Replying to
@briankrebs It's more important now than ever that AI agents have good governance, are used responsibly and monitored appropriately.
Productivity is nice, but security still matters.
Remote
Hummingbird Security
@HummingbirdSecurity@mastodon.social
mastodon 4.8.0-nightly.2026-10-06Saas innovation for digital defense. Sign up for our newest product, Auth Sentry's Monitor tier for FREE ID Monitoring. Upgrade for complete, explainable investigations. Predictive intelligence +more
0 Followers
0 Following
24 Posts
Joined March 09, 2026
Most identity security tools focus on human identities or non-human identities. Attackers don't make that choice.
A real attack chain: social engineering call gets a password reset. That access authorizes a new OAuth app. The OAuth app pivots to a service account with broader permissions.
Three identity types. One attack. Most tools see fragments.
Auth Sentry monitors both in a single graph: gethumming.io/how-it-works
#IdentitySecurity #ITDR #CyberSecurity #NHI
Access reviews were designed around a the idea that every identity belongs to a person.
Service accounts don't have managers. OAuth tokens don't have offboarding triggers. API keys don't map to anyone in your HR system.
The governance model simply doesn't transfer cleanly to machines & without visibility into what's actually there, review season becomes a lot of approving things nobody fully understands.
Auth Sentry Monitor is free: gethumming.io/Monitor/
#IdentitySecurity #ITDR #CyberSecurity
Every time someone on your team connects an AI tool to their work account, a new OAuth identity gets created in your environment.
It doesn't expire when the tool stops being used. It doesn't get caught by standard offboarding. It just persists, holding access nobody's monitoring.
In most orgs, NHIs like these outnumber human ones. Most were never inventoried.
Visibility is step one. Auth Sentry Monitor is free:
gethumming.io/Monitor/
RE: @briankrebs@infosec.exchange
Breaches can have far reaching consequences - not just on your business, but on the lives of your customers. If you've been putting of adding a continuous identity monitoring layer to your existing security stack, now's the time - especially amid the current heightened attack cycle brought on by the conflict in Iran.
Replying to
@briankrebs Thanks for raising awareness on this.
Voice phishing is now one of the most effective initial access methods in recent incident data.
The attack doesn't beat your technical controls. It convinces someone to bypass them.
No suspicious login. Nothing to filter. A valid credential, handed over through normal procedures.
What IS detectable: behavior after the handover. The attacker doesn't move like the legitimate user. Auth Sentry catches it.
gethumming.io/how-it-works
You already know it's there.
The unreviewed service accounts. The abandoned tokens. The access that should've been cleaned up when people left but wasn't.
The gap between "we know" and "we've acted" is one of the most common realities in security
operations.
Not a motivation problem. A visibility and prioritization problem.
Auth Sentry Monitor was built for this moment. Always free, no sales call:
gethumming.io/monitor
Attacker hand-off times have dropped from hours to seconds. Dwell times are rising. Attackers are moving faster when active, while staying hidden longer during persistence.
They're not racing your detection window. They're operating comfortably inside it.
Detection that waits for a breach event is already behind. The window is during persistence in the behavioral signals that appear before the objective is reached.
That's where Auth Sentry operates: gethumming.io
#ITDR #CyberSecurity
You already know it's there.
The unreviewed service accounts. The abandoned tokens. The access that should've been cleaned up when people left but wasn't.
The gap between "we know this exists" and "we've done something about it" is one of the most common realities in security operations.
Not a motivation problem. A visibility and prioritization problem.
Auth Sentry Monitor was built for exactly this moment.
Free. No sales call: gethumming.io/monitor
#IdentitySecurity #ITDR #CyberSecurity
Trivy supply chain attack: Aqua rotated credentials to cut off the attacker. The attacker stayed in using valid logins.
Mandiant: 1,000+ impacted SaaS environments.
Credential rotation is the right response, but not sufficient when the attacker already has valid access that looks legitimate to everything watching.
