Josh M. Bryant

I was talking to @ZackKorman about this, and I think part of the disconnect is that people are picturing two different types of companies traditional enterprises and modern, cloud native startups. Traditional enterprises often put workloads behind DMZs, internal networks, or segmented cloud environments, limiting what’s directly reachable. In that setup, phishing and credential spraying can be especially valuable ways in. Compare that with a startup built around internet-facing apps, APIs, and SaaS integrations. There can be a much broader surface to attack directly. Both can run on AWS or GCP. The distinction is what’s exposed and how access is controlled. That changes which attack paths are useful. That also matters when people talk about attacker “swarms.” An EDR can isolate a workstation or kill the processes supporting an attacker’s access. If that workstation was their only foothold, adding more agents doesn’t magically restore access to that network segment. Detection is only part of the picture. Companies can also restrict outbound communications through egress filtering, enforced proxies, or always on VPN and secure web gateway configurations. Those controls can block or disrupt the communications an attacker needs to maintain access. Even stealing NTDS.dit doesn’t guarantee a path back in. Depending on the access path, the attacker may still have to contend with MFA, conditional access, segmentation, and other controls. More agents can accelerate attempts, but they still need a viable route in. nitter.cf/HackingLZ/status/21191…