'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Shadow AI: how to discover, govern, and secure AI apps
Blocking AI tools doesn't stop employees from using AI — it stops you seeing how they use it. The solution: make the governed path easier than the workaround.
// Read
SaaS security
96 posts
SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.
We coined the poisoned tenant attack in 2023; in 2026, someone used it on us
Someone created a fake OpenAI organization using our company's name and invited specific Push employees to join it. Here's what we learned.
Threat research
// Read
Why you can't control AI without being in the browser
Why the right browser security tool makes a separate AI visibility and control purchase unnecessary — and how to decide what you actually need.
Thought leadership
// Read
Shadow AI: what Push data reveals about the scale of the problem
Push telemetry shows the average organization has 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in use. Here's what it means for security.
Thought leadership
// Read
The top 10 security problems you can solve in the browser — ranked by value
Ranking the security problems you can solve in the browser by security value and browser fit.
Thought leadership
// Read
The three attack techniques behind ShinyHunters' 2026 campaigns
ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture.
Threat research
// Read
Unpacking the Vercel breach: A cautionary tale for Shadow AI and OAuth sprawl
In April 2026, Vercel was compromised via an OAuth app integrated into their Google Workspace tenant stemming from a compromised third-party AI SaaS provider.
Breach analysis
// Read
Cyber Essentials April 2026 update: Mandatory MFA on ALL cloud services (and how Push can help)
Big changes are being made to the Cyber Essentials scheme in 2026 that will change how companies must validate compliance. Here’s what you need to know.
Regulation & compliance
// Read
What the expansion of NYCRR Part 500 means for MFA regulation and compliance
NYCRR Part 500 is tightening its MFA and asset management requirements. Here's what the changes means for compliance.
Regulation & compliance
// Read
How cyber breaches are driving tighter MFA requirements and enforcement
MFA regulators, insurers, and policy-makers are getting tighter on their MFA requirements, fuelled by public cyber breaches.
Regulation & compliance
// Read
How the browser became the main cyber battleground
How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.
Thought leadership
// Read
Introducing our guide to phishing detection evasion techniques
Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection.
Guide
// Read
Navigating the 2025 HIPAA Security Rule changes: What you need to know (and how Push can help)
The HIPAA Security Rule is getting a long-overdue facelift in 2025. Here's our quick overview of the key changes and how Push can help you to be compliant.
Regulation & compliance
// Read
Scattered Spider: TTP evolution in 2025
How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.
Threat research
// Read
Series B and Beyond: Securing the New Perimeter
I’m thrilled to share that Push Security has raised our Series B funding. This is a huge moment for us and our customers in the fight against identity attacks.
Company news
// Read
How consent phishing is evolving to defeat detection controls
Consent phishing is where attackers trick users into authorizing access for malicious OAuth apps. Here's how attackers are using this technique in the wild.
Threat research
// Read
Dissecting a recent MailChimp phishing attack
HIBP creator and well-known security person Troy Hunt recently blogged about a phish he fell for. Here’s what it tells us about how phishing is evolving.
Breach analysis
// Read
Introducing Push password enforcement — for when weak passwords are still plaguing you
Detects when employees have weak, reused, or stolen passwords and guide them to update their password using in-browser messaging on any app.
Product feature
// Read
6 breaches in 5 months: Why attackers are targeting Jira with stolen credentials
Attackers are persistently targeting Jira accounts with stolen credentials. What can we learn from this trend?
Breach analysis
// Read
5 ways attackers can use Computer-Using Agents to automate identity attacks
We're back with part 2 of our research into OpenAI Operator to share our findings on how it can be used to automate identity attacks.
Threat research
// Read
How new AI agents will transform credential stuffing attacks
Credential stuffing attacks had a huge impact in 2024. But things could be dialled up even further with Computer-Using Agents like OpenAI Operator.
Threat research
// Read
Minimum Viable Identity Security
How app developers can go beyond Minimum Viable Secure Product (MVSP) to implement better identity protections and prevent identity-based attacks.
Thought leadership
// Read
Considering the security implications of Computer-Using Agents (like OpenAI Operator)
CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.
Threat research
// Read
No more hard simple problems: Enforce MFA on third-party apps with Push
Using Push to enforce MFA on third-party apps in the browser — even where MFA enforcement isn't supported by the app itself.
Product feature
// Read
How real-world attacks and research drove Push’s most popular features of 2024
How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities.
Product feature
// Read
Product release: December 2024
Here’s what’s new on the Push platform for December 2024.
Release notes
// Read
Snowflake: Looking back on 2024’s landmark security event
165 Snowflake customers were targeted by criminals using stolen credentials from infostealer infections, impacting hundreds of millions of people.
Breach analysis
// Read
A new class of phishing: Verification phishing and cross-IdP impersonation
How phishing for email verification can be combined with cross-IdP impersonation to gain direct access to downstream SaaS and bypass hardened IdP accounts.
Threat research
// Read
Cross-IdP impersonation: Hijacking SSO to access downstream apps
Cross-IdP impersonation is a method of hijacking SSO to access downstream apps — without needing to compromise accounts on your company’s main IdP.
