AI-native MCP Identity Security & Governance platform for lifecycle management, passwordless, conversational AI & human verification. SOC 2, ISO 27001.
Pleasanton, CA
Joined June 2009
- Tweets4.1K
- Following1.7K
- Followers1.6K
- Likes288
Privilege creep: the access people collect as they change jobs, join projects or cover for colleagues, while the old rights never get removed. A September 2022 DHS OIG audit found USCIS didn't have a process to adequately verify access after personnel transferred offices.
Review access at every role change. Avatier's Access Governance automates those reviews and certifications. attackcost.com/en/glossary/p…
Black Basta playbook, per an FBI, CISA, HHS and MS-ISAC advisory: flood a user's inbox with spam, then call acting as tech support and ask them to download a remote access tool. From October 2024 the same campaign also used Microsoft Teams.
The fix: hang up on support calls you didn't ask for and call your help desk back on a number you already know. Avatier's Assisted Reset sends every MFA challenge to the user, so the help desk agent only sees pass or fail. attackcost.com/en/threat-act…
Offboarding gap: a leaver's main login is disabled, but their app accounts, tokens, shared passwords or remote access stay live.
In an April 2022 SEC filing, Block said a former employee downloaded Cash App Investing reports with some US customer information, accessed without permission after the person's employment ended. Deprovision every app automatically from the HR exit event.
Avatier's HR User Provisioning disables accounts and revokes access once HR marks someone terminated. attackcost.com/en/glossary/o…
You can go passwordless on Windows without phones, badges or extra hardware. The credential follows the user, and we keep governing the password while you retire it.
credentialgovernance.com
One factor is an invitation. Three is a wall. With a governed password and strong MFA together, a stolen password alone won't get anyone in.
credentialgovernance.com
Locked out at the login screen with no way to reach a reset page? Users can unlock and reset from the Windows or Mac login screen itself, with MFA.
credentialgovernance.com
They don't hack. They call. Assisted Reset sends the identity challenge to the real user's device, so the help desk never has to trust the voice on the line.
credentialgovernance.com
Passwords didn't disappear, so we govern them. Users reset their own passwords in one secured place, with MFA checks and your policy applied. Setup takes a day.
credentialgovernance.com
A weak password gets blocked at the domain controller before it's ever saved. Each new password is checked against your policy, common-password lists and known breaches as it's set. Covers AD, Entra ID and legacy systems.
credentialgovernance.com
A joint FBI and CISA advisory, citing public reporting, says Scattered Spider actors posed as employees to get IT help desks to reset passwords and move MFA to devices the actors control.
MFA fatigue, also called push bombing: the attacker already has the password and keeps triggering sign-in prompts until a tired or confused user taps approve. One tap gives them a valid session.
CISA and the FBI's Scattered Spider advisory (AA23-320A), citing public reporting, said the group's actors sent repeated MFA prompts that led employees to press Accept. How to stop it: phishing-resistant MFA, or at least number matching with sign-in context.
Limit how many prompts can be sent, and alert on bursts of denied pushes. #CybersecurityAwarenessMonth #MFA attackcost.com/en/glossary/m…