},{"id":35625},"Leaked email to attacker's inbox","Confidential email from Outlook appears in GMail",{"url":35916,"width":35917,"height":35918},"https://images.ctfassets.net/y1cdw1ablpvd/7buoz26rTelsWCvn9H8eUq/af55d1b900b715e943b891535efac456/image1.png",1101,271,{"items":35920},[],{},"SaaS attack matrix: The shadow workflow’s evil twin","threat-research","2023-09-11T00:00:00.000Z",{"items":35926},[35927,36396,37205],{"__typename":2059,"sys":35928,"content":35929,"title":34937,"synopsis":36384,"hashTags":59,"publishedDate":36385,"slug":35784,"tagsCollection":36386,"authorsCollection":36392},{"id":34931},{"json":35930},{"data":35931,"content":35932,"nodeType":856},{},[35933,35951,35958,35965,35972,35991,35998,36017,36023,36030,36037,36044,36051,36058,36065,36085,36092,36099,36105,36112,36119,36126,36132,36138,36144,36151,36158,36164,36171,36178,36185,36191,36198,36205,36212,36219,36226,36232,36239,36246,36252,36259,36266,36272,36278,36285,36350,36357,36363,36370,36377],{"data":35934,"content":35935,"nodeType":860},{},[35936,35940,35947],{"data":35937,"marks":35938,"value":35939,"nodeType":864},{},[],"We published the ",{"data":35941,"content":35942,"nodeType":883},{"uri":32829},[35943],{"data":35944,"marks":35945,"value":32835,"nodeType":864},{},[35946],{"type":1455},{"data":35948,"marks":35949,"value":35950,"nodeType":864},{},[]," on GitHub, which is an open-source research project to demonstrate the multitude of attacks that are possible against SaaS-native and hybrid SaaS organizations. On release day it contained 38 different techniques. ",{"data":35952,"content":35953,"nodeType":860},{},[35954],{"data":35955,"marks":35956,"value":35957,"nodeType":864},{},[],"However, we know it’s not just individual attack techniques and the phases of the cyber kill chain that matter - it’s also how you chain attacks together. Two lower risk vulnerabilities chained together could be a critical issue.",{"data":35959,"content":35960,"nodeType":860},{},[35961],{"data":35962,"marks":35963,"value":35964,"nodeType":864},{},[],"In this article, we’re going to demonstrate that by combining two of our favorite new SaaS attack techniques, poisoned tenants and SAMLjacking, you can make a simple, but effective attack chain.",{"data":35966,"content":35967,"nodeType":1009},{},[35968],{"data":35969,"marks":35970,"value":35971,"nodeType":864},{},[],"What is a poisoned tenant?",{"data":35973,"content":35974,"nodeType":860},{},[35975,35978,35987],{"data":35976,"marks":35977,"value":21,"nodeType":864},{},[],{"data":35979,"content":35981,"nodeType":883},{"uri":35980},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/poisoned_tenants/description.md",[35982],{"data":35983,"marks":35984,"value":35986,"nodeType":864},{},[35985],{"type":1455},"Poisoned tenants",{"data":35988,"marks":35989,"value":35990,"nodeType":864},{},[]," involve an adversary registering a tenant for a SaaS app they control and tricking target users to join it, often using built-in invite functionality. The end goal is to have some target users actively using a tenant you (as the adversary) control.",{"data":35992,"content":35993,"nodeType":1009},{},[35994],{"data":35995,"marks":35996,"value":35997,"nodeType":864},{},[],"What the hell is SAMLjacking?",{"data":35999,"content":36000,"nodeType":860},{},[36001,36004,36013],{"data":36002,"marks":36003,"value":21,"nodeType":864},{},[],{"data":36005,"content":36007,"nodeType":883},{"uri":36006},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[36008],{"data":36009,"marks":36010,"value":36012,"nodeType":864},{},[36011],{"type":1455},"SAMLjacking",{"data":36014,"marks":36015,"value":36016,"nodeType":864},{},[]," is where an attacker makes use of SAML SSO configuration settings for a SaaS tenant they control in order to redirect users to a malicious link of their choosing during the authentication process. This can be highly effective for phishing as the original URL will be a legitimate SaaS URL and users are expecting to provide credentials.",{"data":36018,"content":36019,"nodeType":1009},{},[36020],{"data":36021,"marks":36022,"value":35032,"nodeType":864},{},[],{"data":36024,"content":36025,"nodeType":860},{},[36026],{"data":36027,"marks":36028,"value":36029,"nodeType":864},{},[],"A poisoned tenant on its own could be an epic supply chain attack if you get really lucky. Imagine discovering an organization was wanting to migrate to Slack and then catching some key teams with a Slack poisoned tenant and gradually getting the whole organization migrated over. You’d have a goldmine of information as an administrator of the platform.",{"data":36031,"content":36032,"nodeType":860},{},[36033],{"data":36034,"marks":36035,"value":36036,"nodeType":864},{},[],"However, it might be hard to trick a whole organization into using an attacker controlled slack instance without anyone realizing, but it could be a lot easier to successfully invite e.g. a marketing team into using/adopting a new marketing app that helps them do SEO. This might be easier to perform, but it doesn't really give the attacker valuable data in the poisoned tenant of the marketing app, so it seems a bit pointless.",{"data":36038,"content":36039,"nodeType":860},{},[36040],{"data":36041,"marks":36042,"value":36043,"nodeType":864},{},[],"On the other hand, what about SAMLjacking? It’s a great technique on its own, but you still need to get users to login to the app. Sure, you’ll be sending them a legitimate SaaS URL with a valid TLS certificate etc and so it’s going to pass the sniff test for many people and also bypass email security appliances and similar security tools. However, you’re still effectively phishing them for credentials, the one thing we train users to be most suspicious about, so there is still a possibility they will spot the attack. ",{"data":36045,"content":36046,"nodeType":860},{},[36047],{"data":36048,"marks":36049,"value":36050,"nodeType":864},{},[],"But what if you could combine these techniques so that a poisoned tenant didn’t need to be a big, juicy target to be useful and a SAMLjacking attack didn’t even necessarily require phishing someone directly? What if the attack could be successful just from a target accessing their own bookmarks or open tabs for an app they already use?",{"data":36052,"content":36053,"nodeType":860},{},[36054],{"data":36055,"marks":36056,"value":36057,"nodeType":864},{},[],"In a combination scenario, a user doesn't need to be phished for SAMLjacking. One day they go back to their tab and it's logged out and they get SAMLjacked while logging back in. They don't have to click a link in an email. That’s what we are talking about here, so let’s consider an example of this making use of the SaaS-based wiki, Nuclino.",{"data":36059,"content":36060,"nodeType":1009},{},[36061],{"data":36062,"marks":36063,"value":36064,"nodeType":864},{},[],"An example attack - Nuclino",{"data":36066,"content":36067,"nodeType":860},{},[36068,36072,36081],{"data":36069,"marks":36070,"value":36071,"nodeType":864},{},[],"Before moving on, I’d just like to point out that this isn’t a vulnerability with ",{"data":36073,"content":36075,"nodeType":883},{"uri":36074},"https://www.nuclino.com/",[36076],{"data":36077,"marks":36078,"value":36080,"nodeType":864},{},[36079],{"type":1455},"Nuclino",{"data":36082,"marks":36083,"value":36084,"nodeType":864},{},[]," per se and it won’t be limited to Nuclino either. I’ve used Nuclino as an example because it’s a great wiki platform we use at Push Security, so I’m familiar with it. ",{"data":36086,"content":36087,"nodeType":860},{},[36088],{"data":36089,"marks":36090,"value":36091,"nodeType":864},{},[],"It also allows custom SAML authentication, both as part of its free trial and as part of its lowest tier paid plan. This should be commended as many SaaS apps don’t support SAML or other forms of SSO, and many of those that do charge a huge premium via enterprise plans to gain access to it. We love you Nuclino, sorry!",{"data":36093,"content":36094,"nodeType":860},{},[36095],{"data":36096,"marks":36097,"value":36098,"nodeType":864},{},[],"We'll take a walkthrough of how the attack chain works now. However, if you'd like to jump straight to a demo of the attack then checkout the video here:",{"data":36100,"content":36104,"nodeType":996},{"target":36101},{"sys":36102},{"id":36103,"type":1001,"linkType":1002},"3y6ZMPPsbh6PYlQ7IOxOzS",[],{"data":36106,"content":36107,"nodeType":860},{},[36108],{"data":36109,"marks":36110,"value":36111,"nodeType":864},{},[],"Next, we'll do a full walkthrough of the attack.",{"data":36113,"content":36114,"nodeType":1312},{},[36115],{"data":36116,"marks":36117,"value":36118,"nodeType":864},{},[],"Step 1 - Setup a poisoned tenant and invite target users",{"data":36120,"content":36121,"nodeType":860},{},[36122],{"data":36123,"marks":36124,"value":36125,"nodeType":864},{},[],"The first step for an adversary is to set up their poisoned tenant and then make use of the invite functionality to target some employees of the target organization. With Nuclino, you can either do this by sending sharing links directly to the target or invite them through the Nuclino app, and it will send out legit email invitations on your behalf.",{"data":36127,"content":36131,"nodeType":996},{"target":36128},{"sys":36129},{"id":36130,"type":1001,"linkType":1002},"740nQhGSFp2nFU1b4DP7Mp",[],{"data":36133,"content":36137,"nodeType":996},{"target":36134},{"sys":36135},{"id":36136,"type":1001,"linkType":1002},"4GFL1L7Mmp3nnBODwC9SbH",[],{"data":36139,"content":36143,"nodeType":996},{"target":36140},{"sys":36141},{"id":36142,"type":1001,"linkType":1002},"7KUWKFFlDyvBVoM3MEhPwR",[],{"data":36145,"content":36146,"nodeType":1312},{},[36147],{"data":36148,"marks":36149,"value":36150,"nodeType":864},{},[],"Step 2 - Target responds to the invitation or later signs up for Nuclino",{"data":36152,"content":36153,"nodeType":860},{},[36154],{"data":36155,"marks":36156,"value":36157,"nodeType":864},{},[],"The interesting thing here is that whether the target signs up for Nuclino directly from the joining link or they sign up for an account separately in future, they get mapped to the workspace they have been invited to by default.",{"data":36159,"content":36163,"nodeType":996},{"target":36160},{"sys":36161},{"id":36162,"type":1001,"linkType":1002},"2GlTHcT1cpQ44jb5lN9dr4",[],{"data":36165,"content":36166,"nodeType":1312},{},[36167],{"data":36168,"marks":36169,"value":36170,"nodeType":864},{},[],"Step 3 - Configure a malicious SAML server",{"data":36172,"content":36173,"nodeType":860},{},[36174],{"data":36175,"marks":36176,"value":36177,"nodeType":864},{},[],"Once the adversary has a critical mass of users on their poisoned tenant, they can later engage the SAMLjacking attack. ",{"data":36179,"content":36180,"nodeType":860},{},[36181],{"data":36182,"marks":36183,"value":36184,"nodeType":864},{},[],"To do this, they need to configure a custom SAML server. You can point this to a fake authentication provider they control that mirrors the appearance of the SSO provider the target users are accustomed to using in order to capture credentials.",{"data":36186,"content":36190,"nodeType":996},{"target":36187},{"sys":36188},{"id":36189,"type":1001,"linkType":1002},"1RbhUTZd5Ak4UvjiZhub4V",[],{"data":36192,"content":36193,"nodeType":860},{},[36194],{"data":36195,"marks":36196,"value":36197,"nodeType":864},{},[],"If you toggle the setting to require SSO, existing users will be sent emails prompting them to link their accounts to SSO. That leads to two possible paths to a user compromise.",{"data":36199,"content":36200,"nodeType":1009},{},[36201],{"data":36202,"marks":36203,"value":36204,"nodeType":864},{},[],"Paths to user compromise ",{"data":36206,"content":36207,"nodeType":1312},{},[36208],{"data":36209,"marks":36210,"value":36211,"nodeType":864},{},[],"The first possibility",{"data":36213,"content":36214,"nodeType":860},{},[36215],{"data":36216,"marks":36217,"value":36218,"nodeType":864},{},[],"This compromise occurs when the target sees the email that SSO has been configured and clicks the link in order to link their account to SSO. A smart adversary may improve the social engineering quality with an email sent out in advance informing users that the internal security team has requested Nuclino be linked to SSO. This makes the target expect the email and consider it legitimate. ",{"data":36220,"content":36221,"nodeType":860},{},[36222],{"data":36223,"marks":36224,"value":36225,"nodeType":864},{},[],"Even though the email is an official email from Nuclino and the link contained is an official Nuclino URL, it will immediately redirect to the malicious SAML server that has been configured, where credentials can then be captured.",{"data":36227,"content":36231,"nodeType":996},{"target":36228},{"sys":36229},{"id":36230,"type":1001,"linkType":1002},"6zWiAfBx7aaUeo6t04AtUl",[],{"data":36233,"content":36234,"nodeType":1312},{},[36235],{"data":36236,"marks":36237,"value":36238,"nodeType":864},{},[],"Second compromise possibility",{"data":36240,"content":36241,"nodeType":860},{},[36242],{"data":36243,"marks":36244,"value":36245,"nodeType":864},{},[],"If the user ignores the email, the other potential outcome occurs when their session expires and they need to login again to regain access. This is similar to a watering hole attack. When their session expires, the target’s open tabs or bookmarks will redirect back to the workspace specific login page, which will now look like this:",{"data":36247,"content":36251,"nodeType":996},{"target":36248},{"sys":36249},{"id":36250,"type":1001,"linkType":1002},"580CvVtdyEpqdiK8T1lSfQ",[],{"data":36253,"content":36254,"nodeType":860},{},[36255],{"data":36256,"marks":36257,"value":36258,"nodeType":864},{},[],"Clicking the button to login with SSO will immediately redirect to the malicious SAML server and launch the attack. Alternatively, if the target attempts to login without SSO, the login will fail with an error message telling them to login with SSO.",{"data":36260,"content":36261,"nodeType":860},{},[36262],{"data":36263,"marks":36264,"value":36265,"nodeType":864},{},[],"Either way, once the SAMLjacking has taken effect, they’ll be faced with a familiar-looking SSO login page from a trusted source at a point they are expecting to enter their credentials - something even the most paranoid of users could easily fall for unknowingly. ",{"data":36267,"content":36271,"nodeType":996},{"target":36268},{"sys":36269},{"id":36270,"type":1001,"linkType":1002},"5eFctGgFywtmhhjaXVraqN",[],{"data":36273,"content":36274,"nodeType":1009},{},[36275],{"data":36276,"marks":36277,"value":35633,"nodeType":864},{},[],{"data":36279,"content":36280,"nodeType":860},{},[36281],{"data":36282,"marks":36283,"value":36284,"nodeType":864},{},[],"At this point, having compromised multiple user’s Google credentials, an adversary has a lot of options available:",{"data":36286,"content":36287,"nodeType":941},{},[36288,36298,36308,36330],{"data":36289,"content":36290,"nodeType":945},{},[36291],{"data":36292,"content":36293,"nodeType":860},{},[36294],{"data":36295,"marks":36296,"value":36297,"nodeType":864},{},[],"Access all data in Google apps like GMail, Google Drive etc",{"data":36299,"content":36300,"nodeType":945},{},[36301],{"data":36302,"content":36303,"nodeType":860},{},[36304],{"data":36305,"marks":36306,"value":36307,"nodeType":864},{},[],"Access other SaaS apps that use SSO with the same Google account",{"data":36309,"content":36310,"nodeType":945},{},[36311],{"data":36312,"content":36313,"nodeType":860},{},[36314,36318,36327],{"data":36315,"marks":36316,"value":36317,"nodeType":864},{},[],"Access other SaaS apps that use ",{"data":36319,"content":36321,"nodeType":883},{"uri":36320},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/passwordless_logins/description.md",[36322],{"data":36323,"marks":36324,"value":36326,"nodeType":864},{},[36325],{"type":1455},"passwordless logins",{"data":36328,"marks":36329,"value":21,"nodeType":864},{},[],{"data":36331,"content":36332,"nodeType":945},{},[36333],{"data":36334,"content":36335,"nodeType":860},{},[36336,36340,36347],{"data":36337,"marks":36338,"value":36339,"nodeType":864},{},[],"Access other SaaS apps via email ",{"data":36341,"content":36342,"nodeType":883},{"uri":35424},[36343],{"data":36344,"marks":36345,"value":35430,"nodeType":864},{},[36346],{"type":1455},{"data":36348,"marks":36349,"value":21,"nodeType":864},{},[],{"data":36351,"content":36352,"nodeType":860},{},[36353],{"data":36354,"marks":36355,"value":36356,"nodeType":864},{},[],"Essentially, this can potentially lead to a compromise of every SaaS application accessible by the compromised user - all from the use of a poisoned tenant for an app with no particularly sensitive data or permissions.",{"data":36358,"content":36359,"nodeType":1312},{},[36360],{"data":36361,"marks":36362,"value":35763,"nodeType":864},{},[],{"data":36364,"content":36365,"nodeType":860},{},[36366],{"data":36367,"marks":36368,"value":36369,"nodeType":864},{},[],"We have seen how two new SaaS-focused attack techniques can be combined into one more effective attack chain. This shows how a successful poisoned tenant attack for even a low risk app can still be a significant threat when combined with a SAMLjacking attack. ",{"data":36371,"content":36372,"nodeType":860},{},[36373],{"data":36374,"marks":36375,"value":36376,"nodeType":864},{},[],"This demonstrates even the least sensitive edge cases of SaaS sprawl can represent a vector to laterally move to compromise much more valuable assets. History taught us that protecting core production assets was not enough. Adversaries often achieved compromises via test systems and unsecured development resources. What we are seeing now is that this parallel exists in the SaaS-native world too. Therefore, we need to be protecting all SaaS resources with greater vigilance than their standalone sensitivity would indicate.",{"data":36378,"content":36379,"nodeType":860},{},[36380],{"data":36381,"marks":36382,"value":36383,"nodeType":864},{},[],"So what can be done about it? Well, like much in security, there is no silver bullet solution to this issue. SaaS apps are here to stay and are designed to be flexible, easy to sign up for and use. The key first step is always to get good visibility into the SaaS sprawl across your organization. If certain employees or teams start making use of a new SaaS app (or a new tenant for an existing one), that’s probably something your security team should be aware of so they can make sure it’s legitimate and being used as securely as possible. ","In this article, we’re going to demo combining two of our favorite new SaaS attack techniques to make a simple, but effective attack chain.\n","2023-08-17T00:00:00.000Z",{"items":36387},[36388,36390],{"sys":36389,"name":15033},{"id":15032},{"sys":36391,"name":342},{"id":15029},{"items":36393},[36394],{"fullName":34884,"firstName":34885,"jobTitle":34886,"profilePicture":36395},{"url":34890},{"__typename":2059,"sys":36397,"content":36399,"title":37187,"synopsis":37188,"hashTags":59,"publishedDate":37189,"slug":37190,"tagsCollection":37191,"authorsCollection":37197},{"id":36398},"6VZQJzQ2FNetGNMEjiuXB2",{"json":36400},{"data":36401,"content":36402,"nodeType":856},{},[36403,36410,36417,36424,36431,36438,36445,36451,36469,36476,36521,36528,36535,36580,36599,36606,36613,36620,36640,36659,36666,36699,36706,36724,36731,36738,36769,36789,36796,36801,36808,36815,36822,36829,36836,36843,36850,36857,36864,36871,36878,36885,36901,36908,36978,36985,36992,37021,37036,37043,37050,37057,37090,37110,37117,37124,37131,37138,37157,37175,37181],{"data":36404,"content":36405,"nodeType":860},{},[36406],{"data":36407,"marks":36408,"value":36409,"nodeType":864},{},[],"Our goal at Push is simple — to stop identity attacks. Today, the vast majority of identity vulnerabilities exist in the context of SaaS apps. ",{"data":36411,"content":36412,"nodeType":860},{},[36413],{"data":36414,"marks":36415,"value":36416,"nodeType":864},{},[],"The reasons for this are clear: Security teams have reduced central oversight and control over SaaS apps than they are used to, these apps exist in large numbers per company, and the identities that are used to access these apps are... complicated, to say the least. Securing hundreds of apps, with thousands of associated identities, is therefore no mean feat. ",{"data":36418,"content":36419,"nodeType":860},{},[36420],{"data":36421,"marks":36422,"value":36423,"nodeType":864},{},[],"Securing SaaS use means building controls that are easy to use, easy to understand — and ultimately effective. Not just effective against the hand-wavy concept of “SaaS attacks,” but specific techniques — the most common techniques that are likely to cause real damage.",{"data":36425,"content":36426,"nodeType":860},{},[36427],{"data":36428,"marks":36429,"value":36430,"nodeType":864},{},[],"To talk about this, we need to have a shared understanding of what these techniques are. To get that conversation going, we’ve pulled together all the techniques we're aware of, and our research team has even added a bunch of new ones.",{"data":36432,"content":36433,"nodeType":1009},{},[36434],{"data":36435,"marks":36436,"value":36437,"nodeType":864},{},[],"The SaaS attack matrix",{"data":36439,"content":36440,"nodeType":860},{},[36441],{"data":36442,"marks":36443,"value":36444,"nodeType":864},{},[],"We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-specific. In fact, these techniques don’t touch endpoints (so they bypass EDR) or customer networks (so they bypass network detection) — so we’re calling them networkless attacks.",{"data":36446,"content":36450,"nodeType":996},{"target":36447},{"sys":36448},{"id":36449,"type":1001,"linkType":1002},"768Zv5gTVHyu5rbzJAzL4F",[],{"data":36452,"content":36453,"nodeType":860},{},[36454,36458,36466],{"data":36455,"marks":36456,"value":36457,"nodeType":864},{},[],"You can find more detailed descriptions of these techniques (and hopefully PRs for some we missed) on ",{"data":36459,"content":36460,"nodeType":883},{"uri":32829},[36461],{"data":36462,"marks":36463,"value":36465,"nodeType":864},{},[36464],{"type":1455},"GitHub",{"data":36467,"marks":36468,"value":2924,"nodeType":864},{},[],{"data":36470,"content":36471,"nodeType":860},{},[36472],{"data":36473,"marks":36474,"value":36475,"nodeType":864},{},[],"Since we’re not targeting endpoints, let’s talk about the new targets: The accounts/identities on SaaS apps. We found it was useful to think about these identities not as standalone isolated islands — but much more like a graph; less a single web-server on the internet and more like many Windows endpoints on an Active Directory. ",{"data":36477,"content":36478,"nodeType":860},{},[36479,36483,36492,36495,36504,36508,36517],{"data":36480,"marks":36481,"value":36482,"nodeType":864},{},[],"You can leverage this access to an identity on a trusted platform to target (so laterally move or escalate privilege to) other users or identities. For example, attacks like using access to SaaS apps to ",{"data":36484,"content":36486,"nodeType":883},{"uri":36485},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/in-app_phishing/description.md",[36487],{"data":36488,"marks":36489,"value":36491,"nodeType":864},{},[36490],{"type":1455},"phish other employees through comments",{"data":36493,"marks":36494,"value":902,"nodeType":864},{},[],{"data":36496,"content":36498,"nodeType":883},{"uri":36497},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_user_spoofing/description.md",[36499],{"data":36500,"marks":36501,"value":36503,"nodeType":864},{},[36502],{"type":1455},"spoofing users on IM platforms",{"data":36505,"marks":36506,"value":36507,"nodeType":864},{},[]," to social engineer them there — or perhaps ",{"data":36509,"content":36511,"nodeType":883},{"uri":36510},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_backdooring/description.md",[36512],{"data":36513,"marks":36514,"value":36516,"nodeType":864},{},[36515],{"type":1455},"backdooring links",{"data":36518,"marks":36519,"value":36520,"nodeType":864},{},[]," in documents.",{"data":36522,"content":36523,"nodeType":860},{},[36524],{"data":36525,"marks":36526,"value":36527,"nodeType":864},{},[],"In this case, unusually, it’s not the data in these hundreds of SaaS apps that create risk, and you need to consider low-risk (from a data perspective) apps as a vector to pivot to higher-risk apps in your estate.",{"data":36529,"content":36530,"nodeType":1312},{},[36531],{"data":36532,"marks":36533,"value":36534,"nodeType":864},{},[],"Initial access and poisoned