The Dangerous Moment Is the State Change: Security Testing for Connected Devices

Posted on October 27, 2026 by Brent Huston

The firmware image passes static analysis.

The administrative interface survives a penetration test. The network scan shows only approved services. The mobile application and cloud API have been reviewed. The device enters production with a clean report.

Then the device changes state.

A technician enters maintenance mode. An update loses power halfway through installation. A factory reset prepares the device for a new owner. A recovery process restores an older image. A field engineer connects to a local service interface. A retired device remains registered to a cloud account.

The controls that worked during normal operation may not work the same way during any of those transitions.

That is the testing gap.

Connected-device security is usually evaluated as a collection of components and attack surfaces: firmware, hardware, network services, wireless interfaces, applications, APIs, and cloud infrastructure. Each view matters. None of them, by itself, proves that the product preserves its intended trust state when it is provisioned, updated, interrupted, repaired, reset, transferred, recovered, or retired.

The practical lesson is straightforward:

Device security assurance should test the transitions that change authority, software, data, and operating mode—not only the device’s steady state.

A Connected Product Has More Than One Security State

A connected device is not simply secure or insecure.

It moves through states.

The lifecycle may include manufacturing, initial provisioning, normal operation, degraded operation, maintenance, software update, rollback, recovery, factory reset, ownership transfer, and retirement. Some products add calibration, emergency operation, offline modes, safety overrides, diagnostic modes, or vendor-support access.

Each state can change:

Which identities are trusted.
Which interfaces are reachable.
Which code is allowed to run.
Which secrets are present.
Which data is retained.
Which actions are permitted.
Which events are logged.
Which recovery paths are available.

The current NIST IR 8259 Revision 1, finalized in April 2026, tells IoT product manufacturers to define expected customers and use cases, identify cybersecurity requirements, and plan how the product will support customer risk management. The companion NIST IR 8259A baseline includes device identification, configuration, data protection, logical access to interfaces, secure software update, and cybersecurity-state awareness.

Those capabilities do not exist only during normal operation.

They must remain meaningful while the product changes state.

Steady-State Testing Can Miss Transition Risk

Static firmware analysis can identify exposed secrets, unsafe configurations, vulnerable components, dangerous functions, and other defects inside an image.

Dynamic testing can examine running services, authentication, authorization, input handling, communications, and runtime behavior.

Hardware and interface testing can examine local access paths that a remote network assessment will never see.

Application and API testing can evaluate the services that control the device, store its data, and connect it to other systems.

The OWASP IoT Security Testing Guide reflects this broader reality by organizing testing around the device model, firmware, interfaces, communications, and runtime behavior rather than treating an IoT product as a single web endpoint.

The transition problem appears between those views.

Consider the questions created by an update:

Who is allowed to initiate it?
How does the device authenticate the update source and verify the image?
Can an authorized image be replayed after it should have expired?
What happens if power, storage, or connectivity fails halfway through installation?
Does rollback return the device to an older but vulnerable state?
Are security settings, keys, and logs preserved correctly?
Does the device report that it is running a degraded or unexpected version?

Now consider a factory reset:

Which user data is removed?
Which device identity and cryptographic material remain?
Are cloud registrations, mobile-app bindings, or vendor accounts disconnected?
Does the reset restore an unsafe default configuration?
Can a previous owner or administrator still reach the product?
Is the reset event visible to the next operator?

A review that tests only the stable image before and after the transition may miss the condition created during the transition itself.

Build a State-Transition Test Model

Start with a state diagram, not a tool list.

For each important transition, create a compact test record with six fields.

1. Entry condition: What starts the transition?

Identify the command, signal, physical action, scheduled event, fault, account action, or environmental condition that moves the device out of its current state.

Examples include an update request, boot failure, service-button sequence, cloud command, expired certificate, loss of connectivity, storage exhaustion, ownership transfer, or operator decision.

The entry condition should be testable. If the team cannot reproduce the condition safely, it cannot demonstrate how the product behaves when the condition occurs.

2. Authority: Who or what may cause it?

Name every actor that can initiate, approve, block, or complete the transition.

That may include the device owner, local administrator, vendor support team, cloud service, companion application, update-signing system, physical technician, automation service, or another device.

Then test the boundary between those roles.

An identity authorized to read device status should not automatically gain authority to install firmware. A field technician permitted to run diagnostics should not silently become a permanent administrator. A cloud service that can request an update should not be able to bypass the device’s independent verification of the image.

3. Protected state: What changes or persists?

List the assets and security properties that the transition can modify:

Firmware and boot components.
Configuration and policy.
Credentials, keys, certificates, and trust anchors.
User, customer, operational, or diagnostic data.
Device identity and ownership records.
Local and network interfaces.
Logging and monitoring state.
Safety limits and operating parameters.

Testing should confirm both what changes and what must not change.

4. Failure path: What happens when the transition does not finish normally?

Interrupt the process in a controlled environment.

Remove a dependency. Deny a required authorization. Present an invalid or older image. Exhaust an expected resource. Break connectivity at a defined step. Restart the device while state is being written.

The purpose is not to create theatrical destruction.

It is to learn whether failure moves the product into a secure, observable, and recoverable condition.

5. Evidence: What proves the resulting state?

Define the evidence an operator, customer, assessor, or incident responder can use to determine what happened.

That may include version and integrity measurements, event logs, update records, administrative actions, device-state reports, cloud audit records, tamper indicators, recovery results, or retained forensic artifacts.

If the device cannot explain its own security state, the organization may have to guess whether the transition succeeded.

6. Consequence: What can the new state affect?

Connect the technical result to the product’s real use.

Could the device disclose data, stop a business process, permit unauthorized control, produce incorrect measurements, lose availability, weaken a safety function, or become impossible to recover remotely?

The same technical defect can have very different significance in a consumer accessory, payment device, building controller, medical product, industrial sensor, or safety-related system.

