
CTO at @permisosecurity Alum: @Mandiant, https://xitter.cf/t.co/kqlvYwe86k, USMC
Joined March 2011
- Tweets5.3K
- Following1.4K
- Followers3.6K
- Likes4.9K
Pinned Tweet
The last few months I have had so much fun rapidly prototyping personal and @permisosecurity projects.
I treat every weekend as a hackathon. Using @cursor_ai has been a game changer for me to be able to crank out fast and mostly polished POCs. Today, I'm gonna showcase some of of these!
1aN0rmus retweeted
Promoted to Partner at Microsoft (Threat Intel) 🤠
The useful trick: find where what you’re good at meets a gap nobody else is covering, then spend your time problem-solving there. Do it enough & you’re solving future problems for other teams. Time runs out fast so you have to understand adversaries & attack surface enough to pick the gaps with the most potential. That’s probably the hardest part for me - not pursuing many fun sidequests (100% completion doesn’t translate to work achievement).
Also, roll hard with a bunch of absolute units and always give them credit first. It’s wild to look back at the amazing people I’ve worked with in security and what they’ve gone on to accomplish – and know my peers have the same trajectory.
Your own recognition might come, but find value in the impact first.
1aN0rmus retweeted
Excited to start a new adventure @GreyNoiseIO. I'm sure I'll be jamming on myriad evils, but I am esp interested in working on early warning problems, defending against AI-enabled threats, and protecting everything connected to the cyber-physical world. See you on the edge!
Super impressed with the classification powers of @typesafeai's Jev so far.
55.6 million input tokens == $1.87 ... Fast and in expensive for sure! Getting some cool stuff done with the model, super cool @typesafeai
1aN0rmus retweeted
🤓 I just published a short video about PromptIntel, the threat intelligence feed for AI.
PromptIntel is an open database that tracks adversarial prompts observed in attacks. The goal is to identify prompts that attackers actively use in their operations.
🎥 youtu.be/Ids__t2jOdk
1aN0rmus retweeted
Going to be dropping a detailed #clickfix MacOS campaign post tomorrow morning that is quite unknown but large - very illusive. Several outlets have small fragments of the campaign but going to tie it together under #PasteSwitch.
oh btw, Mac malware - so hot right now.
1aN0rmus retweeted
11 years later and still no one has answered this man.
How did the Russians basically stick something to his log file?
In honor of the @Mandiant rebrand and the kick-off of #CyberDefenseSummit (MIRcon) – I bring to you this important piece of security conference history: youtu.be/JQht_HuMH2U
Video is now public for the first time 😂
1aN0rmus retweeted
Anthropic published real AI intrusion data that probably deserves more attention than speculative concerns over the probability of AI doom.
Both concerns can coexist, but one has practical risk that directly impacts most enterprises in the short-term -- whereas the other should probably dictate how the AI labs [are forced to] behave
Replying to @ItsReallyNick
Anthropic has now published their side of this APT29 🇷🇺 cyber espionage campaign, complete with a timeline of capability development & intrusions: anthropic.com/threat-intelli…
...helpful data to support prior comments about Midnight Blizzard's CaptiveCrunch being enabled by AI
1aN0rmus retweeted
Anthropic has now published their side of this APT29 🇷🇺 cyber espionage campaign, complete with a timeline of capability development & intrusions: anthropic.com/threat-intelli…
...helpful data to support prior comments about Midnight Blizzard's CaptiveCrunch being enabled by AI
1aN0rmus retweeted
Today @okta announced a series of innovations across Okta Identity Governance and Okta Privileged Access, along with expanded identity threat detection and response capabilities.
You can't accelerate AI adoption by handing out credentials and hoping for the best. The only way to move fast safely is by having real-time control over every identity in your environment, whether they’re humans, machines, or AI agents.
By unifying governance, PAM, and ITDR on a single platform, we're helping teams automate compliance, reduce standing privileges, and govern, secure, and monitor every identity across their organization.
1aN0rmus retweeted
Today @okta announced new @auth0 capabilities built specifically for where the agentic era is heading.
Nearly every leader I speak with is making a full-court press on agentic AI. Most are starting inside the enterprise, with employee-facing use cases. But there’s a fundamental shift happening in how companies interact with consumers: AI agents are starting to research products, make decisions, and transact on people’s behalf. At the same time, every company is trying to strengthen its relationship with customers, and make it easier for them to sign up, buy, and get value.
Both scenarios present the same challenge: how do you make those experiences faster and easier without sacrificing security? Identity helps eliminate that trade-off, and that’s what we’re focused on with Auth0.
The capabilities we announced today help customers securely transact with AI assistants like ChatGPT, while also helping organizations improve conversion from the first customer interaction, and layer enterprise-ready identity capabilities directly onto existing identity infrastructure with minimal friction.
Identity has always been about securely connecting people to technology. As those connections change, identity has to change with them.
Think your AI agent rollout is moving at a manageable pace? Think again. 📈
Speaking on @Bloomberg, our CEO @toddmckinnon shared a concrete story from a recent Okta for AI Agents deal. When the evaluation started, Okta's tools detected 50 agents in the customer's environment. Just a few weeks later, that number had exploded to 1,500 agents.
We're officially out of the chatbot phase and into the era of autonomous agents. These agents are incredibly powerful and proliferating fast, but without proper identity management, they introduce massive, unforeseen risks.
1aN0rmus retweeted
Team Perth’s Caught Pals
Team Prison Charges Pending
Team…
abc.net.au/news/2026-08-27/t…
1aN0rmus retweeted
A malicious #Cloudflare Zaraz Pageview action on edgeupstudio[.]com unpacked a #ClickFix BW Panel bootstrap from the ErrTraffic toolkit, which resolved infrastructure through a Polygon smart contract and encrypted its controller traffic.
derp.ca/research/zaraz-click…
1aN0rmus retweeted
Hopefully you listened when I said get your resumes ready. @GreyNoiseIO is hiring Threat Researchers who will develop and exploit first, second, and third-party access and sources to produce cyber threat intelligence that practitioners will use to detect, disrupt, and impose cost on adversaries. job-boards.greenhouse.io/gre…




