tenants",{"data":36536,"content":36537,"nodeType":860},{},[36538,36542,36551,36554,36563,36567,36576],{"data":36539,"marks":36540,"value":36541,"nodeType":864},{},[],"Attacks like ",{"data":36543,"content":36545,"nodeType":883},{"uri":36544},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[36546],{"data":36547,"marks":36548,"value":36550,"nodeType":864},{},[36549],{"type":1455},"credential stuffing",{"data":36552,"marks":36553,"value":902,"nodeType":864},{},[],{"data":36555,"content":36557,"nodeType":883},{"uri":36556},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/email_phishing/description.md",[36558],{"data":36559,"marks":36560,"value":36562,"nodeType":864},{},[36561],{"type":1455},"email phishing",{"data":36564,"marks":36565,"value":36566,"nodeType":864},{},[]," that get you initial access to SaaS apps are fairly well known — because they work and are widely used. We’re also starting to see tools and attacks that suggest that ",{"data":36568,"content":36570,"nodeType":883},{"uri":36569},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[36571],{"data":36572,"marks":36573,"value":36575,"nodeType":864},{},[36574],{"type":1455},"phishing employees through these IM apps",{"data":36577,"marks":36578,"value":36579,"nodeType":864},{},[]," is about to go mainstream.",{"data":36581,"content":36582,"nodeType":860},{},[36583,36587,36595],{"data":36584,"marks":36585,"value":36586,"nodeType":864},{},[],"Another interesting attack is a spin on the classic waterhole attack called a ",{"data":36588,"content":36589,"nodeType":883},{"uri":35980},[36590],{"data":36591,"marks":36592,"value":36594,"nodeType":864},{},[36593],{"type":1455},"poisoned tenant",{"data":36596,"marks":36597,"value":36598,"nodeType":864},{},[],". Rather than attacking a customer tenant for a SaaS app, the attacker lures employees into joining an attacker-controlled tenant. ",{"data":36600,"content":36601,"nodeType":860},{},[36602],{"data":36603,"marks":36604,"value":36605,"nodeType":864},{},[],"SaaS apps allow anyone to name app tenants (a.k.a. spaces, teams, or instances) anything they like — including your company name. Attackers send invites to your employees from within the app with a customized message explaining why they should join this new tenant (or sign up to the app if they are not already a user). ",{"data":36607,"content":36608,"nodeType":860},{},[36609],{"data":36610,"marks":36611,"value":36612,"nodeType":864},{},[],"Attackers might even pay for premium licenses in the app to further entice employees to join. The attacker then waits for the employee to upload sensitive data or create integrations with other company apps containing crown jewels.",{"data":36614,"content":36615,"nodeType":1312},{},[36616],{"data":36617,"marks":36618,"value":36619,"nodeType":864},{},[],"Living-off-the-(SaaS)-land to persist and avoid detection",{"data":36621,"content":36622,"nodeType":860},{},[36623,36627,36636],{"data":36624,"marks":36625,"value":36626,"nodeType":864},{},[],"In the endpoint world, a favorite technique is the use of legit OS utilities or ",{"data":36628,"content":36630,"nodeType":883},{"uri":36629},"https://lolbas-project.github.io",[36631],{"data":36632,"marks":36633,"value":36635,"nodeType":864},{},[36634],{"type":1455},"LOLBaS",{"data":36637,"marks":36638,"value":36639,"nodeType":864},{},[]," (Living-Off-the-Land Binaries and Scripts), which are often signed Microsoft utilities. Perhaps the most well-known example is executing scripts through PowerShell rather than building custom malware. That isn’t as useful these days, but there was a time when PowerShell was routinely used to bypass AV, EDR, and even app allow-listing.",{"data":36641,"content":36642,"nodeType":860},{},[36643,36647,36655],{"data":36644,"marks":36645,"value":36646,"nodeType":864},{},[],"In that same living-off-the-land mindset, an attacker trying to maintain access to each SaaS app they compromise using custom OAuth integration apps might instead choose to use legit SaaS apps that specialize in workflow automation to create ",{"data":36648,"content":36649,"nodeType":883},{"uri":34964},[36650],{"data":36651,"marks":36652,"value":36654,"nodeType":864},{},[36653],{"type":1455},"shadow workflows",{"data":36656,"marks":36657,"value":36658,"nodeType":864},{},[],". Utilizing legit SaaS apps also means they can hide in plain sight from incident responders, instead of having to rely on unverified or unpublished integrations.",{"data":36660,"content":36661,"nodeType":860},{},[36662],{"data":36663,"marks":36664,"value":36665,"nodeType":864},{},[],"Perhaps the best example here is using a well-known automation app like Zapier, which claims to have more than 5,000 integrations. These integrations are often verified, approved, and connected to a trusted vendor (Zapier). An attacker might create workflows to:",{"data":36667,"content":36668,"nodeType":941},{},[36669,36679,36689],{"data":36670,"content":36671,"nodeType":945},{},[36672],{"data":36673,"content":36674,"nodeType":860},{},[36675],{"data":36676,"marks":36677,"value":36678,"nodeType":864},{},[],"Do daily data exfiltration from a victim’s data lake.",{"data":36680,"content":36681,"nodeType":945},{},[36682],{"data":36683,"content":36684,"nodeType":860},{},[36685],{"data":36686,"marks":36687,"value":36688,"nodeType":864},{},[],"Configure a webhook that adds malicious accounts to a Github repo on demand.",{"data":36690,"content":36691,"nodeType":945},{},[36692],{"data":36693,"content":36694,"nodeType":860},{},[36695],{"data":36696,"marks":36697,"value":36698,"nodeType":864},{},[],"Automatically find and replace bank account numbers in emails to the finance team.",{"data":36700,"content":36701,"nodeType":860},{},[36702],{"data":36703,"marks":36704,"value":36705,"nodeType":864},{},[],"All appear as legitimate Zapier integrations. But, before you put in alerts specifically for Zapier, know that it’s one of dozens of apps that support these kinds of offensive workflows.",{"data":36707,"content":36708,"nodeType":860},{},[36709,36713,36720],{"data":36710,"marks":36711,"value":36712,"nodeType":864},{},[],"A sneaky attacker might go further and use an ",{"data":36714,"content":36715,"nodeType":883},{"uri":35005},[36716],{"data":36717,"marks":36718,"value":35011,"nodeType":864},{},[36719],{"type":1455},{"data":36721,"marks":36722,"value":36723,"nodeType":864},{},[]," to make another instance of an existing integration — making this backdoor almost impossible to discover.",{"data":36725,"content":36726,"nodeType":1312},{},[36727],{"data":36728,"marks":36729,"value":36730,"nodeType":864},{},[],"Features or vulnerabilities?",{"data":36732,"content":36733,"nodeType":860},{},[36734],{"data":36735,"marks":36736,"value":36737,"nodeType":864},{},[],"When looking for attack techniques, you’re typically going after features that have weaknesses you can abuse rather than bugs in a single app that will be patched. ",{"data":36739,"content":36740,"nodeType":860},{},[36741,36745,36754,36757,36765],{"data":36742,"marks":36743,"value":36744,"nodeType":864},{},[],"It’s pretty common for SaaS apps to skip email verification or allow multiple simultaneous authentication methods. Both of these are conscious design choices in the name of lowering the friction of account creation and reducing customer support. However, these features make techniques like ",{"data":36746,"content":36748,"nodeType":883},{"uri":36747},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/account_ambushing/description.md",[36749],{"data":36750,"marks":36751,"value":36753,"nodeType":864},{},[36752],{"type":1455},"account ambushing",{"data":36755,"marks":36756,"value":902,"nodeType":864},{},[],{"data":36758,"content":36760,"nodeType":883},{"uri":36759},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[36761],{"data":36762,"marks":36763,"value":23167,"nodeType":864},{},[36764],{"type":1455},{"data":36766,"marks":36767,"value":36768,"nodeType":864},{},[]," possible. If these attacks become widespread, these might come to be seen more as bugs rather than a positive feature for users.",{"data":36770,"content":36771,"nodeType":860},{},[36772,36776,36785],{"data":36773,"marks":36774,"value":36775,"nodeType":864},{},[],"In other cases, the bugs are serious enough and hard enough to patch that they’re worth noting as a technique. The recently disclosed (and perfectly named) ",{"data":36777,"content":36779,"nodeType":883},{"uri":36778},"https://www.descope.com/blog/post/noauth",[36780],{"data":36781,"marks":36782,"value":36784,"nodeType":864},{},[36783],{"type":1455},"nOAuth",{"data":36786,"marks":36787,"value":36788,"nodeType":864},{},[]," bug fits this bill. ",{"data":36790,"content":36791,"nodeType":860},{},[36792],{"data":36793,"marks":36794,"value":36795,"nodeType":864},{},[],"The bug arises from a confusion between an email identity and email metadata field in Microsoft integrations and without a central fix from MS (the fix isn’t trivial), these bugs are likely to be discovered and re-occur on third-party OAuth apps for a while to come.",{"data":36797,"content":36800,"nodeType":996},{"target":36798},{"sys":36799},{"id":32740,"type":1001,"linkType":1002},[],{"data":36802,"content":36803,"nodeType":1009},{},[36804],{"data":36805,"marks":36806,"value":36807,"nodeType":864},{},[],"The SaaS market is driving these offensive techniques",{"data":36809,"content":36810,"nodeType":860},{},[36811],{"data":36812,"marks":36813,"value":36814,"nodeType":864},{},[],"SaaS apps are basically web apps that are run in the cloud and accessed from endpoints, so then WebApp, endpoint, and cloud security should cover all of SaaS, right? ",{"data":36816,"content":36817,"nodeType":860},{},[36818],{"data":36819,"marks":36820,"value":36821,"nodeType":864},{},[],"That was our assumption when we started, but what we found instead was that SaaS marketing practices are driving a lot of pretty interesting techniques that you don’t run into in standalone web apps.",{"data":36823,"content":36824,"nodeType":1312},{},[36825],{"data":36826,"marks":36827,"value":36828,"nodeType":864},{},[],"Modern SaaS is easy to adopt, easy to use, low friction, low cost, low overhead",{"data":36830,"content":36831,"nodeType":860},{},[36832],{"data":36833,"marks":36834,"value":36835,"nodeType":864},{},[],"Making apps easy to sign up for and low effort to support means you need to make some interesting choices when it comes to designing account creation and recovery flows. ",{"data":36837,"content":36838,"nodeType":860},{},[36839],{"data":36840,"marks":36841,"value":36842,"nodeType":864},{},[],"Many apps allow users to sign into apps using multiple methods, easily invite collaborators (internal and external) and avoid any additional friction during the signup process. ",{"data":36844,"content":36845,"nodeType":860},{},[36846],{"data":36847,"marks":36848,"value":36849,"nodeType":864},{},[],"For example, many apps avoid verifying new account email addresses. This is not laziness, these are conscious design choices — not driven by security clearly, but not accidents.",{"data":36851,"content":36852,"nodeType":1312},{},[36853],{"data":36854,"marks":36855,"value":36856,"nodeType":864},{},[],"Modern SaaS is highly integrated",{"data":36858,"content":36859,"nodeType":860},{},[36860],{"data":36861,"marks":36862,"value":36863,"nodeType":864},{},[],"Most SaaS apps are trying to build app marketplaces or perform well in other apps' marketplaces (often both), and it’s rare these days to find apps that don’t integrate with other apps. ",{"data":36865,"content":36866,"nodeType":860},{},[36867],{"data":36868,"marks":36869,"value":36870,"nodeType":864},{},[],"OAuth has become the de facto standard protocol for doing this, and most users have become quite used to approving OAuth2.0 consent flows. These integrations have opened up lots of incredibly useful doors for attackers to persist access and move laterally across SaaS apps that few incident response teams have run into yet. These tokens don’t expire when you reset passwords, aren’t protected by MFA, and actions they performed are rarely logged. ",{"data":36872,"content":36873,"nodeType":860},{},[36874],{"data":36875,"marks":36876,"value":36877,"nodeType":864},{},[],"These are not bugs or oversights but rather a consequence of how these APIs are intended to be used (by machines, not human adversaries).",{"data":36879,"content":36880,"nodeType":1009},{},[36881],{"data":36882,"marks":36883,"value":36884,"nodeType":864},{},[],"Problems with observing SaaS attacks ",{"data":36886,"content":36887,"nodeType":860},{},[36888,36892,36897],{"data":36889,"marks":36890,"value":36891,"nodeType":864},{},[],"This research begs one question above others: ",{"data":36893,"marks":36894,"value":36896,"nodeType":864},{},[36895],{"type":2246},"“Are we seeing these attacks in the wild?",{"data":36898,"marks":36899,"value":36900,"nodeType":864},{},[],"” ",{"data":36902,"content":36903,"nodeType":1312},{},[36904],{"data":36905,"marks":36906,"value":36907,"nodeType":864},{},[],"Yes, definitely",{"data":36909,"content":36910,"nodeType":860},{},[36911,36915,36924,36927,36936,36940,36949,36953,36961,36965,36974],{"data":36912,"marks":36913,"value":36914,"nodeType":864},{},[],"For some of the better-known techniques, like credential stuffing and email phishing, the answer is an easy yes. Stats from ",{"data":36916,"content":36918,"nodeType":883},{"uri":36917},"https://www.microsoft.com/en-us/security/blog/2023/05/04/how-microsoft-can-help-you-go-passwordless-this-world-password-day/",[36919],{"data":36920,"marks":36921,"value":36923,"nodeType":864},{},[36922],{"type":1455},"Microsoft (1,287 password attacks every second)",{"data":36925,"marks":36926,"value":902,"nodeType":864},{},[],{"data":36928,"content":36930,"nodeType":883},{"uri":36929},"https://auth0.com/blog/top-insights-from-our-2022-state-of-secure-identity-report/",[36931],{"data":36932,"marks":36933,"value":36935,"nodeType":864},{},[36934],{"type":1455},"Auth0 (a third of their traffic is credential stuffing)",{"data":36937,"marks":36938,"value":36939,"nodeType":864},{},[]," speaks volumes. Other sources like the ",{"data":36941,"content":36943,"nodeType":883},{"uri":36942},"https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2022/cyber-security-breaches-survey-2022",[36944],{"data":36945,"marks":36946,"value":36948,"nodeType":864},{},[36947],{"type":1455},"NCSC's Cyber Security Breaches Survey 2022",{"data":36950,"marks":36951,"value":36952,"nodeType":864},{},[]," and the ",{"data":36954,"content":36955,"nodeType":883},{"uri":8425},[36956],{"data":36957,"marks":36958,"value":36960,"nodeType":864},{},[36959],{"type":1455},"Verizon 2023 Data Breach Investigations Report",{"data":36962,"marks":36963,"value":36964,"nodeType":864},{},[]," suggest that phishing is also a major cause of SaaS breaches. Anecdotal reports from colleagues in the Incident Response field suggest that malicious mail forwarding rules are seen a lot, something which is supported by the ",{"data":36966,"content":36968,"nodeType":883},{"uri":36967},"https://expel.com/expel-quarterly-threat-report/",[36969],{"data":36970,"marks":36971,"value":36973,"nodeType":864},{},[36972],{"type":1455},"Expel Quarterly Threat Report for Q1 2023",{"data":36975,"marks":36976,"value":36977,"nodeType":864},{},[]," (see page 6).",{"data":36979,"content":36980,"nodeType":860},{},[36981],{"data":36982,"marks":36983,"value":36984,"nodeType":864},{},[],"The takeaway is that the current focus for defenders should be to ensure users have good phishing-resistant account security in place — make sure you have basics like strong unique passwords and MFA in place across your entire SaaS estate.",{"data":36986,"content":36987,"nodeType":1312},{},[36988],{"data":36989,"marks":36990,"value":36991,"nodeType":864},{},[],"For newer OAuth attacks, it’s a lot less clear …",{"data":36993,"content":36994,"nodeType":860},{},[36995,36999,37004,37008,37017],{"data":36996,"marks":36997,"value":36998,"nodeType":864},{},[],"Other techniques like consent phishing have been discussed in some breach disclosures like the ",{"data":37000,"marks":37001,"value":37003,"nodeType":864},{},[37002],{"type":1455},"2020 SANS breach",{"data":37005,"marks":37006,"value":37007,"nodeType":864},{},[],". These OAuth techniques also pop up in the news (for example, the ",{"data":37009,"content":37011,"nodeType":883},{"uri":37010},"https://www.bleepingcomputer.com/news/security/github-how-stolen-oauth-tokens-helped-breach-dozens-of-orgs/",[37012],{"data":37013,"marks":37014,"value":37016,"nodeType":864},{},[37015],{"type":1455},"2022 Github/Heroku/Travis-CI breach",{"data":37018,"marks":37019,"value":37020,"nodeType":864},{},[]," where GitHub accounts were breached using stolen Heroku and Travis-CI OAuth tokens). ",{"data":37022,"content":37023,"nodeType":860},{},[37024,37028,37033],{"data":37025,"marks":37026,"value":37027,"nodeType":864},{},[],"That said, none of these techniques come up as frequently as their usefulness would suggest. This means one of two things: ",{"data":37029,"marks":37030,"value":37032,"nodeType":864},{},[37031],{"type":2246},"Either attackers aren’t yet using them widely, or they are and we aren’t detecting them",{"data":37034,"marks":37035,"value":2924,"nodeType":864},{},[],{"data":37037,"content":37038,"nodeType":860},{},[37039],{"data":37040,"marks":37041,"value":37042,"nodeType":864},{},[],"There is certainly a case to be made that attackers simply don’t need these newer techniques yet. Many organizations don’t have a way of discovering SaaS use in their organization yet, never mind breached accounts, so new persistence techniques might be a bit more than necessary at the moment.",{"data":37044,"content":37045,"nodeType":1312},{},[37046],{"data":37047,"marks":37048,"value":37049,"nodeType":864},{},[],"But would we know if it was happening?",{"data":37051,"content":37052,"nodeType":860},{},[37053],{"data":37054,"marks":37055,"value":37056,"nodeType":864},{},[],"On the other hand, there is certainly the possibility that these attacks are increasingly used, but are simply not being discovered. A strong argument in favor of this view is the difficulty in investigating these attacks. Very few SaaS apps provide enough logging capability to discover these attacks as a customer. This is true even for the biggest, most mature apps like Office 365 and Google Workspace unless you are on top license tiers. This is doubly true for attacks that use OAuth, with many apps providing no insight or details into actions made using OAuth-authenticated APIs. ",{"data":37058,"content":37059,"nodeType":860},{},[37060,37064,37073,37077,37086],{"data":37061,"marks":37062,"value":37063,"nodeType":864},{},[],"This suggests only the SaaS providers for these apps are really in a position to discover and investigate them. This does ring true when you consider that ",{"data":37065,"content":37067,"nodeType":883},{"uri":37066},"https://blog.heroku.com/april-2022-incident-review",[37068],{"data":37069,"marks":37070,"value":37072,"nodeType":864},{},[37071],{"type":1455},"Heroku",{"data":37074,"marks":37075,"value":37076,"nodeType":864},{},[]," relied heavily on Github during the investigation (and in one case even the detection of) their 2022 breaches, and the same seems true for a similar breach affecting ",{"data":37078,"content":37080,"nodeType":883},{"uri":37079},"https://circleci.com/blog/jan-4-2023-incident-report/",[37081],{"data":37082,"marks":37083,"value":37085,"nodeType":864},{},[37084],{"type":1455},"CircleCI",{"data":37087,"marks":37088,"value":37089,"nodeType":864},{},[]," later that year. Github and CircleCI’s customers prompted the investigation after seeing strange behavior, but Github had access to the logs to investigate. It’s difficult to imagine that most or even many SaaS vendors have the resources or inclination to run these investigations effectively as GitHub appears to have.",{"data":37091,"content":37092,"nodeType":860},{},[37093,37097,37107],{"data":37094,"marks":37095,"value":37096,"nodeType":864},{},[],"So, are these attacks happening in the real world? My best guess is it’s a little bit of column A and a little bit of column B — there are likely not so many of these attacks happening yet, and when they do, I suspect the vast majority go undetected. ",{"data":37098,"content":37100,"nodeType":883},{"uri":37099},"https://www.youtube.com/watch?v=j95kNwZw8YY",[37101],{"data":37102,"marks":37103,"value":37106,"nodeType":864},{},[37104,37105],{"type":1455},{"type":2246},"But that’s just like my opinion, man.",{"data":37108,"marks":37109,"value":21,"nodeType":864},{},[],{"data":37111,"content":37112,"nodeType":860},{},[37113],{"data":37114,"marks":37115,"value":37116,"nodeType":864},{},[],"This is part of the reason we think enabling red teamers to try these techniques in anger is useful — this is the time-proven way to understand these risks.",{"data":37118,"content":37119,"nodeType":1009},{},[37120],{"data":37121,"marks":37122,"value":37123,"nodeType":864},{},[],"What’s next?",{"data":37125,"content":37126,"nodeType":860},{},[37127],{"data":37128,"marks":37129,"value":37130,"nodeType":864},{},[],"We’ve barely scratched the surface, but perhaps there is enough here to get the discussion going. From past experience, discussion may not be enough, and it’s likely that live offensive work like penetration tests or more likely red team exercises will be required to make the risks of using these techniques real for the wider security community. ",{"data":37132,"content":37133,"nodeType":860},{},[37134],{"data":37135,"marks":37136,"value":37137,"nodeType":864},{},[],"After all, seeing is believing. We think some more practical examples and tools to help red  teamers use these techniques on engagements will help drive awareness forward, so we’ll be looking to build out this content.",{"data":37139,"content":37140,"nodeType":860},{},[37141,37145,37154],{"data":37142,"marks":37143,"value":37144,"nodeType":864},{},[],"We’ve started with pure networkless attacks that don’t touch customer networks or endpoints, but there are many useful techniques to connect the old endpoint world to the SaaS world. Consider stealing OAuth tokens from a thick client on an endpoint, or using a ",{"data":37146,"content":37148,"nodeType":883},{"uri":37147},"https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/",[37149],{"data":37150,"marks":37151,"value":37153,"nodeType":864},{},[37152],{"type":1455},"backdoored GitHub repo to get code execution on endpoints",{"data":37155,"marks":37156,"value":2924,"nodeType":864},{},[],{"data":37158,"content":37159,"nodeType":860},{},[37160,37164,37171],{"data":37161,"marks":37162,"value":37163,"nodeType":864},{},[],"Help us all better understand how widespread these attacks are by sharing some war stories. We’d love some comments, discussions, or PRs on ",{"data":37165,"content":37166,"nodeType":883},{"uri":32829},[37167],{"data":37168,"marks":37169,"value":36465,"nodeType":864},{},[37170],{"type":1455},{"data":37172,"marks":37173,"value":37174,"nodeType":864},{},[],"!",{"data":37176,"content":37180,"nodeType":996},{"target":37177},{"sys":37178},{"id":37179,"type":1001,"linkType":1002},"2y0INxqAi594O7rCAVKhTI",[],{"data":37182,"content":37183,"nodeType":860},{},[37184],{"data":37185,"marks":37186,"value":21,"nodeType":864},{},[],"Let’s talk about SaaS attack techniques","Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.","2023-07-27T00:00:00.000Z","saas-attack-techniques",{"items":37192},[37193,37195],{"sys":37194,"name":15033},{"id":15032},{"sys":37196,"name":342},{"id":15029},{"items":37198},[37199],{"fullName":37200,"firstName":37201,"jobTitle":37202,"profilePicture":37203},"Jacques Louw","Jacques","Co-founder / CRO",{"url":37204},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg",{"__typename":2059,"sys":37206,"content":37208,"title":37643,"synopsis":37644,"hashTags":59,"publishedDate":37645,"slug":37646,"tagsCollection":37647,"authorsCollection":37651},{"id":37207},"3QpljiYU9YHEUhd5gsvypj",{"json":37209},{"data":37210,"content":37211,"nodeType":856},{},[37212,37219,37226,37233,37240,37247,37253,37260,37267,37274,37281,37287,37294,37300,37320,37327,37333,37352,37373,37392,37399,37406,37413,37420,37426,37432,37439,37446,37453,37460,37466,37473,37521,37527,37533,37551,37557,37564,37570,37577,37583,37590,37597,37603,37609,37615,37622,37629,37636],{"data":37213,"content":37214,"nodeType":860},{},[37215],{"data":37216,"marks":37217,"value":37218,"nodeType":864},{},[],"As an attacker, we have a wide range of persistence options available to us in a traditional account or endpoint compromise scenario. From discovering a user's password, to creating new backdoor accounts, to using one of an insane