Protect, Detect, and Recover

Device assurance is incomplete if it tests only whether unauthorized change can be prevented.

NIST SP 800-193 organizes platform-firmware resilience around three goals: protect the platform from unauthorized change, detect unauthorized change when it occurs, and recover rapidly and securely.

That sequence is a useful testing standard.

Protect

Verify that only authorized entities can initiate the transition and that the device independently validates the software, configuration, or command it is about to trust.

Test version policy, signing, authorization separation, local access controls, service interfaces, and the protection of keys and trust anchors.

Detect

Verify that the product can recognize and report an incomplete, unauthorized, degraded, or unexpected state.

An update mechanism that rejects a bad image but leaves no useful record may protect the device while weakening incident response. A device that boots a fallback image without reporting the version change may remain operational while concealing a material security event.

Recover

Verify that recovery returns the product to an intended trust state, not merely to an operable state.

The device may power on and still be running an obsolete image, unsafe configuration, untrusted key set, or diagnostic mode. Recovery evidence should show what was restored, which trust decision authorized it, and what follow-up action remains.

Physical Consequence Changes the Test Plan

Connected products can affect more than data.

The final NIST SP 800-82 Revision 3 defines operational technology broadly as programmable systems and devices that interact with the physical environment and emphasizes that security measures must account for performance, reliability, and safety requirements.

That changes how testing should be performed.

An aggressive production scan, unplanned reboot, malformed command, or interrupted update may be acceptable in a disposable lab unit and unacceptable in a live operational process. Some questions should be answered through offline firmware analysis, emulation, configuration review, representative hardware, isolated test networks, or a controlled lab before anyone considers validation in the field.

The test plan should distinguish:

What can be examined without operating the device.
What can be exercised safely on representative hardware.
What requires an isolated system or simulated environment.
What must be validated in the deployed environment under a carefully approved procedure.
What should not be tested actively because the safety or availability consequence is unacceptable.

Restraint is part of good testing.

The objective is not to prove that the assessor can break the device.

It is to produce useful evidence without creating the harm the assessment is supposed to prevent.

Scale Assurance by Consequence and Change

Not every connected product needs the same depth of testing.

A low-consequence, easily replaced device with no sensitive data and minimal authority does not need the same assurance program as a long-lived controller that can alter a physical process.

Set the testing tier using factors such as:

Safety and operational consequence.
Access to sensitive data or privileged actions.
Exposure to untrusted networks, users, or physical access.
Authority of local, wireless, cloud, and service interfaces.
Complexity of update, rollback, and recovery mechanisms.
Dependence on companion applications, APIs, and vendor cloud services.
Expected service life and ability to replace the product.
Availability of logs, integrity evidence, and emergency recovery.

Then define retest triggers.

A new firmware branch, bootloader, hardware revision, wireless stack, update service, cloud backend, cryptographic design, manufacturing process, or field-service workflow can change the transition model even when the product name remains the same.

The current NIST IR 8259 Revision 1 reinforces this lifecycle view by asking manufacturers to consider customer needs, product requirements, risk mitigations, and the support customers require to use the product securely.

Security testing should follow the product as those conditions change.

Measure Transition Assurance, Not Just Defect Counts

A vulnerability count is useful for remediation tracking.

It does not show whether the product preserves trust across its lifecycle.

More useful measures include:

Percentage of high-consequence state transitions represented in the test model.
Percentage of update and recovery paths that independently authenticate software and enforce version policy.
Percentage of reset, transfer, and retirement paths that remove customer data and obsolete account bindings as designed.
Percentage of maintenance and diagnostic actions attributable to a named identity.
Percentage of interrupted transitions that produce an observable security-state record.
Time required to recover a representative device to a known, supported, and verified state.
Number of product changes that altered the threat model but did not trigger security retesting.
Percentage of critical transition tests that include the companion application, API, cloud service, and deployed operating assumptions.

One question is especially revealing:

After an update, reset, or recovery fails, can you prove which trust state the device is in?

If the answer depends on a visual guess, undocumented service sequence, or the memory of one engineer, the product may be recoverable without being governable.

What Security Leaders Should Do This Week

Choose one connected product with meaningful business, safety, privacy, or operational consequence.

Draw its states. Include provisioning, normal operation, update, degraded operation, maintenance, recovery, reset, transfer, and retirement where applicable.
Name every transition authority. Identify who or what can initiate, approve, complete, or block each state change.
Map what changes and persists. Include software, configuration, identities, keys, data, interfaces, logging, and cloud bindings.
Choose one failure path. Safely interrupt an update, recovery, reset, or maintenance workflow on representative equipment.
Verify protect, detect, and recover. Confirm that unauthorized change is prevented, abnormal state is visible, and recovery restores a supported trust state.
Connect the result to consequence. Decide what the observed behavior could mean for safety, operations, customers, data, and incident response.
Set the retest triggers. Require reassessment when a material component, interface, update path, backend dependency, or field workflow changes.

A secure firmware image matters.

A hardened interface matters.

A tested API matters.

The product still has to move safely between the states that join those components together.

Test the transition.

That is where the device changes what it trusts.

Put MicroSolved’s Device and Lab Testing Experience to Work

MicroSolved, Inc. can help organizations evaluate industrial, IoT, embedded, and connected products through controlled, evidence-driven security testing.

MSI can assist with:

Product threat modeling and state-transition test design.
Firmware extraction, static analysis, emulation, and controlled runtime testing.
Review of local, network, wireless, service, application, API, and cloud interfaces.
Update, rollback, reset, maintenance, recovery, and retirement-path validation.
Embedded-device, firmware, AMI, SCADA, segmentation, and tamper-resistance assessment.
Test planning for high-availability, safety-sensitive, and critical-infrastructure environments.
Prioritized mitigation guidance that connects technical findings to business and operational consequence.

To discuss connected-device, firmware, industrial, or lab testing, contact MicroSolved at info@microsolved.com or +1.614.351.1237.

Relax. We’re on watch.

