100,000 OAuth Grants Later, Security Teams Still Can’t See the Risk

Joe: How's it going, Danielle? It's great to get you on the podcast. I'm actually really looking forward to our conversation today. Danielle: Yeah, thanks Joe. I'm also pretty stoked to be here. Joe: Yeah. Yeah, absolutely. It's it's an interesting time, you know, I I feel like in the tech space overall. I've been I mean, I I've I've been getting like so many texts and you know, reach outs from people and friends that are like, have you been playing with like this, you know, agentic AI and all this other stuff? And you know, it's like people that like normally don't think about technical stuff and now they're trying to, you know, use AI to like make their lives easier, right? Which is which is great. That's probably what they should be using it for. but like we're going into a interesting place where like this technology is more prevalent than like any other evolution of technology that we've seen. How's going, everyone? So before we dive into the episode, I wanted to let you know that this episode is sponsored by Nudge Security. Nudge Security is a great solution, something that I stumbled across a couple months ago, maybe at the beginning of this year. And this thing has been in the making for quite a while. So happy to have them on. And if you're interested in learning more about their solution and how it can help you. Go check it out at the links in the description of this episode. Now back to the episode. Danielle: It it's wild. It absolutely. I I think this moment right now too with the the kind of explosion of AI that we've been living in like the past few years, obviously from a technology user and kind of a knowledge worker perspective, I definitely feel like, man, if I don't use these tools and I don't skill up and I don't get really good at, you know, prompting or kind of creating agents now or whatever the next thing is in this evolution. you know there would be consequences for me professionally in the in the long run, right? And I think we've all heard that message kind of on an individual basis. And then on the security side too, it this is it's such a wild moment, right? To be in the place of trying to help s organizations just get their arms around what's happening in this technology space because it moves so quickly. And it's just one of those things that when you stop to kind of compare or reflect on this the sort of cloud transformation that we all lived through, you know, 15, 20 years ago. and then SaaS transformation and now this kind of AI transformation moment that we're in. it I keep asking myself, like, am I just getting older or is this moving faster? Right. Because it seems as though cloud transformation did not happen at such a clipping pace. And and to be fair, in the, you know, you could point back to those early days of the hyperscalers and say, well, security trailed the cloud, you know, the kind of progress in in in the same way we're seeing that on AI. But now because of the speed and the scale and the scope of AI use again across the enterprise, within the kind of threat actor landscape, that necessity to secure it and to be able to figure out how to govern it becomes a so more like so so much more urgent to move quickly on that. And so it is wild to be you know on kind of multiple levels to kind of be living in this moment and working in tech. And then there are moments when I like kind of have to stop and just like reflect, like, you know, I feel very entrenched in this space right now. And like we are still, like you and I and and everyone in this space are in this like kind of like five percent of the global population that are like living and breathing this right now, right? So we're still like as much as it feels like this is moving fast and I feel perpetually behind. like we're still in this like very small kind of early days, kind of experimental phase of this technology. So it's I mean, it's a wild time to be to work in the space and I don't think that I'd wanna be anywhere else right now as well. Joe: Yeah, it's it's pretty crazy. You know, like when I when I was graduating with my bachelor's and like kind of just like in help desk, you know, first kind of job out of college, you know, cloud was like cloud was there, you know, like AWS had S3 and EC2, you know, going. But there wasn't like a huge push of like cloud migration, right? Then a couple of years later People started to like really focus on like cloud migration and whatnot. But it was still like very, very company based. You know, like there were so many companies out there that were just like, yeah, we're not migrating to the cloud, like there's no need for us to. We just spent, you know, a billion dollars on this data center. We're not gonna we're not gonna just like leave it, you know? Sorry. But you know, and and like that also like kind of directed where I was trying to like focus on where I was going in my career, right? Because I wanted to get into into cloud security. And, you know, I I wanted to go to a company that was like going into the cloud or in the cloud and so I could learn all that stuff. Right. And there was a good amount of time until like cloud security became even like a shell of what it is today. Right. And then SaaS security kind of like came along with it to some extent, you know, like people kind of just started to pay attention to SaaS security when like AI kind of kicked off. Right. I mean, like, Danielle: absolutely. Joe: it was like SaaS security didn't even get its get its like proper, you know, time in the space, right? And now now I think pretty much everyone i is like completely behind and everyone feels left behind. Like, you know, I was talking to you know, a mentor of mine, a mentor and a friend of mine, and he's been in the space longer than me, and he's like even f feeling like he's completely behind and he started working with AI sooner than me, right? And we're in this space where really like if you don't if you don't know how to incorporate AI, use AI in your daily job. Like you're just simply going to be unemployed, you know, in five, ten years. Like that's just what it is. You know, like you think about you think about other like technical, you know, revolutions or whatever, right? Where think about like even going from like the typewriter to just like the basic computer back then. I'm sure people were like, Yeah, I'm never gonna lose my typewriter job to Danielle: Right. Joe: some stupid screen that you type. you know, keys on like none of that. Like that's not gonna happen. Right. And the people that stuck with their typewriter went into unemployment with their typewriter. You know, like that's just what it was. Danielle: Yeah, I you know it is, I mean, there's so much there to to kind