Threat research
// Read
Product release: November 2024
Here’s what’s new on the Push platform for November 2024.
Release notes
// Read
What we can learn from the recent ServiceNow/Microsoft disclosure
Account takeover on third-party apps is the flavor of the month for security researchers — what can we learn from it?
Breach analysis
// Read
How many vulnerable identities do you have?
Using Push data to calculate how many vulnerable identities the average organization has, and how they lead to different methods of account takeover.
Threat research
// Read
The SaaS attack matrix: A year in review
It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed.
Threat research
// Read
Hackers don’t hack in, they log in: How to prevent account takeover with Push
How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts.
Product feature
// Read
5 reasons why Push Security shouldn’t exist
Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.
Thought leadership
// Read
Ghost logins: When forgotten identities come back to haunt you
How ghost logins can be used by cyber attackers for account takeover and persistence.
Threat research
// Read
Investigating and responding to a third-party data breach using Push
How to use Push to investigate and respond to a third-party data breach, which results in credentials being stolen and sold on criminal marketplaces.
Guide
// Read
Phishing 2.0 – how phishing toolkits are evolving with AitM
Attackers are using Adversary in the Middle (AitM) phishing toolkits to bypass MFA. We look at what AitM is, how it works, and what you can do about it.
Threat research
// Read
Enforce end-user security controls with our new app banner options
Use Push's variety of app banner options to control which cloud apps employees use, and how they use them.
Product feature
// Read
Product release: April 2024
Here’s what’s new on the Push platform for April 2024.
Release notes
// Read
A year of building: Top features we shipped this year
Some highlights of what we've built over the last year on our mission of stopping identity attacks.
Company news
// Read
Tracking identity-based attacks in the wild
To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.
Threat research
// Read
Can my admins steal my cloud password manager secrets?
Can admins access the secrets from your corporate password manager? If so, how does this affect incident response in a compromised admin account scenario?
Threat research
// Read
5 ways to defeat identity-based attacks
In this blog post we will cover what identities are, how we secure perimeters in general, and and how this maps to the identity space.
Thought leadership
// Read
Product release: February 2024
Here’s what’s new on the Push platform for February 2024.
Release notes
// Read
Introducing in-browser app banners: Set guardrails for cloud apps
Don’t leave it up to your employees to figure out how to use cloud apps securely. Guide them directly in their browsers when they access their apps.
Product feature
// Read
Product release: January 2024
Here’s what’s new on the Push platform for January 2024.
Release notes
// Read
What is SAML SSO?
In this article, we'll explain what SAML SSO is, how it works, and clarify some common misconceptions.
Guide
// Read
Oktajacking
In this article, we'll show you how to use Okta to do keylogging for you, without needing to have your own malicious domain hosting your malicious SAML server.
Threat research
// Read
Abusing Okta's SWA authentication
We'll cover the implications of using Okta's SWA authentication method. Learn what security teams need to know in an account breach and IR scenario.
Threat research
// Read
Product release: November 2023
Here’s what’s new on the Push platform for November 2023.
Release notes
// Read
Understanding Third-Party Risk Management (TPRM): how to protect your organization
In this article, we define third-party risk management and explore additional approaches that can help manage third-party risk.
Guide
// Read
Slack Attack: A phisher's guide to persistence and lateral movement
In this post, we're going to demonstrate how to phish via Slack to gain persistence and move laterally.
Threat research
// Read
Slack Attack: A phisher's guide to initial access
In this article, we’ll demonstrate how IM apps, specifically Slack, are an increasingly attractive target for a range of phishing & social engineering attacks.
Threat research
// Read
6 ways to manage third-party access to your data with Push
Employees are self-adopting SaaS apps and creating new cloud identities without IT approval. Learn how to manage which third parties have access to your data.
Product feature
// Read
6 surprising takeaways from a recent report on identity-based attacks
A new report on securing digital identities has some interesting takeaways to consider as we think about securing identities in the cloud. Here's our take.
Thought leadership
// Read
Product release: September 2023
Here’s what’s new on the Push platform for September 2023.
Release notes
// Read
Credential stuffing: The most common attack against SaaS identities
Credential stuffing attacks are incredibly common, but they often go undetected. These attacks are often the entry point for attack. Learn how to prevent them.
Guide
// Read
Get out of the dark: Manage the risk of shadow identities
Employees sign up to cloud apps on their own every day. Each time, they create a new account and a new identity on that app. How do you find and secure them?
Guide
// Read
The shadow workflow’s evil twin: A nearly invisible attack chain
In this article, we’re going to demonstrate how combining two of our favorite new SaaS attack techniques makes a simple, but very stealthy persistence approach.
Threat research
// Read
Under the radar: The risky terrain of OAuth scopes in third-party Integrations
While OAuth scopes provide seamless online user authentication, they also carry significant risk. Watch out for these common, dangerous scopes.
Guide
// Read
Understanding Shadow IT and Shadow SaaS: Definition, security risks, and how to manage it
We’ll define shadow IT, talk through the security risks associated with it and give some actionable guidance on how to manage it.
