🛡️ Visually helping to spread the message #DefenceInDepth starts with #Identity @SpecterOps - Tweets, satire and harmless opinions are my own.
Seattle, US
Joined May 2021
- Tweets141
- Following289
- Followers98
- Likes122
Considering what AI can do on the creative front today this ad from knee-deep-pandemic 2020 sort of... hit the nail on the head.
Kay Daskalakis retweeted
Attack paths are evolving with cloud, agentic AI, and an expanding web of identities and permissions.
Join @JustinKohler10 & me on Aug. 25 for our discussion around what we’re seeing, why AWS is the next frontier for Attack Path Management, and what AI-driven identities mean for defenders.
Join us: ghst.ly/4h0yWPn
Kay Daskalakis retweeted
Remember that the clean source principle applies to #passwordless as well.
At #BHUSA I will disclose 3 new vulnerabilities in a major WebAuthn implementation, introduce 20+ novel passkey attack vectors, and release 3 offensive open-source tools.
blackhat.com/us-26/briefings…
ALT Pass-the-Passkey Family of Attacks Black Hat USA 2026 Talk Poster
> They didn't break in. They followed the path you built.
#AttackPathBasics
ALT Someone standing at a whiteboard/map showing connected nodes - a visual attack graph. Lines connecting entry point to crown jewels. He's tracing the route with his finger.
> The badge says visitor. The access says otherwise.
#AttackPathBasics
ALT Pixel-art office surveillance scene showing a visitor searching through a filing cabinet of confidential documents while employees pass by unnoticed.
The shift from service principals to user-based service accounts feels like progress until you realise what it actually means.
Now your automated workloads authenticate like humans. Same MFA exemptions. Same session lifetimes. Same inherited group memberships nobody audits.
We didn't solve the identity sprawl problem. We renamed it.
Automatic attack disruption sounds like the dream. Isolate the device. Contain the threat.
But what if the compromised identity has already traversed three trust boundaries before the device gets flagged?
The device is one node. The identity is the path.
Disrupting the endpoint doesn't disrupt the graph.
Something I keep coming back to.
Techniques change. Phishing, AiTM kits, poisoned pipelines. The vector shifts every quarter.
But the graph stays. The relationships, the trust chains, the inherited permissions. That structure is the constant underneath all the noise.
I think defending the graph matters more than chasing techniques. But I'm curious. Where do you spend most of your defensive energy?
I've started wondering if "defence-in-depth" sometimes becomes "defence-in-debt."
60 Conditional Access policies. DPAPI keys nobody tracks. Certificate templates granting enrollment to Domain Users.
Layer after layer, but each one carrying its own unaudited risk.
Does anyone else feel like depth without visibility is just complexity in disguise?
> He authenticated once. He's been everywhere since.
#AttackPathBasics
ALT Pixel-art office security camera scene showing an intruder crawling through a ceiling vent while employees below continue working, unaware.
There's a scheduled task on a Tier-1 server I found recently. Running as Domain Admin.
Created in 2021. The person who made it left the company two years ago. Nobody reviewed it. Nobody questioned it.
It's a servant door. Quietly holding open a path nobody's watching.
How many of these do you think exist in your environment right now?
Something I've been thinking about.
Most SOC analysts live in Kusto. Not Cypher. So when someone rebuilt BloodHound's queries in KQL for Sentinel, it felt like meeting defenders where they already are.
I think that's the pattern worth copying. Don't ask people to learn a new language. Bring the insight to their existing workflow.
What tools have you seen succeed because they met people where they already work?
> Authenticate once. Traverse anything.
#AttackPathBasics
ALT Pixel-art office security scene where a person walks through a corporate doorway after access controls marked “OFF” and “BYPASSED” are ignored. The guard is distracted by social media, and the game caption says no one stops them.
An AI agent completed a 32-step corporate network attack in hours.
It didn't need zero-days. It walked through open doors. Misconfigured delegations, stale credentials, inherited permissions.
I think the uncomfortable part isn't that AI can hack. It's that the paths were already there waiting.
What's your take? Are we building for AI-speed adversaries yet?
"Apply security updates and try Cyber Essentials."
That's what AISI recommended after an AI agent compromised a corporate network in hours.
I wonder if we're past the point where patching alone is a credible response to structural identity problems.
What do you think? Is this guidance keeping pace with the threat?
I keep finding permissions granted in 2019 that nobody's reviewed since.
Tier 0 access inherited through nested groups. Service accounts with Domain Admin that outlived the project they were built for.
It's not malice. It's just time doing what time does to access.
Anyone else doing regular access archaeology on their environment? What's the oldest permission you've found still active?
I sat across from a CISO once. Fully patched. MFA everywhere. Logs shipping beautifully.
Then we showed them the graph. One path from helpdesk to Domain Admin through nested group memberships nobody had audited in years.
It's like an X-ray that shows a problem you didn't know you had.
How many of you have run that exercise on your own environment?
Saturday night thought.
Every security team I've worked with has a "this is how we're protected" diagram.
I've rarely seen one that says "this is how we'd be attacked."
I wonder if that's the gap. Defence-in-depth without an attacker's perspective feels like architecture with a padlock drawn on top.
Does your team map both sides, or just one?
An attacker doesn't need a malicious domain to move through your environment.
FOCI and BroCI flip legitimate tokens into edges that bypass every network control you have.
The real fix isn't better detection. It's removing the arrow.
Sorry… not sorry :)
4.7 is largely the pre-nerfed Opus 4.6
- Yes the benchmarks will say otherwise.
- Yes I am exaggerating (within scepticism boundaries).
- No this post does not involve scientific analysis. It’s Thursday evening and I spent a large time of the day in planes.
#SlightlyOffTopic #StillTrue
