📣 Today's press release recaps highlights from 2024, which include more than doubling our customer base and tripling ARR!

Thank you to our customers, investors, partners, and friends who have provided invaluable feedback and support along the way. 🙏🏻

bit.ly/40umBu6

"Allowed in my org” and “right for my org” aren’t the same answer, but a lot of AI agents stop at the first one. An agent that approves access without knowing who’s actually requesting it isn’t saving you work. It’s just moving the risk somewhere else.

bit.ly/4sF2kOK

A CMDB tells you every VM you run. It tells you nothing about who can read your customer data.

Our 2027 prediction: the attack surface isn’t a list of assets anymore. It’s a graph of grants, created in a few clicks with no sign-off.

bit.ly/4i8o2as

A vendor gets approved for one narrow use case. 18 months later it’s got broad access, company-wide adoption, and AI features nobody reviewed.

The paperwork still says low risk.

bit.ly/4sjhQjn

Avg company has 2x more SaaS apps than employees. 60% were never sanctioned.

An annual vendor review can’t keep up with that, or with how fast the
vendors it does cover actually change. bit.ly/4iywH63

Only 30 to 40% of SaaS and AI apps ever get a formal TPRM review. The ones that do are assessed once, then left alone.

Adaptive risk management adjusts controls as risk changes, not when the next review comes due.

bit.ly/3VJBjxo

OAuth grant numbers worth sitting with: 88 per employee, 31 with data-level access, ~45 min to review each manually.

Do that math at scale. Manual review was never going to keep pace.

bit.ly/4zwm21y

You approved an app in March. By June, someone invited contractors, uploaded sensitive data, and connected an AI agent with one click.

Same vendor. Very different risk.

Here's a breakdown of how Adaptive Risk Management keeps up: bit.ly/4dTqYFx

Gartner: half of all SaaS breaches will trace to overprivileged OAuth tokens by 2027.

You can’t review a grant you don’t know exists. Dormant grants and stale integrations don’t show up in logs.

Wrote about it for @BleepinComputer

bit.ly/4i6OYat

"If a SaaS app gets breached, that's the vendor's problem."

Nudge's Danielle Russell on Security Unfiltered: it never worked that way.

In reality, security built programs for the 10 apps it knew about and still owned the other 90.

Full episode here: bit.ly/4B6kkWr

Manual review of one high-risk OAuth grant: 45 minutes. Verdict: revoke.
Same grant through our new AI agent: 15 seconds. Same verdict.

Average employee has 88 OAuth grants. 31 touch data. Nobody is reviewing those by hand.

This will help ➡️ bit.ly/4yCwVPu

TPRM didn't break because of AI. It was already broken.

We assessed vendors, never usage. We screened on scores that measured their marketing site, not your data. We triaged and hoped.

The score is about them. Your exposure is about what you gave them.

bit.ly/3U7KKGr

Most vendor reviews are accurate for exactly one day.
After that: new OAuth grants, teams, AI features, & agents. Nothing triggers a second look.

Adaptive Risk Management in Nudge Security re-scores risk as it changes & tells you what to fix first.

bit.ly/4rOpNNg

Three questions before connecting any AI tool: what can it see, what can it do, who owns it?

Good framing. The catch: those questions get answered on a consent screen, by one person, right before they click Allow. Not in a review.

bit.ly/4dVq9Mb

Your team approved that SaaS app 6 months ago. Since then: new integrations, new users, an AI agent, and data nobody signed off on.

Risk doesn't stop at approval. Most programs stop watching right there.

Today, we're launching Adaptive Risk Management: bit.ly/4xQNzJK

Today, Nudge Security is introducing Nudge AI Agents that take crushing, repetitive work off your team's plate — OAuth grant reviews, browser extension triage, vendor risk analysis.

Agents assemble!

Learn more here: nudgesecurity.com/post/were-taki…

🎉 We're thrilled to announce our $22.5M Series A funding led by Cerberus Ventures, with participation from Ballistic Ventures, Forgepoint Capital, and Squadra Ventures.

Many thanks to our customers, investors, and supporters. Stay tuned!

bit.ly/49kOTvY

As the adoption curve for GenAI continues to bend skyward, the risk of a cascading, AI-fueled cyberattack is becoming a more immediate threat.

This OpEd in @theinformation by @russellspitler explores this risk (subscription required):
bit.ly/4igmnh3

#ai #ciso #infosec

2024 has brought an unprecedented spike in identity-based attacks against #Okta customers, as well as attacks exploiting misconfigurations in Microsoft 365 and Google Workspace.

Learn how Nudge Security can help:
bit.ly/48LZPAx

#iam #sysadmin #itdr #ciso #macadmin

🔥 Hot product news! We've extended our security posture management capabilities to include Okta, furthering your ability to harden your identity infrastructure with Nudge.

Learn more here:
bit.ly/3YPsxMg

#iam #okta #sysadmin #sspm #ciso #cio #grc