Guide
// Read
SAMLjacking a poisoned tenant
In this article, we’re going to demo combining two of our favorite new SaaS attack techniques to make a simple, but effective attack chain.
Threat research
// Read
Focus on account and identity security to reduce SaaS risks
You’ve probably locked down the known cloud services your company is using, but what about all those other SaaS apps people in the company are using?
Guide
// Read
SaaS Security: what is it & how to manage the risk
We'll quickly define SaaS security and help you better understand how to manage the risk SaaS applications introduce to your business
Guide
// Read
Let’s talk about SaaS attack techniques
Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.
Threat research
// Read
Free and trial SaaS applications are even riskier than paid apps
Free and trial SaaS accounts are often invisible to security teams and still interact with real, live corporate data.
Thought leadership
// Read
The no-jargon guide to solving shadow SaaS
Adapt your thinking to secure your data. Security needs to move from being the Department of No to the Department of Yes, Unless...
Guide
// Read
7 Steps to secure your data across shadow SaaS apps
Attackers commonly target SaaS apps because they know employees sign up without running them past IT first. Learn how to adjust to secure your data.
Guide
// Read
SaaS sprawl isn't a problem - if you completely change your approach
Employees using a new work app used to be the final step of the software-onboarding process. Now it's the first. Security must adapt to secure business data.
Thought leadership
// Read
Want to discover the full extent of your SaaS sprawl? Embrace browser extensions
Browser extensions are the most effective SaaS discovery tool because they can capture employee SaaS use and adoption in real time, as employees sign up.
Thought leadership
// Read
Embrace SaaS to move faster than your competitors
Look at enabling SaaS from a broader understanding of the business and not just the impact to security
Thought leadership
// Read
Push it real good: Why I’m excited to join Push’s board
SaaS sprawl is not just a raw increase of apps in-use, but also due to employees self-adopting new apps. Orgs need sensible guardrails for employees.
Company news
// Read
From launch to series A
We’re proud to announce our $15M Series A round, led by GV. Here's what we've learned about what our customers need since we launched in July 2022.
Company news
// Read
Product Release: March 2023
Here’s what’s new on the Push platform for March 2023.
Release notes
// Read
An investigation guide for assessing app-to-app OAuth integration risk
An employee has added a new integration to your Azure tenant or Google Workspace. How do you assess risk? We’ll cover a few techniques in this article.
Guide
// Read
How attackers compromise Azure organizations through SaaS apps
This article covers common ways an app could lead to compromise in Microsoft Azure, and what to look out for when determining risk to your organization.
Threat research
// Read
Product Release: December 2022
Here’s what’s new on the Push platform for December 2022.
Release notes
// Read
Maintaining persistent access in a SaaS-first world
Attackers have loads of persistence options in an endpoint compromise scenario, but what changes in a SaaS-first world? We talk new attack methods in this post.
Threat research
// Read
Is it safe to allow my employees to connect third-party apps to our M365/Google Workspace tenant?
Learn about the benefits and risks of SaaS integrations and get tips for how to manage the risks.
Guide
// Read
Should I let my employees login with their work Google account?
Is logging in with Google or Microsoft secure? Yes, with caveats.
Thought leadership
// Read
How to kick off an incident response investigation for a compromised SaaS account
We'll walk through how to quickly detect and mitigate business email compromise (BEC) and then prevent future attacks.
Guide
// Read
Product release: August 2022
Here’s what’s new on the Push platform for August 2022.
Release notes
// Read
How to discover SaaS use without invading employee privacy
Learn how to manage SaaS in a way that keeps employees productive and doesn't compromise privacy.
Thought leadership
// Read
5 steps to manage the risk of unsanctioned SaaS
Learn some lightweight ways to manage the risks SaaS introduces without relying on restrictive policies that block employees from using their preferred tools.
Guide
// Read
How to find the right SaaS security solution for your organization
In this guide, we’ll break down some major SaaS use cases and match them up with solutions that can address them, covering pros and cons for each.
Guide
// Read
What we’ve been up to with our seed funding: a peek behind the curtain
Yesterday, we announced our official launch and what Push Security is all about following our $4m series seed.
Company news
// Read
Building a culture of trust to secure SaaS, together
We’re excited to announce our $4M seed round, led by Decibel. See how we’re building tech that allows companies to let employees freely & securely adopt SaaS.
Company news
// Read
Push Security Announces $4M Seed Round to Introduce User-Centric Approach to Securing SaaS
Launches solution that finds SaaS apps employees are using and guides them to fix issues
Company news
// Read
How to roll-your-own SaaS discovery
We’ve compiled some methods for discovering SaaS. Lets explore each approach and learn new ways to discover unknown SaaS, capture SaaS use, and secure it.
Guide
// Read
How to find a malicious OAuth app on Microsoft 365
How do you find a malicious Microsoft 365 OAuth app? Learn what to look for, and what to ignore, when checking your users haven't been consent phished.
Guide
// Read
Investigating user delegated OAuth tokens in Google Workspace - a ride along
Introduction to OAuth tokens in Google Workspace, how they are used, reasons you might want to review them, and a discussion of how you might go about it.
Guide
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.