David O'Brien (he/him)

Super excited! Just launched the #EntraID capability to quickly and easily create a security assessment, including diagrams of how resources relate, detailed reporting, and very soon also Entra ID attack paths. Free testing is available on our website.

Anthropomorphize much? What head?!

Decided to move our product website away from self-hosted Wordpress to GitHub pages. Just too much hassle with Wordpress. Using spec-driven development any "design issues" are now a thing of the past.

I need help. I need a laptop that has at least 32GB memory, isn't heavy, has 5+ hrs battery life on regular use, isn't Dell. I always had Lenovo X1 Carbon. Only bought Dell XPS because Lenovo wasn't available here during COVID. Is the X1 Carbon still it. Or something else?

You'd think a British airline would be able to deal with this?

Agentic AI security 🤣 .----. .----. / o o\ /o o \ | |--⚔️--⚔️--| | | | | | | | | | | | '-^-^-' '-^-^-'

Considering a free ARGOS CLI for local Azure and Entra ID security assessments. No SaaS account, no data uploaded. What would make it useful to you? Misconfigurations, attack paths, HTML reports, inventory, or something else?

Would people be interested in a CLI version of ARGOS? Not a SaaS bound version, but locally run as a one-time assessment CLI. It looks like data sovereignty concerns are moving people to think about alternatives to SaaS.

Today, as a B2B SaaS founder, I spent my evening figuring out why users using Google identity couldn't log in to ARGOS Cloud Security anymore. Turns out, Google devices to delete our oauth2 app without notification. Excitement I can do without.

sigh

Building an app that works for a single organisation is hard. Building an app that works for dozens of organisations is harder. Building an app that works for dozens of organisations that use it across dozens of organisations sometimes is mind explodingly difficult.

Researchers analysed 1,069 Microsoft 365 apps and flagged 139 apps for stupidly wrong or unusual permissions. One project management app requested UserAuthenticationMethod.ReadWrite.All , cool and normal. arxiv.org/abs/2608.02336

"agentic" really is the nextgen "nextgen" 🤢

We eat our own dog food at ARGOS. 🐶 Microsoft Entra is enabling agent identity blueprint registration for non-admins by default. Even with app registration disabled! ARGOS caught it in our own tenant. 👀 Have you already checked your own tenant? #EntraID #m365

Poor ChatGPT :(

Sneak peek at what's coming to ARGOS 👀 Policy Sets. Run all security rules, or only attack paths, select compliance frameworks, or build your own custom rule sets. Mix and match. Whatever you like. More control over what ARGOS assesses. Coming very soon. 💖

I get it, AI / LLMs make it easy to build a nice dashboard, to show something quickly, but some LLM thrown-together spaghetti code is not a product, it's also not "good enough". Ian Malcolm was right, just because you can, doesn't mean you should.

Did you know an Azure role name often tells you less than the permissions it actually grants? Contributor is easy. roleAssignments/write is the interesting bit nobody checked until now. ARGOS evaluates effective privilege at the individual Azure action level now.