AI tools were used as a research assistant for this content, but human moderation and writing are also included.

The Network Is the Configuration: Why Device-by-Device Reviews Miss Systemic Risk

Posted on October 14, 2026 by Brent Huston

The firewall passes its review.

The router matches its hardening guide. The core switches have approved templates. The VPN concentrator is supported. The wireless controllers have current settings. Each team can point to a device, a checklist, and a green result.

The environment can still be unsafe.

A route may bypass the intended boundary. An emergency access rule may have become permanent. Two business units may use different authentication sources for the same administrative function. A management interface may be reachable from the wrong zone. Logging may be enabled on the newest devices and absent from the oldest ones. A segmentation design may exist in a diagram without being enforced consistently across the equipment that implements it.

The failure is not necessarily inside one device.

It lives in the relationships among them.

That is the limitation of device-by-device configuration review. It can tell an organization whether individual components satisfy selected requirements. It may not show whether the combined environment still implements the security architecture the organization believes it has.

The practical lesson is straightforward:

Configuration assurance should prove the effective state of the environment, not merely the acceptability of isolated devices.

The Network Does Not Experience Controls One Device at a Time

Standards correctly require secure configuration practices.

NIST Special Publication 800-128 describes security-focused configuration management as the work of managing and monitoring system configurations to support business functionality while reducing organizational risk. The CIS Controls call for maintained secure configurations across enterprise assets and software, while CIS Control 12 focuses on actively managing network devices so vulnerable services and access points do not become attacker paths.

Those practices create necessary baselines. The harder question is whether the baselines compose into the intended result.

Consider segmentation.

One firewall may correctly restrict traffic between two zones. That does not prove there is no alternate route through another firewall, a cloud connection, a VPN profile, a shared management network, a wireless bridge, or a vendor access path. Each component can look reasonable in isolation while the system still permits a path the architecture was intended to prevent.

The same problem appears with authentication, logging, encryption, administrative access, name resolution, and trusted-host definitions. The control is often distributed across products, vendors, versions, teams, and locations. Its effectiveness depends on consistency and relationships.

A useful review must therefore ask two different questions:

Is this configuration acceptable for this component?
Does this collection of configurations enforce the intended control across the environment?

The first question finds local defects.

The second finds systemic risk.

Separate Intent, Implementation, and Effective State

Most organizations have at least three versions of their network.

The intended network

This is the architecture described in diagrams, standards, policies, design documents, approved data flows, and segmentation plans. It explains what the organization expects the environment to do.

The implemented network

This is the collection of current device and application configurations: routes, access-control lists, VLANs, authentication servers, management interfaces, DNS settings, logging destinations, encryption choices, firmware versions, and exceptions.

The effective network

This is what those configurations permit, deny, trust, expose, record, and connect when they operate together.

The three should agree. They often diverge because organizations change continuously. Acquisitions introduce new standards. Cloud services create new paths. Vendors receive temporary access. Emergency rules survive the event that created them. Hardware generations overlap. Different teams interpret the same policy differently. A compensating control exists in one region and is assumed to exist everywhere.

The September 2026 edition of the Australian Signals Directorate’s Information Security Manual guidance for networking illustrates the breadth of evidence involved. It calls for maintained network documentation that includes high-level and logical diagrams as well as device settings for critical systems and network equipment. It also addresses segmentation, dedicated management networks, device hardening, and logging of security-relevant events, including configuration changes.

No single configuration file proves all of that.

Assurance comes from reconciling intent, implementation, and effective state across the devices that jointly create the control.

Build a Configuration Evidence Model

An environment-wide review needs more than a larger pile of device reports. It needs a model that preserves the relationships among assets, settings, policies, and exceptions.

A practical configuration evidence model has five views.

1. Inventory view: What is represented?

Identify the devices, applications, virtual appliances, cloud controls, and other components included in the evidence set. Record product families, versions, roles, locations, owners, and collection dates.

The purpose is not to claim that configuration collection replaces every asset-discovery mechanism. It is to make the assessment boundary explicit and expose gaps between the systems the organization believes it has and the configurations it can actually produce.

2. Baseline view: What should be true?

Map relevant settings to vendor guidance, industry benchmarks, regulatory requirements, organizational standards, and documented operating needs.

A baseline should not become a blind checklist. Some deviations are necessary. Some settings have different meanings across products. Some security recommendations conflict with availability, safety, or support constraints. The assessment should preserve those conditions rather than flattening them into a generic pass or fail.

3. Relationship view: What does the environment allow?

Model the connections and dependencies that individual reviews tend to miss:

Which routes and rules create paths between trust zones?
Which systems can reach administrative interfaces?
Which authentication, logging, time, DNS, and update services are trusted?
Where do vendor access paths enter?
Are segmentation controls consistent across every device that implements the boundary?
Do cloud, wireless, remote-access, and legacy paths preserve the same assumptions?

This is where configuration data becomes architecture evidence.

4. Exception view: Why is the deviation present?

Every material deviation should have an owner, business reason, affected scope, compensating control, approval, and review or expiration date.

Without that context, the assessor cannot distinguish a consciously accepted operating requirement from drift, error, or forgotten emergency access. A technically accurate report can still produce poor decisions if it treats every difference as equivalent.

5. Trend view: Is the control getting stronger?

Retain enough continuity to compare assessments over time.

Leaders should be able to see whether high-risk deviations are being removed, whether the same root causes recur, whether one product family or business unit is falling behind, and whether remediation is producing greater control consistency.

A point-in-time result answers, “What did we find?”

A trend answers, “Are we learning?”

Look for Patterns, Not Just Findings

The value of environment-wide analysis is not that it generates more findings.

It is that it can reveal which findings share a cause.

Twenty devices using an obsolete protocol may not represent twenty independent failures. They may point to one outdated standard, one unsupported management tool, one inherited template, or one team that never received the replacement process.