of unpack. I I think though, like just kind of grabbing on to that last piece there, that that message I think is again, every knowledge worker has been hearing this for five years, right? Like automated be automated out of a job. When you're a CISO within an organization and your message has been, whoa. like let's roll this out carefully in a control pilot and let's make sure that we've properly vetted and considered the risks. Let's make sure we've got our governance committee set up first to to kind of make sure that that we're thinking about how to properly roll this out. I I think most employees have said, man, I'm sorry, I can't afford to wait. And and I think on the flip side, a lot of boards and executive teams have also said, man, we cannot afford to wait for that. Right. And so I think it what's so, so interesting again, just to of come back The like the speed and the scale of this is you have this sort of central tension within the organization, and you've had this over the past few years where I think that the security organization has felt as though you know, I I'll appreciate the security teams have been on this path of trying to get out of being the department of no, right? But I think that they sort of lost the ability to say no because the business started to move on too quickly beyond it, right? And and that that's sort of that that kind of tension that that I think is really, really palpable and really important as we think about how do we design workforce security solutions for this AI era, knowing that now if you you know try to stop the use of AI within your organization, you might be like the trade offs could be putting your business at a disadvantage, right? At a competitive disadvantage, or putting your employees in a position where they think. Hey, I don't want to work at a company that doesn't give me access to the latest and greatest tools, right? And I need to go somewhere that I can experiment and I can go fast and I can break things. So that kind of central tension of this this technology moment I think is is super important to to kind of unpack. The the kind of contrast in to the cloud transformation moment that we went through versus this AI transformation also is such an interesting one because You know, when you were early in your career, and when I was early in my career, like I was a you know, Amazon was was as far as I knew, was a bookseller or a bookstore, right? and so this the the kind of population of experimenters in the cloud and in the onset of the cloud era was was really relegated to to developers, right? Like the barrier to entry of the technology was pretty high, right? and so you really had only your most technical employees, maybe your developers who were experimenting and spent spending up you know cloud services and maybe in an uncontrolled way. And then and then we did go through this this kind of moment within SAS, and especially I think the the pandemic kind of really catalyzed this moment, which is, you know, everyone went home, everyone left the corporate network, and everyone grabbed whatever tools. they wanted to or could at the moment to to make their jobs more efficient, right? The the reduction of the barrier of entry to get access to technology in in the in the workplace has just completely eroded over the past 10 years. And so when you talk about, you know, SaaS security never really had its moment and now here we are in this in this moment of AI, which in some shape and fashion looks and feels a lot like SaaS, right? Most of your workforce is not rolling their own models on their machines. They're reaching out to SaaS-based AI tools through the browser to get work done. I mean you're you're totally right. Like we have more technology users. It's easier than ever for those technology users across any part of the business, not just in the dev environment. Anyone can grab tools, anyone can connect tools together. I can share data out of HubSpot or Salesforce. with a very quick click of an OAuth grant. you know, that because we we I don't think the the the moment for SaaS security and really understanding the scope and the challenge of that that kind of attack service really materialized in a meaningful way over the past 10 years. I think that's where kind of what contributes to this moment where now it becomes this sort of third-party AI and SaaS security problem. Because so much of of of what AI tooling employees are using right now is baked into the SaaS environments where their corporate data lives, right? again, like I'm very, you know, maybe you've got a few folks who are experimenting and and downloading OpenClaw and God help them, but most of the the folks across the business, they're gonna be turning to the embedded agentic capabilities and the embedded AI capabilities within the SaaS tools that they're already familiar with, but they're already using. They're gonna be hooking up their Agents to the remote MCP servers of all of their SaaS tools because that's where the business data lives, where the business logic lives, right? And so this really in a lot of ways is an extension of a security problem that really never got the kind of attention and the urgency that was warranted as this sort of kind of pro-sumer SaaS model just exploded over the past 10 years, right? And in the question around that, I mean, I, you know. This is not a critique of where CISOs have prioritized budget and and focus for the past decade, obviously. but I I think that, you know, there has always been this assumption within that kind of SaaS realm that like, you know, a lot of the a lot of the concerns around SaaS security, you know, these are third-party risk concerns. These are things where like if this SaaS environment gets popped, I can I can kind of point to the vendor and say like it was, you know, a a fault of the vendor. and and for whatever reason, like despite the fact that we know that like the shared responsibility model really puts the identity and the access and the data that you put into the SaaS environment in your corner, it it just seemed to be kind of a slow recognition that like, hey, outside of the like 10 business tools that we we know about and we manage at an enterprise level, like we need to be thinking about all of this, like the the other 90% of our SaaS estate that is completely you know in the shadows to us as as security and IT teams. Joe: Hmm. Yeah, I mean, you know, a lot of the times like You know, the the the way that you would like s solve a lot of those problems is essentially like having a pretty robust onboarding process for, you know, third parties and SAS tools and everything else like that. But you know, kind of like in in the real world, it doesn't really work like that because it's very slow, you know, and