The 10 best shadow IT tools in 2026: Push, Microsoft, Zscaler, and more
Ranking the top 10 shadow IT tools in 2026: How each one discovers apps, what it shows you about them, and where it falls short.
Guide
// Read
Supply chain security
5 posts
Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.
The three attack techniques behind ShinyHunters' 2026 campaigns
ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture.
Threat research
// Read
Introducing the Browser & Identity Attacks Matrix
We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.
Thought leadership
// Read
Why relying on browser extension risk scoring is an antipattern that won’t predict your next breach
Why typical browser extension risk scores are poor predictors of which extensions will actually lead to a compromise.
Thought leadership
// Read
Guide to secure browser extension deployment
How extension developers can improve their security controls to prevent extension compromise.
Guide
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.