AI-native MCP Identity Security & Governance platform for lifecycle management, passwordless, conversational AI & human verification. SOC 2, ISO 27001.
Pleasanton, CA
Joined June 2009
- Tweets4.1K
- Following1.7K
- Followers1.6K
- Likes300
All tricks, no treats. The "help desk" caller who needs a reset now, the MFA push you didn't start, the urgent invoice with new bank details. Same costume every time: ordinary and in a hurry. Slow down and check who's really asking. Happy Halloween from Avatier.
The FBI said in Nov 2025 that IC3 had received more than 5,100 account takeover fraud complaints since January 2025, with losses exceeding $262 million. Require strong verification before any recovery or MFA change.
Avatier's Password Portal can verify password recovery and changes with MFA. attackcost.com/en/glossary/a…
Deepfake voice: AI-made speech that imitates a real person closely enough to fool listeners. In May 2025 the FBI warned of AI-generated voice messages claiming to come from senior US officials, used to build rapport before gaining access to personal accounts.
Confirm sensitive requests through a known channel, never the voice alone. Avatier's Assisted Reset sends help desk challenges to the user; the agent only sees pass or fail. attackcost.com/en/glossary/d…
Dormant account: still enabled, but nobody has signed in for a long time. Nobody is using it, so an unexpected MFA prompt reaches no one.
CISA and the FBI said in March 2022 that Russian state-sponsored actors guessed the password of an inactive account that was un-enrolled from MFA but not disabled, then enrolled a new device and got in. Auto-disable inactive accounts and verify every MFA re-enrollment.
Avatier's Access Governance routes access reviews to the managers who know the users. attackcost.com/en/glossary/d…
FBI and CISA say Akira ransomware actors got in through VPN services that had no multifactor authentication configured, mostly by exploiting known vulnerabilities.
The advisory says they also used spearphishing, valid credentials and password spraying, then encrypted systems and threatened to leak stolen data. The fix: enforce MFA on every VPN and remote access account, and patch your VPN quickly.
Avatier's Strong MFA Login binds a second factor to every password sign-in before Active Directory grants access. attackcost.com/en/threat-act…
Privilege creep: the access people collect as they change jobs, join projects or cover for colleagues, while the old rights never get removed. A September 2022 DHS OIG audit found USCIS didn't have a process to adequately verify access after personnel transferred offices.
Review access at every role change. Avatier's Access Governance automates those reviews and certifications. attackcost.com/en/glossary/p…
Black Basta playbook, per an FBI, CISA, HHS and MS-ISAC advisory: flood a user's inbox with spam, then call acting as tech support and ask them to download a remote access tool. From October 2024 the same campaign also used Microsoft Teams.
The fix: hang up on support calls you didn't ask for and call your help desk back on a number you already know. Avatier's Assisted Reset sends every MFA challenge to the user, so the help desk agent only sees pass or fail. attackcost.com/en/threat-act…
Offboarding gap: a leaver's main login is disabled, but their app accounts, tokens, shared passwords or remote access stay live.
In an April 2022 SEC filing, Block said a former employee downloaded Cash App Investing reports with some US customer information, accessed without permission after the person's employment ended. Deprovision every app automatically from the HR exit event.
Avatier's HR User Provisioning disables accounts and revokes access once HR marks someone terminated. attackcost.com/en/glossary/o…
You can go passwordless on Windows without phones, badges or extra hardware. The credential follows the user, and we keep governing the password while you retire it.
credentialgovernance.com