Adam Bateman //O
@ajaybateman
Followers
238
Following
255
Media
3
Statuses
175
Co-founder, CEO @pushsecurity
London, England
Joined August 2009
big news
We’re excited to announce that Sublime has raised $150M in a Series C led by @Georgian_io, joined by new investors @Avenir_Growth, @01Advisors, @jonoberheide, and @nicoleperlroth, and existing investors @IndexVentures, @IVP, @slow, and @CitiVentures. This year we launched ASA
3
5
19
A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding | TechCrunch
techcrunch.com
Reflecting on 10 years since its launch, the honeypot maker explains why the company did not take on any VC funding.
1
11
36
Thrilled to be partnering with @PushSecurity to lead their Series B! Push is bring identity security to where work happens today - the browser. Hear from me, CEO @ajaybateman and @jordan_segall on why Push is the future of identity security:
1
5
12
Someone is using Evilginx to target customers of Onfido, part of Entrust, with a malicious Google advert that comes above the legitimate Onfido advert 🤯 Yes that us[.]com domain is actually an evilginx server - guess which advert is the malicious one
2
17
26
7/ At first, this might seem obvious, unrealistic or not that big a deal. Read the full article and dwell on it for a while. Trust me, the more you think about it, the more crazy you'll realize this is. Full article -
pushsecurity.com
How phishing for email verification can be combined with cross-IdP impersonation to gain direct access to downstream SaaS and bypass hardened IdP accounts.
0
1
1
1/ A new class of phishing - how verification phishing and cross-idp impersonation can bypass your SSO. Here is a video demo, but this is one where you really need to read the full article too - https://t.co/R6xZaawwpr I'll summarize the key points in this thread.
5
19
54
BDR: Browser Detection and Response https://t.co/IOykCkZIpl
thehackernews.com
Why modern ‘Phishing 2.0’ attacks using AitM and BitM toolkits are a big problem for security teams, and what you can do to stop them.
1
49
277
Identity Threat Detection and Response…What is it and how do we define it? @ajaybateman from @PushSecurity, breaks it down on the @CloudSecPodcast and other tools you may need in your Security defenses. 🎧 Don’t miss this episode! https://t.co/pJMqSKFeag
#ITDR #CloudSecurity
0
6
8
1/ It’s fascinating how many layers of protection even poorly written AiTM phishing kits put in place to frustrate discovery now. I’m talking about the type of kit where the authors forgot to implement the JS encryption function placeholder they wrote so it returns clear text😂
2
2
3
Is the Snowflake breach, touted as the biggest in history, identity security’s WannaCry moment? Join Luke Jennings, VP R&D at @PushSecurity, to explore what Snowflake shows us about the complexity of the identity attack surface, and discuss the practical steps that
3
23
41
Some asked how to remove these ghost logins from Snowflake after migrating to SAML SSO. You can unset a user's password. The guidance is here: https://t.co/iyfJ6y8kzz
community.snowflake.com
Join our community of data professionals to learn, connect, share and innovate together
10/ I wouldn’t be surprised if organizations responding to Snowflake right now think they’ve solved the problem by migrating their users to use SSO, without realizing they’re not actually securing those existing vulnerable identities, just creating new ones on top.
0
2
7
The Snowflake breach will be for cloud identity attacks what WannaCry was for Ransomware. Join @jukelennings to explore the practical takeaways from the incident. Select the best time for you using the dropdown menu. https://t.co/2JnS0FfB5C
0
3
2
While recommendations to enable MFA will certainly help combat these types of threats, it is important for organizations to understand the MFA is not a panacea. One example, described by @jukelennings of @PushSecurity , of how attackers can subvert MFA is Session Cookie Theft.
There's been lots of reporting on the campaign against Snowflake DB, so I thought it'd be useful to look at it from an Attack Path PoV. This post shows how you can create an graph for your SNOW deployment & what that tells us about the campaign. https://t.co/1crZ5n0rL0
1
3
12
This year @ThinkstCanary cleared $19m in ARR. - We still have less than 40 people... - We still do "no" outbound sales... We believe more security-product companies can do this too, by focusing a little more on customer-love. We spoke about it at the @DecibelVC event at RSAC.
12
41
253
In town for #RSAC next week? I have a (super brief) talk at the @DecibelVC Oasis (on Tuesday) on why cybersecurity products need to focus a little less on war and a little more on love¹. https://t.co/0F7nO4y2nD __ ¹ With @ThinkstCanary as a case-study.
luma.com
Please join us at the Decibel “Oasis” MeetUp as we host cybersecurity founders and early adopters seeking fresh perspectives and open networking with builders…
1
4
9
Now you can detect and block identity attacks directly inside any web browser. 1. Stop corp password reuse and phishing 2. Detect EvilGinx/EvilNoVNC 3. Session Hijacking detection ... and more. Hear the full announcement on @riskybusiness
https://t.co/xQH9Yy2Kdj
0
8
11
Bypass MFA, own an Okta account, then persist after you are shut down. 1. Trick employee to auth to Okta via a transparent VNC session 2. Persist on downstream SaaS 3. SAMLJacking for "lateral movement" Check it out: https://t.co/RCrbZewuZu
#redteam #blueteam
0
6
8
We've put together an index of the latest identity-based attacks, focusing on examples of networkless and SaaS-SaaS attacks that have been publicly disclosed. These attacks can tell us a lot about where identity attacks are headed. Check it out!
pushsecurity.com
To keep track of how identity attacks are evolving, we’ve put together this helpful index of recent breaches, focusing on the latest identity-based techniques.
0
3
13
Can admins steal cloud password manager secrets? Tl;dr - Yes! I use Dashlane as an example but it’s a generic approach and may end up a hash dumping equivalent for the SaaS-native world. It’s worth understanding the details! https://t.co/ZujUvLDVk2
pushsecurity.com
Can admins access the secrets from your corporate password manager? If so, how does this affect incident response in a compromised admin account scenario?
0
6
21