number of \"run keys\" to keep an implant running beyond reboot, or even moving laterally to other internal systems - an attacker has plenty of choice.",{"data":37220,"content":37221,"nodeType":860},{},[37222],{"data":37223,"marks":37224,"value":37225,"nodeType":864},{},[],"But how does this change in a SaaS-first world? In this post, we'll consider some of the new challenges and opportunities that are presented to an attacker who wants to maintain persistence in the new world order, so you can better investigate incidents and quickly defend against attacks. We'll cover a variety of techniques, including malicious mail rules, OAuth backdoor tricks and document sharing links to see how persistence can be maintained, even in the event of password changes and device wipes.",{"data":37227,"content":37228,"nodeType":1009},{},[37229],{"data":37230,"marks":37231,"value":37232,"nodeType":864},{},[],"So what’s changed?",{"data":37234,"content":37235,"nodeType":860},{},[37236],{"data":37237,"marks":37238,"value":37239,"nodeType":864},{},[],"In a traditional compromise scenario, a common example would be an endpoint compromised through phishing, which is used to deliver a malicious implant to establish a command and control channel with the endpoint. In order to maintain access, an attacker would likely use one or more endpoint persistence methods to ensure their implant is launched again post-reboot when the user turns their laptop off for the day. ",{"data":37241,"content":37242,"nodeType":860},{},[37243],{"data":37244,"marks":37245,"value":37246,"nodeType":864},{},[],"This would often become a foothold into the internal network of the compromised organization. The endpoint or user is the start, but an attacker may seek to move laterally to other endpoints and servers on the internal network, where security is often much lower than the external perimeter.",{"data":37248,"content":37252,"nodeType":996},{"target":37249},{"sys":37250},{"id":37251,"type":1001,"linkType":1002},"5aSsHI9aZjsZIIXcV3YDYk",[],{"data":37254,"content":37255,"nodeType":860},{},[37256],{"data":37257,"marks":37258,"value":37259,"nodeType":864},{},[],"In a SaaS-first world, this situation has begun to change somewhat. There are many companies now that have significantly reduced the size of their internal networks or are even fully in the cloud and do not have any internal network infrastructure. In this case, traditional lateral movement becomes much more difficult or impossible. Additionally, endpoints are becoming increasingly hard targets to compromise and incident response teams have matured and have gotten better at cleaning up endpoint compromises. ",{"data":37261,"content":37262,"nodeType":860},{},[37263],{"data":37264,"marks":37265,"value":37266,"nodeType":864},{},[],"The consequence of this is that attackers need to make the most use of the access they have during an endpoint or user compromise and maintain access where possible, even in the event of a password reset and full laptop wipe. Additionally, new SaaS-focused persistence options are now possible, which are also often resistant to password changes and endpoints wipes, so these are increasingly attractive options for an attacker. ",{"data":37268,"content":37269,"nodeType":860},{},[37270],{"data":37271,"marks":37272,"value":37273,"nodeType":864},{},[],"One other change is that persistence is less binary than it has been traditionally. Typically, persistence would often be on a per-user or per-endpoint basis. Either an attacker would have full control of a user account (e.g. knowing the password) or full control of an endpoint (e.g. an implant running on the endpoint). The main differentiation would be in whether endpoint-level access was administrative level control over the endpoint or an implant running as a low-privileged user account. However, in the SaaS-world persistence is much more asset dependent and thus less binary. It could be persistent access to email, or documents, or chat conversations or any number of other assets and capabilities.",{"data":37275,"content":37276,"nodeType":1312},{},[37277],{"data":37278,"marks":37279,"value":37280,"nodeType":864},{},[],"Mail rules",{"data":37282,"content":37286,"nodeType":996},{"target":37283},{"sys":37284},{"id":37285,"type":1001,"linkType":1002},"3bcLzOfZupSDatdzfFrJDQ",[],{"data":37288,"content":37289,"nodeType":860},{},[37290],{"data":37291,"marks":37292,"value":37293,"nodeType":864},{},[],"Mail rules are a handy feature found in most email clients. You might have used them to forward emails to your teammates while you’re off sipping Piña Coladas, or to move incoming email from that spammy colleague to the “don’t read” folder. However, they can also be used for a range of malicious activities, such as forwarding emails to an external address (e.g. password resets, invoices, “confidential” emails etc) or deleting emails (e.g. security alerts!). A good example of a real-world attack involving this technique was the 2020 SANS breach.\n",{"data":37295,"content":37299,"nodeType":996},{"target":37296},{"sys":37297},{"id":37298,"type":1001,"linkType":1002},"5RoIfopOGmTaORtG7fqYQo",[],{"data":37301,"content":37302,"nodeType":860},{},[37303,37307,37317],{"data":37304,"marks":37305,"value":37306,"nodeType":864},{},[],"If you want to read more about this technique, you can check out our ",{"data":37308,"content":37312,"nodeType":5064},{"target":37309},{"sys":37310},{"id":37311,"type":1001,"linkType":1002},"2zZ8kxP0t8Smi9b6hpT34k",[37313],{"data":37314,"marks":37315,"value":37316,"nodeType":864},{},[],"previous article",{"data":37318,"marks":37319,"value":2924,"nodeType":864},{},[],{"data":37321,"content":37322,"nodeType":1312},{},[37323],{"data":37324,"marks":37325,"value":37326,"nodeType":864},{},[],"OAuth attack #1: Custom OAuth app integration",{"data":37328,"content":37332,"nodeType":996},{"target":37329},{"sys":37330},{"id":37331,"type":1001,"linkType":1002},"7suW3GZpDsu2RnopkUiA3L",[],{"data":37334,"content":37335,"nodeType":860},{},[37336,37340,37349],{"data":37337,"marks":37338,"value":37339,"nodeType":864},{},[],"OAuth apps can be used to request permanent access to a set of permissions on behalf of a user. This can be as simple as the ability to verify a user’s identity for a simple social login or it could be as permissive as having full control over email, document stores, wiki pages, admin capabilities, etc. You can read more details about this in our ",{"data":37341,"content":37345,"nodeType":5064},{"target":37342},{"sys":37343},{"id":37344,"type":1001,"linkType":1002},"68syxk4cmD6QOdVRcDqgEZ",[37346],{"data":37347,"marks":37348,"value":37316,"nodeType":864},{},[],{"data":37350,"marks":37351,"value":12800,"nodeType":864},{},[],{"data":37353,"content":37354,"nodeType":860},{},[37355,37359,37369],{"data":37356,"marks":37357,"value":37358,"nodeType":864},{},[],"However, from an attacker’s perspective a custom OAuth app could be created with sensitive permissions and connected to a user’s account in order to maintain access to their data. In the event that an attacker has compromised a user’s account or endpoint, they could directly consent to their own malicious OAuth app on behalf of the user in order to gain persistence. This could also be achieved as part of a ",{"data":37360,"content":37364,"nodeType":5064},{"target":37361},{"sys":37362},{"id":37363,"type":1001,"linkType":1002},"1bV8YTSQHvveCTnRc4H8su",[37365],{"data":37366,"marks":37367,"value":37368,"nodeType":864},{},[],"consent phishing",{"data":37370,"marks":37371,"value":37372,"nodeType":864},{},[]," attack to effectively compromise a user’s account and gain this persistence at the same time. In either case, this would enable continued access to the user’s data even if their password is changed and their endpoint fully wiped.   ",{"data":37374,"content":37375,"nodeType":860},{},[37376,37380,37388],{"data":37377,"marks":37378,"value":37379,"nodeType":864},{},[],"Attacks utilizing these types of techniques are becoming increasingly common and Microsoft even ",{"data":37381,"content":37383,"nodeType":883},{"uri":37382},"https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-OAuth-applications-used-to-compromise-email-servers-and-spread-spam/",[37384],{"data":37385,"marks":37386,"value":37387,"nodeType":864},{},[],"wrote about some real-world attacks",{"data":37389,"marks":37390,"value":37391,"nodeType":864},{},[]," they uncovered recently that involved the use of malicious OAuth apps.",{"data":37393,"content":37394,"nodeType":1312},{},[37395],{"data":37396,"marks":37397,"value":37398,"nodeType":864},{},[],"OAuth attack #2: SaaS platform integration",{"data":37400,"content":37401,"nodeType":860},{},[37402],{"data":37403,"marks":37404,"value":37405,"nodeType":864},{},[],"A similar approach to using a custom OAuth app is to make use of legitimate SaaS services that allow an attacker to make sensitive integrations as a more hide-in-plain-sight approach. For example, let’s take the popular SaaS platform Canva, a graphic design tool that is used to create social media graphics, presentations, posters, documents and other visual content, as an example. Canva, like many SaaS platforms, allows you to make integrations with document stores like OneDrive and Google Drive in order to easily import and export files between Canva and them. If an attacker is interested primarily in maintaining access to a user’s files, then they could make an integration with a platform like Canva and then use that to maintain access.",{"data":37407,"content":37408,"nodeType":860},{},[37409],{"data":37410,"marks":37411,"value":37412,"nodeType":864},{},[],"While this doesn’t provide any raw capabilities beyond a custom OAuth app, an attacker may be more likely to go undetected in this scenario. Discovering an integration with a completely unknown, unverified OAuth app that hasn’t been seen in use elsewhere in the organization, or anywhere at all, is suspicious. Finding an integration with a major SaaS platform, particularly if it is one in use by other users in the organization, is much less suspicious. Additionally, many of them will have verified ticks having been through Microsoft’s or Google’s own verification processes. The only downside for an attacker is having to find SaaS platforms that request the correct permissions and provide the functionality that the attacker is looking for, whereas a custom OAuth app could be used to request any permissions and code could be written to use those permissions however an attacker would like.",{"data":37414,"content":37415,"nodeType":860},{},[37416],{"data":37417,"marks":37418,"value":37419,"nodeType":864},{},[],"If a custom OAuth app is the equivalent of a custom implant on an endpoint, then using a legitimate SaaS platform integration is the equivalent of a more living-off-the-land approach, such as using TeamViewer, RDP or Powershell, etc.\n",{"data":37421,"content":37425,"nodeType":996},{"target":37422},{"sys":37423},{"id":37424,"type":1001,"linkType":1002},"53pL4O8zgfLBKqZbbcN3aI",[],{"data":37427,"content":37431,"nodeType":996},{"target":37428},{"sys":37429},{"id":37430,"type":1001,"linkType":1002},"6ovQnE1bu7tVCJr4OfzfhI",[],{"data":37433,"content":37434,"nodeType":1312},{},[37435],{"data":37436,"marks":37437,"value":37438,"nodeType":864},{},[],"OAuth attack #3: Legitimate desktop/mobile app impersonation",{"data":37440,"content":37441,"nodeType":860},{},[37442],{"data":37443,"marks":37444,"value":37445,"nodeType":864},{},[],"Ok, we promise this is the last OAuth variation example - but it’s another interesting way to abuse OAuth connections! Previously, we spoke of either connecting a custom OAuth app or using an OAuth integration via a legitimate SaaS platform. A custom OAuth app has the most flexibility for an attacker, but looks far more suspicious if discovered, whereas a legitimate SaaS platform looks much more….well, legitimate!",{"data":37447,"content":37448,"nodeType":860},{},[37449],{"data":37450,"marks":37451,"value":37452,"nodeType":864},{},[],"What if you could have both of those advantages in one? Well, that can be achieved, too! The reason SaaS platforms don’t have the same flexibility is because they keep their client IDs and secrets for their apps so the attacker can only use the OAuth app indirectly via the features provided by the SaaS platform. However, some OAuth connections are made using desktop or mobile apps that obviously can’t keep their OAuth app secrets secret from a user. While it is generally not possible for an attacker to make use of these in a consent phishing attack, due to not controlling the reply URLs, they can be used in a pure persistence scenario with an already compromised account. ",{"data":37454,"content":37455,"nodeType":860},{},[37456],{"data":37457,"marks":37458,"value":37459,"nodeType":864},{},[],"Let’s take Mozilla Thunderbird, a cross-platform email client, as an example. The client IDs and secrets for different OAuth apps are actually stored in the source code in this case: ",{"data":37461,"content":37465,"nodeType":996},{"target":37462},{"sys":37463},{"id":37464,"type":1001,"linkType":1002},"3Ed90clKC3GG4BcPfeV6Nm",[],{"data":37467,"content":37468,"nodeType":860},{},[37469],{"data":37470,"marks":37471,"value":37472,"nodeType":864},{},[],"As an attacker, this gives us multiple advantages. ",{"data":37474,"content":37475,"nodeType":941},{},[37476,37491,37506],{"data":37477,"content":37478,"nodeType":945},{},[37479],{"data":37480,"content":37481,"nodeType":860},{},[37482,37487],{"data":37483,"marks":37484,"value":37486,"nodeType":864},{},[37485],{"type":899},"App Impersonation",{"data":37488,"marks":37489,"value":37490,"nodeType":864},{},[]," - These are client IDs that will be seen in use legitimately by other users and we can impersonate them. In Thunderbird’s case, the Microsoft app isn’t actually a verified app but the Google one shows as verified. Whatever the case, it looks much less suspicious than a completely unknown app with no known business use case. ",{"data":37492,"content":37493,"nodeType":945},{},[37494],{"data":37495,"content":37496,"nodeType":860},{},[37497,37502],{"data":37498,"marks":37499,"value":37501,"nodeType":864},{},[37500],{"type":899},"Flexible Use",{"data":37503,"marks":37504,"value":37505,"nodeType":864},{},[]," - We have access to the client IDs and secrets, so we can do whatever we want with the OAuth integration, writing custom code to query APIs as we please. We are not limited to the functionality provided by Thunderbird itself.\n",{"data":37507,"content":37508,"nodeType":945},{},[37509],{"data":37510,"content":37511,"nodeType":860},{},[37512,37517],{"data":37513,"marks":37514,"value":37516,"nodeType":864},{},[37515],{"type":899},"Arbitrary Permission Granting",{"data":37518,"marks":37519,"value":37520,"nodeType":864},{},[]," - We aren’t actually limited to just the permissions that Thunderbird would normally request (e.g. email/calendar). Since we’re in control of the OAuth secrets, we can just request whatever scopes we want. For example, shown below is us using the Microsoft Thunderbird OAuth secrets to request permissions that also include access to all files, Sharepoint, AD access, etc. \n",{"data":37522,"content":37526,"nodeType":996},{"target":37523},{"sys":37524},{"id":37525,"type":1001,"linkType":1002},"22nQPPKCgUUEr7QPQBFHNS",[],{"data":37528,"content":37532,"nodeType":996},{"target":37529},{"sys":37530},{"id":37531,"type":1001,"linkType":1002},"5eIVlfPzpxuO7D41r7DPfe",[],{"data":37534,"content":37535,"nodeType":941},{},[37536],{"data":37537,"content":37538,"nodeType":945},{},[37539],{"data":37540,"content":37541,"nodeType":860},{},[37542,37547],{"data":37543,"marks":37544,"value":37546,"nodeType":864},{},[37545],{"type":899},"(Semi-)Bypass Google Restricted Scopes",{"data":37548,"marks":37549,"value":37550,"nodeType":864},{},[]," - When it comes to arbitrary permission granting, there is a caveat with Google in that some of the more sensitive scopes Google offer are only available to selected approved and verified apps. Therefore, we can’t necessarily just request access to any permission with Google. For example, if we modify Thunderbird to request access to Google Drive (a restricted scope) then we get the following: ",{"data":37552,"content":37556,"nodeType":996},{"target":37553},{"sys":37554},{"id":37555,"type":1001,"linkType":1002},"3HIcve3zqVFheiZ2tJILJl",[],{"data":37558,"content":37559,"nodeType":860},{},[37560],{"data":37561,"marks":37562,"value":37563,"nodeType":864},{},[],"Access to Gmail is also considered a restricted scope. However, obviously Thunderbird is an email client, so if it uses OAuth it’s going to want access to Gmail, right? Well, yes, the Thunderbird app ID is permitted access to Gmail data, so we can use it to gain that access and appear as a legitimate verified app, in addition to requesting any other non-restricted permissions we’re interested in: ",{"data":37565,"content":37569,"nodeType":996},{"target":37566},{"sys":37567},{"id":37568,"type":1001,"linkType":1002},"5SqY9Q2g7DpHhCGJVQDcgF",[],{"data":37571,"content":37572,"nodeType":1312},{},[37573],{"data":37574,"marks":37575,"value":37576,"nodeType":864},{},[],"Document-sharing links",{"data":37578,"content":37582,"nodeType":996},{"target":37579},{"sys":37580},{"id":37581,"type":1001,"linkType":1002},"2EEC98Ros0MdMX2gt4OGKe",[],{"data":37584,"content":37585,"nodeType":860},{},[37586],{"data":37587,"marks":37588,"value":37589,"nodeType":864},{},[],"Ok, no more OAuth, we promise! The final option we want to highlight is the (ab-)use of document-sharing links. Many organizations make use of OneDrive, Sharepoint and Google Drive for document editing, sharing and collaboration. However, it’s pretty common to want to share documents with people outside your organization sometimes too, right? That’s where document-sharing links come in. You can create a document sharing link to share with specific individuals in other Google/Azure organizations or you can create anonymous links that anyone with knowledge of the (unguessable randomized) link can access.",{"data":37591,"content":37592,"nodeType":860},{},[37593],{"data":37594,"marks":37595,"value":37596,"nodeType":864},{},[],"Very similar functionality is present in both OneDrive and Google Drive, but this same legitimate functionality can also be abused by attackers to maintain backdoor access to either select files or entire root folders. Sharing a root folder will cause future files to inherit those sharing permissions. This is a modern repeat of the age-old problem of access control list (ACL) management on internal file servers, only now internet-based attackers can potentially abuse this without needing VPN or similar access. ",{"data":37598,"content":37602,"nodeType":996},{"target":37599},{"sys":37600},{"id":37601,"type":1001,"linkType":1002},"4IUv2rbEMXrJUAdEYC9xxD",[],{"data":37604,"content":37608,"nodeType":996},{"target":37605},{"sys":37606},{"id":37607,"type":1001,"linkType":1002},"bMAt7XvLmIEIDwzZrAawU",[],{"data":37610,"content":37611,"nodeType":1312},{},[37612],{"data":37613,"marks":37614,"value":35763,"nodeType":864},{},[],{"data":37616,"content":37617,"nodeType":860},{},[37618],{"data":37619,"marks":37620,"value":37621,"nodeType":864},{},[],"We've demonstrated a few new persistence options attackers are using against organizations as they move to the cloud. While some existing persistence and lateral movement options are no longer working in these environments, attackers have been able to quickly adapt to new conditions to get at their targets.",{"data":37623,"content":37624,"nodeType":860},{},[37625],{"data":37626,"marks":37627,"value":37628,"nodeType":864},{},[],"Some of these attacks have already been seen in the wild and others may already be happening under the radar. In any case, being aware of how attackers will try to compromise SaaS-first organizations helps you prepare to defend and respond to these attacks. ",{"data":37630,"content":37631,"nodeType":860},{},[37632],{"data":37633,"marks":37634,"value":37635,"nodeType":864},{},[],"It’s extremely important for incident response teams to adapt to these changes, as a password reset and a device wipe is not sufficient to regain control of a user account, even when no lateral movement to internal systems has been performed.",{"data":37637,"content":37638,"nodeType":860},{},[37639],{"data":37640,"marks":37641,"value":37642,"nodeType":864},{},[],"New steps need to be added to IR playbooks in the event of user or device compromises to cover the revocation of OAuth permissions and refresh tokens, the auditing of mail rules and changes to document sharing configurations.","Maintaining persistent access in a SaaS-first world","Attackers have loads of persistence options in an endpoint compromise scenario, but what changes in a SaaS-first world? We talk new attack methods in this post.","2022-11-29T00:00:00.000Z","maintaining-persistent-access-in-a-saas-first-world",{"items":37648},[37649],{"sys":37650,"name":15033},{"id":15032},{"items":37652},[37653],{"fullName":34884,"firstName":34885,"jobTitle":34886,"profilePicture":37654},{"url":34890},"nearly-invisible-attack-chain","blog/nearly-invisible-attack-chain",{"json":37658},{"data":37659,"content":37660,"nodeType":856},{},[37661],{"data":37662,"content":37663,"nodeType":860},{},[37664],{"data":37665,"marks":37666,"value":37667,"nodeType":864},{},[],"We’re going to demonstrate how combining two of our favorite new SaaS attack techniques - from our SaaS Attacks Matrix research - makes a simple, but very stealthy approach that maintains persistent access.",{"id":37669,"publishedAt":37670},"7ygI4NLJ2zpuiVwAlggkTG","2026-08-12T11:55:59.906Z",{"items":37672},[37673,37675],{"sys":37674,"name":15033},{"id":15032},{"sys":37676,"name":342},{"id":15029},{"items":37678},[37679,37681,37683,37685,37687,37689,37691,37693,37695,37697],{"sys":37680,"name":279,"slug":280,"tier":31},{"id":276},{"sys":37682,"name":413,"slug":414,"tier":31},{"id":410},{"sys":37684,"name":545,"slug":546,"tier":31},{"id":542},{"sys":37686,"name":342,"slug":343,"tier":31},{"id":339},{"sys":37688,"name":484,"slug":485,"tier":45},{"id":481},{"sys":37690,"name":404,"slug":405,"tier":45},{"id":401},{"sys":37692,"name":571,"slug":572,"tier":45},{"id":568},{"sys":37694,"name":431,"slug":432,"tier":45},{"id":428},{"sys":37696,"name":368,"slug":369,"tier":45},{"id":365},{"sys":37698,"name":333,"slug":334,"tier":45},{"id":330},"dOWGpyVPlOdvk8MP541yXUYAhD19BxKwElFq8HzGBV4",{"id":37701,"title":37702,"authorsCollection":37703,"content":37711,"extension":228,"faqItemsCollection":38449,"faqTitle":59,"featured":6,"hashTags":59,"meta":38451,"metaTitle":38452,"ogImage":59,"postType":38453,"publishedDate":38454,"relatedBlogPostsCollection":38455,"slug":40252,"stem":40253,"subtitle":59,"summary":40254,"synopsis":40265,"sys":40266,"tagsCollection":40269,"topicsCollection":40275,"__hash__":40291},"blog/blog/the-risky-terrain-of-oauth-scopes-in-third-party.json","Under the radar: The risky terrain of OAuth scopes in third-party Integrations",{"items":37704},[37705],{"fullName":37706,"firstName":37707,"jobTitle":37708,"socialLinks":59,"profilePicture":37709},"Johann Scheepers","Johann","Senior Security Engineer",{"url":37710},"https://images.ctfassets.net/y1cdw1ablpvd/75IEOH93vR0hbvxuqTu1m3/f6222745ee6892ea07bc18727a5a5ae7/T016S22KZ96-U02LU3SKC2D-e1e755770536-512.png",{"json":37712,"links":38434},{"data":37713,"content":37714,"nodeType":856},{},[37715,37722,37729,37736,37744,37793,37800,37807,37814,37822,37914,37921,37928,37935,37942,37989,37996,38003,38011,38058,38065,38095,38102,38110,38202,38209,38216,38223,38231,38277,38284,38291,38298,38306,38347,38354,38361,38368,38387,38394,38401,38423,38428],{"data":37716,"content":37717,"nodeType":860},{},[37718],{"data":37719,"marks":37720,"value":37721,"nodeType":864},{},[],"While OAuth scopes are instrumental in providing seamless online user authentication, they also carry significant risk in terms of security breaches. This risk magnifies when exposed to malicious actors, who can exploit certain high-risk scopes such as Microsoft 365’s “MailboxSettings.ReadWrite”, and Google Workspace’s “gmail.settings.sharing” to carry out nefarious actions.",{"data":37723,"content":37724,"nodeType":860},{},[37725],{"data":37726,"marks":37727,"value":37728,"nodeType":864},{},[],"This article includes the most common high-risk scopes that may pose risk to your organization following the compromise of a third-party integration. Watch out for these common, dangerous scopes in your next risk assessment.",{"data":37730,"content":37731,"nodeType":1009},{},[37732],{"data":37733,"marks":37734,"value":37735,"nodeType":864},{},[],"Capability: Backdoor Mailbox",{"data":37737,"content":37738,"nodeType":860},{},[37739],{"data":37740,"marks":37741,"value":37743,"nodeType":864},{},[37742],{"type":2246},"Types of attacks: Business email compromise, account takeover via password reset email",{"data":37745,"content":37746,"nodeType":4845},{},[37747,37770],{"data":37748,"content":37749,"nodeType":4581},{},[37750,37760],{"data":37751,"content":37752,"nodeType":4569},{},[37753],{"data":37754,"content":37755,"nodeType":860},{},[37756],{"data":37757,"marks":37758,"value":37759,"nodeType":864},{},[],"Microsoft 365 / Azure",{"data":37761,"content":37762,"nodeType":4569},{},[37763],{"data":37764,"content":37765,"nodeType":860},{},[37766],{"data":37767,"marks":37768,"value":37769,"nodeType":864},{},[],"Google Workspace",{"data":37771,"content":37772,"nodeType":4581},{},[37773,37783],{"data":37774,"content":37775,"nodeType":4569},{},[37776],{"data":37777,"content":37778,"nodeType":860},{},[37779],{"data":37780,"marks":37781,"value":37782,"nodeType":864},{},[],"MailboxSettings.ReadWrite",{"data":37784,"content":37785,"nodeType":4569},{},[37786],{"data":37787,"content":37788,"nodeType":860},{},[37789],{"data":37790,"marks":37791,"value":37792,"nodeType":864},{},[],"https://www.googleapis.com/auth/gmail.settings.sharing",{"data":37794,"content":37795,"nodeType":860},{},[37796],{"data":37797,"marks":37798,"value":37799,"nodeType":864},{},[],"Scopes that allow you to alter sensitive mailbox settings, such as forwarding rules, can allow malicious actors to take over a user’s mailbox by moving, deleting, or forwarding mail externally. This type of attack is typically prevalent in business email compromise (BEC) scenarios where malicious actors intercepts sensitive communications, leading to invoice fraud as an example.",{"data":37801,"content":37802,"nodeType":860},{},[37803],{"data":37804,"marks":37805,"value":37806,"nodeType":864},{},[],"The malicious actor would also be able to forward password reset email requests and delete the email from the victim’s inbox to avoid detection, thereby gaining the ability to reset credentials and gain access to third-party SaaS applications while remaining undetected.",{"data":37808,"content":37809,"nodeType":1009},{},[37810],{"data":37811,"marks":37812,"value":37813,"nodeType":864},{},[],"Capability: Account Takeover, Privilege Escalation",{"data":37815,"content":37816,"nodeType":860},{},[37817],{"data":37818,"marks":37819,"value":37821,"nodeType":864},{},[37820],{"type":2246},"Types of attacks: account takeover via password reset, privilege escalation via group membership change",{"data":37823,"content":37824,"nodeType":4845},{},[37825,37846,37869,37892],{"data":37826,"content":37827,"nodeType":4581},{},[37828,37837],{"data":37829,"content":37830,"nodeType":4569},{},[37831],{"data":37832,"content":37833,"nodeType":860},{},[37834],{"data":37835,"marks":37836,"value":37759,"nodeType":864},{},[],{"data":37838,"content":37839,"nodeType":4569},{},[37840],{"data":37841,"content":37842,"nodeType":860},{},[37843],{"data":37844,"marks":37845,"value":37769,"nodeType":864},{},[],{"data":37847,"content":37848,"nodeType":4581},{},[37849,37859],{"data":37850,"content":37851,"nodeType":4569},{},[37852],{"data":37853,"content":37854,"nodeType":860},{},[37855],{"data":37856,"marks":37857,"value":37858,"nodeType":864},{},[],"Directory.ReadWrite.All",{"data":37860,"content":37861,"nodeType":4569},{},[37862],{"data":37863,"content":37864,"nodeType":860},{},[37865],{"data":37866,"marks":37867,"value":37868,"nodeType":864},{},[],"https://www.googleapis.com/auth/admin.directory.user.security",{"data":37870,"content":37871,"nodeType":4581},{},[37872,37882],{"data":37873,"content":37874,"nodeType":4569},{},[37875],{"data":37876,"content":37877,"nodeType":860},{},[37878],{"data":37879,"marks":37880,"value":37881,"nodeType":864},{},[],"User.ReadWrite.All",{"data":37883,"content":37884,"nodeType":4569},{},[37885],{"data":37886,"content":37887,"nodeType":860},{},[37888],{"data":37889,"marks":37890,"value":37891,"nodeType":864},{},[],"https://www.googleapis.com/auth/admin.directory.user",{"data":37893,"content":37894,"nodeType":4581},{},[37895,37904],{"data":37896,"content":37897,"nodeType":4569},{},[37898],{"data":37899,"content":37900,"nodeType":860},{},[37901],{"data":37902,"marks":37903,"value":21,"nodeType":864},{},[],{"data":37905,"content":37906,"nodeType":4569},{},[37907],{"data":37908,"content":37909,"nodeType":860},{},[37910],{"data":37911,"marks":37912,"value":37913,"nodeType":864},{},[],"https://www.googleapis.com/auth/admin.directory.group",{"data":37915,"content":37916,"nodeType":860},{},[37917],{"data":37918,"marks":37919,"value":37920,"nodeType":864},{},[],"The above scopes are typically used by applications that perform identity management within your cloud environment. “Directory.ReadWrite.All” for example, allows you to read and modify practically any aspect of objects within your directory. This includes group membership, password resets, and re-enabling previously disabled accounts. ",{"data":37922,"content":37923,"nodeType":860},{},[37924],{"data":37925,"marks":37926,"value":37927,"nodeType":864},{},[],"“User.ReadWrite.All” has similar privileges, albeit limited in scope to user accounts only. An attacker in a position to abuse such scopes would be able to take over accounts, escalate privileges by assigning the accounts to privileged groups, and remain under the radar by making use of previously disabled accounts.",{"data":37929,"content":37930,"nodeType":1009},{},[37931],{"data":37932,"marks":37933,"value":37934,"nodeType":864},{},[],"Capability: Email Access",{"data":37936,"content":37937,"nodeType":860},{},[37938],{"data":37939,"marks":37940,"value":37743,"nodeType":864},{},[37941],{"type":2246},{"data":37943,"content":37944,"nodeType":4845},{},[37945,37966],{"data":37946,"content":37947,"nodeType":4581},{},[37948,37957],{"data":37949,"content":37950,"nodeType":4569},{},[37951],{"data":37952,"content":37953,"nodeType":860},{},[37954],{"data":37955,"marks":37956,"value":37759,"nodeType":864},{},[],{"data":37958,"content":37959,"nodeType":4569},{},[37960],{"data":37961,"content":37962,"nodeType":860},{},[37963],{"data":37964,"marks":37965,"value":37769,"nodeType":864},{},[],{"data":37967,"content":37968,"nodeType":4581},{},[37969,37979],{"data":37970,"content":37971,"nodeType":4569},{},[37972],{"data":37973,"content":37974,"nodeType":860},{},[37975],{"data":37976,"marks":37977,"value":37978,"nodeType":864},{},[],"Mail.ReadWrite",{"data":37980,"content":37981,"nodeType":4569},{},[37982],{"data":37983,"content":37984,"nodeType":860},{},[37985],{"data":37986,"marks":37987,"value":37988,"nodeType":864},{},[],"https://mail.google.com/",{"data":37990,"content":37991,"nodeType":860},{},[37992],{"data":37993,"marks":37994,"value":37995,"nodeType":864},{},[],"Scopes that have direct access to mailboxes naturally provide risk in terms of a malicious actor’s ability to read sensitive information, and access to third-party SaaS applications’ password reset email requests, not unlike the ‘Backdoor Mailbox’ capability.",{"data":37997,"content":37998,"nodeType":1009},{},[37999],{"data":38000,"marks":38001,"value":38002,"nodeType":864},{},[],"Capability: Access as User",{"data":38004,"content":38005,"nodeType":860},{},[38006],{"data":38007,"marks":38008,"value":38010,"nodeType":864},{},[38009],{"type":2246},"Types of attacks: Gain access to resources available to the particular account",{"data":38012,"content":38013,"nodeType":4845},{},[38014,38035],{"data":38015,"content":38016,"nodeType":4581},{},[38017,38026],{"data":38018,"content":38019,"nodeType":4569},{},[38020],{"data":38021,"content":38022,"nodeType":860},{},[38023],{"data":38024,"marks":38025,"value":37759,"nodeType":864},{},[],{"data":38027,"content":38028,"nodeType":4569},{},[38029],{"data":38030,"content":38031,"nodeType":860},{},[38032],{"data":38033,"marks":38034,"value":37769,"nodeType":864},{},[],{"data":38036,"content":38037,"nodeType":4581},{},[38038,38048],{"data":38039,"content":38040,"nodeType":4569},{},[38041],{"data":38042,"content":38043,"nodeType":860},{},[38044],{"data":38045,"marks":38046,"value":38047,"nodeType":864},{},[],"Directory.AccessAsUser.All",{"data":38049,"content":38050,"nodeType":4569},{},[38051],{"data":38052,"content":38053,"nodeType":860},{},[38054],{"data":38055,"marks":38056,"value":38057,"nodeType":864},{},[],"https://www.googleapis.com/auth/cloud-platform",{"data":38059,"content":38060,"nodeType":860},{},[38061],{"data":38062,"marks":38063,"value":38064,"nodeType":864},{},[],"Scopes that provide “Access as User” privileges are typically used by applications that need to impersonate a user and their access permissions. This may not sound super risky at the surface level, but if you consider that a user may have access to shared resources across an organization, the risk starts to add up.",{"data":38066,"content":38067,"nodeType":860},{},[38068,38072,38080,38084,38091],{"data":38069,"marks":38070,"value":38071,"nodeType":864},{},[],"One example of the impact of such scopes is noted in Chris Moberly's incredibly informative ",{"data":38073,"content":38075,"nodeType":883},{"uri":38074},"https://initblog.com/2020/gcp-post-exploitation/",[38076],{"data":38077,"marks":38078,"value":38079,"nodeType":864},{},[],"blog post",{"data":38081,"marks":38082,"value":38083,"nodeType":864},{},[]," where the “",{"data":38085,"content":38086,"nodeType":883},{"uri":38057},[38087],{"data":38088,"marks":38089,"value":38057,"nodeType":864},{},[38090],{"type":1455},{"data":38092,"marks":38093,"value":38094,"nodeType":864},{},[],"” scope is abused to authenticate to practically all API functions within Google Cloud, and in turn access the owner’s data.",{"data":38096,"content":38097,"nodeType":1009},{},[38098],{"data":38099,"marks":38100,"value":38101,"nodeType":864},{},[],"Capability: OneDrive / SharePoint /  Google Drive File Access",{"data":38103,"content":38104,"nodeType":860},{},[38105],{"data":38106,"marks":38107,"value":38109,"nodeType":864},{},[38108],{"type":2246},"Types of attacks: Gain access to all files stored within the OneDrive/SharePoint or Google Drive services",{"data":38111,"content":38112,"nodeType":4845},{},[38113,38134,38157,38180],{"data":38114,"content":38115,"nodeType":4581},{},[38116,38125],{"data":38117,"content":38118,"nodeType":4569},{},[38119],{"data":38120,"content":38121,"nodeType":860},{},[38122],{"data":38123,"marks":38124,"value":37759,"nodeType":864},{},[],{"data":38126,"content":38127,"nodeType":4569},{},[38128],{"data":38129,"content":38130,"nodeType":860},{},[38131],{"data":38132,"marks":38133,"value":37769,"nodeType":864},{},[],{"data":38135,"content":38136,"nodeType":4581},{},[38137,38147],{"data":38138,"content":38139,"nodeType":4569},{},[38140],{"data":38141,"content":38142,"nodeType":860},{},[38143],{"data":38144,"marks":38145,"value":38146,"nodeType":864},{},[],"Files.ReadWrite.All / Files.Read.All",{"data":38148,"content":38149,"nodeType":4569},{},[38150],{"data":38151,"content":38152,"nodeType":860},{},[38153],{"data":38154,"marks":38155,"value":38156,"nodeType":864},{},[],"https://www.googleapis.com/auth/drive",{"data":38158,"content":38159,"nodeType":4581},{},[38160,38170],{"data":38161,"content":38162,"nodeType":4569},{},[38163],{"data":38164,"content":38165,"nodeType":860},{},[38166],{"data":38167,"marks":38168,"value":38169,"nodeType":864},{},[],"Sites.ReadWrite.All / Sites.Read.All",{"data":38171,"content":38172,"nodeType":4569},{},[38173],{"data":38174,"content":38175,"nodeType":860},{},[38176],{"data":38177,"marks":38178,"value":38179,"nodeType":864},{},[],"https://www.googleapis.com/auth/drive.readonly",{"data":38181,"content":38182,"nodeType":4581},{},[38183,38192],{"data":38184,"content":38185,"nodeType":4569},{},[38186],{"data":38187,"content":38188,"nodeType":860},{},[38189],{"data":38190,"marks":38191,"value":29978,"nodeType":864},{},[],{"data":38193,"content":38194,"nodeType":4569},{},[38195],{"data":38196,"content":38197,"nodeType":860},{},[38198],{"data":38199,"marks":38200,"value":38201,"nodeType":864},{},[],"https://www.googleapis.com/auth/drive.file",{"data":38203,"content":38204,"nodeType":860},{},[38205],{"data":38206,"marks":38207,"value":38208,"nodeType":864},{},[],"OneDrive, SharePoint, and Google Drive are likely the services where some of the most sensitive content in your organization resides. Scopes that provide access to document stores should thus be treated as having access to critical information (think PII, trade secrets, acquisition deals).",{"data":38210,"content":38211,"nodeType":860},{},[38212],{"data":38213,"marks":38214,"value":38215,"nodeType":864},{},[],"Document theft would be possible with the read-only scopes. However, a malicious actor with ‘write’ permissions would be able to expand into another level of attacks which involves manipulating the content of documents. This could include altering banking details on invoices, or the inclusion of malicious code in macros embedded in the documents, leading to code execution and further compromise.",{"data":38217,"content":38218,"nodeType":1009},{},[38219],{"data":38220,"marks":38221,"value":38222,"nodeType":864},{},[],"Capability: Privilege Escalation, Persistence",{"data":38224,"content":38225,"nodeType":860},{},[38226],{"data":38227,"marks":38228,"value":38230,"nodeType":864},{},[38229],{"type":2246},"Types of attacks: Adding credentials, backdooring applications",{"data":38232,"content":38233,"nodeType":4845},{},[38234,38255],{"data":38235,"content":38236,"nodeType":4581},{},[38237,38246],{"data":38238,"content":38239,"nodeType":4569},{},[38240],{"data":38241,"content":38242,"nodeType":860},{},[38243],{"data":38244,"marks":38245,"value":37759,"nodeType":864},{},[],{"data":38247,"content":38248,"nodeType":4569},{},[38249],{"data":38250,"content":38251,"nodeType":860},{},[38252],{"data":38253,"marks":38254,"value":37769,"nodeType":864},{},[],{"data":38256,"content":38257,"nodeType":4581},{},[38258,38268],{"data":38259,"content":38260,"nodeType":4569},{},[38261],{"data":38262,"content":38263,"nodeType":860},{},[38264],{"data":38265,"marks":38266,"value":38267,"nodeType":864},{},[],"Application.ReadWrite.All",{"data":38269,"content":38270,"nodeType":4569},{},[38271],{"data":38272,"content":38273,"nodeType":860},{},[38274],{"data":38275,"marks":38276,"value":38057,"nodeType":864},{},[],{"data":38278,"content":38279,"nodeType":860},{},[38280],{"data":38281,"marks":38282,"value":38283,"nodeType":864},{},[],"The \"Application.ReadWrite.All\" scope could enable a malicious actor to add credentials to applications already present in your tenant, paving the way for privilege escalation.As an example, if a malicious actor compromises an application with this scope, they could add credentials to any other application in your tenant that has the \"Directory.ReadWrite.All\" scope, thereby gaining access to its data and privileges.",{"data":38285,"content":38286,"nodeType":860},{},[38287],{"data":38288,"marks":38289,"value":38290,"nodeType":864},{},[],"This naturally lends itself to a malicious actor gaining persistence via the addition of credentials to other applications. This would allow them to authenticate as these other applications within your Azure or Google tenants, and allow them to assume those applications’ privileges, too.",{"data":38292,"content":38293,"nodeType":1009},{},[38294],{"data":38295,"marks":38296,"value":38297,"nodeType":864},{},[],"Capability: Teams chat history / OneNote access",{"data":38299,"content":38300,"nodeType":860},{},[38301],{"data":38302,"marks":38303,"value":38305,"nodeType":864},{},[38304],{"type":2246},"Types of attacks: Gain access to users’ teams chat histories or OneNote notes",{"data":38307,"content":38308,"nodeType":4845},{},[38309,38321,38334],{"data":38310,"content":38311,"nodeType":4581},{},[38312],{"data":38313,"content":38314,"nodeType":4569},{},[38315],{"data":38316,"content":38317,"nodeType":860},{},[38318],{"data":38319,"marks":38320,"value":37759,"nodeType":864},{},[],{"data":38322,"content":38323,"nodeType":4581},{},[38324],{"data":38325,"content":38326,"nodeType":4569},{},[38327],{"data":38328,"content":38329,"nodeType":860},{},[38330],{"data":38331,"marks":38332,"value":38333,"nodeType":864},{},[],"Chat.ReadWrite / Chat.ReadWrite.All",{"data":38335,"content":38336,"nodeType":4581},{},[38337],{"data":38338,"content":38339,"nodeType":4569},{},[38340],{"data":38341,"content":38342,"nodeType":860},{},[38343],{"data":38344,"marks":38345,"value":38346,"nodeType":864},{},[],"Notes.ReadWrite.All",{"data":38348,"content":38349,"nodeType":860},{},[38350],{"data":38351,"marks":38352,"value":38353,"nodeType":864},{},[],"If a malicious actor were to gain access to your meeting notes or Teams chat histories, what would they find? Perhaps passwords shared between team members or confidential proprietary information? With the scopes designated with ‘All’, a malicious actor will be able to pull the Teams or notes history of all users within the organization.",{"data":38355,"content":38356,"nodeType":1009},{},[38357],{"data":38358,"marks":38359,"value":38360,"nodeType":864},{},[],"I found an integration we use that includes these dangerous scopes… now what?",{"data":38362,"content":38363,"nodeType":860},{},[38364],{"data":38365,"marks":38366,"value":38367,"nodeType":864},{},[],"While the scopes listed here are definitely some of the most dangerous when granted to third-party integrations, they will usually be paired with legitimate apps offering legitimate functionality. But then how do you determine which integrations need further scrutiny?",{"data":38369,"content":38370,"nodeType":860},{},[38371,38375,38384],{"data":38372,"marks":38373,"value":38374,"nodeType":864},{},[],"The biggest red flag you might come across would be an unrecognized or unapproved integration making use of these scopes, as it may be associated with attacks such as ",{"data":38376,"content":38379,"nodeType":5064},{"target":38377},{"sys":38378},{"id":37363,"type":1001,"linkType":1002},[38380],{"data":38381,"marks":38382,"value":37368,"nodeType":864},{},[38383],{"type":1455},{"data":38385,"marks":38386,"value":12800,"nodeType":864},{},[],{"data":38388,"content":38389,"nodeType":860},{},[38390],{"data":38391,"marks":38392,"value":38393,"nodeType":864},{},[],"Determining their legitimacy should be the number one priority. This would hopefully be done via your security team having performed due diligence and permissions review, and ascertaining whether the app has legitimate use within the business. As with the consent phishing example, a user may have granted a third-party app access to their mailbox or OneDrive files without fully grasping the implications of their actions.",{"data":38395,"content":38396,"nodeType":860},{},[38397],{"data":38398,"marks":38399,"value":38400,"nodeType":864},{},[],"Push provides visibility to the security team whenever a new third-party integration is detected by way of notifications via a designated Slack or Teams channel. This may help your security team stay on top of unsanctioned apps by providing the ability to remove integrations which may provide unnecessary risk to your organization.",{"data":38402,"content":38403,"nodeType":860},{},[38404,38408,38419],{"data":38405,"marks":38406,"value":38407,"nodeType":864},{},[],"\nIf you’re interested in further reading about how attackers can compromise your environment through SaaS apps, ",{"data":38409,"content":38413,"nodeType":5064},{"target":38410},{"sys":38411},{"id":38412,"type":1001,"linkType":1002},"3JXKiUMGU8JBpndhLRYOCJ",[38414],{"data":38415,"marks":38416,"value":38418,"nodeType":864},{},[38417],{"type":1455},"this article",{"data":38420,"marks":38421,"value":38422,"nodeType":864},{},[]," may shed some light on the topic. ",{"data":38424,"content":38427,"nodeType":996},{"target":38425},{"sys":38426},{"id":32740,"type":1001,"linkType":1002},[],{"data":38429,"content":38430,"nodeType":860},{},[38431],{"data":38432,"marks":38433,"value":21,"nodeType":864},{},[],{"entries":38435},{"inline":38436,"hyperlink":38437,"block":38446},[],[38438,38442],{"sys":38439,"__typename":2059,"title":38440,"slug":38441},{"id":37363},"Consent phishing: the emerging phishing technique that can bypass 2FA","consent-phishing-the-emerging-phishing-technique-that-can-bypass-2fa",{"sys":38443,"__typename":2059,"title":38444,"slug":38445},{"id":38412},"How attackers compromise Azure organizations through SaaS apps ","how-attackers-compromise-azure-organizations-through-saas-apps",[38447],{"sys":38448,"__typename":1717,"type":32801,"ctaText":32802,"buttonLabel":32803,"buttonColour":1721,"buttonUrl":59},{"id":32740},{"items":38450},[],{},"Dangerous OAuth scopes in third-party Integrations","guide","2023-09-06T00:00:00.000Z",{"items":38456},[38457,39774],{"__typename":2059,"sys":38458,"content":38459,"title":38444,"synopsis":38476,"hashTags":59,"publishedDate":39763,"slug":38445,"tagsCollection":39764,"authorsCollection":39770},{"id":38412},{"json":38460},{"data":38461,"content":38462,"nodeType":856},{},[38463,38470,38477,38484,38491,38512,38519,38525,38532,38539,38546,38580,38586,38593,38711,38718,38725,38981,38988,38995,39001,39034,39041,39048,39054,39061,39067,39074,39081,39087,39094,39101,39107,39114,39121,39127,39134,39150,39156,39163,39195,39202,39222,39229,39236,39243,39249,39287,39307,39360,39367,39374,39394,39412,39419,39452,39458,39465,39472,39479,39486,39493,39500,39520,39526,39533,39552,39559,39566,39572,39579,39586,39592,39599,39645,39652,39658,39665,39671,39678,39685,39718,39724,39731,39738,39745,39752,39757],{"data":38464,"content":38465,"nodeType":860},{},[38466],{"data":38467,"marks":38468,"value":38469,"nodeType":864},{},[],"With the proliferation of SaaS apps and integrations comes an equal helping of uncertainty surrounding the associated security risks. If you’ve ever found yourself in a position where you’ve had to review a SaaS app integration, whether it’s during the remediation stage of an incident or simply during the process of tending to a user request, then keep on reading. ",{"data":38471,"content":38472,"nodeType":860},{},[38473],{"data":38474,"marks":38475,"value":38476,"nodeType":864},{},[],"This article covers common ways an app could lead to compromise in Microsoft Azure, and what to look out for when determining risk to your organization.",{"data":38478,"content":38479,"nodeType":1009},{},[38480],{"data":38481,"marks":38482,"value":38483,"nodeType":864},{},[],"Consent phishing",{"data":38485,"content":38486,"nodeType":1312},{},[38487],{"data":38488,"marks":38489,"value":38490,"nodeType":864},{},[],"The issue:",{"data":38492,"content":38493,"nodeType":860},{},[38494,38498,38508],{"data":38495,"marks":38496,"value":38497,"nodeType":864},{},[],"This method of compromising user accounts has been covered a ",{"data":38499,"content":38502,"nodeType":5064},{"target":38500},{"sys":38501},{"id":37363,"type":1001,"linkType":1002},[38503],{"data":38504,"marks":38505,"value":38507,"nodeType":864},{},[38506],{"type":1455},"few times",{"data":38509,"marks":38510,"value":38511,"nodeType":864},{},[]," by Push. Without rehashing too much of the content, the main idea behind consent phishing is to get a user to perform an integration while the app masquerades as something official. ",{"data":38513,"content":38514,"nodeType":860},{},[38515],{"data":38516,"marks":38517,"value":38518,"nodeType":864},{},[],"As an example, a user is sent an email where the content is either surprisingly legitimate, or sparks sufficient curiosity to make them want to access the data behind the link. They are directed to a Microsoft or Google login page, where the app asks for certain permissions, such as mailbox access. The user, having performed these actions before, thinks nothing of it and clicks ‘allow’. The attacker successfully tricked the user to give them access to their mailbox (or whichever privileges the app was requesting).",{"data":38520,"content":38524,"nodeType":996},{"target":38521},{"sys":38522},{"id":38523,"type":1001,"linkType":1002},"2zeeE8NrgX4MnpHdIjszot",[],{"data":38526,"content":38527,"nodeType":1312},{},[38528],{"data":38529,"marks":38530,"value":38531,"nodeType":864},{},[],"The solution:",{"data":38533,"content":38534,"nodeType":860},{},[38535],{"data":38536,"marks":38537,"value":38538,"nodeType":864},{},[],"There are two ways to help prevent this type of compromise:",{"data":38540,"content":38541,"nodeType":860},{},[38542],{"data":38543,"marks":38544,"value":38545,"nodeType":864},{},[],"The first is to go the “block everything” route by