Blog

In the News

PRESS RELEASE: Recognize Announces Investment in Security Risk Advisors

PRESS RELEASE: Recognize Announces Investment in Security Risk Advisors

Recognize announces a strategic investment in Security Risk Advisors, a leading cybersecurity services firm specializing in advisory, managed security, and proprietary software solutions. This partnership aims to accelerate growth and innovation in the face of evolving cyber threats.

Office of the CISO

Tools

Pruning Garden Paths in AWS with Neph

Pruning Garden Paths in AWS with Neph

Explore Neph, Security Risk Advisors’ free, graph-based tool for AWS security analysis. Learn how it maps attack paths, handles IAM complexities, and supports iterative analysis to enhance cloud security workflows.

Pruning Garden Paths in AWS with Neph

Explore Neph, Security Risk Advisors’ free, graph-based tool for AWS security analysis. Learn how it maps attack paths, handles IAM complexities, and supports iterative analysis to enhance cloud security workflows.

Introducing Tier 0: How AI Is Empowering the Agentive SOC

Discover how Tier 0, powered by SCALR AI, is transforming Security Operations Centers. By automating repetitive tasks and enriching alerts, Tier 0 enables analysts to focus on real threats, creating a smarter, more sustainable SOC. Learn more about this innovative approach.

Casting a New Vision for Red Teams

Red Teams have exploded in popularity and funding over the past 8+ years. They have evolved their skill and grown their team members, but many Red Teams have not evolved their scope and deliverables to maximize value for the organizations they help protect.   Red...

CISO Guidance for AI Security

AI introduces both risks and opportunities for businesses, and organizations should be prepared to protect their AI technology at the same level they protect traditional “crown jewel” or other sensitive data. Senior leadership will look to CISOs for guidance both on how to protect AI and how to use it to enhance the security of their organizations. What follows is some guidance on how a CISO might proceed as AI technology evolves and is deployed.

Pruning Garden Paths in AWS with Neph

Explore Neph, Security Risk Advisors’ free, graph-based tool for AWS security analysis. Learn how it maps attack paths, handles IAM complexities, and supports iterative analysis to enhance cloud security workflows.

Just Another Kusto Hacker – Behind the Scenes Breakdown!

Participating in the “Just Another Kusto Hacker” challenge was an incredible opportunity to push my skills with Kusto Query Language (KQL) to the next level. Winning the challenge was not just a personal milestone but also a reflection of the expertise and creativity we foster at SRA. Azure Data Explorer (ADX) is a key technology for us, powering our SCALR Sight platform and enabling us to analyze vast cybersecurity datasets to deliver actionable insights to our clients.

Beware of ClickFix: A Growing Social Engineering Threat

ClickFix is a rapidly evolving social engineering technique that began gaining momentum in mid-2024. By camouflaging malware delivery within fake CAPTCHA verification screens or error messages, threat actors successfully lure end users into pressing Windows+R, pasting malicious code, and executing it, often without raising immediate suspicion. This advisory examines how ClickFix operates, documents active campaigns, and provides detection strategies and mitigation recommendations.

Timberlake: AWS Attack Automation

Timberlake is a tool we are releasing that helps to automate AWS attack simulations. It was originally designed to support our purple team operations here at Security Risk Advisors. In this blog, we will introduce the Timberlake tool and its functionality.

This Traversal had a Face for Radio (CVE-2020-17383)

Quick Seek Mode – TL; DR An interesting directory traversal was identified by SRA during an external penetration test for one of our clients. In addition to the standard checks for Linux filesystems, the team discovered how to disclose the password for the web UI...

Sharpening Offensive Skills Through Purple Teams

Discover how purple teams bridge the gap between red and blue teams, offering red teamers real-time feedback, hands-on experience with defensive tools, and insights into enterprise environments. Learn how this collaborative approach sharpens offensive skills and enhances detection strategies.