companies, especially now, are highly incentivized to move like quicker than ever. You know, like in in cloud security, that's kind of when the shift happened from security teams no longer really being able to say no. because you know, developers no longer had like technical constraints around them. It's like, well, no, give me access to AWS. AWS has all the resources, I can just spin up whatever I need, and we'll be fine, we'll make the progress and we're good. And so the business realized that and then, you know, kind of like put it back on us where it's like, hey, if you keep on saying no, like we're just gonna get rid of you, like that's just what it is. We're gonna outsource you, we're gonna get rid of you. It doesn't matter. And so, you know, we're kind of like already beaten into that mentality of like you have to build in controls around a really fast paced environment overall. And The legacy way of kind of managing a SaaS provider is by doing that onboarding process and saying, like, okay, well, I have to send encrypted data to you, right? Like you have to manage this key, it decrypts it so that your service can use it and I can utilize the service and whatnot. I have to manage the roles and everything else like that, working through all of that, working through all of the all that workflow and everything. and that's fine if you have like Salesforce as your SaaS, you know, solution, right? Like you you have like three different SaaS solutions going on in the environment. But it's not sustainable for really any organization to start being like, okay, well we c you know, we have to like do an assessment of HubSpot and you know all this other stuff. Right. Like it's completely unobtainable. You'd have to have an entire like Team of like a hundred people just to do that sort of assessment constantly. And you know, I'll give you an example. I was working for, you know, a really large automotive manufacturer and just their North America finance division. Like that's literally the only area that I cared about. And my CISO came to me and said, Hey, look, like we have we're using Salesforce. I think we have like three instances of Salesforce. But I don't really know what they're connecting to. I don't know the kind of data that we're putting into it or any workflows around it or anything like that. Can you go meet with this person, get like the architecture overview of it, you know, kind of like ask them security questions and figure out, you know, what's actually going on. So I meet with them, right? And I say, like, well, you you know, like, how many accounts do we have? How many Salesforce instances do we have? All this sort of stuff. And like right off the bat, he's like, Well, we have seven Salesforce instances and we're getting three more within the next 60 days and we're sharing this like private data with this other entity over here and no we didn't do any like checks we just had to make it work you know we didn't think we'd have to do any of these checks or anything. And you know I spent I the meeting went from thirty minutes to being two hours long. And like three sessions of two hours long of this guy explaining to me basically like how he broke every security rule that we had, you know, to make it work. Like, and it wasn't his fault because literally, like the CFO came down and was like, We need this right now. And he's a developer, and they gave him a a credit card and they're just like, Set it up. We don't care. Right? Like And this was something that security didn't know even happened. You know, like, and that's happening everywhere. If that's happening at a multi-billion dollar company that's global, right? And I'm in one little tiny division of that company, then you can't tell me that like some random startup is doing it better. It's like, no, they're doing the same thing. Like put it on a company card and move on. Danielle: Absolutely. Yes. I mean, this is what you just described is is the rule, not the exception, right? And it has been for many years. And without fail, we we've evangelized a lot of folks at Nigel Security who will come in and say, you know what, we've got a really good handle on all of our important business applications. It's okay, well let's, you know, let's start a trial, let's spin it on. It takes, you know, less than a day to get a full visibility of of what's actually going on. And the the types of surprises that you find in that estate are are pretty eye-opening, right? you know, from the third-party risk standpoint though, what that what you just described, like a best in class TPRM program, just on the the kind of cyber risk piece, is about like 30% of the whole estate goes through some sort of vendor security review, right? there's there's so many programs that are still very much stitched together with spreadsheets. And then our very like point in time. Okay, we do this review for about 30% of all the vendors that we actually work with because we only know about you know 50% and then we kind of can only handle the you know the top ones. that still is only like a point in time of that vendor security profile, which we know changes dynamically across or across the course of a year or or however you're doing those kind of snapshots, right? So things like this technology provider SOC2. report might expire halfway through our contract with them. Do we have eyes on how to get that, you know, refreshed? There might be a you know data breach that the vendor experiences. They might sh add new AI features into their product that change the data privacy or the data policy or the subprocessor agreements within that vendor. That the there's rarely do we find kind of an always on or kind of continuous TPRM program that really does scale. and and kind of run across all of the the kind of third party vendors that employees are are bringing in. And to your other point, most of the most of the decisions we actually see being made within the enterprise around technology adoption and use are completely decentralized and and completely circumvental processes. To your earlier point, those processes are way too slow, right? I've worked in a large enterprise as well and we had our you know internal technology a portal that you're supposed to use to ask for permission to use a new SaaS application at work. And and you know, we kind of thought about that as a black hole, right? Like your request went into that. And then, you know, if you really needed to get a job done, you found creative ways to to kind of work around that. And three months later, after you fully onboarded the tool that you wanted to use in the first place, you'd get a return email that just said, no, you can't use this tool, right? And so that sort of time delay, like again, at the speed and the scale that the workforce