preventing any integrations from being added to your tenants at all. This is quite heavy-handed and a bit like throwing the baby out with the bathwater, as this approach leads to IT/security departments becoming known as the departments of ‘NO’, potentially resulting in users circumventing controls, and the emergence of shadow IT.",{"data":38547,"content":38548,"nodeType":860},{},[38549,38553,38562,38566,38576],{"data":38550,"marks":38551,"value":38552,"nodeType":864},{},[],"The second is to be sensible about what to allow and what to prevent during SaaS integrations. For instance, in Microsoft 365 administrators are able to ",{"data":38554,"content":38556,"nodeType":883},{"uri":38555},"https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-permission-classifications",[38557],{"data":38558,"marks":38559,"value":38561,"nodeType":864},{},[38560],{"type":1455},"specify low-risk scopes",{"data":38563,"marks":38564,"value":38565,"nodeType":864},{},[],", such as ones specifically used for performing social logins (which are okay to do ",{"data":38567,"content":38570,"nodeType":5064},{"target":38568},{"sys":38569},{"id":37344,"type":1001,"linkType":1002},[38571],{"data":38572,"marks":38573,"value":38575,"nodeType":864},{},[38574],{"type":1455},"by the way",{"data":38577,"marks":38578,"value":38579,"nodeType":864},{},[],"). Admins can then allow employees to perform social logins, and integrate apps making use of other low-risk scopes from  verified apps only. Employees can also request access to anything requiring other scopes. This is a great way to enable users to perform their jobs, while preventing them from accidentally exposing themselves or the wider organization to unnecessary risk.",{"data":38581,"content":38585,"nodeType":996},{"target":38582},{"sys":38583},{"id":38584,"type":1001,"linkType":1002},"44NsMwlLpX4qnZP94GyTSO",[],{"data":38587,"content":38588,"nodeType":860},{},[38589],{"data":38590,"marks":38591,"value":38592,"nodeType":864},{},[],"When configuring the above for the first time, Microsoft provides a list of 5 scopes:",{"data":38594,"content":38595,"nodeType":4845},{},[38596,38619,38642,38665,38688],{"data":38597,"content":38598,"nodeType":4581},{},[38599,38609],{"data":38600,"content":38601,"nodeType":4569},{},[38602],{"data":38603,"content":38604,"nodeType":860},{},[38605],{"data":38606,"marks":38607,"value":38608,"nodeType":864},{},[],"profile",{"data":38610,"content":38611,"nodeType":4569},{},[38612],{"data":38613,"content":38614,"nodeType":860},{},[38615],{"data":38616,"marks":38617,"value":38618,"nodeType":864},{},[],"View user's basic profile",{"data":38620,"content":38621,"nodeType":4581},{},[38622,38632],{"data":38623,"content":38624,"nodeType":4569},{},[38625],{"data":38626,"content":38627,"nodeType":860},{},[38628],{"data":38629,"marks":38630,"value":38631,"nodeType":864},{},[],"openid",{"data":38633,"content":38634,"nodeType":4569},{},[38635],{"data":38636,"content":38637,"nodeType":860},{},[38638],{"data":38639,"marks":38640,"value":38641,"nodeType":864},{},[],"Sign users in",{"data":38643,"content":38644,"nodeType":4581},{},[38645,38655],{"data":38646,"content":38647,"nodeType":4569},{},[38648],{"data":38649,"content":38650,"nodeType":860},{},[38651],{"data":38652,"marks":38653,"value":38654,"nodeType":864},{},[],"email",{"data":38656,"content":38657,"nodeType":4569},{},[38658],{"data":38659,"content":38660,"nodeType":860},{},[38661],{"data":38662,"marks":38663,"value":38664,"nodeType":864},{},[],"View user's email address",{"data":38666,"content":38667,"nodeType":4581},{},[38668,38678],{"data":38669,"content":38670,"nodeType":4569},{},[38671],{"data":38672,"content":38673,"nodeType":860},{},[38674],{"data":38675,"marks":38676,"value":38677,"nodeType":864},{},[],"User.Read",{"data":38679,"content":38680,"nodeType":4569},{},[38681],{"data":38682,"content":38683,"nodeType":860},{},[38684],{"data":38685,"marks":38686,"value":38687,"nodeType":864},{},[],"Sign in and read user profile",{"data":38689,"content":38690,"nodeType":4581},{},[38691,38701],{"data":38692,"content":38693,"nodeType":4569},{},[38694],{"data":38695,"content":38696,"nodeType":860},{},[38697],{"data":38698,"marks":38699,"value":38700,"nodeType":864},{},[],"Offline_access",{"data":38702,"content":38703,"nodeType":4569},{},[38704],{"data":38705,"content":38706,"nodeType":860},{},[38707],{"data":38708,"marks":38709,"value":38710,"nodeType":864},{},[],"Maintain access to data you. have given it access to (refresh tokens)",{"data":38712,"content":38713,"nodeType":860},{},[38714],{"data":38715,"marks":38716,"value":38717,"nodeType":864},{},[],"The above scopes are the minimum required to enable social logins to take place, and would cover a good amount of apps that only require basic information for account creation purposes. ",{"data":38719,"content":38720,"nodeType":860},{},[38721],{"data":38722,"marks":38723,"value":38724,"nodeType":864},{},[],"If you’d like to go a step further, you should also consider approving the following to allow users to integrate these relatively common scopes from verified apps:",{"data":38726,"content":38727,"nodeType":4845},{},[38728,38751,38774,38797,38820,38843,38866,38889,38912,38935,38958],{"data":38729,"content":38730,"nodeType":4581},{},[38731,38741],{"data":38732,"content":38733,"nodeType":4569},{},[38734],{"data":38735,"content":38736,"nodeType":860},{},[38737],{"data":38738,"marks":38739,"value":38740,"nodeType":864},{},[],"Calendars.Read",{"data":38742,"content":38743,"nodeType":4569},{},[38744],{"data":38745,"content":38746,"nodeType":860},{},[38747],{"data":38748,"marks":38749,"value":38750,"nodeType":864},{},[],"Read user calendars",{"data":38752,"content":38753,"nodeType":4581},{},[38754,38764],{"data":38755,"content":38756,"nodeType":4569},{},[38757],{"data":38758,"content":38759,"nodeType":860},{},[38760],{"data":38761,"marks":38762,"value":38763,"nodeType":864},{},[],"Calendars.ReadWrite",{"data":38765,"content":38766,"nodeType":4569},{},[38767],{"data":38768,"content":38769,"nodeType":860},{},[38770],{"data":38771,"marks":38772,"value":38773,"nodeType":864},{},[],"Have full access to user calendars",{"data":38775,"content":38776,"nodeType":4581},{},[38777,38787],{"data":38778,"content":38779,"nodeType":4569},{},[38780],{"data":38781,"content":38782,"nodeType":860},{},[38783],{"data":38784,"marks":38785,"value":38786,"nodeType":864},{},[],"Calendars.ReadWrite.Shared",{"data":38788,"content":38789,"nodeType":4569},{},[38790],{"data":38791,"content":38792,"nodeType":860},{},[38793],{"data":38794,"marks":38795,"value":38796,"nodeType":864},{},[],"Read and write user and shared calendars",{"data":38798,"content":38799,"nodeType":4581},{},[38800,38810],{"data":38801,"content":38802,"nodeType":4569},{},[38803],{"data":38804,"content":38805,"nodeType":860},{},[38806],{"data":38807,"marks":38808,"value":38809,"nodeType":864},{},[],"Contacts.Read",{"data":38811,"content":38812,"nodeType":4569},{},[38813],{"data":38814,"content":38815,"nodeType":860},{},[38816],{"data":38817,"marks":38818,"value":38819,"nodeType":864},{},[],"Read user contacts",{"data":38821,"content":38822,"nodeType":4581},{},[38823,38833],{"data":38824,"content":38825,"nodeType":4569},{},[38826],{"data":38827,"content":38828,"nodeType":860},{},[38829],{"data":38830,"marks":38831,"value":38832,"nodeType":864},{},[],"Contacts.Read.Shared",{"data":38834,"content":38835,"nodeType":4569},{},[38836],{"data":38837,"content":38838,"nodeType":860},{},[38839],{"data":38840,"marks":38841,"value":38842,"nodeType":864},{},[],"Read user and shared contacts",{"data":38844,"content":38845,"nodeType":4581},{},[38846,38856],{"data":38847,"content":38848,"nodeType":4569},{},[38849],{"data":38850,"content":38851,"nodeType":860},{},[38852],{"data":38853,"marks":38854,"value":38855,"nodeType":864},{},[],"Contacts.ReadWrite",{"data":38857,"content":38858,"nodeType":4569},{},[38859],{"data":38860,"content":38861,"nodeType":860},{},[38862],{"data":38863,"marks":38864,"value":38865,"nodeType":864},{},[],"Have full access to user contacts",{"data":38867,"content":38868,"nodeType":4581},{},[38869,38879],{"data":38870,"content":38871,"nodeType":4569},{},[38872],{"data":38873,"content":38874,"nodeType":860},{},[38875],{"data":38876,"marks":38877,"value":38878,"nodeType":864},{},[],"Contacts.ReadWrite.Shared",{"data":38880,"content":38881,"nodeType":4569},{},[38882],{"data":38883,"content":38884,"nodeType":860},{},[38885],{"data":38886,"marks":38887,"value":38888,"nodeType":864},{},[],"Read and write user and shared contacts",{"data":38890,"content":38891,"nodeType":4581},{},[38892,38902],{"data":38893,"content":38894,"nodeType":4569},{},[38895],{"data":38896,"content":38897,"nodeType":860},{},[38898],{"data":38899,"marks":38900,"value":38901,"nodeType":864},{},[],"People.Read",{"data":38903,"content":38904,"nodeType":4569},{},[38905],{"data":38906,"content":38907,"nodeType":860},{},[38908],{"data":38909,"marks":38910,"value":38911,"nodeType":864},{},[],"Read users' relevant people lists",{"data":38913,"content":38914,"nodeType":4581},{},[38915,38925],{"data":38916,"content":38917,"nodeType":4569},{},[38918],{"data":38919,"content":38920,"nodeType":860},{},[38921],{"data":38922,"marks":38923,"value":38924,"nodeType":864},{},[],"Files.Read.Selected",{"data":38926,"content":38927,"nodeType":4569},{},[38928],{"data":38929,"content":38930,"nodeType":860},{},[38931],{"data":38932,"marks":38933,"value":38934,"nodeType":864},{},[],"Read files that the user selects",{"data":38936,"content":38937,"nodeType":4581},{},[38938,38948],{"data":38939,"content":38940,"nodeType":4569},{},[38941],{"data":38942,"content":38943,"nodeType":860},{},[38944],{"data":38945,"marks":38946,"value":38947,"nodeType":864},{},[],"Files.ReadWrite.Selected",{"data":38949,"content":38950,"nodeType":4569},{},[38951],{"data":38952,"content":38953,"nodeType":860},{},[38954],{"data":38955,"marks":38956,"value":38957,"nodeType":864},{},[],"Read and write files that the user selects",{"data":38959,"content":38960,"nodeType":4581},{},[38961,38971],{"data":38962,"content":38963,"nodeType":4569},{},[38964],{"data":38965,"content":38966,"nodeType":860},{},[38967],{"data":38968,"marks":38969,"value":38970,"nodeType":864},{},[],"User.ReadWrite",{"data":38972,"content":38973,"nodeType":4569},{},[38974],{"data":38975,"content":38976,"nodeType":860},{},[38977],{"data":38978,"marks":38979,"value":38980,"nodeType":864},{},[],"Read and write access to user profile",{"data":38982,"content":38983,"nodeType":860},{},[38984],{"data":38985,"marks":38986,"value":38987,"nodeType":864},{},[],"We’ve determined these scopes to be relatively low-risk, but this would depend on the risk appetite of your organization. Pre-approving the scopes will go a long way towards enabling your users to make use of SaaS apps without raising unnecessary approval requests from your IT or security team.",{"data":38989,"content":38990,"nodeType":1009},{},[38991],{"data":38992,"marks":38993,"value":38994,"nodeType":864},{},[],"Unverified apps",{"data":38996,"content":38997,"nodeType":1312},{},[38998],{"data":38999,"marks":39000,"value":38490,"nodeType":864},{},[],{"data":39002,"content":39003,"nodeType":860},{},[39004,39008,39017,39021,39030],{"data":39005,"marks":39006,"value":39007,"nodeType":864},{},[],"First, let’s define what causes an app to be classified as unverified. When you see an app in your tenant that’s marked as unverified, it means that the tenant that publishes the app has not gone through the ",{"data":39009,"content":39011,"nodeType":883},{"uri":39010},"https://learn.microsoft.com/en-gb/azure/active-directory/develop/publisher-verification-overview",[39012],{"data":39013,"marks":39014,"value":39016,"nodeType":864},{},[39015],{"type":1455},"Publisher Verification",{"data":39018,"marks":39019,"value":39020,"nodeType":864},{},[]," process. Going through the verification process requires the publisher to have a Microsoft Partner Network (MPN) account, which typically involves ",{"data":39022,"content":39024,"nodeType":883},{"uri":39023},"https://learn.microsoft.com/en-us/partner-center/verification-responses",[39025],{"data":39026,"marks":39027,"value":39029,"nodeType":864},{},[39028],{"type":1455},"verifying",{"data":39031,"marks":39032,"value":39033,"nodeType":864},{},[]," their business address, email address, and a few additional due diligence tasks. ",{"data":39035,"content":39036,"nodeType":860},{},[39037],{"data":39038,"marks":39039,"value":39040,"nodeType":864},{},[],"While I’m sure this is not a 100% infallible process, at the very least it provides you with the confidence that someone at Microsoft had reached out to the company and spoken to someone who claims they are who they say they are. This is opposed to a random person creating a Microsoft Azure tenant and marking their app as being published by Adobe, as an example.",{"data":39042,"content":39043,"nodeType":860},{},[39044],{"data":39045,"marks":39046,"value":39047,"nodeType":864},{},[],"At Push, we’ve noticed plenty of unverified apps published by legitimate vendors. This could be related to vendors having multiple tenants, and not having completed the verification process across all yet. As an example, we have a few of Adobe’s apps for Microsoft 365:",{"data":39049,"content":39053,"nodeType":996},{"target":39050},{"sys":39051},{"id":39052,"type":1001,"linkType":1002},"4eDWZKrMau1AfU4pXgOW42",[],{"data":39055,"content":39056,"nodeType":860},{},[39057],{"data":39058,"marks":39059,"value":39060,"nodeType":864},{},[],"In the above image, we have a verified app from Adobe, Inc. We know this due to the ‘Verified Publisher’ attribute that is included when parsing the information provided by Microsoft. We can also see that the only reply url is one associated directly with Adobe – adobe.com. Next, we have an unverified app:",{"data":39062,"content":39066,"nodeType":996},{"target":39063},{"sys":39064},{"id":39065,"type":1001,"linkType":1002},"5e5RhdYiMh0Q3CZzmNoRDI",[],{"data":39068,"content":39069,"nodeType":860},{},[39070],{"data":39071,"marks":39072,"value":39073,"nodeType":864},{},[],"This app does not include the ‘verified publisher’ attribute when reading the information provided by Microsoft. However, the app only has one reply url, and this is again a subdomain of adobe.com.",{"data":39075,"content":39076,"nodeType":860},{},[39077],{"data":39078,"marks":39079,"value":39080,"nodeType":864},{},[],"The takeaway here is that not all unverified apps are malicious. More often than not it’s related to the vendor not having gone through the verification process, but this means it unfortunately becomes the security team’s burden to figure out.",{"data":39082,"content":39083,"nodeType":1312},{},[39084],{"data":39085,"marks":39086,"value":38531,"nodeType":864},{},[],{"data":39088,"content":39089,"nodeType":860},{},[39090],{"data":39091,"marks":39092,"value":39093,"nodeType":864},{},[],"At Push, we attempt to review every application we come across to determine if it's legit and whether it belongs to the vendor it claims to originate from. There are multiple ways to do this, but as a general rule of thumb if all the app’s reply urls are associated with the vendor, you are good. You can perform an integration from the app’s website to verify that the particular app ID (seen in the metadata tag above) is the one you are looking at in your environment.",{"data":39095,"content":39096,"nodeType":1009},{},[39097],{"data":39098,"marks":39099,"value":39100,"nodeType":864},{},[],"Apps with excessive privileges",{"data":39102,"content":39103,"nodeType":1312},{},[39104],{"data":39105,"marks":39106,"value":38490,"nodeType":864},{},[],{"data":39108,"content":39109,"nodeType":860},{},[39110],{"data":39111,"marks":39112,"value":39113,"nodeType":864},{},[],"When you first start doing deep dives on permissions associated with apps in your environment, you find yourself looking at some apps and wonder out loud “we’re granting this vendor access to what?!",{"data":39115,"content":39116,"nodeType":860},{},[39117],{"data":39118,"marks":39119,"value":39120,"nodeType":864},{},[],"It’s a totally normal response, but don't worry, we’re here to help. Let’s take diagrams.net as an example:",{"data":39122,"content":39126,"nodeType":996},{"target":39123},{"sys":39124},{"id":39125,"type":1001,"linkType":1002},"7DcPUSZ0nDYKmIy4E9xEHs",[],{"data":39128,"content":39129,"nodeType":860},{},[39130],{"data":39131,"marks":39132,"value":39133,"nodeType":864},{},[],"At first glance this doesn’t seem too bad. For the purposes of this example, let’s say the app was approved by 49 users. That means if diagrams.net got compromised, an attacker would potentially have access to 49 of your user’s OneDrive files. “That’s OK!” you say. “This will only affect a handful of files they’ve been working on locally. Our policy specifies that any company data, specifically data containing PII, be stored in SharePoint.”",{"data":39135,"content":39136,"nodeType":860},{},[39137,39141,39146],{"data":39138,"marks":39139,"value":39140,"nodeType":864},{},[],"And then comes the part where you notice the following permission: ",{"data":39142,"marks":39143,"value":39145,"nodeType":864},{},[39144],{"type":2246},"Sites.Read.All",{"data":39147,"marks":39148,"value":39149,"nodeType":864},{},[],". This permission gives the application the ability to read every file across all SharePoint sites in your organization (that the users have permission to access.) Suddenly the scope of data access is much larger than you hoped.",{"data":39151,"content":39152,"nodeType":1312},{},[39153],{"data":39154,"marks":39155,"value":38531,"nodeType":864},{},[],{"data":39157,"content":39158,"nodeType":860},{},[39159],{"data":39160,"marks":39161,"value":39162,"nodeType":864},{},[],"When faced with the dilemma of granting apps access to resources within your organization, the best course of action is to do a risk assessment.",{"data":39164,"content":39165,"nodeType":860},{},[39166,39170,39178,39182,39191],{"data":39167,"marks":39168,"value":39169,"nodeType":864},{},[],"This requires some good ol’ googling and reviewing the security policies of the app’s creator. You ideally also want to know who they use to process your data. Through this process, I found a ",{"data":39171,"content":39173,"nodeType":883},{"uri":39172},"https://www.diagrams.net/blog/data-protection",[39174],{"data":39175,"marks":39176,"value":38079,"nodeType":864},{},[39177],{"type":1455},{"data":39179,"marks":39180,"value":39181,"nodeType":864},{},[]," on diagrams.net detailing their approach to security and user privacy. They do make note that they don’t ",{"data":39183,"content":39185,"nodeType":883},{"uri":39184},"https://www.diagrams.net/blog/data-protection#:~:text=Because%20your%20sensitive%20diagram%20data%20doesn%E2%80%99t%20leave%20your%20infrastructure%20and%20is%20never%20stored%20on%20the%20diagrams.net%20servers%2C%20diagrams.net%20is%20a%20tool%20which%20lets%20you%20comply%20with%20data%20protection%20certifications%20(ISO%2027000%2C%2027001%20and%2027002)%20and%20the%20GDPR.",[39186],{"data":39187,"marks":39188,"value":39190,"nodeType":864},{},[39189],{"type":1455},"store any sensitive customer data data on their servers",{"data":39192,"marks":39193,"value":39194,"nodeType":864},{},[],", and thus let you comply with GDPR, ISO 2700* etc. certifications if you use their services.",{"data":39196,"content":39197,"nodeType":860},{},[39198],{"data":39199,"marks":39200,"value":39201,"nodeType":864},{},[],"While this is great from a tick box exercise perspective, this doesn’t address the original concern – how much risk are you taking on by letting their app integrate with your environment? What could an attacker who compromises diagrams.net have access to and how do you lessen the risk while still allowing employees to use the app?",{"data":39203,"content":39204,"nodeType":860},{},[39205,39209,39218],{"data":39206,"marks":39207,"value":39208,"nodeType":864},{},[],"Further in the same blog post, they link to a GitHub ",{"data":39210,"content":39212,"nodeType":883},{"uri":39211},"https://github.com/jgraph/security-privacy-legal",[39213],{"data":39214,"marks":39215,"value":39217,"nodeType":864},{},[39216],{"type":1455},"repository",{"data":39219,"marks":39220,"value":39221,"nodeType":864},{},[]," that contains their security and privacy processes, policies, and even some pentest reports. They do a great job of including this information, by the way, so cheers to diagrams.net!",{"data":39223,"content":39224,"nodeType":860},{},[39225],{"data":39226,"marks":39227,"value":39228,"nodeType":864},{},[],"At this point you should have a better understanding of the security of the vendor you’re integrating into your organization, and whether it’s okay to accept the risk. Documenting and adding the information you found to your risk register is also a good idea. Likely, you’ll be taking this information to your Information Security Manager for risk acceptance. ",{"data":39230,"content":39231,"nodeType":860},{},[39232],{"data":39233,"marks":39234,"value":39235,"nodeType":864},{},[],"We’re working on ways to provide this information to our clients through the Push app dashboard in future, too. Sign up or subscribe to our blog to get product updates when features like this are introduced. ",{"data":39237,"content":39238,"nodeType":1009},{},[39239],{"data":39240,"marks":39241,"value":39242,"nodeType":864},{},[],"Hijackable urls and implicit grant flow",{"data":39244,"content":39245,"nodeType":1312},{},[39246],{"data":39247,"marks":39248,"value":38490,"nodeType":864},{},[],{"data":39250,"content":39251,"nodeType":860},{},[39252,39257,39267,39272,39282],{"data":39253,"marks":39254,"value":39256,"nodeType":864},{},[39255],{"type":2246},"Developer side note: The implicit grant flow is no longer recommended due to security-related concerns and that it won’t function where ",{"data":39258,"content":39260,"nodeType":883},{"uri":39259},"https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-third-party-cookies-spas#:~:text=Many%20browsers%20block%20third%2Dparty%20cookies%2C%20cookies%20on%20requests%20to%20domains%20other%20than%20the%20domain%20shown%20in%20the%20browser%27s%20address%20bar.