Inconsistent logging destinations may reveal that an acquisition was never integrated into the monitoring model. Repeated access-control exceptions may show that an application architecture depends on flows the segmentation design did not anticipate. Different authentication sources may indicate that administrative identity has fragmented across regions or product generations.

This changes remediation.

Instead of distributing a long list of device-specific corrections, the organization can address the common mechanism: update the standard, replace the template, redesign the path, migrate the dependency, retire the exception process, or assign ownership for the control.

The result is not merely cleaner configurations. It is a more governable system.

Passive Analysis Matters When Touching the Environment Adds Risk

Active discovery and validation remain important. They can reveal live services, reachable paths, unmanaged assets, and runtime behavior that stored configurations do not show.

They are not always the safest first step.

Operational technology, critical infrastructure, legacy equipment, and fragile high-availability systems may impose strong constraints on scanning, agents, appliances, change windows, and test traffic. NIST’s Guide to Operational Technology Security emphasizes that OT security measures must account for performance, reliability, and safety requirements.

Offline analysis of existing configuration evidence can reduce the need to introduce new software or traffic merely to begin understanding the environment. It can help teams identify likely problems, missing evidence, and validation priorities before selecting the safest live tests.

That does not make offline analysis omniscient.

A configuration may be stale. A device may not be represented. Runtime state may differ from the saved file. A rule may exist but never be exercised. An undocumented path may not appear in the collected data. Configuration evidence should therefore guide targeted validation, not eliminate it.

The safer model is complementary:

Analyze the configuration evidence.
Identify systemic risks and uncertain relationships.
Prioritize the live checks that would resolve the most consequential uncertainty.
Reconcile the observed state with the model.
Preserve the updated evidence for the next review.

Where MachineTruth Fits

MachineTruth™ is MicroSolved’s Analytics as a Service platform for offline, passive device and network analysis.

The service can analyze configuration files and supporting network data to help inventory and map environments, compare settings with standards and best practices, examine routing and trust relationships, support segmentation analysis, identify hardening opportunities, and produce documentation for technical and assurance audiences.

Its most important contribution is scale with context.

MachineTruth allows the assessment to look across products, vendors, versions, locations, and business units while MicroSolved analysts validate findings, account for operating constraints, and translate patterns into prioritized mitigation guidance. Multi-year work can preserve organizational standards, accepted risks, reporting preferences, and trends so that later reviews begin with accumulated knowledge rather than a blank checklist.

MachineTruth does not replace asset discovery, live validation, change control, vulnerability management, architecture ownership, or engineering judgment.

It gives those activities a stronger evidence base by answering a question they often struggle to answer:

What security state do the collected configurations create when we analyze the environment as a whole?

Measure Configuration Assurance, Not Review Volume

Counting reviewed devices is useful for scope management. It is not enough to show that the control is improving.

More useful measures include:

Percentage of in-scope systems with a current configuration represented in the evidence set.
Percentage of critical controls mapped to both an approved baseline and implementation evidence.
Number of material cross-device inconsistencies by control domain.
Percentage of deviations with an owner, rationale, compensating control, and review date.
Age of high-risk configuration drift.
Recurrence rate for findings tied to the same template, standard, or process.
Percentage of high-consequence network zones whose segmentation is supported by current configuration evidence and targeted validation.
Time required to explain an allowed path from source to destination across the relevant controls.
Improvement in control consistency between assessment cycles.

One metric is especially revealing:

How long does it take to prove that the network currently enforces the boundary shown on the diagram?

If the answer requires several teams, multiple consoles, undocumented assumptions, and the memory of one experienced engineer, the organization has architecture knowledge but weak architecture evidence.

What Security Leaders Should Do This Week

Choose one high-consequence network zone, service, or business process.

Name the intended boundary. Identify what the zone protects, which communications should be allowed, which should be denied, and which teams own the decision.
Collect current evidence. Obtain the relevant firewall, router, switch, VPN, wireless, cloud, DNS, authentication, and logging configurations using an approved secure process.
Declare the assessment boundary. Record what is present, what is missing, how current the data is, and which runtime questions configuration evidence cannot answer.
Compare across the environment. Look for inconsistent management access, authentication sources, logging destinations, insecure services, unsupported versions, stale rules, and alternate routes.
Test the relationships. Confirm that the combined configurations enforce the intended segmentation and trust model.
Explain every exception. Require an owner, business reason, compensating control, and expiration or review date.
Fix the common causes first. Prioritize templates, standards, tools, and processes that can remove the same weakness from many systems.
Preserve the baseline. Retain the result so the next review can measure drift and improvement rather than starting over.

A network diagram is an important expression of intent.

A device checklist is an important test of local configuration.

Neither, by itself, proves the effective security state of the environment.

The network is created by the way configurations interact.

Review it that way.

Put MachineTruth to Work on Your Environment

MicroSolved, Inc. can help organizations use MachineTruth Global Configuration Assessments to:

Analyze device and application configurations at enterprise scale.
Reconcile network documentation with collected configuration evidence.
Identify systemic hardening, authentication, logging, routing, and access-control issues.
Evaluate segmentation and trusted relationships across mixed-vendor environments.
Prioritize root-cause remediation instead of distributing disconnected findings.
Preserve accepted risks, organizational standards, and improvement trends across assessment cycles.
Plan targeted validation for critical, sensitive, and operational technology environments.

To discuss a MachineTruth assessment, contact MicroSolved at info@microsolved.com or +1.614.351.1237.

Relax. We’re on watch.

AI tools were used as a research assistant for this content, but human moderation and writing are also included.

Your Security Controls May Be Less Independent Than You Think

Posted on July 13, 2026 by Brent Huston

Most enterprise security programs still measure strength by counting controls.

MFA is deployed. EDR is deployed. Logging is centralized. Privileged access is monitored. Cloud guardrails are active. The dashboard shows broad framework coverage, so leadership concludes that the organization has defense in depth.

That conclusion may be wrong.