is operating because we lived in the in now in this like hyper decentralized IT kind of decision making world, that is something that I think security teams and IT teams have just been scrambling to contend with for you know for many years now. So and then to your point around like just when you even dig into one environment, like one Salesforce environment, right, which no one's going to like It's very it's rare that any organization would not know that they're using Salesforce, but to your point, how many instances? How are each how is each instance configured? Who has access to each instance? Who are my admins? How like what's integrated into this instance of Salesforce? It's it's the you know that test tenant of Salesforce or Snowflake that you know didn't have MFA enforced or that you know was integrated with you know with with Sales Loft or Versell or whatever. Third party integration is getting popped through OAuth kind of grant compromise. You know, those those are the things that really come back to to kind of bite security teams. And it's also, I will say, this this kind of complex mesh of kind of shadowy, you know, applications and integrations and and app to app integrations and access. This is a place that I think threat actors have really set their sights on. in recent years. You know, we're we're all so concerned right now in this kind of post-mythos mythos world of hey, we gotta, you know, accelerate our our Vul management, our patch management processes. we can point to so many examples where attackers are are not really targeting vulnerabilities in zero days because they can just as easily, you know, find a way into a SaaS environment through, you know, through compromise credentials or a poorly configured SaaS environment or some third-party. you know integration that that they can you know compromise the OL token for. So it's that kind of complex mesh that I think that becomes a a pretty sizable attack surface for organizations. And and whether or not organizations think about this as an AI security problem or an AI or a SaaS security problem, I think is kind of one in the same. And that root root kind of problem statement is that your workforce is able to make decisions on a daily basis. without the permission or the oversight of IT security that do carry risk and bring risk into your organization, right? Joe: Yeah, it's You there there's like a couple things there, right? So you know, we're whenever we're talking about mythos and like I've I've had like br people bring it up to me before, like, I'm worried about this thing or whatever. You know, you you're worrying about the wrong things, right? Like if you are worried about, you know, some bad actor using a model to find a zero day in your environment, you know, so that they can get in and whatnot, well, like Guess what? That exact same thing can happen to all of your competitors. So if you're just the target of the day, you're the target of the day. You know, hackers are smart people, and we're also like extremely lazy in terms of we're not gonna go for the highest level fruit possible. No, let me let me go fish someone and I'm gonna go steal all their tokens. And then I'm gonna go get into everything. And guess what? It's probably gonna be automated because I want to go eat something while you know this hack is going on. Like I don't need to sit there and watch it, right? Like that's just how it is, and it's always been like that. Now, you know, LLMs and AI models, they're making it a little bit easier and they're making it more accessible to everyone because, like, you know, before For you to be a hacker, like you'd really have to know you know coding pretty well, you have to know different systems pretty well, like you have to understand the tool sets really well. And now what we're running into is you know, like a script kitty can literally just spin up, you know, Claude with a with a you know twenty dollar gift card or whatever, and now they have like a full blown reconnaissance package, you know, created because they convince Claude. no, this is just for research. You know, it's like totally fine. And, you know, the these these owners and these CEOs, they come out like every other month and they're saying, like, yeah, it's more secure, we protect it better, it's identifying all these issues more. And it's like, look, you know, I I don't focus on AI pen testing myself, but if someone like myself that Is just nefarious enough just to get things done, right? Can figure out how to manipulate this model and bend it to my will, like with relative ease within 30 minutes, like it's doing what I want it to do. And taking me 30 minutes because I'm not an expert, because I'm like not doing that all the time, right? Like, then whatever your controls are are not gonna work, right? Whatever their claims are are just false. Which I always laugh whenever they tell tell us that like security people are gonna lose their jobs in six months. Like, okay, I'll wait another six months, you know. and and then, you know, on the other side of it, right? Like, there's people like like Pliny the Liberator on on X that literally posts these jailbreaks every single day of these models, right? Like Anthropic comes out with a new model, they claim it's more secure than ever. Within two hours, Pliny has root access on this model and it's doing whatever it wants. It's telling it the recipe to make anthrax, like, you know, insane stuff, right? But that's the world that we live in now where, like, you know, anyone can get access to these things. It's no longer like kind of a walled garden or, you know, gated knowledge to some extent. I mean, like before, you know, you'd have to spend like a long time really learning this stuff. I mean, it would take you years to learn it, right? Like it's that's not a month, that's not a summer vacation for these kids. You know, like it's literally these kids not having lives and learning it, you know, and really becoming experts at security and whatnot. And now it's like, no, I don't even need to know what the code is doing. Like, you know, for for my dissertation, right? Like Grok has been helping me a lot. and it I I put the code that Grok gave me into Claude and I said All right, find the issues with it. I need you to do like X, Y, and Z with it, right? Claude immediately was like, Well, this is a really good template, but it doesn't doesn't do any of these things that like you need it to actually do. And so that, you know, 30 minutes later, Claude spits out an absolutely perfect like model. And it's perfect in my eyes because I'm not a dev, right? I'm sure a dev would look at it and be like, well, that's inefficient or whatever, you know. But for me, my goal is that it works and that that's like it. You know, that's