#cloud

3 posts

Identity-First Attacks: The Kill Chain Defends Five Stages the Attacker Skips

The 2011 kill chain trains you to stop malware at the perimeter. Identity-first attackers skip five of its seven links and log in. What to defend instead.

May 15, 2026 · 15 min read

#identity #threat-landscape #cloud #lateral-movement

threat intel advanced T1552.005

Workload Identities Have a Home Address — So Watch Where They Get Used

Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host — use from elsewhere is theft.

Apr 20, 2026 · 12 min read

#nhi #workload-identity #cloud #sigma

threat intel intermediate T1078.004

45 to 1: Non-Human Identities Are Your Biggest Detection Blind Spot

You have ~45 non-human identities per human — and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.

Mar 15, 2026 · 17 min read

#nhi #identity #cloud #ai-agents