The problem is not necessarily that the controls are weak. The problem is that several supposedly independent controls may rely on the same underlying service.

An identity provider may authenticate administrators to the EDR console, SIEM, cloud environment, ticketing system, and incident-response platform. A centralized telemetry pipeline may supply detection data to multiple tools. Several controls may reside in the same cloud account, depend on the same DNS or time service, or be managed through one administrative plane.

On a control matrix, these appear to be separate layers.

In the actual system, they may be branches of the same tree.

Continue reading →

Account Recovery Is Becoming the New Identity Attack Surface

Posted on June 16, 2026 by Brent Huston

As passkeys and phishing-resistant authentication reduce password risk, attackers will move pressure to the recovery plane.

The industry is moving in the right direction.

Passkeys, FIDO2/WebAuthn, hardware security keys, conditional access, better MFA policies, and risk-based sign-in controls are all meaningful improvements. They reduce entire classes of credential theft. They make phishing harder. They remove reusable passwords from many authentication ceremonies. They shift more of the security burden from user judgment to protocol design.

That is good.

But it is not the finish line.

In my recent passkeys article, I called out a point that deserves its own treatment: passkeys do not solve weak account recovery, help desk social engineering, stolen session tokens, OAuth consent abuse, unmanaged vendor access, or excessive privilege. They are a major step forward, but they do not remove the rest of the identity attack surface.

That matters because attackers adapt.

Continue reading →

Rational Security in the AI Era: How Attackers Are Evolving and How We Must Respond

Posted on June 3, 2026 by Brent Huston

The weaponization of artificial intelligence by cybercriminals and nation-state actors has crossed a critical inflection point. We no longer live in a world where we can rely solely on traditional perimeters; the threat landscape has fundamentally shifted into what we might call “Extremistan,” where the speed and scale of attacks demand a completely new level of resilience.

SadKitty

At MicroSolved, our mission is to provide rational cybersecurity for an irrational world. To do that effectively, we must look unflinchingly at the data.

The Problem and the Metrics

The numbers tell a stark story of industrialization at machine speed. According to recent threat reports, AI-enabled adversaries increased their attack volume by 89% year-over-year. More concerning is the velocity: the average eCrime breakout time has collapsed to just 29 minutes, with the fastest recorded intrusion moving from initial access to lateral movement in a staggering 27 seconds.

The financial impact is equally severe. The FBI IC3 recorded over 22,000 AI-related complaints with adjusted losses exceeding $893 million in 2025 alone, including tens of millions lost to AI-enabled Business Email Compromise (BEC). AI is accelerating attack speeds by 4x, making human-speed incident response no longer viable.

Continue reading →

Why My AI Agents Needed CaneCorso as a Security Control Plane

Posted on May 4, 2026 by Brent Huston

AI agents are powerful because they can read, reason, summarize, decide, and act across a wide range of information sources.

That is also what makes them dangerous.

The more useful an agent becomes, the more likely it is to consume data I do not fully trust. Emails. Newsletters. RSS feeds. API responses. Documents sent as attachments. Social media. YouTube transcripts. Scraped search results. Web pages. Translated content. Random bits of text pulled from places where I do not control the author, the formatting, the intent, or the payload.

That is a very different security model than the one most of us are used to.

In traditional applications, we spend a lot of time separating code from data, users from administrators, trusted networks from untrusted networks, and internal systems from the internet. With LLMs and agents, all of those boundaries start to blur. Instructions, context, content, and intent all arrive in the same stream. The model has to reason over that stream, and the agent has to decide what to do with the result.

That is exactly why I wanted a security control plane in front of my own AI agents.

For me, that control plane became CaneCorso™.

CaneCorsoAI

Continue reading →

Introducing CaneCorso: An AI Application Firewall Built for Real Workflows

Posted on April 16, 2026 by Brent Huston

AI has officially crossed the line from experiment to infrastructure.

Email flows into copilots. Documents feed RAG pipelines. Support tickets trigger agents that can take action. The convenience is real—and so is the risk.

What hasn’t caught up is security.

Most security models were built for a world where inputs were predictable and trust boundaries were well-defined. That world doesn’t exist anymore. Today, untrusted content flows directly into systems that can reason, decide, and act.

That’s exactly where things get interesting—and dangerous.

When Good Data Carries Bad Instructions

One of the biggest misconceptions about AI security is that it’s a model problem. It’s not. It’s a workflow problem.

Attackers don’t need to break in anymore. They ride along with legitimate data—emails, PDFs, tickets, knowledge base entries—and inject instructions that your AI system may interpret as truth.

Think about what that means in practice:

A support ticket that contains hidden instructions
A PDF with embedded prompt injection
A knowledge base entry that poisons RAG outputs
An approval workflow manipulated through summarization

Layer in human behavior—blind trust, over-privileged access, weak validation—and you’ve got a system primed to fail in ways that traditional controls simply won’t catch.

CaneCorsoAI

A More Rational Approach to AI Security

CaneCorso™ takes a different path.

Instead of trying to block everything suspicious (and breaking workflows in the process), it follows what’s described in the Rational AI Security model —security that behaves more like an immune system than a wall.

That means:

Detecting and isolating threats without stopping the system
Treating all inbound content as untrusted by default
Preserving business continuity while reducing risk
Producing measurable, auditable outcomes

This isn’t theoretical. It’s a direct response to how AI systems actually behave in production.

One Control Plane for AI Workflows

At its core, CaneCorso gives you a shared AI Application Firewall—a single control plane that sits between your workflows and your models.

Instead of every team building its own brittle filters, you get consistent, reusable protection across:

Email triage and analysis
RAG pipelines and knowledge systems
Document AI and OCR ingestion
Support and ticketing workflows
Agent-driven automation

The platform delivers:

Runtime decisions: allow, sanitize, tokenize, or block
Privacy controls: redact or tokenize sensitive data before model exposure
Audit-ready logs: reasons, scores, and evidence you can actually use
Adversarial validation: Injection Scanner proves controls before and after deployment

This isn’t just about stopping attacks—it’s about making security operationally usable.