like that's the world that we live in now, you know, where where you have this like I I would say like a year one PhD scholar at at your fingertips at all times. Danielle: Yeah, absolutely. And and I think that like, you know, all the things we have talked about, how the barrier to entry to get access to AI tooling across the entire workforce, folks who are non-technical business users, that's a big challenge. your third party vendor estate that you didn't have visibility of on and now they're all launching their own embedded AI capabilities, that's another problem. But your point there is is is super critical, which is this has also lowered the barrier to entry on the attack side or on the threat actor side, right? And and I think that what we kind of have recognized in the industry is like very quickly security vendors and technology builders need to also figure out how to leverage agentic capabilities for the defenders, right? Because this is a speeds problem, because this is a scale problem. And as much as you know that might be true in this kind of like v zero day versus patch management race, I think it's also true in this kind of general risk surface of third party AI as well. And and and I kind of want to give you a few examples of how we're thinking about some of these problems. So let's just take Again, coming back to this like mesh of OAuth grants that any employee can can act as a grantor in like one, two clicks, connect an agent to all of their SAS data, or give you know some AI note taker access to everyone's calendar, or or you know, give an a c code tool access to all of our GitHub repos. So we're at this point where because that that capability, that kind of decision that's happening within the workforce. is so at scale and so decentralized. A lot of organizations that we work with are sitting on something like a hundred thousand plus individual OAuth grants that constitute some amount of data access, some amount of data exposure. This is a a surface that we have seen threat actors taking advantage of because no one's really got eyes on on mitigating the risk of this the surface, right? So if you look at you know the past few high profile data breach disclosures related to you know the sales loft, sales drift, sales force breach, the Vercel attack, the I'm forgetting Clue was the most recent one. It it really is like let's let's attack this this kind of entry point of these unmanaged, unmitigated, persistent grants that are connecting you know, third party tools into our critical business applications and data. And then we can kind of come in through those less secure third party tools or we can kind of compromise the the auth in the middle. that but but like so that is a you know an attack path that that at scale, you know, we see threat actors starting to take more advantage of that using tools to to kind of reduce the barrier to entry to to kind of attack that that weakness. within the organization though, I don't know about you, Joe, but like I don't know many security teams who have full-time staff members who are dedicated to sitting there and reviewing the scopes and the permission of every app to app integration or every OAuth grant. All right. And and even if you could, right? Like at scale, at a hundred thousand OAuth grants, I don't know many security practitioners who want that job either, right? Yeah. And so this Joe: Yeah. Yeah. I I don't think anyone would want that job. Danielle: No, and I don't think you could hire for it. And I don't think a lot of CISOs are gonna go to their board and say, hey, we have this this you know large unmitigated risk surface, and I just need five FTEs in three years and I'll have this problem solved, right? Like that's not a realistic conversation. And so this is a prime example of a great starting place to leverage agentic capabilities to really think about what are those sort of tier one analyst type of activities that you would expect someone to do to analyze an individual auth grant. So not just, hey, what are the scopes and permission? What's the risk posture of the authorizing app? What's the risk posture of the authorized app? who's the grantor? Does the grantor have privileged credentials into this environment? So if this credential, these entitlements do get compromised, you know, it it represents additional risk. What's the business case, right? How do we know, like, why did this user grant this integration? What were they trying to get done? What is is there a real reason? You know, you talked about sitting with your Salesforce admin for two hours to do that type of discovery work. So, there again, like. times that by a hundred thousand unique business cases around every grant. And this is this becomes an untenable problem at scale to even start to address. And so here, this is where I'm really excited because, you know, obviously what we're doing at national security and and kind of what I I see the opportunity for is to really use agents to build those sort of tier one analysis type of or risk analysis types of of jobs, right? To say like, hey, anytime we see a a overly permissive or highly permissive connection between two applications. My job is to go analyze that, understand the nature of each of these apps, understand the scope, the nature of the scopes and the permissions, the entitlements, reach out to the grantor directly and say, hey Joe, can you help us understand what you're trying to get done here? That agent can take that into context as well, consume that business context, and kind of like spit out a pithy decision, like, hey, this is too risky. It's you know it's against your policy and the business value just isn't there. Recommend, you know, tearing this down. and then and being able to kind of follow through with that revocation pro progress at scale in kind of a continuous motion, right? With the right human in the loop type of of oversight from a security team. Obviously we don't want to break business integrations unnecessarily. But this is the type of like at scale kind of risk reduction activity that we think is is just so ripe. for using agentic capabilities for the defenders, right? So this is, you know, this moment right now, from an in an AI security standpoint, I know we're not the only, you know, technology provider that's looking at how do we reduce large swaths of risk or kind of cut down risk that really no one's no one's doing. It's not about making a security analyst five times or ten times faster. It's about doing the jobs that no one is tackling right now, right? Or because they're on 10 of what scale. And because they these are things that happen every day, those are the I think the the areas where we can start to kind of tighten up and use more agentic capabilities to kind of reduce the