%20This%20block%20breaks%20the%20implicit%20flow%20and%20requires%20new%20authentication%20patterns%20to%20successfully%20sign%20in%20users.",[39261],{"data":39262,"marks":39263,"value":39266,"nodeType":864},{},[39264,39265],{"type":1455},{"type":2246},"3rd party cookies are blocked in browsers",{"data":39268,"marks":39269,"value":39271,"nodeType":864},{},[39270],{"type":2246},". Instead, you should switch to using the ",{"data":39273,"content":39275,"nodeType":883},{"uri":39274},"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow",[39276],{"data":39277,"marks":39278,"value":39281,"nodeType":864},{},[39279,39280],{"type":1455},{"type":2246},"authorization code flow",{"data":39283,"marks":39284,"value":39286,"nodeType":864},{},[39285],{"type":2246}," if applicable to your requirements.",{"data":39288,"content":39289,"nodeType":860},{},[39290,39294,39303],{"data":39291,"marks":39292,"value":39293,"nodeType":864},{},[],"Let’s quickly go over how OAuth2’s implicit grant flow works so you can better understand how to spot potentially risky apps and integrations, and why this can result in a security concern. Microsoft provides a great ",{"data":39295,"content":39297,"nodeType":883},{"uri":39296},"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow",[39298],{"data":39299,"marks":39300,"value":39302,"nodeType":864},{},[39301],{"type":1455},"breakdown",{"data":39304,"marks":39305,"value":39306,"nodeType":864},{},[]," of the implicit grant flow, however for the purposes of brevity (and simplicity), it does the following:",{"data":39308,"content":39309,"nodeType":35103},{},[39310,39320,39330,39340,39350],{"data":39311,"content":39312,"nodeType":945},{},[39313],{"data":39314,"content":39315,"nodeType":860},{},[39316],{"data":39317,"marks":39318,"value":39319,"nodeType":864},{},[],"A user goes to a web app and clicks a login link",{"data":39321,"content":39322,"nodeType":945},{},[39323],{"data":39324,"content":39325,"nodeType":860},{},[39326],{"data":39327,"marks":39328,"value":39329,"nodeType":864},{},[],"The web app redirects the user to authenticate and authorize the app. This is performed against your identity provider (in this example, Microsoft)",{"data":39331,"content":39332,"nodeType":945},{},[39333],{"data":39334,"content":39335,"nodeType":860},{},[39336],{"data":39337,"marks":39338,"value":39339,"nodeType":864},{},[],"If this is the first time authorizing the app, the user is presented with a list of scopes (permissions) the app will need access to, and the user clicks “approve”",{"data":39341,"content":39342,"nodeType":945},{},[39343],{"data":39344,"content":39345,"nodeType":860},{},[39346],{"data":39347,"marks":39348,"value":39349,"nodeType":864},{},[],"This responds with a token to one of the hard-coded reply urls associated with the app integration (e.g. https://apps.diagrams.net/microsoft as with the ‘Apps with excessive privileges’ example)",{"data":39351,"content":39352,"nodeType":945},{},[39353],{"data":39354,"content":39355,"nodeType":860},{},[39356],{"data":39357,"marks":39358,"value":39359,"nodeType":864},{},[],"The app uses the token to access the user’s resources with the permissions approved in step 3",{"data":39361,"content":39362,"nodeType":860},{},[39363],{"data":39364,"marks":39365,"value":39366,"nodeType":864},{},[],"Based on the flow above, if an attacker gets their hands on the token from step 4, they can perform requests as the user, granting them access to your resources. To get the token, you need to control one of the hardcoded reply url endpoints, and convince a user to authenticate to the app – perhaps via a phishing attack.",{"data":39368,"content":39369,"nodeType":860},{},[39370],{"data":39371,"marks":39372,"value":39373,"nodeType":864},{},[],"As an example, some of the apps we’ve reviewed contained reply urls which were subdomains of azurewebsites.net and ngrok.io. These urls don’t appear problematic at first. However, the urls could have been used during the development process, and were forgotten about at the conclusion of the project. During the review process we follow at Push, we found multiple examples of such urls that were no longer in use.",{"data":39375,"content":39376,"nodeType":860},{},[39377,39381,39390],{"data":39378,"marks":39379,"value":39380,"nodeType":864},{},[],"This could allow an attacker to register the urls and perform phishing attacks against organizations that use these particular apps, granting the attacker access to previously- approved scopes and resources. The outcome of this attack would be similar to ",{"data":39382,"content":39384,"nodeType":883},{"uri":39383},"https://www.oauth.com/oauth2-servers/authorization/security-considerations/#:~:text=Redirect%20URL%20Manipulation",[39385],{"data":39386,"marks":39387,"value":39389,"nodeType":864},{},[39388],{"type":1455},"redirect URL manipulation",{"data":39391,"marks":39392,"value":39393,"nodeType":864},{},[],", but instead of taking advantage of an open or misconfigured redirect, the attacker is in control of the endpoint where the token ends up.",{"data":39395,"content":39396,"nodeType":860},{},[39397,39401,39408],{"data":39398,"marks":39399,"value":39400,"nodeType":864},{},[],"How would you even go about detecting if an app makes use of the implicit grant flow? This requires getting your hands dirty with making authorization requests to your tenant for the specific app ID, and passing the “response_type=token” parameter in the url. This should return an error if the app is not configured with the implicit grant flow. If you’d like to test this yourself, you can follow the “Run in Postman” link at the top of ",{"data":39402,"content":39403,"nodeType":883},{"uri":39296},[39404],{"data":39405,"marks":39406,"value":38418,"nodeType":864},{},[39407],{"type":1455},{"data":39409,"marks":39410,"value":39411,"nodeType":864},{},[]," to make this process a bit easier.",{"data":39413,"content":39414,"nodeType":860},{},[39415],{"data":39416,"marks":39417,"value":39418,"nodeType":864},{},[],"Another example of a hijackable url includes dangling DNS records. Let’s say your app includes a reply url pointing to a legacy server used for development (eg. apptesting-dev.ctrlaltsecure.com). This server was hosted on an EC2 instance in AWS, and has long since been decommissioned. However, the IP address associated with the instance is still pointing to the same address. A determined attacker could potentially gain access to the IP address by spinning up resources until it’s assigned to them.",{"data":39420,"content":39421,"nodeType":860},{},[39422,39426,39435,39439,39448],{"data":39423,"marks":39424,"value":39425,"nodeType":864},{},[],"OWASP has ",{"data":39427,"content":39429,"nodeType":883},{"uri":39428},"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover",[39430],{"data":39431,"marks":39432,"value":39434,"nodeType":864},{},[39433],{"type":1455},"published an article",{"data":39436,"marks":39437,"value":39438,"nodeType":864},{},[]," and HackerOne ",{"data":39440,"content":39442,"nodeType":883},{"uri":39441},"https://www.hackerone.com/application-security/guide-subdomain-takeovers",[39443],{"data":39444,"marks":39445,"value":39447,"nodeType":864},{},[39446],{"type":1455},"posted a guide",{"data":39449,"marks":39450,"value":39451,"nodeType":864},{},[]," highlighting ways to take over subdomains , and it’s very easy to overlook.",{"data":39453,"content":39454,"nodeType":1312},{},[39455],{"data":39456,"marks":39457,"value":38531,"nodeType":864},{},[],{"data":39459,"content":39460,"nodeType":860},{},[39461],{"data":39462,"marks":39463,"value":39464,"nodeType":864},{},[],"Unfortunately there is no elegant solution to this problem, and it’s not easy to spot as you would need to review each url to see if it’s still in use, in addition to figuring out if the app makes use of the implicit grant flow. Even then, is the active url being used by the developer, or has an attacker already claimed it.",{"data":39466,"content":39467,"nodeType":860},{},[39468],{"data":39469,"marks":39470,"value":39471,"nodeType":864},{},[],"The best course of action here is likely to make use of a proxy that prevents users from accessing unclassified urls, or urls with a low reputation. However, you will risk breaking applications and making your developers angry. This also does not solve the dangling DNS issue, as with the EC2 instance problem above.",{"data":39473,"content":39474,"nodeType":860},{},[39475],{"data":39476,"marks":39477,"value":39478,"nodeType":864},{},[],"Another option is to contact vendors of apps that you’ve noticed including such urls in their apps and ask them to remove the stale entries from their apps.",{"data":39480,"content":39481,"nodeType":1009},{},[39482],{"data":39483,"marks":39484,"value":39485,"nodeType":864},{},[],"You think you’ve been compromised. Now what?",{"data":39487,"content":39488,"nodeType":860},{},[39489],{"data":39490,"marks":39491,"value":39492,"nodeType":864},{},[],"\nRegardless of the method of compromise, there’s a few steps you can take to review what happened and to prevent further access into your environment.",{"data":39494,"content":39495,"nodeType":1312},{},[39496],{"data":39497,"marks":39498,"value":39499,"nodeType":864},{},[],"Review app sign-in logs",{"data":39501,"content":39502,"nodeType":860},{},[39503,39507,39516],{"data":39504,"marks":39505,"value":39506,"nodeType":864},{},[],"In Azure Active Directory, head to ",{"data":39508,"content":39510,"nodeType":883},{"uri":39509},"https://portal.azure.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null",[39511],{"data":39512,"marks":39513,"value":39515,"nodeType":864},{},[39514],{"type":1455},"Enterprise applications",{"data":39517,"marks":39518,"value":39519,"nodeType":864},{},[]," and click on the app you want to review. In the new window, click on sign-in logs. You will be presented with a list of user sign-ins (interactive and non-interactive), service principal sign-ins, and managed identity sign-ins.",{"data":39521,"content":39525,"nodeType":996},{"target":39522},{"sys":39523},{"id":39524,"type":1001,"linkType":1002},"2L7vf2zjZBelGMJSjP2inY",[],{"data":39527,"content":39528,"nodeType":860},{},[39529],{"data":39530,"marks":39531,"value":39532,"nodeType":864},{},[],"What you typically need to look for is non-interactive user sign-in logs. Non-interactive sign-ins are related to login events performed on behalf of a user where usernames and passwords were not used (read: tokens). You want to review the sign-ins to determine if there were authentication events from IP addresses unrelated to normal employee activity, which can include discrepancies in geographical locations, and out-of-hours activity. Service principal sign-ins would also be of interest, however it would be more difficult to determine odd behavior as you wouldn’t have user sign-ins to compare with.",{"data":39534,"content":39535,"nodeType":860},{},[39536,39540,39548],{"data":39537,"marks":39538,"value":39539,"nodeType":864},{},[],"You could also review Azure’s ",{"data":39541,"content":39543,"nodeType":883},{"uri":39542},"https://portal.azure.com/#view/Microsoft_AAD_IAM/SecurityMenuBlade/~/RiskySignIns",[39544],{"data":39545,"marks":39546,"value":39547,"nodeType":864},{},[],"risky sign-ins ",{"data":39549,"marks":39550,"value":39551,"nodeType":864},{},[],"page, as these issues are likely to show up already classified. Just make sure your filters include non-interactive sign-in methods.",{"data":39553,"content":39554,"nodeType":1312},{},[39555],{"data":39556,"marks":39557,"value":39558,"nodeType":864},{},[],"Review app audit logs",{"data":39560,"content":39561,"nodeType":860},{},[39562],{"data":39563,"marks":39564,"value":39565,"nodeType":864},{},[],"In the same window underneath sign-in logs, you’ll find the audit logs section. Audit logs will provide you with crucial information relating to when an app was integrated, by who, and which permissions were delegated.",{"data":39567,"content":39571,"nodeType":996},{"target":39568},{"sys":39569},{"id":39570,"type":1001,"linkType":1002},"5HRLoa9zlIWZdZGLN84Yae",[],{"data":39573,"content":39574,"nodeType":1312},{},[39575],{"data":39576,"marks":39577,"value":39578,"nodeType":864},{},[],"Disable the app",{"data":39580,"content":39581,"nodeType":860},{},[39582],{"data":39583,"marks":39584,"value":39585,"nodeType":864},{},[],"If you’ve determined that an app was involved in an incident, the first step would be to disable the app to prevent malicious actors from performing any further authentication. Under the application’s properties, change the setting “Enable for users to sign-in?” from “Yes” to “No”, followed by clicking “Save.”",{"data":39587,"content":39591,"nodeType":996},{"target":39588},{"sys":39589},{"id":39590,"type":1001,"linkType":1002},"12NnJ8OhD3K27rFRJ48t6a",[],{"data":39593,"content":39594,"nodeType":1312},{},[39595],{"data":39596,"marks":39597,"value":39598,"nodeType":864},{},[],"Revoke all refresh tokens",{"data":39600,"content":39601,"nodeType":860},{},[39602,39606,39615,39619,39628,39632,39641],{"data":39603,"marks":39604,"value":39605,"nodeType":864},{},[],"Disabling the app is not enough to prevent attackers from maintaining access to your environment. ",{"data":39607,"content":39609,"nodeType":883},{"uri":39608},"https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens",[39610],{"data":39611,"marks":39612,"value":39614,"nodeType":864},{},[39613],{"type":1455},"Refresh tokens",{"data":39616,"marks":39617,"value":39618,"nodeType":864},{},[]," provide a way for apps to retrieve new access tokens without bugging users with pesky sign-in screens. Tokens are typically valid for between ",{"data":39620,"content":39622,"nodeType":883},{"uri":39621},"https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#access-token-lifetime:~:text=The%20default%20lifetime%20of%20an%20access%20token%20is%20variable.%20When%20issued%2C%20the%20default%20lifetime%20of%20an%20access%20token%20is%20assigned%20a%20random%20value%20ranging%20between%2060%2D90%20minutes%20(75%20minutes%20on%20average).",[39623],{"data":39624,"marks":39625,"value":39627,"nodeType":864},{},[39626],{"type":1455},"60 to 90 minutes",{"data":39629,"marks":39630,"value":39631,"nodeType":864},{},[],", and if a refresh token has been issued, the token holder can request new tokens for ",{"data":39633,"content":39635,"nodeType":883},{"uri":39634},"https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens#:~:text=The%20default%20lifetime%20for%20the%20refresh%20tokens%20is%2024%20hours%20for%20single%20page%20apps%20and%2090%20days%20for%20all%20other%20scenarios",[39636],{"data":39637,"marks":39638,"value":39640,"nodeType":864},{},[39639],{"type":1455},"up to 90 days",{"data":39642,"marks":39643,"value":39644,"nodeType":864},{},[],"! ",{"data":39646,"content":39647,"nodeType":860},{},[39648],{"data":39649,"marks":39650,"value":39651,"nodeType":864},{},[],"So, revoking refresh tokens is an important step as part of the mitigation and recovery steps. This step can be performed with some PowerShell – luckily Microsoft provides pre-generated scripts for you to copy and paste. Click on ‘Permissions’ for the app, followed by ‘Review permissions.’ ",{"data":39653,"content":39657,"nodeType":996},{"target":39654},{"sys":39655},{"id":39656,"type":1001,"linkType":1002},"7vuFmlmZbzfNhWHPj8ToHm",[],{"data":39659,"content":39660,"nodeType":860},{},[39661],{"data":39662,"marks":39663,"value":39664,"nodeType":864},{},[],"In the new window, click on ‘This application is malicious and I’m compromised.’ This will present you with the necessary PowerShell scripts to remove users from the app, revoke all permissions granted to the app, and finally to revoke refresh tokens associated with the app.",{"data":39666,"content":39670,"nodeType":996},{"target":39667},{"sys":39668},{"id":39669,"type":1001,"linkType":1002},"4NnD6WKRHlnzKE0F4GUDEm",[],{"data":39672,"content":39673,"nodeType":1312},{},[39674],{"data":39675,"marks":39676,"value":39677,"nodeType":864},{},[],"What to do if the initial access token was stolen",{"data":39679,"content":39680,"nodeType":860},{},[39681],{"data":39682,"marks":39683,"value":39684,"nodeType":864},{},[],"The initial access token cannot be revoked. In practice, if an attacker has managed to steal an access token it will be valid for the remainder of its lifespan, which is typically one hour. This is true even if the account is disabled, the compromised app deleted, and all refresh tokens revoked. If you’re responding to an incident, you will need to keep an eye on audit logs for an hour or more after performing the above steps to make sure the valid access token wasn’t still being used to perform actions in the environment.",{"data":39686,"content":39687,"nodeType":860},{},[39688,39692,39701,39705,39714],{"data":39689,"marks":39690,"value":39691,"nodeType":864},{},[],"Microsoft’s response to this was to develop something called ",{"data":39693,"content":39695,"nodeType":883},{"uri":39694},"https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation",[39696],{"data":39697,"marks":39698,"value":39700,"nodeType":864},{},[39699],{"type":1455},"continuous access evaluation",{"data":39702,"marks":39703,"value":39704,"nodeType":864},{},[],". However, they admit in the article that it does not address a scenario where an attacker exfiltrated the token outside of a ",{"data":39706,"content":39708,"nodeType":883},{"uri":39707},"https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation#:~:text=Token%20export%20to%20a%20machine%20outside%20of%20a%20trusted%20network%20can%20be%20prevented%20with%20Conditional%20Access%20location%20policies",[39709],{"data":39710,"marks":39711,"value":39713,"nodeType":864},{},[39712],{"type":1455},"trusted network",{"data":39715,"marks":39716,"value":39717,"nodeType":864},{},[],", in which case conditional access policy enforcement would be required to address the issue. Continuous access evaluation is ideal for handling specific cases of user access into the environment such as employee contract termination, or scenarios where conditional access policies are violated.",{"data":39719,"content":39720,"nodeType":1009},{},[39721],{"data":39722,"marks":39723,"value":35763,"nodeType":864},{},[],{"data":39725,"content":39726,"nodeType":860},{},[39727],{"data":39728,"marks":39729,"value":39730,"nodeType":864},{},[],"This article should have given you a better understanding of the most common issues presented when reviewing SaaS apps integrated into your environment. ",{"data":39732,"content":39733,"nodeType":860},{},[39734],{"data":39735,"marks":39736,"value":39737,"nodeType":864},{},[],"Determining whether using an app would result in compromise is not a simple task, especially if you haven’t observed malicious behavior. As such, the best course of action is to consider all angles, which include the business case of users requiring its use, the permission scopes, and whether the vendor’s security practices are in line with your requirements.",{"data":39739,"content":39740,"nodeType":860},{},[39741],{"data":39742,"marks":39743,"value":39744,"nodeType":864},{},[],"SaaS is a new(ish) frontier that can be really daunting to defend against attackers, but it's not impossible to reduce risk without simply blocking access to SaaS. And, remember: denying users access to tools will make them find ways around the limitations.",{"data":39746,"content":39747,"nodeType":860},{},[39748],{"data":39749,"marks":39750,"value":39751,"nodeType":864},{},[],"We hope this article helps you get a better handle on how to determine if you’ve been compromised, and respond to incidents involving SaaS apps and/or OAuth integrations to your core work platforms.",{"data":39753,"content":39756,"nodeType":996},{"target":39754},{"sys":39755},{"id":37179,"type":1001,"linkType":1002},[],{"data":39758,"content":39759,"nodeType":860},{},[39760],{"data":39761,"marks":39762,"value":21,"nodeType":864},{},[],"2023-01-03T00:00:00.000Z",{"items":39765},[39766,39768],{"sys":39767,"name":15033},{"id":15032},{"sys":39769,"name":342},{"id":15029},{"items":39771},[39772],{"fullName":37706,"firstName":37707,"jobTitle":37708,"profilePicture":39773},{"url":37710},{"__typename":2059,"sys":39775,"content":39777,"title":40238,"synopsis":40239,"hashTags":59,"publishedDate":40240,"slug":40241,"tagsCollection":40242,"authorsCollection":40248},{"id":39776},"3cvobsSnd6xjB6tHhWt4bX",{"json":39778},{"data":39779,"content":39780,"nodeType":856},{},[39781,39788,39796,39803,39836,39843,39851,39884,39904,39911,39917,39923,39931,39938,39944,39950,39957,39964,39971,39990,39996,40003,40023,40030,40036,40044,40051,40058,40077,40084,40091,40098,40104,40111,40117,40124,40130,40137,40158,40166,40173,40180,40187,40193,40211,40218,40224,40231],{"data":39782,"content":39783,"nodeType":860},{},[39784],{"data":39785,"marks":39786,"value":39787,"nodeType":864},{},[],"An employee has added a new app-to-app (aka OAuth) integration to your Azure tenant or Google Workspace but you’re unsure of what it is or what risk it poses to your organization. We’ll cover a few techniques to help you assess the risk in this article.",{"data":39789,"content":39790,"nodeType":1312},{},[39791],{"data":39792,"marks":39793,"value":39795,"nodeType":864},{},[39794],{"type":899},"Introduction",{"data":39797,"content":39798,"nodeType":860},{},[39799],{"data":39800,"marks":39801,"value":39802,"nodeType":864},{},[]," There are a few key questions to keep in mind when evaluating an OAuth integration:",{"data":39804,"content":39805,"nodeType":941},{},[39806,39816,39826],{"data":39807,"content":39808,"nodeType":945},{},[39809],{"data":39810,"content":39811,"nodeType":860},{},[39812],{"data":39813,"marks":39814,"value":39815,"nodeType":864},{},[],"Is the source (usually the app vendor) trustworthy?",{"data":39817,"content":39818,"nodeType":945},{},[39819],{"data":39820,"content":39821,"nodeType":860},{},[39822],{"data":39823,"marks":39824,"value":39825,"nodeType":864},{},[],"What can it do if it is not trustworthy? Does it have access to your data? How much access? Does it request more permissions that it should need to function?",{"data":39827,"content":39828,"nodeType":945},{},[39829],{"data":39830,"content":39831,"nodeType":860},{},[39832],{"data":39833,"marks":39834,"value":39835,"nodeType":864},{},[],"What does it actually do (i.e. what do the logs indicate)? Which teams or individuals will be using it and for what purposes?",{"data":39837,"content":39838,"nodeType":860},{},[39839],{"data":39840,"marks":39841,"value":39842,"nodeType":864},{},[],"There are a variety of data sources that can be considered for each of these primary questions, which we’ll break down in this next section:. ",{"data":39844,"content":39845,"nodeType":1312},{},[39846],{"data":39847,"marks":39848,"value":39850,"nodeType":864},{},[39849],{"type":899},"Name and Verification Status",{"data":39852,"content":39853,"nodeType":860},{},[39854,39858,39867,39871,39880],{"data":39855,"marks":39856,"value":39857,"nodeType":864},{},[],"Every OAuth integration has a name and both Microsoft and Google verification processes that allow OAuth integrations to be verified as belonging to a particular company. Microsoft has a ",{"data":39859,"content":39861,"nodeType":883},{"uri":39860},"https://learn.microsoft.com/en-us/azure/active-directory/develop/publisher-verification-overview",[39862],{"data":39863,"marks":39864,"value":39866,"nodeType":864},{},[39865],{"type":1455},"publisher verification process ",{"data":39868,"marks":39869,"value":39870,"nodeType":864},{},[],"that’s dependent on its Microsoft Cloud Partner Program, whereas Google has a ",{"data":39872,"content":39874,"nodeType":883},{"uri":39873},"https://support.google.com/cloud/answer/9110914?hl=en#zippy=%2Csteps-to-prepare-for-verification",[39875],{"data":39876,"marks":39877,"value":39879,"nodeType":864},{},[39878],{"type":1455},"brand verification process",{"data":39881,"marks":39882,"value":39883,"nodeType":864},{},[]," that also has different levels of requirements depending on the level of data access requested.",{"data":39885,"content":39886,"nodeType":860},{},[39887,39891,39900],{"data":39888,"marks":39889,"value":39890,"nodeType":864},{},[],"While being verified does not mean an integration poses no risk – in fact, there ",{"data":39892,"content":39894,"nodeType":883},{"uri":39893},"https://msrc.microsoft.com/blog/2023/01/threat-actor-consent-phishing-campaign-abusing-the-verified-publisher-process/",[39895],{"data":39896,"marks":39897,"value":39899,"nodeType":864},{},[39898],{"type":1455},"have been malicious phishing campaigns using verified publishers",{"data":39901,"marks":39902,"value":39903,"nodeType":864},{},[]," – it at least provides some extra assurance around what the integration actually is. This is especially true with Google integrations where access to restricted scopes has been granted.",{"data":39905,"content":39906,"nodeType":860},{},[39907],{"data":39908,"marks":39909,"value":39910,"nodeType":864},{},[],"For example, consider the Slack OAuth integration for Google Workspace. The name and icon make it very clear what the integration is claiming to be and the verification status shows that Google has verified this data - so you can quickly ensure the vendor is who they say they are, accept them as a third-party vendor, and move on to more traditional risk assessments. You can start to address questions like, “Should Slack be used within the organization?”  Does Slack as a company meet required security and compliance standards?” “Is an OAuth integration required or should it be used purely as a web or desktop app?,” and so on.   ",{"data":39912,"content":39916,"nodeType":996},{"target":39913},{"sys":39914},{"id":39915,"type":1001,"linkType":1002},"aYslILzQ1kwQUHy7Cw7lR",[],{"data":39918,"content":39922,"nodeType":996},{"target":39919},{"sys":39920},{"id":39921,"type":1001,"linkType":1002},"OmghmgRgSrdtMW9kgHaoa",[],{"data":39924,"content":39925,"nodeType":1312},{},[39926],{"data":39927,"marks":39928,"value":39930,"nodeType":864},{},[39929],{"type":899},"Reply URLs and Approved Domains",{"data":39932,"content":39933,"nodeType":860},{},[39934],{"data":39935,"marks":39936,"value":39937,"nodeType":864},{},[],"Some integrations may be unverified or have very generic or confusing names that give little indication as to who is actually behind the integration. For example, consider the following Microsoft OAuth integration:",{"data":39939,"content":39943,"nodeType":996},{"target":39940},{"sys":39941},{"id":39942,"type":1001,"linkType":1002},"2smtwpUnKZElj4tmZUcobg",[],{"data":39945,"content":39949,"nodeType":996},{"target":39946},{"sys":39947},{"id":39948,"type":1001,"linkType":1002},"23Dg0elnnY1j0dHP3GICJc",[],{"data":39951,"content":39952,"nodeType":860},{},[39953],{"data":39954,"marks":39955,"value":39956,"nodeType":864},{},[],"This integration says that it’s Trello, the well known SaaS platform. However, it’s unverified, so how do we actually know it is really Trello and not a malicious app masquerading as Trello? Reply URLs (Microsoft) and approved domains (Google) are other interesting sources of data about an integration as they give authorized callback URLs. ",{"data":39958,"content":39959,"nodeType":860},{},[39960],{"data":39961,"marks":39962,"value":39963,"nodeType":864},{},[],"During a common code-based flow for an OAuth consent, once the user has authorized the request, a redirect needs to be made back to a domain/URL that is controlled by the OAuth app vendor to pass the code back to the app. Then the app can use the code to get a token that can be used to act on behalf of the user. ",{"data":39965,"content":39966,"nodeType":860},{},[39967],{"data":39968,"marks":39969,"value":39970,"nodeType":864},{},[],"If any domain or URL could be used then there would be nothing stopping an attacker from impersonating legitimate OAuth apps and having the details passed back to a domain they control. This is much less of an issue with code-based flows, since the attacker would need access to the app secrets as well. However, with implicit flows that pass the token back directly, that would mean an impersonation attack would be possible and implicit flows are still somewhat common. To guard against this, the app owner has to specify exactly which domains or URLs are permitted for sending codes and tokens to. ",{"data":39972,"content":39973,"nodeType":860},{},[39974,39978,39986],{"data":39975,"marks":39976,"value":39977,"nodeType":864},{},[],"For Microsoft, this is one of the many fields returned from Graph API if you ",{"data":39979,"content":39981,"nodeType":883},{"uri":39980},"https://learn.microsoft.com/en-us/graph/api/serviceprincipal-get?view=graph-rest-1.0&tabs=http",[39982],{"data":39983,"marks":39984,"value":39985,"nodeType":864},{},[],"enumerate the service principals for apps installed",{"data":39987,"marks":39988,"value":39989,"nodeType":864},{},[]," on your tenant. ",{"data":39991,"content":39995,"nodeType":996},{"target":39992},{"sys":39993},{"id":39994,"type":1001,"linkType":1002},"115UEpFqDESlZJ0F5TqMjj",[],{"data":39997,"content":39998,"nodeType":860},{},[39999],{"data":40000,"marks":40001,"value":40002,"nodeType":864},{},[],"In this case, the app has only one authorized reply URL, which points to trello.com. This means that authorization tokens can only be sent to this URL. So, for the integration to be used (or abused) the developer (or attacker) would need control of that domain. In this example, you’d have some assurance that this integration is legitimately associated with Trello. However, there are no guarantees. It’s possible for an attacker to put a range of domains in a malicious integration they control and they only need control of one domain to make use of it. So if attackerdomain.com was also present, then trello.com could just be an effort by an attacker to make their integration appear more legitimate. Therefore, you need to consider all domains present as a whole, as the presence of one known legitimate domain isn’t enough on its own if other domains might be questionable. ",{"data":40004,"content":40005,"nodeType":860},{},[40006,40010,40019],{"data":40007,"marks":40008,"value":40009,"nodeType":864},{},[],"One caveat here is that this is much less of an issue when it comes to Google apps that have been through Google brand verification. Part of the verification process involves ",{"data":40011,"content":40013,"nodeType":883},{"uri":40012},"https://developers.google.com/identity/protocols/oauth2/production-readiness/brand-verification#authorized-domains",[40014],{"data":40015,"marks":40016,"value":40018,"nodeType":864},{},[40017],{"type":1455},"ensuring that the vendor owns the domains",{"data":40020,"marks":40021,"value":40022,"nodeType":864},{},[]," (approved domains) registered in any callbacks. Therefore, if it’s a Google verified app then you don’t have to worry about legitimate domains being impersonated by an attacker to give a fake sense of legitimacy. ",{"data":40024,"content":40025,"nodeType":860},{},[40026],{"data":40027,"marks":40028,"value":40029,"nodeType":864},{},[],"It used to be possible to query the approved domains for a Google app via an undocumented API, however, this recently stopped returning this information. However, there are still other details returned by the API that can be of use during an investigation. See an example for Slack below, but you can replace the project ID in the URL with any app project ID:",{"data":40031,"content":40035,"nodeType":996},{"target":40032},{"sys":40033},{"id":40034,"type":1001,"linkType":1002},"4kw9ZSZaGhbmvrp3wlaJgW",[],{"data":40037,"content":40038,"nodeType":1312},{},[40039],{"data":40040,"marks":40041,"value":40043,"nodeType":864},{},[40042],{"type":899},"Permissions",{"data":40045,"content":40046,"nodeType":860},{},[40047],{"data":40048,"marks":40049,"value":40050,"nodeType":864},{},[],"Both Google and Microsoft provide a very large number of permissions to give fine-grained control of what level of data access an OAuth integration has. This can be everything from a simple social login to access to high-risk data assets, like document stores and email inboxes, as well as administrative functionality. ",{"data":40052,"content":40053,"nodeType":860},{},[40054],{"data":40055,"marks":40056,"value":40057,"nodeType":864},{},[],"It’s worth noting a few differences between how Microsoft and Google handle these permissions. While both have a very large number of fine-grained permissions for users to delegate, Microsoft also has the concept of App Roles, which administrative users can consent to as well. These are often similarly named to delegated permissions, except they give access to data for all users rather than just for the user granting consent. ",{"data":40059,"content":40060,"nodeType":860},{},[40061,40065,40074],{"data":40062,"marks":40063,"value":40064,"nodeType":864},{},[],"For example, an ordinary user might be able to consent to grant access to their exchange email inbox using a delegated permission, but an app could also request access to an app role to allow access to all users’ email inboxes and an administrative user could consent to that using the same consent screen. Google does have similar capabilities but they are managed separately ",{"data":40066,"content":40068,"nodeType":883},{"uri":40067},"https://support.google.com/a/answer/162106?hl=en",[40069],{"data":40070,"marks":40071,"value":40073,"nodeType":864},{},[40072],{"type":1455},"using domain-wide delegation",{"data":40075,"marks":40076,"value":12800,"nodeType":864},{},[],{"data":40078,"content":40079,"nodeType":860},{},[40080],{"data":40081,"marks":40082,"value":40083,"nodeType":864},{},[],"Another important difference to consider here is that, as mentioned in the section above about verification, Google has different verification requirements depending on the data access requested. Microsoft allows even unverified apps to request access to any data, whereas Google designates some of the most sensitive data sources (such as Google Drive and Gmail) as being sensitive and requiring an app to not just be verified but to have undergone a much more stringent manual security review, including third-party security testing. ",{"data":40085,"content":40086,"nodeType":860},{},[40087],{"data":40088,"marks":40089,"value":40090,"nodeType":864},{},[],"Even without good reason to trust an OAuth integration, if the permissions it requests are extremely low risk then arguably it isn’t much of an issue. On the other hand, organizations with a need for a particularly stringent level of security may not be comfortable sharing high risk permissions with even fairly established SaaS vendors. Consequently, one of the most important data sources for evaluating the risk of an OAuth integration is to look at the permissions it exposes. ",{"data":40092,"content":40093,"nodeType":860},{},[40094],{"data":40095,"marks":40096,"value":40097,"nodeType":864},{},[],"An important factor to consider is that permissions are not necessarily fixed to be the same for every user. If more than one employee makes use of the same SaaS integration, it’s possible they may grant different permissions depending on what the integration does and how they enabled it. For example, let’s consider the Slack integration we saw before:",{"data":40099,"content":40103,"nodeType":996},{"target":40100},{"sys":40101},{"id":40102,"type":1001,"linkType":1002},"37l3selHqmcY8PKCLZEiKN",[],{"data":40105,"content":40106,"nodeType":860},{},[40107],{"data":40108,"marks":40109,"value":40110,"nodeType":864},{},[],"In this particular example, we have 15 users who have granted access to three different very low risk permissions concerning their basic account information, which typically are the minimum required in order to enable a simple social login. However, additional permissions have been granted for some other users:",{"data":40112,"content":40116,"nodeType":996},{"target":40113},{"sys":40114},{"id":40115,"type":1001,"linkType":1002},"3pJ0G2yfMnM7fNpP3IMs3a",[],{"data":40118,"content":40119,"nodeType":860},{},[40120],{"data":40121,"marks":40122,"value":40123,"nodeType":864},{},[],"It seems 15 users have also allowed access to their Google calendars and 5 users have also allowed full access to their Google Drive. This is due to different employees adding different Slack apps to enable calendar and file integration. For example, a standard social login to Slack using a Google account won’t even present the user with a consent screen because it only requests the most basic scopes. However, add a sensitive Slack app integration, like the one for Google Drive, and the user will receive a consent screen that looks like this, which is where this difference between users comes from:",{"data":40125,"content":40129,"nodeType":996},{"target":40126},{"sys":40127},{"id":40128,"type":1001,"linkType":1002},"fjM0oY0viy3p9OAxdrmtT",[],{"data":40131,"content":40132,"nodeType":860},{},[40133],{"data":40134,"marks":40135,"value":40136,"nodeType":864},{},[],"Even if Slack is an officially used SaaS provider for an organization though, perhaps enabling complete Google Drive access to a third party would be seen as a compliance risk too far, in which case, you could revoke the file permissions to reduce risk, if desired. ",{"data":40138,"content":40139,"nodeType":860},{},[40140,40144,40154],{"data":40141,"marks":40142,"value":40143,"nodeType":864},{},[],"In cases of untrusted OAuth integrations or those that are difficult to verify, the overall risk still remains very low if innocuous permissions like those required for social logins are the only permissions granted. In fact, the majority of OAuth integrations we see at Push do not request anything other than social login permissions. If you want to know more about social login risk then check our previous article ",{"data":40145,"content":40149,"nodeType":5064},{"target":40146},{"sys":40147},{"id":40148,"type":1001,"linkType":1002},"1pbtctbbJRqLuz8dOsecOt",[40150],{"data":40151,"marks":40152,"value":40153,"nodeType":864},{},[],"here",{"data":40155,"marks":40156,"value":40157,"nodeType":864},{},[],". However, much more careful attention should be paid once you see unknown integrations with high- risk permissions, such as full access to file stores.",{"data":40159,"content":40160,"nodeType":1312},{},[40161],{"data":40162,"marks":40163,"value":40165,"nodeType":864},{},[40164],{"type":899},"Activity Logs",{"data":40167,"content":40168,"nodeType":860},{},[40169],{"data":40170,"marks":40171,"value":40172,"nodeType":864},{},[],"It’s one thing to know what an integration can access in principle, due to its permissions, but it’s another to know what it’s actually doing. In one case, an integration may have requested permissions in order to access a user’s entire file store, but it may only use that functionality when specifically directed to as a result of a user attempting to share a file or some other trigger activity.",{"data":40174,"content":40175,"nodeType":860},{},[40176],{"data":40177,"marks":40178,"value":40179,"nodeType":864},{},[],"That isn’t to say there is no risk, certainly if the vendor is compromised and the tokens stolen then an attacker could arbitrarily access any files they like. However, if an integration constantly accesses all users files and syncs them in their entirety then that is clearly a very different risk profile to observe. Additionally, the ability to determine what an integration has actually done in an incident response scenario is invaluable.  ",{"data":40181,"content":40182,"nodeType":860},{},[40183],{"data":40184,"marks":40185,"value":40186,"nodeType":864},{},[],"Microsoft and Google offer different options here, which aren’t always available by default. Google provides API call visibility for OAuth integrations, which gives extremely detailed visibility of what an OAuth integration is doing and when. Here you can see the Slack integration using its Google Drive permissions to look for notifications for file changes, while the Thunderbird email integration is accessing some gmail related label data:",{"data":40188,"content":40192,"nodeType":996},{"target":40189},{"sys":40190},{"id":40191,"type":1001,"linkType":1002},"UqbMx5UzEimig5uvUvag7",[],{"data":40194,"content":40195,"nodeType":860},{},[40196,40200,40207],{"data":40197,"marks":40198,"value":40199,"nodeType":864},{},[],"The key caveat with Google is that it’s not available on all plans. You can see ",{"data":40201,"content":40203,"nodeType":883},{"uri":40202},"https://support.google.com/a/answer/6124308?hl=en",[40204],{"data":40205,"marks":40206,"value":40153,"nodeType":864},{},[],{"data":40208,"marks":40209,"value":40210,"nodeType":864},{},[]," that it's only available using Enterprise, Education and Cloud Identity Premium licenses. ",{"data":40212,"content":40213,"nodeType":860},{},[40214],{"data":40215,"marks":40216,"value":40217,"nodeType":864},{},[],"For Microsoft, rather than separate OAuth API call data, detailed audit data available as part of Microsoft Purview often gives context that can be traced back to OAuth integrations when that was the source. For example, here you can see the Mozilla Thunderbird OAuth integration being used to download a file from OneDrive. This is the same event you would get if a file was downloaded from a web interface, but in this case you can see in the AppAccessContext that it specifies a ClientAppId, which refers to the OAuth integration performing the action. This means you can track all activity specifically back to individual OAuth integrations separately from activity performed by a user within web interfaces - a very useful capability!",{"data":40219,"content":40223,"nodeType":996},{"target":40220},{"sys":40221},{"id":40222,"type":1001,"linkType":1002},"38oqwAXkDrQSJzP1ByECLF",[],{"data":40225,"content":40226,"nodeType":1312},{},[40227],{"data":40228,"marks":40229,"value":35763,"nodeType":864},{},[40230],{"type":899},{"data":40232,"content":40233,"nodeType":860},{},[40234],{"data":40235,"marks":40236,"value":40237,"nodeType":864},{},[],"In this article, we have seen a range of ways that OAuth integrations for both Microsoft and Google can be investigated in order to gain a better understanding of their risk profile, as well as investigating what they actually do in an incident response scenario. While there are no hard and fast rules for when an integration should be considered safe or dangerous, hopefully this gives some idea as to how to perform a risk assessment to make a call depending on your organization’s risk tolerance level. ","An investigation guide for assessing app-to-app OAuth integration risk","An employee has added a new integration to your Azure tenant or Google Workspace. How do you assess risk? We’ll cover a few techniques in this article.","2023-03-15T00:00:00.000Z","an-investigation-guide-for-assessing-app-to-app-oauth-integration-risk",{"items":40243},[40244,40246],{"sys":40245,"name":342},{"id":15029},{"sys":40247,"name":2729},{"id":2728},{"items":40249},[40250],{"fullName":34884,"firstName":34885,"jobTitle":34886,"profilePicture":40251},{"url":34890},"the-risky-terrain-of-oauth-scopes-in-third-party","blog/the-risky-terrain-of-oauth-scopes-in-third-party",{"json":40255},{"data":40256,"content":40257,"nodeType":856},{},[40258],{"data":40259,"content":40260,"nodeType":860},{},[40261],{"data":40262,"marks":40263,"value":40264,"nodeType":864},{},[],"While OAuth scopes provide seamless online user authentication, they also carry significant risk. This article explores these common, dangerous scopes so you can keep an eye out for them during your next risk assessment.\n","While OAuth scopes provide seamless online user authentication, they also carry significant risk. Watch out for these common, dangerous scopes.\n",{"id":40267,"publishedAt":40268},"7D24HwiebYpKv6FRe1ouwv","2026-08-12T11:56:01.538Z",{"items":40270},[40271,40273],{"sys":40272,"name":2729},{"id":2728},{"sys":40274,"name":342},{"id":15029},{"items":40276},[40277,40279,40281,40283,40285,40287,40289],{"sys":40278,"name":545,"slug":546,"tier":31},{"id":542},{"sys":40280,"name":413,"slug":414,"tier":31},{"id":410},{"sys":40282,"name":342,"slug":343,"tier":31},{"id":339},{"sys":40284,"name":484,"slug":485,"tier":45},{"id":481},{"sys":40286,"name":633,"slug":634,"tier":45},{"id":630},{"sys":40288,"name":368,"slug":369,"tier":45},{"id":365},{"sys":40290,"name":404,"slug":405,"tier":45},{"id":401},"Hv7q1XTbEcBgLekpQwc22uCbbTTpSGOb5Hnz5njcKKI",{"id":40293,"title":40294,"authorsCollection":40295,"content":40299,"extension":228,"faqItemsCollection":40652,"faqTitle":59,"featured":6,"hashTags":40654,"meta":40659,"metaTitle":40660,"ogImage":59,"postType":6981,"publishedDate":40661,"relatedBlogPostsCollection":40662,"slug":41148,"stem":41149,"subtitle":59,"summary":41150,"synopsis":41161,"sys":41162,"tagsCollection":41165,"topicsCollection":41171,"__hash__":41181},"blog/blog/should-you-disable-external-email-auto-forwarding.json","Should you disable external email auto-forwarding?",{"items":40296},[40297],{"fullName":4949,"firstName":4950,"jobTitle":4951,"socialLinks":59,"profilePicture":40298},{"url":4953},{"json":40300,"links":40619},{"data":40301,"content":40302,"nodeType":856},{},[40303,40322,40329,40359,40375,40382,40389,40396,40404,40411,40431,40438,40458,40464,40472,40479,40499,40507,40526,40534,40541,40594,40601,40608,40613],{"data":40304,"content":40305,"nodeType":860},{},[40306,40310,40318],{"data":40307,"marks":40308,"value":40309,"nodeType":864},{},[],"Mail rules can be abused by attackers to get stealthy, persistent access to a mailbox, leak data and facilitate high-impact Business Email Compromise (",{"data":40311,"content":40313,"nodeType":883},{"uri":40312},"/blog/email-security-how-hackers-use-mail-rules-to-access-your-inbox/",[40314],{"data":40315,"marks":40316,"value":40317,"nodeType":864},{},[],"read more here",{"data":40319,"marks":40320,"value":40321,"nodeType":864},{},[],"). So, lots of organisations decide to ban external auto-forwarding of email altogether. The question is, is this a good move?",{"data":40323,"content":40324,"nodeType":1312},{},[40325],{"data":40326,"marks":40327,"value":40328,"nodeType":864},{},[],"This is damage limitation, not prevention",{"data":40330,"content":40331,"nodeType":860},{},[40332,40336,40341,40345,40355],{"data":40333,"marks":40334,"value":40335,"nodeType":864},{},[],"It’s important to recognise that adding a malicious mail rule to a user’s mailbox is a ",{"data":40337,"marks":40338,"value":40340,"nodeType":864},{},[40339],{"type":899},"post-compromise activity",{"data":40342,"marks":40343,"value":40344,"nodeType":864},{},[],". That is, an attacker has already compromised the victim somehow - compromised their password, deployed malware on their machine, performed consent phishing etc. - they already have access to their mailbox. At this point, you should assume all data in the mailbox is compromised anyway. (See here for “",{"data":40346,"content":40350,"nodeType":5064},{"target":40347},{"sys":40348},{"id":40349,"type":1001,"linkType":1002},"e4805bba-2531-4250-bdcc-ab996dd33519",[40351],{"data":40352,"marks":40353,"value":40354,"nodeType":864},{},[],"what to do if I find a malicious mail rule?",{"data":40356,"marks":40357,"value":40358,"nodeType":864},{},[],"”)",{"data":40360,"content":40361,"nodeType":860},{},[40362,40366,40371],{"data":40363,"marks":40364,"value":40365,"nodeType":864},{},[],"Preventing external auto-forwarding rules therefore reduces",{"data":40367,"marks":40368,"value":40370,"nodeType":864},{},[40369],{"type":899}," further potential impact",{"data":40372,"marks":40373,"value":40374,"nodeType":864},{},[]," to a compromised account - worth doing if no one is using the feature, but what if your users are?",{"data":40376,"content":40377,"nodeType":1312},{},[40378],{"data":40379,"marks":40380,"value":40381,"nodeType":864},{},[],"Security vs. user experience",{"data":40383,"content":40384,"nodeType":860},{},[40385],{"data":40386,"marks":40387,"value":40388,"nodeType":864},{},[],"Good security should enable a business and its users to work securely rather than constrain it. Controls that restrict users’ productivity or are seen as a nuisance will be bypassed and although you might prevent a potential attack type, you’ll ultimately cause less secure behaviour from your users.",{"data":40390,"content":40391,"nodeType":860},{},[40392],{"data":40393,"marks":40394,"value":40395,"nodeType":864},{},[],"With that in mind, if external auto-forwarding of email is something your users need - and there are plenty of legitimate scenarios where this may be the case - you should be considering how to manage the risk, rather than eliminate it. The good news is this is totally doable. Equally, if none, or most of your users don’t need this feature, you should of course disable it to reduce your overall risk.",{"data":40397,"content":40398,"nodeType":860},{},[40399],{"data":40400,"marks":40401,"value":40403,"nodeType":864},{},[40402],{"type":899},"Managing the risk on Exchange Online for Microsoft 365 through detection alone",{"data":40405,"content":40406,"nodeType":860},{},[40407],{"data":40408,"marks":40409,"value":40410,"nodeType":864},{},[],"Managing the risk of external auto-forwarding email rules means making sure you’re alerted when one is created. ",{"data":40412,"content":40413,"nodeType":860},{},[40414,40418,40427],{"data":40415,"marks":40416,"value":40417,"nodeType":864},{},[],"If you’re using Exchange Online for Microsoft 365, ",{"data":40419,"content":40421,"nodeType":883},{"uri":40420},"https://protection.office.com/alertpolicies",[40422],{"data":40423,"marks":40424,"value":40426,"nodeType":864},{},[40425],{"type":1455},"an informational alert policy",{"data":40428,"marks":40429,"value":40430,"nodeType":864},{},[]," - “Creation of forwarding/redirect rule” - can be enabled so alerts of this type of suspicious rules will be sent to tenant admins when they are created in future. ",{"data":40432,"content":40433,"nodeType":860},{},[40434],{"data":40435,"marks":40436,"value":40437,"nodeType":864},{},[],"/prod",{"data":40439,"content":40440,"nodeType":860},{},[40441,40445,40454],{"data":40442,"marks":40443,"value":40444,"nodeType":864},{},[],"The downside of this approach is it isn’t possible to look retrospectively (",{"data":40446,"content":40448,"nodeType":883},{"uri":40447},"https://gcits.com/knowledge-base/find-inbox-rules-forward-mail-externally-office-365-powershell/",[40449],{"data":40450,"marks":40451,"value":40453,"nodeType":864},{},[40452],{"type":1455},"without using PowerShell",{"data":40455,"marks":40456,"value":40457,"nodeType":864},{},[],") so alerts will only fire on future creation of forwarding rules. Additionally, alerts also fire for internal forwarding rules which can generate a lot of noise when looking specifically for malicious rules. ",{"data":40459,"content":40463,"nodeType":996},{"target":40460},{"sys":40461},{"id":40462,"type":1001,"linkType":1002},"2aafjsTsqy7ljL5hh8c3MO",[],{"data":40465,"content":40466,"nodeType":860},{},[40467],{"data":40468,"marks":40469,"value":40471,"nodeType":864},{},[40470],{"type":899},"Managing the risk on Exchange Online for Microsoft 365  through detection & prevention",{"data":40473,"content":40474,"nodeType":860},{},[40475],{"data":40476,"marks":40477,"value":40478,"nodeType":864},{},[],"In addition to being alerted when rules are created, you can take steps to either disallow external auto-forwarding rules altogether, or prevent them taking effect. You might think disallowing their creation is better but if you can permit creation but stop them from taking effect, you keep a high-fidelity detection of account compromise, without adding any additional