Continue reading →

Identity Security Is Now the #1 Attack Vector — and Most Organizations Are Not Architected for It

Posted on December 8, 2025 by Brent Huston

How identity became the new perimeter

In 2025, identity is no longer simply a control at the edge of your network — it is the perimeter. As organizations adopt SaaS‑first strategies, hybrid work, remote access, and cloud identity federation, the traditional notion of network perimeter has collapsed. What remains is the identity layer — and attackers know it.

Today’s breaches often don’t involve malware, brute‑force password cracking, or noisy exploits. Instead, adversaries leverage stolen tokens, hijacked sessions, and compromised identity‑provider (IdP) infrastructure — all while appearing as legitimate users.

SyntheticID

That shift makes identity security not just another checkbox — but the foundation of enterprise defense.

Failure points of modern identity stacks

Even organizations that have deployed defenses like multi‑factor authentication (MFA), single sign‑on (SSO), and conditional access policies often remain vulnerable. Why? Because many identity architectures are:

Overly permissive — long‑lived tokens, excessive scopes, and flat permissioning.
Fragmented — identity data is scattered across IdPs, directories, cloud apps, and shadow IT.
Blind to session risk — session tokens are often unmonitored, allowing token theft and session hijacking to go unnoticed.
Incompatible with modern infrastructure — legacy IAMs often can’t handle dynamic, cloud-native, or hybrid environments.

In short: you can check off MFA, SSO, and PAM, and still be wide open to identity‑based compromise.

Token‑based attack: A walkthrough

Consider this realistic scenario:

An employee logs in using SSO. The browser receives a token (OAuth or session cookie).
A phishing attack — or adversary-in-the-middle (AiTM) — captures that token after the user completes MFA.
The attacker imports the token into their browser and now impersonates the user — bypassing MFA.
The attacker explores internal SaaS tools, installs backdoor OAuth apps, and escalates privileges — all without tripping alarms.

A single stolen token can unlock everything.

Building identity security from first principles

The modern identity stack must be redesigned around the realities of today’s attacks:

Identity is the perimeter — access should flow through hardened, monitored, and policy-enforced IdPs.
Session analytics is a must — don’t just authenticate at login. Monitor behavior continuously throughout the session.
Token lifecycle control — enforce short token lifetimes, minimize scopes, and revoke unused sessions immediately.
Unify the view — consolidate visibility across all human and machine identities, across SaaS and cloud.

How to secure identity for SaaS-first orgs

For SaaS-heavy and hybrid-cloud organizations, these practices are key:

Use a secure, enterprise-grade IdP
Implement phishing-resistant MFA (e.g., hardware keys, passkeys)
Enforce context-aware access policies
Monitor and analyze every identity session in real time
Treat machine identities as equal in risk and value to human users

Blueprint: continuous identity hygiene

Use systems thinking to model identity as an interconnected ecosystem:

Pareto principle — 20% of misconfigurations lead to 80% of breaches.
Inversion — map how you would attack your identity infrastructure.
Compounding — small permissions or weak tokens can escalate rapidly.

Core practices:

Short-lived tokens and ephemeral access
Just-in-time and least privilege permissions
Session monitoring and token revocation pipelines
OAuth and SSO app inventory and control
Unified identity visibility across environments

30‑Day Identity Rationalization Action Plan

Day	Action
1–3	Inventory all identities — human, machine, and service.
4–7	Harden your IdP; audit key management.
8–14	Enforce phishing-resistant MFA organization-wide.
15–18	Apply risk-based access policies.
19–22	Revoke stale or long-lived tokens.
23–26	Deploy session monitoring and anomaly detection.
27–30	Audit and rationalize privileges and unused accounts.

More Information

If you’re unsure where to start, ask these questions:

How many active OAuth grants are in our environment?
Are we monitoring session behavior after login?
When was the last identity privilege audit performed?
Can we detect token theft in real time?

If any of those are difficult to answer — you’re not alone. Most organizations aren’t architected to handle identity as the new perimeter. But the gap between today’s risks and tomorrow’s solutions is closing fast — and the time to address it is now.

Help from MicroSolved, Inc.

At MicroSolved, Inc., we’ve helped organizations evolve their identity security models for more than 30 years. Our experts can:

Audit your current identity architecture and token hygiene
Map identity-related escalation paths
Deploy behavioral identity monitoring and continuous session analytics
Coach your team on modern IAM design principles
Build a 90-day roadmap for secure, unified identity operations

Let’s work together to harden identity before it becomes your organization’s softest target. Contact us at microsolved.com to start your identity security assessment.

References

BankInfoSecurity – “Identity Under Siege: Enterprises Are Feeling It”
SecurityReviewMag – “Identity Security in 2025”
CyberArk – “Lurking Threats in Post-Authentication Sessions”
Kaseya – “What Is Token Theft?”
CrowdStrike – “Identity Attacks in the Wild”
Wing Security – “How to Minimize Identity-Based Attacks in SaaS”
SentinelOne – “Identity Provider Security”
Thales Group – “What Is Identity Security?”
System4u – “Identity Security in 2025: What’s Evolving?”
DoControl – “How to Stop Compromised Account Attacks in SaaS”

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

The New Golden Hour in Ransomware Defense

Posted on August 19, 2025 by Brent Huston

Organizations today face a dire reality: ransomware campaigns—often orchestrated as Ransomware‑as‑a‑Service (RaaS)—are engineered for speed. Leveraging automation and affiliate models, attackers breach, spread, and encrypt entire networks in well under 60 minutes. The traditional incident response window has all but vanished.

This shrinking breach-to-impact interval—what we now call the ransomware golden hour—demands a dramatic reframing of how security teams think, plan, and respond.