risk, take the jobs off the plates of the actual security teams, in order to kind of you know, lessen the risk of of this broad attack service that, you know, is really representative of the decisions your employees are making every day. So Joe: Yeah. Yeah, it's funny because, you know, I I I get on calls with customers, you know, every single day. And like I I'll ask when it's AI focused. I'll I'll just say like, all right, well, you know, how many agents do you have in your environment? What what's your SaaS apps look like? What you know, AI models are you using? And like I'll I'll just ask how confident are you in your answers? You know, and and like Typically the ones that are, you know, f honest will say like, I'm pretty sure, but I'm not, you know, a hundred percent, right? Like and and that's always like a probably the best answer. I I had one person who was like super confident that, you know, it was a certain amount of like apps and models and everything. And I I just said, All right, well, like, let's just hook up nudge real quick, you know, and And like we'll see. In a couple hours, we'll just see. We'll t get on the phone tomorrow. You know, and we get on there and it's like ninety percent of it in there, he didn't even realize was in the environment. And I'm sitting here like, you know, I was telling you, hey, if you're using Salesforce, you're probably using their agents. If you're using this, you're probably you probably have these connections, right? And you know, that they always like swear up and down, right, in this situation at least when they're like overly confident. They always just like swear up and down, yeah, like it's not happening, not here. Our people wouldn't do it, our people are trained better, they know better. It's like they're people at the end of the day. They don't want to get fired, they want to do a good job. Like typically most people want to do a good job, right? So like they're going to find a way to get something done no matter what. And you know, like earlier on in my career, I was deploying a A web proxy solution, like a cloud web proxy solution. And my manager was like, Yeah, no matter what, people cannot send, you know, any data to this to to whatever like file share system he he named, right? And I'm sitting here, like, you do understand, like, one, like, I'm in security. So when you say I can't do something like My mind immediately goes to how can I do this? Right? Whether it's gonna piss you off or whatever, like I'm gonna have fun with it. You know, even if I get called into an office by HR, like it's gonna be fun at the end of the day for me, you know, like that sort of thing. That because that's the mentality though that an attacker has. That's the mentality of a potentially bad actor where it's just like, you said I can't do what? Like, okay, well, I'm gonna go try because like Hackers have a real problem with authority, like a real problem with someone telling us we can't do something. And I don't know what it is. I've always had that, like had so many problems. I'm sure my mom just was like so Danielle: Yeah. Joe: fed up with me at at points in time. But, you know, like that's the mentality, right? And by the end of the day, like within like two hours, you know, I found different, like five different ways of how I'm gonna exfil this data, right? And He was like, but that, you know, you can't actually like, you're not gonna get to like real data. I was like, you want me to get to real data? Cause like I'll go get to real data right now, you know? Like, and so like I I just showed him. I was like, Well, you said I can't have access. I got access, like right over here. You know, like I just started like enumerating the environment like in front of him because he was just so confident. Yeah, you cannot do it. I blocked it at the network level. It's like I don't. care what you did, I'm going to get around it. You know, like that's the whole point. And it kind of like just like cracked open his his mind a little bit to like the capabilities because he always viewed everything from a from a networking perspective. It's like, well, guess what? Like you may have the network locked down. That's great. But you don't have Telnet locked down on the core router of our environment. And so do you really think it matters when you like encrypt all the network traffic, like it's all TLS, but when I get to the core router it's telnet and I can get right in and from there I can make any path I want, you know, like this is the stuff we're talking about. Danielle: I I man, I I appreciate the the sort of hold my beer mentality when Joe: Yeah. Danielle: someone tells you no. you know, Joe, Joe, I hate to tell you, like you're not unique in that. Like this is well researched, just fundamentals of human behavior, right? there's there's kind of we we work with some very smart folks who work in in kind of behavioral psychology out of out of Duke University, one of our advisors. And we talk a lot about things like reactance theory, which is if you tell someone no, they tend to or if you s if you take away what someone perceives as a freedom, right, and they start to feel their freedoms constrained, right? it is not a willingness of like, yeah, sure, I'll comply, of course, just because you set a policy, Mr. CISO, of course I'll comply and do exactly what you say and trained me on six months ago. no human behavior, like when we perceive our freedoms being infringed upon, we tend to react negatively to those and try to find solutions. And like this has been well studied even within the cybersecurity kind of awareness space. I think even Gartner had a stat that like 72% of employees admit to bypassing or working around security controls in order to get a job done. And I think that the danger is that you you know, you know, we all heard this sort of this this kind of trope of like the stupid user or or like everyone in my organization is a threat to me. this is not really about malice. I mean, it seems like in your case you were kind of like, let me show how weak your security is, Joe: Yeah. Danielle: because I'm I can do it. But I think in general, like most employees when they decide to circumvent or override or not accept a security policy is because they don't agree with it. Or they don't have an understanding of the risk context, or they do and they're making that decision that the trade-off is worth it because they've got a million dollar deal on the line and they have to use, you know, this file share tool that you said no to in order to get that paperwork done. And it's better to ask for forgiveness later because they know that the, you know, the CRO will back them up in that conversation. And so when we kind of look at this kind of picture, this is not about your workforce. being