Behavioral detection during the persistence phase is the other half.
Try us free: gethumming.io
Full article: 👇 https://cyberscoop.com/trivy-supply-chain-attack-aqua-downstream-extortion-fallout/?utm_source=dlvr.it&utm_medium=twitter
Identity debt is the accumulated cost of decisions that made sense at the time.
Abandoned OAuth tokens. Service accounts from old projects.
Over-permission fixes that would've taken time no one had to fix...
Pragmatic then. Compounding now.
Like code debt, you can't prioritize what you can't see.
Auth Sentry Monitor inventories human & non-human identities, blast radius analysis, & relationship mapping FREE
gethumming.io/monitor
Most identity threat detection fires after the attacker has authenticated.
By then, you're not preventing anything, you're containing it.
The behavioral signals that precede an identity attack are detectable earlier. A password spray generates a distinct pattern across providers during the attempt phase, before a single login succeeds.
Sub-5-second detection. Complete investigations, not raw alerts.
gethumming.io
That's just mean, John.
Your IdP tracks the identities provisioned through it.
OAuth tokens granted directly by employees? Outside its view. Service accounts in cloud infrastructure? Not in Okta. SaaS-to-SaaS integrations? Authenticating independently.
Your IdP reports on what it knows about. It was never designed to see across systems it doesn't control.
A full identity inventory requires connecting across providers not just reading from one.
Get Auth Sentry Monitor free: gethumming.io/monitor
#ITDR #CyberSecurity
Something worth thinking about:
New phishing research shows attackers are now deliberately generating alert noise during the investigation phase, not to evade detection, but to delay response to it.
Alert fatigue isn't a staffing failure. It's becoming a calculated attack vector.
The fix isn't more analysts. It's detection that doesn't wait for a human to clear a queue.
We can help. ➡️ gethumming.io
Free tier & 7 day trials of premium features
RE: @briankrebs@infosec.exchange
As we mentioned in our threat bulletin, it is more important than ever for businesses to protect themselves - even if they earnestly believe that "hackers wouldn't care about their business" and they "wouldn't be a target." Read more and find out what you can do here: https://gethumming.io/blog/iranian-apt-threat-bulletin/
What does a real investigation look like?
200 correlated alerts. 2 identity providers. Auth events from 4 countries in 40 minutes. Rules firing across 3 attack patterns at once.
The first 10-15 minutes go to reading. Building the picture before any response is possible.
Auth Sentry AI Analysis compresses that to seconds. The AI reads & suggests next steps. The analyst decides.
Try free for 7 days:
gethumming.io/how-it-works
New from Auth Sentry: AI Analysis.
When a complex investigation comes in with 100s of alerts, & multiple rules firing, auth events across countries, the first job is just reading. Building the narrative before you can act.
Our AI Analysis does it automatically. Plain-English report & disposition recommendation with visible reasoning, next steps scoped to your active integrations.
Available on Predict now - try free for 7 days
gethumming.io/how-it-works
Why did Gartner introduce IVIP?
3 things shifted at once: non-human identities exploded past what existing governance can track.
Zero Trust moved from strategy to operational requirement, boards & auditors started requiring real-time answers about identity posture that spreadsheets can't provide.
The visibility gap existed before. Now the cost of leaving it open is much higher.
The window is open. Get started now for free at:
gethumming.io
Gartner named a new category last year: IVIP — Identity Visibility and Intelligence Platforms.
IGA, PAM, authentication, secrets management - each solves something real. Each creates its own silo.
IVIP is the intelligence layer that makes the rest legible. Not a replacement. The missing piece.
Less than 5% of companies have adopted this so far, but it's worth understanding what it can do for your company.
Find out how we can help:
gethumming.io
#IdentitySecurity #IVIP #IAM #CyberSecurity
Replying to
@i0null@infosec.exchange inspired.
Replying to
@LovingFalloutLondon1954@mastodon.social The real question is: was it good?