Why It Matters

Attackers now move faster than ever. A rising number of campaigns are orchestrated through RaaS platforms, democratizing highly sophisticated tools and lowering the technical barrier for attackers^[1]. When speed is baked into the attack lifecycle, traditional defense mechanisms struggle to keep pace.

Analysts warn that these hyper‑automated intrusions are leaving security teams in a race against time—with breach response windows shrinking inexorably, and full network encryption occurring in under an hour^[2].

The Implications

Delayed detection equals catastrophic failure. Every second counts: if detection slips beyond the first minute, containment may already be too late.
Manual response no longer cuts it. Threat hunting, playbook activation, and triage require automation and proactive orchestration.
Preparedness becomes survival. Only by rehearsing and refining the first 60 minutes can teams hope to blunt the attack’s impact.

What Automation Can—and Can’t—Do

What It Can Do

Accelerate detection with AI‑powered anomaly detection and behavior analysis.
Trigger automatic containment via EDR/XDR systems.
Enforce execution of playbooks with automation^[3].

What It Can’t Do

Replace human judgment.
Compensate for lack of preparation.
Eliminate all dwell time.

Elements SOCs Must Pre‑Build for “First 60 Minutes” Response

Clear detection triggers and alert criteria.
Pre‑defined milestone checkpoints:
- T+0 to T+15: Detection and immediate isolation.
- T+15 to T+30: Network-wide containment.
- T+30 to T+45: Damage assessment.
- T+45 to T+60: Launch recovery protocols^[4].
Automated containment workflows^[5].
Clean, tested backups^[6].
Chain-of-command communication plans^[7].
Simulations and playbook rehearsals^[8].

When Speed Makes the Difference: Real‑World Flash Points

Only 17% of enterprises paid ransoms in 2025. Rapid containment was key^[6].
Disrupted ransomware gangs quickly rebrand and return^[9].
St. Paul cyberattack: swift containment, no ransom paid^[10].

Conclusion: Speed Is the New Defense

Ransomware has evolved into an operational race—powered by automation, fortified by crime‑as‑a‑service economics, and executed at breakneck pace. In this world, the golden hour isn’t a theory—it’s a mandate.

Design and rehearse a first‑60‑minute response playbook.
Automate containment while aligning with legal, PR, and executive workflows.
Ensure backups are clean and recovery-ready.
Stay agile—because attackers aren’t stuck on yesterday’s playbook.

References

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Continuous Third‑Party Risk: From SBOM Pipelines to SLA Enforcement

Posted on July 24, 2025 by Brent Huston

Recent supply chain disasters—SolarWinds and MOVEit—serve as stark wake-up calls. These breaches didn’t originate inside corporate firewalls; they started upstream, where vendors and suppliers held the keys. SolarWinds’ Orion compromise slipped unseen through trusted vendor updates. MOVEit’s managed file transfer software opened an attack gateway to major organizations. These incidents underscore one truth: modern supply chains are porous, complex ecosystems. Traditional vendor audits, conducted quarterly or annually, are woefully inadequate. The moment a vendor’s environment shifts, your security posture does too—out of sync with your risk model. What’s needed isn’t another checkbox audit; it’s a system that continuously ingests, analyzes, and acts on real-world risk signals—before third parties become your weakest link.

ThirdPartyRiskCoin

The Danger of Static Assessments

For decades, third-party risk management (TPRM) relied on periodic rites: contracts, questionnaires, audits. But those snapshots fail to capture evolving realities. A vendor may pass a SOC 2 review in January—then fall behind on patching in February, or suffer a credential leak in March. These static assessments leave blind spots between review windows.

Point-in-time audits also breed complacency. When a questionnaire is checked, it’s filed; no one revisits until the next cycle. During that gap, new vulnerabilities emerge, dependencies shift, and threats exploit outdated components. As noted by AuditBoard, effective programs must “structure continuous monitoring activities based on risk level”—not by arbitrary schedule AuditBoard.

Meanwhile, new vulnerabilities in vendor software may remain undetected for months, and breaches rarely align with compliance windows. In contrast, continuous third-party risk monitoring captures risk in motion—integrating dynamic SBOM scans, telemetry-based vendor hygiene signals, and SLA analytics. The result? A live risk view that’s as current as the threat landscape itself.

Framework: Continuous Risk Pipeline

Building a continuous risk pipeline demands a multi-pronged approach designed to ingest, correlate, alert—and ultimately enforce.

A. SBOM Integration: Scanning Vendor Releases

Software Bill of Materials (SBOMs) are no longer optional—they’re essential. By ingesting vendor SBOMs (in SPDX or CycloneDX format), you gain deep insight into every third-party and open-source component. Platforms like BlueVoyant’s Supply Chain Defense now automatically solicit SBOMs from vendors, parse component lists, and cross-reference live vulnerability databases arXiv+6BlueVoyant+6BlueVoyant+6.

Continuous SBOM analysis allows you to:

Detect newly disclosed vulnerabilities (including zero-days) in embedded components
Enforce patch policies by alerting downstream, dependent teams
Document compliance with SBOM mandates like EO 14028, NIS2, DORAriskrecon.com+8BlueVoyant+8Panorays+8AuditBoard

Academic studies highlight both the power and challenges of SBOMs: they dramatically improve visibility and risk prioritization, though accuracy depends on tooling and trust mechanisms BlueVoyant+3arXiv+3arXiv+3.

By integrating SBOM scanning into CI/CD pipelines and TPRM platforms, you gain near-instant risk metrics tied to vendor releases—no manual sharing or delays.

B. Telemetry & Vendor Hygiene Ratings

SBOM gives you what’s there—telemetry tells you what’s happening. Vendors exhibit patterns: patching behavior, certificate rotation, service uptime, internet configuration. SecurityScorecard, Bitsight, and RiskRecon continuously track hundreds of external signals—open ports, cert lifecycles, leaked credentials, dark-web activity—to generate objective hygiene scores arXiv+7Bitsight+7BlueVoyant+7.