stupid and not understanding cybersecurity or pay like you know following your your policies you know blindly it it's not about people being nefarious either it really just is that tension of incentives right your employees are not incentivized first and foremost to do the most secure thing your workforce is incentivized first and foremost to get their job done. And if your security policies and your security controls are too inflexible and they they prevent people or inhibit people from getting that work done without a good reason or good justification or explanation, people aren't gonna gladly work around this. And and I don't think that this like we all hire very smart people. We all work very hard to make sure that the people who are are doing sales and marketing are making as much money for the business so we can continue to have a paycheck, that you know everything is is you know humming efficiently. So this is this is again just a misalignment of incentives within the organization. And I think where we're kind of where we come from is the idea that this the design of our security programs and the security of our or the the design of our security controls and even that employee interaction and how employees perceive that policy. Do they perceive it as an infringement upon their freedoms? Or do they receive it as an understanding of the business context surrounding that risk, along with a pathway or a choice to do something that's less risky? Those are the types of interventions and those are the types of kind of controls that we can build and implement in our security programs. The challenge that we've had is I think for the past 30-some years, security teams have really had only one tool at their disposal, and that is some sort of a firewall, right? Which is I can block this or I can allow this. Those are my two like fundamental binary options. And then within that you get all sorts of shades of gray where now you've got exception lists in your firewall that are, you know, six miles long, right? And so we've all kind of like lived lived through that. I I think that mentality of like I only have two choices. I can either block this thing or I can allow this thing. and let chaos prevail. Those are kind of false ultimatums. And I think it really just it takes a better understanding of of of like what are those those motivations, what are those incentives that your workforce has, what is the pace at which the business needs to operate, and then how do we design a security program that has puts in place the right controls, but that aren't just a binary control of like, No, just block it, right? Block it because I said so and that's it. That that type of approach to security is what creates more shadow IT. Like everyone's had swigs and and Casbies and firewalls for you know 10, 20 years now. We have more shadow IT within organizations than ever before, right? So at the end of the day, something something isn't really working and it's it's not that your employees just need to be trained more, right? I think we need to start to take a little bit of a a different approach to how we think about you know, the aligning the security controls and enforcement tools that we have to the the actual like calibrating that to the risk and calibrating that to the business context as well. And of course, you know, figuring out how to use agents to really do that at scale and just in time within that employee experience so that security becomes a sidecar to that experience is is the opportunity and and I think is a real possibility. And obviously we see that in our own customer base as well. Joe: Yeah, talk to me about how Nudge is addressing like the agent, the the agentic AI slash like SAS problem, right? Because whenever I talk to customers about Nudge, I always kind of start with like from the SAS perspective, right? Because I I think people often kind of miss it or miscategorize AI and they think it's You know, in in some respects, like yes, it is a different security stack, it's a different tech stack, you know, but like the most common way that we're using it is through agent based models in these SaaS platforms, right? And so, you know, I I always start with saying, like, hey, Nudge started as a SaaS security vendor, right? Like they built out the platform around that, and then as AI became a thing, you know, they they naturally added in that functionality rather than someone else trying to bolt on these things. They like already had, you know, kind of like the platform, the groundwork already there, which, you know, benefits benefits you guys a lot because you're able to scale properly. You're able to interact with these different, you know, integration points properly, which, you know, I've seen the other side of it, right? Where a company just gobbles up a whole bunch of other solutions, whole bunch of other companies. They call it something different. And now they're trying to make it work on the back end. And it's like these five dispert, you know, solutions that they're trying to just like bolt together and hopefully it doesn't break, which really only works in their test environment that they're working on. And as soon as you put it into anyone's real environment, that is scaling up and down rapidly, that's, you know, growing over time and everything else like that. Like, it doesn't work. You know, and like I I've seen it firsthand, I've interacted with it firsthand, and I absolutely hate solutions like that. So that's why like when I saw, you know, nudge security, I I felt like it was a natural it was a natural capability. It was a natural not pivot, but like add on capability and functionality to the platform. Danielle: Yeah, for sure. I I would say y you're spot on, right? when when I think back to like twenty twenty-three, we started to track what we kind of considered AI native apps or AI native SaaS apps, right? Third party AI tools that employees were signing up for most of your browser based experience, right? So it looks and feels a lot like SaaS, right? and and that wasn't any additional cost to us to build because it it was fundamentally a a challenge around SAS. And and certainly, you know, the the the evolution of AI has taken us into really new and interesting territories related to who's building agents, who's entitling agents with tools and permissions, how are we connecting aid AI tools that maybe are running locally on our our machines to SaaS data sitting through that remote MCP connection. And so But but all of everything that we have done has really been a creative to to being able to understand that that broad attack surface, right? And and I think this is the part, you know, when we look at the AI security vendor landscape and sort of there's an an you know, a new startup