Using Purple Teams to Set Detection Engineering Priorities

Purple Teams play a crucial role in enhancing detection engineering efforts by combining the offensive expertise of red teams with the defensive strategies and knowledge of blue teams. By leveraging the insights gained from simulating real-world attacks, organizations can identify detection opportunities and prioritize their engineering efforts.

Coercing Authentication from a Domain System: Analyzing a New Test Case from the 2025 Threat Simulation Index

Explore the latest addition to SRA’s 2025 Threat Simulation Index: the “Coerce Authentication from Domain System” test case. This blog post delves into how tools like PetitPotam and Coercer exploit Windows RPC protocols to force domain systems into unintended authentications. Ideal for purple teams aiming to benchmark and enhance their organization’s threat resilience.

Beware of ClickFix: A Growing Social Engineering Threat

ClickFix is a rapidly evolving social engineering technique that began gaining momentum in mid-2024. By camouflaging malware delivery within fake CAPTCHA verification screens or error messages, threat actors successfully lure end users into pressing Windows+R, pasting malicious code, and executing it, often without raising immediate suspicion. This advisory examines how ClickFix operates, documents active campaigns, and provides detection strategies and mitigation recommendations.

Introducing Tier 0: How AI Is Empowering the Agentive SOC

Discover how Tier 0, powered by SCALR AI, is transforming Security Operations Centers. By automating repetitive tasks and enriching alerts, Tier 0 enables analysts to focus on real threats, creating a smarter, more sustainable SOC. Learn more about this innovative approach.

Just Another Kusto Hacker – Behind the Scenes Breakdown!

Participating in the “Just Another Kusto Hacker” challenge was an incredible opportunity to push my skills with Kusto Query Language (KQL) to the next level. Winning the challenge was not just a personal milestone but also a reflection of the expertise and creativity we foster at SRA. Azure Data Explorer (ADX) is a key technology for us, powering our SCALR Sight platform and enabling us to analyze vast cybersecurity datasets to deliver actionable insights to our clients.

Beware of ClickFix: A Growing Social Engineering Threat

ClickFix is a rapidly evolving social engineering technique that began gaining momentum in mid-2024. By camouflaging malware delivery within fake CAPTCHA verification screens or error messages, threat actors successfully lure end users into pressing Windows+R, pasting malicious code, and executing it, often without raising immediate suspicion. This advisory examines how ClickFix operates, documents active campaigns, and provides detection strategies and mitigation recommendations.

The Entra-nce to Tenant Maturity

SRA has developed a maturity strategy for identity and access management (IAM) in Entra ID. The goal is for our clients and readers to achieve the “Modern” maturity level and aspire to be at the “Advanced” maturity level.

Limiting WMI Lateral Movement via DCOM Permissions

If you are looking for a way to curb WMI-based lateral movement – and especially if you do not want a dependency on another control, such as a firewall – DCOM permissions may prove to be a useful method that works with traditional configuration management.

Entra ID to the Rescue: Streamlining Identity Access Reviews with a Dash of Governance

The blog highlights the challenges of managing identity access reviews in complex environments and emphasizes the benefits of using automated tools like Microsoft’s Identity Governance to streamline these processes. Security Risk Advisors (SRA) offers custom solutions to help organizations implement and report on access review results, enhancing compliance and efficiency .

Introducing Tier 0: How AI Is Empowering the Agentive SOC

Discover how Tier 0, powered by SCALR AI, is transforming Security Operations Centers. By automating repetitive tasks and enriching alerts, Tier 0 enables analysts to focus on real threats, creating a smarter, more sustainable SOC. Learn more about this innovative approach.

Get Off the Neverending AI Treadmill and Secure Your Organization

This blog explores why enterprises should resist the urge to chase the latest LLMs and instead focus on securing AI adoption through cloud-based platforms like Azure, AWS, and Google Cloud. Learn how strategic AI implementation can align security, IT, and innovation for long-term success.

