Nudge Security

Nudge Security helps modern organizations achieve effective SaaS security and governance at scale.

[Nudge Security @nudge_security]

📣 Today's press release recaps highlights from 2024, which include more than doubling our customer base and tripling ARR!

Thank you to our customers, investors, partners, and friends who have provided invaluable feedback and support along the way. 🙏🏻

https://t.co/T87w0sPPxf

[Nudge Security @nudge_security]

Block a risky tool and plenty of people just find a way around it. Now you can’t see the very risk you meant to manage.

Calibrated friction: observe, inform, justify, escalate. Save the block for the risks that earn it.

https://t.co/2QkGzB7rHE

[Nudge Security @nudge_security]

"Allowed in my org” and “right for my org” aren’t the same answer, but a lot of AI agents stop at the first one. An agent that approves access without knowing who’s actually requesting it isn’t saving you work. It’s just moving the risk somewhere else.

https://t.co/fAhWSIK4vS

[Nudge Security @nudge_security]

A CMDB tells you every VM you run. It tells you nothing about who can read your customer data.

Our 2027 prediction: the attack surface isn’t a list of assets anymore. It’s a graph of grants, created in a few clicks with no sign-off.

https://t.co/pdwlkwEIQ9

[Nudge Security @nudge_security]

A vendor gets approved for one narrow use case. 18 months later it’s got broad access, company-wide adoption, and AI features nobody reviewed.

The paperwork still says low risk.

https://t.co/WOzNeh2p7T

[Nudge Security @nudge_security]

Avg company has 2x more SaaS apps than employees. 60% were never sanctioned.

An annual vendor review can’t keep up with that, or with how fast the
vendors it does cover actually change. https://t.co/fp6yZFQ6ee

[Nudge Security @nudge_security]

Only 30 to 40% of SaaS and AI apps ever get a formal TPRM review. The ones that do are assessed once, then left alone.

Adaptive risk management adjusts controls as risk changes, not when the next review comes due.

https://t.co/sfWFaSqV6d

[Nudge Security @nudge_security]

OAuth grant numbers worth sitting with: 88 per employee, 31 with data-level access, ~45 min to review each manually.

Do that math at scale. Manual review was never going to keep pace.

https://t.co/RZgBfEufdw

[Nudge Security @nudge_security]

You approved an app in March. By June, someone invited contractors, uploaded sensitive data, and connected an AI agent with one click.

Same vendor. Very different risk.

Here's a breakdown of how Adaptive Risk Management keeps up: https://t.co/b5ESCdiAUs

[Nudge Security @nudge_security]

Gartner: half of all SaaS breaches will trace to overprivileged OAuth tokens by 2027.

You can’t review a grant you don’t know exists. Dormant grants and stale integrations don’t show up in logs.

Wrote about it for @BleepinComputer

https://t.co/6Pm0EAU38g

[Nudge Security @nudge_security]

"If a SaaS app gets breached, that's the vendor's problem."

Nudge's Danielle Russell on Security Unfiltered: it never worked that way.

In reality, security built programs for the 10 apps it knew about and still owned the other 90.

Full episode here: https://t.co/yUIiQaOrwc

[Nudge Security @nudge_security]

Manual review of one high-risk OAuth grant: 45 minutes. Verdict: revoke.
Same grant through our new AI agent: 15 seconds. Same verdict.

Average employee has 88 OAuth grants. 31 touch data. Nobody is reviewing those by hand.

This will help ➡️ https://t.co/KjIzX66BaZ

[Nudge Security @nudge_security]

TPRM didn't break because of AI. It was already broken.

We assessed vendors, never usage. We screened on scores that measured their marketing site, not your data. We triaged and hoped.

The score is about them. Your exposure is about what you gave them.

https://t.co/0fVf8UxYPf

[Nudge Security @nudge_security]

Most vendor reviews are accurate for exactly one day.
After that: new OAuth grants, teams, AI features, & agents. Nothing triggers a second look.

Adaptive Risk Management in Nudge Security re-scores risk as it changes & tells you what to fix first.

https://t.co/vvrglxO5Ms

[Nudge Security @nudge_security]

Three questions before connecting any AI tool: what can it see, what can it do, who owns it?

Good framing. The catch: those questions get answered on a consent screen, by one person, right before they click Allow. Not in a review.

https://t.co/ZSRVyw2cYB

[Nudge Security @nudge_security]

Your team approved that SaaS app 6 months ago. Since then: new integrations, new users, an AI agent, and data nobody signed off on.

Risk doesn't stop at approval. Most programs stop watching right there.

Today, we're launching Adaptive Risk Management: https://t.co/XVKaafn4ZL

[Nudge Security @nudge_security]

Today, Nudge Security is introducing Nudge AI Agents that take crushing, repetitive work off your team's plate — OAuth grant reviews, browser extension triage, vendor risk analysis.

Agents assemble!

Learn more here: https://t.co/4TLXwgMqW1

[Nudge Security @nudge_security]

🎉 We're thrilled to announce our $22.5M Series A funding led by Cerberus Ventures, with participation from Ballistic Ventures, Forgepoint Capital, and Squadra Ventures.

Many thanks to our customers, investors, and supporters. Stay tuned!

https://t.co/3qw9nZZ3MM

[Nudge Security @nudge_security]

As the adoption curve for GenAI continues to bend skyward, the risk of a cascading, AI-fueled cyberattack is becoming a more immediate threat.

This OpEd in @theinformation by @russellspitler explores this risk (subscription required):
https://t.co/aNmioqB8G1

#ai #ciso #infosec

[Nudge Security @nudge_security]

2024 has brought an unprecedented spike in identity-based attacks against #Okta customers, as well as attacks exploiting misconfigurations in Microsoft 365 and Google Workspace.

Learn how Nudge Security can help:
https://t.co/sWcbr10I7Z

#iam #sysadmin #itdr #ciso #macadmin