every single day to solve some piece of this, right? Because this is an emerging technology space and so it makes sense. But I do think that if you're only focused on solving the AI security problem, you kind of you miss the larger context, which is you you really, you know, you can't solve the AI security problem, the workforce AI security problem without understanding your s your workforce kind of SaaS technology adoption, right? So our vantage point has always been about our kind of our our our point of observation is what we kind of consider the workforce edge, right? It's not your network edge, it's not just the identity edge because it it it kind of it consumes more than just identities. But really it is about like what are those decisions that individual employees are empowered to make autonomously every single day in a decentralized way that is hard for security and IT teams to kind of get their arms around from a visibility standpoint, from a risk assessment standpoint, from a governance standpoint and kind of a remediative standpoint. That is the place where where we believe security really needs to operate. Again, as a sidecar to that employee. We're not we're not gonna go back to a place where employees you know are going to ask for permission to to do every every single thing within a SaaS or AI tool, right? Like that's never going to be a reality again. and so we need to think about again, how do we how do we inject security, both observation, assessment, decision making, processing, and and kind of the right temperature of enforcement controls directly into that employee experience just in time. And just to kind of envision what this might look like in practice, like Joe, let's say you reach out to a new AI tool that's never been seen before in the market. Can we, as you are signing up for that, make a determination within your browser experience about what's the posture of this vendor, right? what is what is Joe trying to get done? Maybe we ask you a quick question, Joe, what are you trying to get done here? Maybe we encourage you to say, hey, like we already have a tool that looks similar to this, that your colleagues are. already using that we've already vetted, can you off-ramp and go use that tool? Let's try to, you know, move you over to the right approved tool first. and then if no, like I need I need this for some business justification, then how do I kind of calibrate that decision of like, yeah, we can let you use this for 90 days or it provided that you don't connect it to our source code or provided that no one else, you know, you don't share sensitive data with this tool. And just so you know, like we have that visibility point. So if we see you start to do those activities, we can start to course correct on that. Those are the types of kind of like local just-in-time decisions that again, no security team can sit over the shoulder of every employee and kind of sit there and make those with them, nor can they entertain a backlog of a hundred thousand decisions that employees have made and try to one by one work those down. So we need to think about how do we get security. kind of designed and embedded at that workforce edge so that we don't slow down the business, but we also don't say, you know, have at it, go wild, you know, security be damned, do what you want, right? There is a there is a way to kind of walk that line. And it really comes down to how we design that kind of the the that that continuum of discovery policy design policy control. Policy enforcement and most importantly, policy experience or how the end user perceives and reacts to that policy that you're putting in front of them, right? And and I think this is just about building smarter security at the end of the day in a way that works at the aligned with how employees actually get work done in a modern environment at the speed and the scale that that the enterprise wants to work at. It's it's possible. And and certainly Joe: Yeah. Danielle: using AI to advance that and make that decisioning even faster. is a really exciting proposition for security teams and and third party risk teams as well. Joe: Yeah, if you if you're not meeting the company where they are or the users where they are, like you're just going to cause more problems. You know, you're gonna cause a lot of friction internally and everything. And it's always a mess because then as soon as your s your security solution, you know, gets a bad rap in the environment, to be like, well, you know, you don't wanna like you don't want to interact with the solution at all because it's gonna add an hour to your day. Just to do basic work that you wanted to do before or that you were doing before, you know, like that sort of thing will kill a tool in an environment quicker than like a technical failure, you know. and I've I've seen it firsthand too. So it it definitely makes sense how Nudge approaches it for sure. I really enjoyed our conversation. Danielle: Yeah, Joe, thank you so much for giving me the opportunity to come on and chat. This has been a a really fun conversation to have with you. Joe: Yeah, absolutely. Well, you know, before I let you go, how about you tell my audience where they could find you if they wanted to connect with you and where they could find Nudge Security if they wanted to learn more and sign up for that that free trial that I actually you know, push it a a little bit myself. Danielle: Yeah, absolutely. Well, let me start with that. so nudge security.com. you can sign up for a free trial without talking to anyone internally. and what's really cool is one point of integration into your your workspace provider, whether it's Google workspace or Microsoft 365, will give you a full historical inventory of where where all the SaaS bodies are buried. with usually within a few hours, maybe a little bit longer if you're very large. Company with a lot long history of email. If folks would like to find me, obviously I spend too much time on LinkedIn as most professionals do. But you can find me at I think it's Hello Danielle is my my slug on LinkedIn. So Joe: nice. Danielle: always happy to chalk shop, always happy to be challenged in some of these kind of concepts related to how we solve some of these human elements of cybersecurity moving forward. but also just so stoked about how AI can help you know create a better a better approach to security for employees and security practitioners alike. Joe: Yeah, absolutely. Well, thanks everyone for watching or listening to this episode. I hope that you definitely enjoyed the conversation. I I know that we did at least. and go ahead and check out you know nudge security and danielle at the links provided in the description of this episode. Thanks everyone. I hope you enjoyed the conversation.