risk.",{"data":40480,"content":40481,"nodeType":860},{},[40482,40486,40495],{"data":40483,"marks":40484,"value":40485,"nodeType":864},{},[],"In Exchange Online for Microsoft 365, you can achieve this with ",{"data":40487,"content":40489,"nodeType":883},{"uri":40488},"https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/external-email-forwarding?view=o365-worldwide",[40490],{"data":40491,"marks":40492,"value":40494,"nodeType":864},{},[40493],{"type":1455},"outbound spam filter policies",{"data":40496,"marks":40497,"value":40498,"nodeType":864},{},[]," to automatically stop any emails auto-forwarded out of your organisation. If an attacker creates a malicious auto-forwarding rule, any forwarded mail will be blocked by the spam filter; if you have your alerts set up correctly, you’ll still receive an alert about the new malicious rule.",{"data":40500,"content":40501,"nodeType":860},{},[40502],{"data":40503,"marks":40504,"value":40506,"nodeType":864},{},[40505],{"type":899},"Managing the risk on Gmail for Google Workspace",{"data":40508,"content":40509,"nodeType":860},{},[40510,40514,40523],{"data":40511,"marks":40512,"value":40513,"nodeType":864},{},[],"Google Workspace only allows complete prevention, such that your users (and attackers) are not able to create forwarding settings. If you decide that is right for you, you can disable automatic forwarding entirely by ",{"data":40515,"content":40517,"nodeType":883},{"uri":40516},"https://support.google.com/a/answer/2491924?hl=en",[40518],{"data":40519,"marks":40520,"value":40522,"nodeType":864},{},[40521],{"type":1455},"following these instructions",{"data":40524,"marks":40525,"value":2924,"nodeType":864},{},[],{"data":40527,"content":40528,"nodeType":860},{},[40529],{"data":40530,"marks":40531,"value":40533,"nodeType":864},{},[40532],{"type":899},"Managing the risk using the Push platform",{"data":40535,"content":40536,"nodeType":860},{},[40537],{"data":40538,"marks":40539,"value":40540,"nodeType":864},{},[],"Using the Push platform makes managing this risk a lot easier with less of your time:",{"data":40542,"content":40543,"nodeType":941},{},[40544,40554,40564,40574,40584],{"data":40545,"content":40546,"nodeType":945},{},[40547],{"data":40548,"content":40549,"nodeType":860},{},[40550],{"data":40551,"marks":40552,"value":40553,"nodeType":864},{},[],"Connect your platform with a few clicks and we’ll sweep your estate for any suspicious rules currently in place.",{"data":40555,"content":40556,"nodeType":945},{},[40557],{"data":40558,"content":40559,"nodeType":860},{},[40560],{"data":40561,"marks":40562,"value":40563,"nodeType":864},{},[],"Get alerts via email or ChatOps (Slack or Teams) when new rules are created. Triage and deal with them directly from the email or chat platform.",{"data":40565,"content":40566,"nodeType":945},{},[40567],{"data":40568,"content":40569,"nodeType":860},{},[40570],{"data":40571,"marks":40572,"value":40573,"nodeType":864},{},[],"Use our ChatOps features to ask users directly if they recognise a rule when you’re unsure. You can even automate this so user feedback is already collected by the time you come to triage.",{"data":40575,"content":40576,"nodeType":945},{},[40577],{"data":40578,"content":40579,"nodeType":860},{},[40580],{"data":40581,"marks":40582,"value":40583,"nodeType":864},{},[],"Disable rules directly from the platform for quick response.",{"data":40585,"content":40586,"nodeType":945},{},[40587],{"data":40588,"content":40589,"nodeType":860},{},[40590],{"data":40591,"marks":40592,"value":40593,"nodeType":864},{},[],"Follow our detailed and clear guides for how to respond comprehensively.",{"data":40595,"content":40596,"nodeType":860},{},[40597],{"data":40598,"marks":40599,"value":35763,"nodeType":864},{},[40600],{"type":899},{"data":40602,"content":40603,"nodeType":860},{},[40604],{"data":40605,"marks":40606,"value":40607,"nodeType":864},{},[],"If your users don’t use external email auto-forwarding, it makes sense to prevent the feature to limit the impact of a malicious mail rule. However, if there are legitimate business reasons for keeping the feature active, this risk can be sufficiently managed through detection.",{"data":40609,"content":40612,"nodeType":996},{"target":40610},{"sys":40611},{"id":37179,"type":1001,"linkType":1002},[],{"data":40614,"content":40615,"nodeType":860},{},[40616],{"data":40617,"marks":40618,"value":21,"nodeType":864},{},[],{"entries":40620},{"inline":40621,"hyperlink":40622,"block":40628},[],[40623],{"sys":40624,"__typename":5291,"title":40625,"slug":40626,"articleId":40627},{"id":40349},"What to do if you find a malicious mail rule in Microsoft 365","what-to-do-if-you-find-a-malicious-mail-rule-microsoft-office-365",10021,[40629,40646],{"sys":40630,"__typename":40631,"content":40632,"title":40643,"buttonText":40644,"buttonUrl":59,"signupRedirectUrl":40645},{"id":40462},"ActionBlockComponent",{"json":40633},{"data":40634,"content":40635,"nodeType":856},{},[40636],{"data":40637,"content":40638,"nodeType":860},{},[40639],{"data":40640,"marks":40641,"value":40642,"nodeType":864},{},[],"It takes less than two minutes to check all your Office 365 or Google Workspace mailboxes.","Use our free tool to check your user's mailboxes for malicious mail rules","Check now","/app/feature/detect-malicious-mail-rules/",{"sys":40647,"__typename":1717,"type":40648,"ctaText":40649,"buttonLabel":40650,"buttonColour":40651,"buttonUrl":59},{"id":37179},"LinkedIn","See more original research and technical content from Push","Follow us on LinkedIn","orange",{"items":40653},[],[40655,271,40656,40657,40658],"businessemailcompromise","mailrules","office365","googleworkspace",{},"Understanding the risks of external email auto-forwarding","2021-06-03T00:00:00.000+01:00",{"items":40663},[40664,41024],{"__typename":2059,"sys":40665,"content":40666,"title":41008,"synopsis":41009,"hashTags":41010,"publishedDate":41012,"slug":41013,"tagsCollection":41014,"authorsCollection":41020},{"id":37311},{"json":40667},{"data":40668,"content":40669,"nodeType":856},{},[40670,40677,40683,40690,40709,40738,40745,40828,40847,40850,40857,40875,40882,40889,40892,40899,40943,40950,40967,40974,40977,40984,40991],{"data":40671,"content":40672,"nodeType":860},{},[40673],{"data":40674,"marks":40675,"value":40676,"nodeType":864},{},[],"Mail rules are a handy feature found in most email clients. You might have used them to forward emails to your teammates while you’re off sipping Piña coladas, or to move incoming email from that spammy colleague to the ‘don’t read’ folder.",{"data":40678,"content":40682,"nodeType":996},{"target":40679},{"sys":40680},{"id":40681,"type":1001,"linkType":1002},"7xLVXoCCjansV1u50e2pbM",[],{"data":40684,"content":40685,"nodeType":860},{},[40686],{"data":40687,"marks":40688,"value":40689,"nodeType":864},{},[],"Sadly for us defenders, they’re just as useful for attackers. After gaining access to a victim's account, attackers will often create a mail rule inside their mailbox as a way to maintain stealthy access. This mail rule can do anything a normal mail rule could but is usually used to forward emails matching sensitive keywords, like ‘invoice’ or ‘payment’, to an external email address controlled by the attacker.",{"data":40691,"content":40692,"nodeType":1116},{},[40693],{"data":40694,"content":40695,"nodeType":860},{},[40696,40700,40705],{"data":40697,"marks":40698,"value":40699,"nodeType":864},{},[],"This gives the ",{"data":40701,"marks":40702,"value":40704,"nodeType":864},{},[40703],{"type":899},"attacker persistent access to the mailbox",{"data":40706,"marks":40707,"value":40708,"nodeType":864},{},[],". Even if the victim's password is changed, they turn on MFA, or their workstation is completely rebuilt - as long as the rule stays in place, it remains effective.",{"data":40710,"content":40711,"nodeType":860},{},[40712,40716,40725,40729,40734],{"data":40713,"marks":40714,"value":40715,"nodeType":864},{},[],"As another example, in ",{"data":40717,"content":40719,"nodeType":883},{"uri":40718},"https://www.reddit.com/r/sysadmin/comments/6l63x6/malicious_outlook_rules/",[40720],{"data":40721,"marks":40722,"value":40724,"nodeType":864},{},[40723],{"type":1455},"this Reddit thread",{"data":40726,"marks":40727,"value":40728,"nodeType":864},{},[]," the author describes how mail rules were used to ",{"data":40730,"marks":40731,"value":40733,"nodeType":864},{},[40732],{"type":2246},"delete ",{"data":40735,"marks":40736,"value":40737,"nodeType":864},{},[],"any emails the affected user received from the company’s Chief Finance Officer (CFO) so that the attacker could pretend to be the CFO, sending them fake emails to convince them to transfer out company funds.",{"data":40739,"content":40740,"nodeType":860},{},[40741],{"data":40742,"marks":40743,"value":40744,"nodeType":864},{},[],"Business Email Compromise (BEC) like this is the most popular type of attack at the moment, causing damages well into the billions according to the FBI. Here are just a few publicly documented breaches involving mail rules:",{"data":40746,"content":40747,"nodeType":941},{},[40748,40768,40788,40808],{"data":40749,"content":40750,"nodeType":945},{},[40751],{"data":40752,"content":40753,"nodeType":860},{},[40754,40757,40765],{"data":40755,"marks":40756,"value":21,"nodeType":864},{},[],{"data":40758,"content":40760,"nodeType":883},{"uri":40759},"https://www.sans.org/dataincident2020",[40761],{"data":40762,"marks":40763,"value":40764,"nodeType":864},{},[],"SANS: 28,000 PII records lost",{"data":40766,"marks":40767,"value":21,"nodeType":864},{},[],{"data":40769,"content":40770,"nodeType":945},{},[40771],{"data":40772,"content":40773,"nodeType":860},{},[40774,40777,40785],{"data":40775,"marks":40776,"value":21,"nodeType":864},{},[],{"data":40778,"content":40780,"nodeType":883},{"uri":40779},"https://www.ic3.gov/Media/News/2020/201204.pdf",[40781],{"data":40782,"marks":40783,"value":40784,"nodeType":864},{},[],"FBI report: BEC involving malicious mail rules costs company $175k",{"data":40786,"marks":40787,"value":21,"nodeType":864},{},[],{"data":40789,"content":40790,"nodeType":945},{},[40791],{"data":40792,"content":40793,"nodeType":860},{},[40794,40797,40805],{"data":40795,"marks":40796,"value":21,"nodeType":864},{},[],{"data":40798,"content":40800,"nodeType":883},{"uri":40799},"https://www.reddit.com/r/Office365/comments/ej0wkx/hacker_created_forwarding_rules_for_users_account/",[40801],{"data":40802,"marks":40803,"value":40804,"nodeType":864},{},[],"Reddit thread: Hacker created forwarding rule for user's account",{"data":40806,"marks":40807,"value":8415,"nodeType":864},{},[],{"data":40809,"content":40810,"nodeType":945},{},[40811],{"data":40812,"content":40813,"nodeType":860},{},[40814,40817,40825],{"data":40815,"marks":40816,"value":21,"nodeType":864},{},[],{"data":40818,"content":40820,"nodeType":883},{"uri":40819},"https://www.microsoft.com/security/blog/2021/06/14/behind-the-scenes-of-business-email-compromise-using-cross-domain-threat-data-to-disrupt-a-large-bec-infrastructure/",[40821],{"data":40822,"marks":40823,"value":40824,"nodeType":864},{},[],"Microsoft case study of BEC operation using mail rules",{"data":40826,"marks":40827,"value":21,"nodeType":864},{},[],{"data":40829,"content":40830,"nodeType":860},{},[40831,40835,40843],{"data":40832,"marks":40833,"value":40834,"nodeType":864},{},[],"You can read ",{"data":40836,"content":40838,"nodeType":883},{"uri":40837},"/blog/case-study-business-email-compromise-bec-attack-nearly-cost-us-millions/",[40839],{"data":40840,"marks":40841,"value":40842,"nodeType":864},{},[],"this case study",{"data":40844,"marks":40845,"value":40846,"nodeType":864},{},[]," of a how a real Business Email Compromise (BEC) attack played out at an engineering firm that we interviewed.",{"data":40848,"content":40849,"nodeType":1005},{},[],{"data":40851,"content":40852,"nodeType":1009},{},[40853],{"data":40854,"marks":40855,"value":40856,"nodeType":864},{},[],"How likely is this to actually happen?",{"data":40858,"content":40859,"nodeType":860},{},[40860,40863,40871],{"data":40861,"marks":40862,"value":21,"nodeType":864},{},[],{"data":40864,"content":40866,"nodeType":883},{"uri":40865},"https://attack.mitre.org/techniques/T1114/003/",[40867],{"data":40868,"marks":40869,"value":40870,"nodeType":864},{},[],"MITRE lists threat groups",{"data":40872,"marks":40873,"value":40874,"nodeType":864},{},[]," that have been known to use mail rules in this way as part of targeted attacks. However, most often, this technique is used opportunistically.",{"data":40876,"content":40877,"nodeType":860},{},[40878],{"data":40879,"marks":40880,"value":40881,"nodeType":864},{},[],"Attackers run phishing campaigns containing thousands of harvested emails from multiple companies. A classic scenario is to trick a user into logging in to a fake Office 365 or Google Workspace login screen, stealing their credentials. Those credentials are then used to create a malicious mail rule inside the compromised user's mailbox. For scale and speed, this process is completely automated.",{"data":40883,"content":40884,"nodeType":860},{},[40885],{"data":40886,"marks":40887,"value":40888,"nodeType":864},{},[],"Similarly a mail rule could be created automatically as the result of a user’s workstation becoming infected with malware.",{"data":40890,"content":40891,"nodeType":1005},{},[],{"data":40893,"content":40894,"nodeType":1009},{},[40895],{"data":40896,"marks":40897,"value":40898,"nodeType":864},{},[],"How to defend against this type of attack?",{"data":40900,"content":40901,"nodeType":860},{},[40902,40906,40914,40918,40927,40931,40940],{"data":40903,"marks":40904,"value":40905,"nodeType":864},{},[],"The first step is to check your mailboxes to make sure no malicious mail rules have already been created. On Office 365, this will require rolling some PowerShell; on Google Workspace, you'll need to query the APIs (we discuss some detail of these options ",{"data":40907,"content":40909,"nodeType":883},{"uri":40908},"/blog/should-you-disable-external-email-auto-forwarding/",[40910],{"data":40911,"marks":40912,"value":40913,"nodeType":864},{},[],"in this post",{"data":40915,"marks":40916,"value":40917,"nodeType":864},{},[],"). Or you can save yourself some pain and use the free tool linked above, which we built for this very purpose. If you find rules that don't look right, follow these guides for what to do next on ",{"data":40919,"content":40922,"nodeType":5064},{"target":40920},{"sys":40921},{"id":40349,"type":1001,"linkType":1002},[40923],{"data":40924,"marks":40925,"value":40926,"nodeType":864},{},[],"Office 365",{"data":40928,"marks":40929,"value":40930,"nodeType":864},{},[]," or ",{"data":40932,"content":40936,"nodeType":5064},{"target":40933},{"sys":40934},{"id":40935,"type":1001,"linkType":1002},"50dab356-e78b-479d-ad45-a07b898b5ec4",[40937],{"data":40938,"marks":40939,"value":37769,"nodeType":864},{},[],{"data":40941,"marks":40942,"value":2924,"nodeType":864},{},[],{"data":40944,"content":40945,"nodeType":860},{},[40946],{"data":40947,"marks":40948,"value":40949,"nodeType":864},{},[],"It's also possible to stop users from creating auto-forwarding rules altogether. If no one is using the feature, this is probably a good idea - you might as well reduce risk. However, there are plenty of situations where teams benefit from the automation and efficiency mail rules bring. Security works best when it enables the business to work securely, rather than constraining it - leaving the feature available whilst managing the risk through detection is a good option as well.",{"data":40951,"content":40952,"nodeType":860},{},[40953,40957,40964],{"data":40954,"marks":40955,"value":40956,"nodeType":864},{},[],"We discuss more about the pros and cons of disabling mail rules and some options for some security controls you can implement so that you can keep them enabled ",{"data":40958,"content":40959,"nodeType":883},{"uri":40908},[40960],{"data":40961,"marks":40962,"value":40963,"nodeType":864},{},[],"in this blog post",{"data":40965,"marks":40966,"value":2924,"nodeType":864},{},[],{"data":40968,"content":40969,"nodeType":860},{},[40970],{"data":40971,"marks":40972,"value":40973,"nodeType":864},{},[],"If you'd like, try Push for free and we'll spot any suspicious mail rules, then work with employees to make sure the mail rule wasn't something they created for a legitimate use. If they haven't, we'll notify you to take action and investigate a potential incident. Find out more here.",{"data":40975,"content":40976,"nodeType":1005},{},[],{"data":40978,"content":40979,"nodeType":1009},{},[40980],{"data":40981,"marks":40982,"value":5063,"nodeType":864},{},[40983],{"type":899},{"data":40985,"content":40986,"nodeType":860},{},[40987],{"data":40988,"marks":40989,"value":40990,"nodeType":864},{},[],"It doesn’t stop there — Push provides comprehensive identity attack detection and response capabilities against techniques like credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":40992,"content":40993,"nodeType":860},{},[40994,40998,41005],{"data":40995,"marks":40996,"value":40997,"nodeType":864},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":40999,"content":41001,"nodeType":883},{"uri":41000},"https://pushsecurity.com/demo?utm_campaign=12081956-FY25Q2_Hacker-News-Article&utm_source=thehackernews&utm_medium=sponsored&utm_content=external-article",[41002],{"data":41003,"marks":41004,"value":18903,"nodeType":864},{},[],{"data":41006,"marks":41007,"value":2924,"nodeType":864},{},[],"Email security: How hackers use mail rules to access your inbox","After phishing campaigns target Office 365 and Google Workspace users, malicious mail rules are automatically added to the user’s mailbox. Take steps to defend.",[40655,271,40656,40657,40658,41011],"emailsecurity","2021-06-10T00:00:00.000+01:00","email-security-how-hackers-use-mail-rules-to-access-your-inbox",{"items":41015},[41016,41018],{"sys":41017,"name":15033},{"id":15032},{"sys":41019,"name":342},{"id":15029},{"items":41021},[41022],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":41023},{"url":4953},{"__typename":2059,"sys":41025,"content":41027,"title":41128,"synopsis":41129,"hashTags":41130,"publishedDate":41132,"slug":41133,"tagsCollection":41134,"authorsCollection":41140},{"id":41026},"pj2eLZXa4PyrY1DD4NCHt",{"json":41028},{"data":41029,"content":41030,"nodeType":856},{},[41031,41038,41041,41048,41055,41061,41068,41075,41082,41089,41096,41101,41108,41114,41121],{"data":41032,"content":41033,"nodeType":860},{},[41034],{"data":41035,"marks":41036,"value":41037,"nodeType":864},{},[],"The following is a personal account from the owner of an engineering consulting and projects company of how a Business Email Compromise (BEC) attack played out against his company, almost costing them millions.",{"data":41039,"content":41040,"nodeType":1005},{},[],{"data":41042,"content":41043,"nodeType":860},{},[41044],{"data":41045,"marks":41046,"value":41047,"nodeType":864},{},[],"It started with a phone call from one of our customers. They wanted to make a payment to us and asked to confirm that our banking details had changed. They had not. Our customer explained they had received another email from us after our original invoice, stating that our banking details had changed.",{"data":41049,"content":41050,"nodeType":860},{},[41051],{"data":41052,"marks":41053,"value":41054,"nodeType":864},{},[],"So many questions ran through my mind. I assured them our details had not changed and asked them to send me the email that they had received.",{"data":41056,"content":41060,"nodeType":996},{"target":41057},{"sys":41058},{"id":41059,"type":1001,"linkType":1002},"7oS3I99lcdKeHo0a4SM7f2",[],{"data":41062,"content":41063,"nodeType":860},{},[41064],{"data":41065,"marks":41066,"value":41067,"nodeType":864},{},[],"There it was. It even had our company logo and signature at the bottom.",{"data":41069,"content":41070,"nodeType":860},{},[41071],{"data":41072,"marks":41073,"value":41074,"nodeType":864},{},[],"We didn't know how the attacker got access to that email account and we assumed they were logging in and reading emails. So we changed the password on the affected email account and moved on.",{"data":41076,"content":41077,"nodeType":860},{},[41078],{"data":41079,"marks":41080,"value":41081,"nodeType":864},{},[],"A day later, the attacker followed up again with the customer and we got another phone call. After having a really difficult conversation, we had to dig deeper and find out what was going on. So we contacted our IT provider and launched an investigation.",{"data":41083,"content":41084,"nodeType":860},{},[41085],{"data":41086,"marks":41087,"value":41088,"nodeType":864},{},[],"We found that the email we sent containing the invoice was also forwarded to an external Gmail address. The attacker had also registered a visually similar domain name and cloned the look and feel of our emails to reply to our customers and trick them into believing it was from us. This 1-letter difference in the domain is highlighted in the image above.",{"data":41090,"content":41091,"nodeType":860},{},[41092],{"data":41093,"marks":41094,"value":41095,"nodeType":864},{},[],"The primary culprit behind the forwarding of the message was then discovered. A mail rule had been created that forwarded emails with the word \"payment\" (among others) in the subject.",{"data":41097,"content":41100,"nodeType":996},{"target":41098},{"sys":41099},{"id":40462,"type":1001,"linkType":1002},[],{"data":41102,"content":41103,"nodeType":860},{},[41104],{"data":41105,"marks":41106,"value":41107,"nodeType":864},{},[],"Some senior employees had received phishing emails a few days prior to this incident taking place. The email took them to a fake Microsoft login page and unfortunately one of them entered their password.",{"data":41109,"content":41113,"nodeType":996},{"target":41110},{"sys":41111},{"id":41112,"type":1001,"linkType":1002},"3LqNjM8OlZLI6XQVtLaOe1",[],{"data":41115,"content":41116,"nodeType":860},{},[41117],{"data":41118,"marks":41119,"value":41120,"nodeType":864},{},[],"This stolen password was used to log in and set up the forwarding rule. This closed the loop and we understood what happened fully.",{"data":41122,"content":41123,"nodeType":860},{},[41124],{"data":41125,"marks":41126,"value":41127,"nodeType":864},{},[],"We learned a lot from the incident (and aged a few years!) and the main recommendations from our IT provider were to delete the mail rule, change the password again and enable MFA on all our email accounts. Had this customer paid this invoice without questioning the change of details, we would have lost millions.","Case study: Business Email Compromise (BEC) attack nearly cost us millions","A story by the owner of an Engineering company on how they almost lost millions from a Business Email Compromise (BEC) style attack. An interesting BEC example.",[40655,271,40656,40657,41131],"warstory","2021-06-14T00:00:00.000+01:00","case-study-business-email-compromise-bec-attack-nearly-cost-us-millions",{"items":41135},[41136,41138],{"sys":41137,"name":15033},{"id":15032},{"sys":41139,"name":2729},{"id":2728},{"items":41141},[41142],{"fullName":41143,"firstName":41144,"jobTitle":41145,"profilePicture":41146},"Tyrone Erasmus","Tyrone","Co-founder / CTO",{"url":41147},"https://images.ctfassets.net/y1cdw1ablpvd/5rkMblymL7lG4pZBiYzWo6/26f0da21be8fc252b13b62aacc22d19d/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-22.jpg","should-you-disable-external-email-auto-forwarding","blog/should-you-disable-external-email-auto-forwarding",{"json":41151},{"data":41152,"content":41153,"nodeType":856},{},[41154],{"data":41155,"content":41156,"nodeType":860},{},[41157],{"data":41158,"marks":41159,"value":41160,"nodeType":864},{},[],"If your users have a business case for external email auto-forwarding, this risk can absolutely be managed - it's not something you must disable. However, if no one’s using the feature, it is a good idea to disable it since it limits the potential impact of an account compromise.","External email auto-forwarding is a feature but also a risk; learn whether you should disable it, and, if you can't, how to manage the risk through detection.",{"id":41163,"publishedAt":41164},"roVnr9Z2sHDPGtemZUE7u","2026-08-13T09:35:37.268Z",{"items":41166},[41167,41169],{"sys":41168,"name":15033},{"id":15032},{"sys":41170,"name":342},{"id":15029},{"items":41172},[41173,41175,41177,41179],{"sys":41174,"name":413,"slug":414,"tier":31},{"id":410},{"sys":41176,"name":342,"slug":343,"tier":31},{"id":339},{"sys":41178,"name":368,"slug":369,"tier":45},{"id":365},{"sys":41180,"name":270,"slug":271,"tier":45},{"id":267},"UXjk5K1jZ7rS9D7aFOMIXdnZFjSoSgkDV-poBKH-Pes",1787040069291]