Using Purview and M365 to Mitigate Data Security Risks in Microsoft Teams Meeting Recordings

Recording Teams meetings is a convenient way to memorialize an important discussion. But without proper controls in place, recordings can capture sensitive information, consume valuable cloud storage space, and become a data loss vector. Make sure your organization has configured the right settings to mitigate these risks and learn how to use Purview to understand if the organization is already oversharing.    

Building a Copilot for Security Custom NetFlow Plugin

We’ve built a custom Copilot for Security plugin that would take advantage of network flow data and use the power of Copilot for Security to extract the exact time and IP address of a host involved in a security incident, then go retrieve, summarize, and analyze the netflow data within 30 minutes on either side of the first noted malicious event to determine if there was potential for lateral movement or other key indicators of attack. This can give insight to understand if an attacker may have attempted to move laterally on your network, and if so where, and using which protocols.

CISO Guidance for AI Security

AI introduces both risks and opportunities for businesses, and organizations should be prepared to protect their AI technology at the same level they protect traditional “crown jewel” or other sensitive data. Senior leadership will look to CISOs for guidance both on how to protect AI and how to use it to enhance the security of their organizations. What follows is some guidance on how a CISO might proceed as AI technology evolves and is deployed.

Microsoft Purview: You Get Out What You Put In

Microsoft’s recently rebranded Purview suite of data governance, security, and compliance solutions offers more capabilities than ever before within a single product. But without a fundamental understanding of your data, getting value out of these tools remains a challenge. Defining your organization’s critical data and objectives for protecting it is a critical first step in maximizing the value of any Purview deployment.

Has NIST Gone Too Far?

The newly published version of the NIST CSF has rightly elevated the importance of cybersecurity governance, but the new Govern function has a disproportionate impact on overall scoring and presents challenges when measuring improvements against the previous version of the framework.

Unleashing the Potential of PCI DSS v4: Strengthening Your Online Payment Security

Explore the impact of the new PCI DSS v4 on scripting in the cybersecurity landscape. Our blog reveals the crucial role scripts play in online payments and their accompanying security threats. Uncovering new controls (6.4.3 and 11.6.1) that require businesses to monitor and validate scripts, we compare an array of solutions including developer tools, third-party software, and innovative policies like CSP and SRI, all aiming to safeguard your environment against unauthorized changes.

Happy Birthday NIST CSF!

The NIST Cybersecurity Framework (CSF) turned 10 years old in February 2023. As the CSF begins its second decade, we revisit the framework itself, SRA’s experience with a few common challenges, and preview the coming changes.

PCI Compliance at Call Centers

Call center operations are not immune to changing compliance requirements even though addressing compliance needs is not their primary function. The Payment Card Industry Security Standards Council (PCI SSC) has introduced additional guidance on securing cardholder...

Getting Started in Cyber Physical System Security Defense

TL;DR – The best way to get started with Cyber Physical System Defense is to create a defense plan, collect asset inventory, and begin implementing monitoring infrastructure. These steps are all much easier said than done. Let's say you just found out that your...

Developing SBOM as a Capability

S4x23 Presents: SBOMs Galore It seemed like a week didn’t go by in 2022 without the mention of Software Bill of Materials (SBOM) in our newsfeeds, from a client, or from a colleague, so the announcement that S4x23 would feature an SBOM challenge piqued our interest....

What is OT?

There are many ways to think about Operational Technology (OT) aside from the official definition. I challenge you to define what “OT” is to your organization, and its alignment to your business.

Follow us on social media

Browse our Webinars

Access these virtual events on-demand and get valuable insight from our thought leaders and subject matter experts.

Get Curated Security News and Critical Vulnerability Reports

Our Threat Intelligence Gathering & Research (TIGR) team is focused on threat intelligence and curates a daily intelligence report, TIGR Threat Watch, with information collected from several industry intel sources. We also create and publish ad-hoc critical vulnerability notifications in case of critical and time-sensitive vulnerabilities or threats.