Josh M. Bryant

Startups emerging from stealth: ❌ Startups emerging from cornfields: ✅ The GraphnAI Public Preview is live: Identity Security that shows which attack paths are real. 🧵👇

I am cursed with a high tolerance to pretty much everything, so I've been in excruciating pain with no relief for 5 days now, waiting for a kidney stone to pass. Saturday I sat in the ER waiting room for 9 hours. They got me into intake immediately, put an IV in my arm, but didn't give me anything. Did a CT scan, then sent me back to the waiting room. About an hour later, I had the results in my MyChart, confirming a 2mm kidney stone. Two hours after that, they took me back into intake, told me the results I'd already read, and said they'd give me Toradol through the IV. I tried to tell them Toradol and NSAIDs in general aren't effective for me. They gave it to me anyway and said they'd check on me in a bit. They also gave me a Flomax pill and said the stone should pass on its own. Two hours later, they called me back again. Told them I was still in intense pain. They couldn't believe it, and reluctantly gave me a Norco and said they would check on me in an hour. That helped dull the pain a little, but it was still there. Back to the waiting room. An hour later, no one came to check, then 2, then 3... Finally I just demanded the IV be removed from my arm so I could leave. They clearly had no interest in treating me, and I had no interest in sitting in the ER waiting room beyond the 9 hours I'd already been there. Monday I called the VA Clinic, and of course my doctor is out on Mondays. No appointments available for months. I told the Nurse what happened at the ER, she reminded me I had to report all community ER visits to the VA within 72 hours, and said she'd send an urgent message to my doc. Tuesday, Nurse calls back and says Doc put in a prescription for Flomax and Toradol. I explained that I was given Toradol in the ER and that it did nothing for me. She ignored me, told me to pickup the prescription before they close. Drive 30 mins to the VA Clinic. Pharmacist tells me they don't have Toradol, and asks if I've tried Ibuprofen. I told her I'd been taking 800mg of Ibuprofen and that it hasn't helped. All she could say was "Wow, that's a lot". Then she made me sit there while she waited for my Doc to approve Diclofenac (another NSAID). I've taken two doses of the Diclofenac now, and unsurprisingly to me, it's done absolutely nothing for me. I am still in an immense amount of pain. I'd prefer to not have to take anything, but at this point I just want the pain to stop. I've barely been able to eat or sleep at all for days now. It's been a few years, but this isn't my 1st kidney stone. The last time I had one, I had normal health insurance through an employer, and I was treated much better. The only difference is now I have to rely on VA Healthcare.

One identity, seven tabs, each answers a different question: the paths through it, its alerts, its timeline, the checks it fails. Then Select Fire™ opens on the fix, simulated before anything changes. graphnai.com/product#flyout

A Domain Admin with a service principal name: any domain user can request its ticket and crack the password offline. The posture check shows the blast radius, the fix and the ATT&CK technique, then confirms the fix. graphnai.com/product/exposur…

Ask Graphne which accounts can replicate the directory. Six can. Five should. One is a service account unused for 14 months. Every answer shows the query it ran, and the fix goes to Select Fire™, where you decide. graphnai.com/product/graphne…

Spending the day in the ER with debilitating pain due to a kidney stone was not on my to-do list. 😭

Thanks to OpenAI and Anthropic, everyone is rediscovering the lessons behind "Chicken Little" and "The boy who cried wolf" from first principles.

These things are necessary, but this is a very reactive mindset and misses a critical component of defense-in-depth. It is more crucial than ever to proactively implement mitigations and controls around your business-critical systems that limit the blast-radius of a compromise. Once you've done that, test your detection capabilities and practice your response procedures as a layer on top. New 0day announcements shouldn't induce panic. They should be a routine you're well prepared for. Keep calm and cyber on.

Thanks to Exchange 5.5 in NT4 domains using DNs years before AD existed, plus having to manage X.509 certificates (which also use DNs) running the Defense Messaging System on top of that... AD and LDAP were easy for me to learn when they first came out. I'm going to go take some ibuprofen now. 🤪

Opus 5.5: I won't write code to detect golden ticket attacks because cyber. I'm downgrading you to Opus 4.8. Opus 4.8: I finished writing the golden ticket detection rule, here's the exact mimikatz and Rubeus commands to run if you'd like to test it.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an unauthenticated attacker run code on a server running PHP, and researchers have shown it can leak passwords and API keys from PHP's memory. Patch first: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both. Then ask the next question: if someone got onto that web server before you patched, where could they go from there? That part is an identity question, and GraphnAI answers it for every server in your directory. - Unconstrained delegation. If the server is trusted for it, whoever controls the server can collect reusable credentials from every user who authenticates to it. GraphnAI flags it, and Select Fire clears it with a change you can undo. graphnai.com/checks/unconstr… - Tier 0 credentials on the box. If a Domain Admin signed in to that server, and a lower-tier account holds rights there that can steal the credential, GraphnAI raises a Cross-tier credential exposure finding. graphnai.com/checks/cross-ti… - Where the site's accounts can go. If the service account the site runs as is an admin on your database or file servers, so is anyone who takes over the site, and an admin's credential left on that server could be one step away. GraphnAI maps every server and share those accounts can reach and shows which of that access has actually been used, so you can remove the rest with changes you can undo. Patching disarms the threat. GraphnAI reduces the blast radius.

I can't believe @techspence posted this without mentioning setting up canaries in AD to detect recon activities like directory enumeration. There are some great free tools out there for this like: github.com/AirbusProtect/AD-…

Kerberoasting targets a SQL service account someone gave replication rights. Minutes later, that account runs DCSync from the same address. Triage confirms the attack and escalates at once, because shutting off a Tier 0 account is a human's call. graphnai.com/product/detecti…

Seeing lots of people talking about having AI backport php2shell patches to PHP versions that went EOL 8 years ago. Cool, but are you also backporting patches for all the other CVEs that came out during that time? Or do you think threat actors only exploit the latest CVEs? 🤔

My daughter wanted to watch Alien tonight (she'd never seen it). I think the last time I watched this was on VHS on a little CRT TV. Streamed from Netflix and upscaled to 8K on a 160" screen with surround sound is quite the upgrade.

9 out of 10, would highly recommend. 😉

Nothing is safe this week.

I dream of the day when no one freaks out over the latest 0-day because everyone's security program has evolved beyond panic patching.

In GraphnAI's Identity Inventory, every number is a question. Click one, and the graph behind it opens above the table, with Tier 0 outlined in red. Intuitive workflows that empower informed decision making. graphnai.com/product