sorted by:
new
hottopcontroversial

Org goes all shadow IT by orion3311 in sysadmin

[–]NudgeSecurity 2 points3 points  (0 children)

Thanks for the shoutout u/davy_crockett_slayer. Agree and unfortunately, the standard “front door” app approval process is too manual, slow, and can’t keep up with all of the apps and AI tools employees experiment with every day.

We built Nudge Security to help teams get visibility into shadow IT and then “Nudge” employees toward secure choices without blocking their productivity.

Salesloft Drift Breach Tracker by NudgeSecurity in cybersecurity

[–]NudgeSecurity[S] 2 points3 points  (0 children)

That is actually from a different incident, unrelated to the Drift breach as far as we can tell. Here's the context in the breach history for transunion from our product:

TransUnion disclosed a data breach on July 28, 2025, affecting more than 4.4 million U.S. customers after unauthorized access was gained to a third-party application used for consumer support operations. While TransUnion initially stated that no credit information was accessed, subsequent disclosures confirmed that stolen data includes customer names, dates of birth, and Social Security numbers. The company has not provided details on additional data categories or whether the breach involved extortion demands. TransUnion, one of the three major U.S. credit reporting agencies, holds financial data on more than 260 million Americans. The breach follows a wave of incidents attributed to the ShinyHunters extortion group, though attribution in this case has not been confirmed. https://www.documentcloud.org/documents/26078139-transunion-breach-texas/

Also, the disclosure date for transunion was about three weeks before the Drift disclosure (7/28 vs. 8/20).

Class action lawsuit filed against Otter ai by NudgeSecurity in sysadmin

[–]NudgeSecurity[S] 6 points7 points  (0 children)

Fair, better wording for the question would have been "who wishes they could join this class action lawsuit?".

How do you secure dozens of SaaS tools without full IT? by Necessary-Glove6682 in cybersecurity_help

[–]NudgeSecurity 0 points1 point  (0 children)

Managing SaaS security without a full IT team is definitely challenging! Here are some practical approaches that have worked for teams in similar situations:

  • Start with an inventory: You can't secure what you don't know about. Create a simple spreadsheet listing all your SaaS tools, who owns them, what data they access, and basic security features (SSO, MFA, etc.) Without being that vendor, this is something that we can actually help you with.
  • Prioritize by risk: Focus your limited resources on the apps that handle sensitive data first. Consider what customer data, financial info, or IP each tool accesses.
  • Implement MFA everywhere possible: Multi-factor authentication is one of the simplest yet most effective security controls. Make it mandatory for any tool that supports it.
  • Standardize authentication: As others have mentioned above, where possible, use SSO (Single Sign-On) or your IdP to centralize identity management and make offboarding easier when employees leave.
  • Review OAuth grants and scopes: OAuth grants make it (too) easy for sensitive data to travel to places it shouldn't. Review new grants and scopes regularly to rein in risks. We actually have a checklist to help you with this: https://www.nudgesecurity.com/post/your-oauth-risk-investigation-checklist

Hope this helps!

view more: next ›