Nudge Security

📣 Today's press release recaps highlights from 2024, which include more than doubling our customer base and tripling ARR! Thank you to our customers, investors, partners, and friends who have provided invaluable feedback and support along the way. 🙏🏻

A CMDB tells you every VM you run. It tells you nothing about who can read your customer data. Our 2027 prediction: the attack surface isn’t a list of assets anymore. It’s a graph of grants, created in a few clicks with no sign-off.

A vendor gets approved for one narrow use case. 18 months later it’s got broad access, company-wide adoption, and AI features nobody reviewed. The paperwork still says low risk.

Avg company has 2x more SaaS apps than employees. 60% were never sanctioned. An annual vendor review can’t keep up with that, or with how fast the vendors it does cover actually change.

Only 30 to 40% of SaaS and AI apps ever get a formal TPRM review. The ones that do are assessed once, then left alone. Adaptive risk management adjusts controls as risk changes, not when the next review comes due.

OAuth grant numbers worth sitting with: 88 per employee, 31 with data-level access, ~45 min to review each manually. Do that math at scale. Manual review was never going to keep pace.

You approved an app in March. By June, someone invited contractors, uploaded sensitive data, and connected an AI agent with one click. Same vendor. Very different risk. Here's a breakdown of how Adaptive Risk Management keeps up:

Gartner: half of all SaaS breaches will trace to overprivileged OAuth tokens by 2027. You can’t review a grant you don’t know exists. Dormant grants and stale integrations don’t show up in logs. Wrote about it for @BleepinComputer

"If a SaaS app gets breached, that's the vendor's problem." Nudge's Danielle Russell on Security Unfiltered: it never worked that way. In reality, security built programs for the 10 apps it knew about and still owned the other 90. Full episode here:

Manual review of one high-risk OAuth grant: 45 minutes. Verdict: revoke. Same grant through our new AI agent: 15 seconds. Same verdict. Average employee has 88 OAuth grants. 31 touch data. Nobody is reviewing those by hand. This will help ➡️

TPRM didn't break because of AI. It was already broken. We assessed vendors, never usage. We screened on scores that measured their marketing site, not your data. We triaged and hoped. The score is about them. Your exposure is about what you gave them.

Most vendor reviews are accurate for exactly one day. After that: new OAuth grants, teams, AI features, & agents. Nothing triggers a second look. Adaptive Risk Management in Nudge Security re-scores risk as it changes & tells you what to fix first.

Three questions before connecting any AI tool: what can it see, what can it do, who owns it? Good framing. The catch: those questions get answered on a consent screen, by one person, right before they click Allow. Not in a review.

Your team approved that SaaS app 6 months ago. Since then: new integrations, new users, an AI agent, and data nobody signed off on. Risk doesn't stop at approval. Most programs stop watching right there. Today, we're launching Adaptive Risk Management:

Today, Nudge Security is introducing Nudge AI Agents that take crushing, repetitive work off your team's plate — OAuth grant reviews, browser extension triage, vendor risk analysis. Agents assemble! Learn more here:

🎉 We're thrilled to announce our $22.5M Series A funding led by Cerberus Ventures, with participation from Ballistic Ventures, Forgepoint Capital, and Squadra Ventures. Many thanks to our customers, investors, and supporters. Stay tuned!

As the adoption curve for GenAI continues to bend skyward, the risk of a cascading, AI-fueled cyberattack is becoming a more immediate threat. This OpEd in @theinformation by @russellspitler explores this risk (subscription required): #ai #ciso #infosec

2024 has brought an unprecedented spike in identity-based attacks against #Okta customers, as well as attacks exploiting misconfigurations in Microsoft 365 and Google Workspace. Learn how Nudge Security can help: #iam #sysadmin #itdr #ciso #macadmin

🔥 Hot product news! We've extended our security posture management capabilities to include Okta, furthering your ability to harden your identity infrastructure with Nudge. Learn more here: #iam #okta #sysadmin #sspm #ciso #cio #grc

You know that feeling when you find $20 in a pair of jeans you haven't worn in awhile? We can help you find SaaS spend you didn't know about, forgot about, or is no longer needed, helping you eliminate wasted spend and fund new investments. #cfo #cio