EP268 Weaponizing the Administrative Fabric: Cloud Identity and SaaS Compromise in M Trends 2026

The episode opens with hosts Tim Peacock and Anton Chivacan welcoming listeners during RSA Week 2026. They introduce the podcast's focus on recent trends in cybersecurity and announce their upcoming live event at the Google booth. The conversation quickly shifts to the episode's main theme: analyzing the M-Trends 2026 report, a leading threat intelligence publication from Mandiant, emphasizing the importance of learning from real incident data rather than just theoretical security practices.

The hosts discuss several alarming statistics from the report, notably the dramatic reduction in adversary handoff times—from eight hours down to just 22 seconds—highlighting how threat actors are leveraging automation and collaboration to escalate attacks faster than defenders can respond. This trend undermines traditional metrics like Mean Time to Respond (MTTR) and calls for a reassessment of security priorities, particularly around early detection of opportunistic and low-impact threats that can quickly escalate.

A major theme is the increasing collaboration among threat groups, including ransomware operators and malicious actors sharing tools and infrastructure. This cooperation enhances their efficiency, allowing simultaneous or staged attacks at unprecedented speeds, which complicates defensive strategies. The discussion underscores how threat groups' objectives align around self-enrichment, leading to more sophisticated and coordinated campaigns.

The episode delves into how traditional cyber threats are evolving, including malvertising becoming more malicious and AI-assisted malware that can perform reconnaissance using AI tools. The hosts emphasize that many threats now resemble natural internet background radiation, but with an increased risk of high-impact events arising from passive, low-impact indicators. The narrative highlights the necessity for proactive controls, understanding initial infection vectors, and tightening security around software supply chains.

A core topic is the concept of 'weaponizing the administrative fabric'—attacking the identity layer that increasingly acts as the new perimeter in cloud environments. The discussion points out how gaining control of identities provides threat actors with significant leverage, enabling broad access and movement within organizations. The hosts note that this trend has become more common and accessible to a range of attackers, including those deploying ransomware, and that managing this risk involves better identity governance and monitoring.

The podcast explores strategies to combat attackers using legitimate tools and scripts—'living off the land'—and their cloud equivalents. Recommendations include understanding baseline activity, restricting unnecessary access, and employing behavioral monitoring. They warn against system administrator misuse and emphasize the importance of limiting privileges and rapid response to anomalies, highlighting the complexity of modern attack techniques.

A recurring discussion revolves around the cultural divide between IT and security teams. The hosts advise that leadership must foster collaboration, align organizational goals, and establish clear policies to improve cooperation. They stress the importance of leadership setting a unified vision and of implementing strict control over third-party relationships to mitigate risks from external suppliers and contractors. The discussion underscores that overcoming internal conflict is essential for strengthening overall security posture.

Finally, the hosts recommend reading Axelrod's 'Evolution of Cooperation' to understand collaboration dynamics and suggest practical exercises like simulated breach responses to improve readiness. They emphasize the importance of learning from past failures and external incidents, especially around voice phishing and supply chain vulnerabilities. The episode concludes with practical advice for CISOs on leveraging the M-Trends report for organizational buy-in and strategic planning.