By feeding these scores into your TPRM workflow, you can:

Rank vendors by real-time risk posture
Trigger assessments or alerts when hygiene drops beyond set thresholds
Compare cohorts of vendors to prioritize remediation

Third-party risk intelligence isn’t a luxury—it’s a necessity. As CyberSaint’s blog explains: “True TPRI gives you dynamic, contextualized insight into which third parties matter most, why they’re risky, and how that risk evolves”BlueVoyant+3cybersaint.io+3AuditBoard+3.

C. Contract & SLA Enforcement: Automated Triggers

Contracts and SLAs are the foundation—but obsolete if not digitally enforced. What if your systems could trigger compliance actions automatically?

Contract clauses tied to SBOM disclosure frequency, patch cycles, or signal scores
Automated notices when vendor security ratings dip or new vulnerabilities appear
Escalation workflows for missing SBOMs, low hygiene ratings, or SLA breaches

Venminder and ProcessUnity offer SLA management modules that integrate risk signals and automate vendor notifications Reflectiz+1Bitsight+1. By codifying SLA-negotiated penalties (e.g., credits, remediation timelines) you gain leverage—backed by data, not inference.

For maximum effect, integrate enforcement into GRC platforms: low scores trigger risk team involvement, legal drafts automatic reminders, remediation status migrates into the vendor dossier.

D. Dashboarding & Alerts: Risk Thresholds

Data is meaningless unless visualized and actioned. Create dashboards that blend:

SBOM vulnerability counts by vendor/product
Vendor hygiene ratings, benchmarks, changes over time
Contract compliance indicators: SBOM delivered on time? SLAs met?
Incident and breach telemetry

Thresholds define risk states. Alerts trigger when:

New CVEs appear in vendor code
Hygiene scores fall sharply
Contracts are breached

Platforms like Mitratech and SecurityScorecard centralize these signals into unified risk registers—complete with automated playbooks SecurityScorecardMitratech. This transforms raw alerts into structured workflows.

Dashboards should display:

Risk heatmaps by vendor tier
Active incidents and required follow-ups
Age of SBOMs, patch status, and SLAs by vendor

Visual indicators let risk owners triage immediately—before an alert turns into a breach.

Implementation: Build the Dialogue

How do you go from theory to practice? It starts with collaboration—and automation.

Tool Setup

Begin by integrating SBOM ingestion and vulnerability scanning into your TPRM toolchain. Work with vendors to include SBOMs in release pipelines. Next, onboard security-rating providers—SecurityScorecard, Bitsight, etc.—via APIs. Map contract clauses to data feeds: SBOM frequency, patch turnaround, rating thresholds.

Finally, build workflows:

Data ingestion: SBOMs, telemetry scores, breach signals
Risk correlation: combine signals per vendor
Automated triage: alerts route to risk teams when threshold is breached
Enforcement: contract notifications, vendor outreach, escalations

Alert Triage Flows

A vendor’s hygiene score drops by 20%? Here’s the flow:

Automated alert flags vendor; dashboard marks “at-risk.”
Risk team reviews dashboard, finds increase in certificate expiry and open ports.
Triage call with Vendor Ops; request remediation plan with 48-hour resolution SLA.
Log call and remediation deadline in GRC.
If unresolved by SLA cutoff, escalate to legal and trigger contract clause (e.g., discount, audit provisioning).

For vulnerabilities in SBOM components:

New CVE appears in vendor’s latest SBOM.
Automated notification to vendor, requesting patch timeline.
Pass SBOM and remediation deadline into tracking system.
Once patch is delivered, scan again and confirm resolution.

By automating as much of this as possible, you dramatically shorten mean time to response—and remove manual bottlenecks.

Breach Coordination Playbooks

If a vendor breach occurs:

Risk platform alerts detection (e.g., breach flagged by telemetry provider).
Initiate incident coordination: vendor-led investigation, containment, ATO review.
Use standard playbooks: vendor notification, internal stakeholder actions, regulatory reporting triggers.
Continually update incident dashboard; sunset workflow after resolution and post-mortem.

This coordination layer ensures your response is structured and auditable—and leverages continuous signals for early detection.

Organizational Dialogue

Success requires cross-functional communication:

Procurement must include SLA clauses and SBOM requirements
DevSecOps must connect build pipelines and SBOM generation
Legal must codify enforcement actions
Security ops must monitor alerts and lead triage
Vendors must deliver SBOMs, respond to issues, and align with patch SLAs

Continuous risk pipelines thrive when everyone knows their role—and tools reflect it.

Examples & Use Cases

Illustrative Story: A SaaS vendor pushes out a feature update. Their new SBOM reveals a critical library with an unfixed CVE. Automatically, your TPRM pipeline flags the issue, notifies the vendor, and begins SLA-tracked remediation. Within hours, a patch is released, scanned, and approved—preventing a potential breach. That same vendor’s weak TLS config had dropped their security rating; triage triggered remediation before attackers could exploit. With continuous signals and automation baked into the fabric of your TPRM process, you shift from reactive firefighting to proactive defense.

Conclusion

Static audits and old-school vendor scoring simply won’t cut it anymore. Breaches like SolarWinds and MOVEit expose the fractures in point-in-time controls. To protect enterprise ecosystems today, organizations need pipelines that continuously intake SBOMs, telemetry, contract compliance, and breach data—while automating triage, enforcement, and incident orchestration.

The path isn’t easy, but it’s clear: implement SBOM scanning, integrate hygiene telemetry, codify enforcement via SLAs, and visualize risk in real time. When culture, technology, and contracts are aligned, what was once a blind spot becomes a hardened perimeter. In supply chain defense, constant vigilance isn’t optional—it’s mandatory.

More Info, Help, and Questions

MicroSolved is standing by to discuss vendor risk management, automation of security processes, and bleeding-edge security solutions with your team. Simply give us a call at +1.614.351.1237 or drop us a line at info@microsolved.com to leverage our 32+ years of experience for your benefit.