Act

Big one for us: Act is now part of the Microsoft for Startups Pegasus Program. Finding risk was never the bottleneck. Acting on it is. That’s why we built Act: to take action on access in the cloud, so the paths attackers rely on stop existing. Pegasus gives us access to Azure’s AI models and the people running some of the largest cloud environments out there. That’s where cloud problems get real, and where we want to be building. Thank you Meital Shamia, Kevin Magee, Tom Pauly, and the whole Microsoft for Startups team.

Microsoft's October Patch Tuesday shipped 1,411 vulnerabilities: 70 critical, 3 zero-days, and one already exploited in the wild (breakdown via BleepingComputer). Two years ago, a normal month was about 100. This month it was 1,411. Microsoft says AI-assisted discovery will keep pushing that number up. Patch faster? Not really... So look at the mix, not the total: → 317 remote code execution flaws. Each one needs a reachable path. → 677 privilege escalation flaws. Each one needs a foothold and permissions worth escalating into. Both preconditions are access. Remove what’s configured but never exercised, and a large share of that exposure can’t be reached, including flaws that don’t have a CVE yet. That makes infrastructure controls your first line of defense against zero-days. Act exists so teams can stop chasing the queue and start acting - safely and sustainably.

We gathered all 4 Act founders on the couch to get real about building security differently. We asked them how we're actually different than a CNAPP, what question customers ask us again and again, and what market convention it's time to finally break. They had a little too much fun filming this one... 🍿 Grab your popcorn and hit play 👇 Jonathan Langer Itay Kirshenbaum Ilai Fallach Stephan Goldberg

Launching Amphi, our open-source toolkit for cloud access, was just step one. The real magic happens when teams bring it into their daily workflows - eliminating those annoying friction points that pop up at every stage of the IAM lifecycle. To show you exactly how it's done, David Kerber and James Berthoty are hosting a hands-on workshop designed specifically for the teams managing IAM policies every day. Understanding true reachability across your cloud is about to get a whole lot easier 🙂 Want to see it in action? Save your spot!

🚨 𝗜𝗳 𝘆𝗼𝘂 𝗿𝘂𝗻 𝗦𝗤𝗟 𝗼𝗻 𝗔𝗺𝗮𝘇𝗼𝗻 𝗔𝘁𝗵𝗲𝗻𝗮, 𝘀𝘁𝗿𝗮𝗻𝗴𝗲𝗿𝘀 𝗰𝗼𝘂𝗹𝗱 𝗿𝗲𝗮𝗱 𝘆𝗼𝘂𝗿 𝗾𝘂𝗲𝗿𝗶𝗲𝘀. 𝗢𝗻𝗲 𝗲𝘅𝘁𝗿𝗮 𝗳𝗶𝗲𝗹𝗱 𝗼𝗻 𝗮𝗻 𝗔𝗣𝗜 𝗰𝗮𝗹𝗹 𝗿𝗲𝘁𝘂𝗿𝗻𝗲𝗱 𝟰𝟯 𝗼𝘁𝗵𝗲𝗿 𝗔𝗪𝗦 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀' 𝗦𝗤𝗟, 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗜𝗗𝘀 𝘁𝗵𝗮𝘁 𝗿𝗮𝗻 𝗶𝘁 👇 Our research team found a cross-tenant flaw in Amazon Athena that handed back the full text of queries other AWS accounts had just run. No shared resource, no permission granted, no relationship of any kind. 𝗧𝗵𝗲 𝗯𝘆𝗽𝗮𝘀𝘀: Write "system" into the SQL and Athena refuses. Move the same word into the Catalog parameter beside it and the query runs. 𝗤𝘂𝗲𝗿𝘆 𝘁𝗲𝘅𝘁 𝗶𝘀 𝗻𝗼𝘁 𝗺𝗲𝘁𝗮𝗱𝗮𝘁𝗮: A WHERE clause usually holds the customer, the account number, the date range. An INSERT written with literal VALUES carries the whole row in plain text. Table and column names show how a company models its business. 𝗜𝘁 𝘄𝗮𝘀 𝗮𝘁𝘁𝗿𝗶𝗯𝘂𝘁𝗮𝗯𝗹𝗲: Every statement came back tagged with the account ID that submitted it. Not anonymous strings. Named accounts. ✅ 𝗔𝗪𝗦 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲: Reported 6 August, replied within hours, closed in every Region in four days. Nothing for customers to do. Full writeup in the link in the first comment.

Big announcement: Eight years ago, I got my first taste of building cloud security tools. We were building a CSPM before the term even existed — we were just solving problems. That feeling of creating impact at scale has never left me. In 2022, I started building again under the name Cloud Copilot, and later created open source tools with a simple goal: "increase the security of the internet". Thanks to the generous feedback of many smart, thoughtful people, those tools grew into something that solved real problems for sophisticated organizations. A stealth startup reached out to talk about some of that work. Soon after, I had the chance to meet three of the cofounders of Act Security in person. It was immediately clear that this team was smart, talented, and deeply passionate about the same problems I cared about. Several conversations later, Act Security acquired Cloud Copilot, and I joined the team full time. There were a few big reasons I decided to join Act. First, the team is focused on solving foundational security problems. For years, I’ve wondered why one of the most fundamental questions in security — “who has access to what?” — still goes unanswered by even the most sophisticated teams in the world. Turns out, it's an incredibly hard problem. The Act founders saw the same problem and chose to lean into foundational security challenges instead of building tooling around the edges. Second, cybersecurity is a team sport. It takes much more than a good library to have a real impact on the industry. The Act team knows how to build, sell, and deliver enterprise software at global scale. Joining this team is a once-in-a-lifetime opportunity for a middle-class kid from Bellevue, Nebraska. Finally, AI is changing everything. Entire industries are being created, destroyed, and transformed right now. This is the time to make a big move and take a big swing; I believe this is the right team to do it with. Joining Act has already been an amazing experience. I get to work side by side with smart, talented, and kind people who are passionate about the same nerdy AWS edge cases I am. As great as it has been so far, I’m even more excited about the journey ahead and all the ways we’ll learn, have fun, and win together.