Material Security

@material_sec

Protect your critical infrastructure. Material Security is a multi-layered detection and response toolkit for Google Workspace and Microsoft 365

San Francisco, CA

material.security

Replies Reposts Media

Material Security
@material_sec
Sep 18
Password reset = fresh start, right? Wrong. OAuth tokens don't care. They're minted per app and survive a reset completely untouched, still valid, still working, still yours (well, theirs now). Offboarding kills them. Nothing else does. Tie your OAuth grants to a personal
00:00
Material Security
@material_sec
Sep 17
An employee connects an AI tool to Google Workspace in one click. No ticket, no review, no separate permission tier for what the AI can reach versus what the employee can. It just inherits everything. Across 159 orgs, we found 978 of these connections doing exactly that. Full
AI Didn't Wait for Your Policy | Material Security
From material.security
Material Security
@material_sec
Sep 16
"Is it normal to feel a little betrayed by your own IT team after a fake phishing test?" @Quora's own IT team clearly thought so, they ditched the quiz. Now one real phishing report warns everyone else instantly, no test, no shame video. How 5 people pulled it off:
Material Security
@material_sec
Sep 15
Whale phishing is illegal no matter how you look at it, right? Protecting our whales matters. In this case, the whales are your CEO and CFO, the people whose approval alone can move money. Levitas Capital lost $8.7M to a fake Zoom invite. Arup lost $25M on a deepfake video call.
1
Material Security
@material_sec
Sep 15
Rajan built a malicious OAuth app, start to finish, for about $5 in cloud costs. Then he showed Matt Johansen how it steals a mailbox without ever tripping an account takeover alert. No MFA bypass. No new login. Just a token doing what it was scoped to do. Full watch: