Blog

I am thrilled to announce that ThreatX was recently recognized as a Great Place to Work-certified company for 2021! This recognition only affirms what we already know: Our team has developed an amazing, inclusive culture that shows up in the excellent work we do each day to help our customers protect the web applications and APIs that run the world.

One of my favorite activities as CEO of ThreatX is participating in meetings with prospects that have a legacy WAF already installed. In most cases, these discussions involve learning about a legacy WAF that, at best, has never been fully deployed or, at worst, has never been trusted enough to be placed into full blocking mode.

...Everything looks like a nail.

There are over a five billion unique user credentials currently circulating on darknet forums. No wonder credential stuffing/brute force attacks are on the rise and remain one of the most popular attack vectors used by both bad actors and bots alike. And they're not always what they seem to be.

We recently surveyed our customers to determine our 2020 NPS (net promoter score). As you may know, this metric calculates how likely a customer is to recommend a company or product. It’s a pretty simple and straightforward survey that asks a simple question:  

In a world where malicious bots roam the internet like hungry lions seeking vulnerable applications to devour, application owners are forced to make tough decisions between streamlined, user-friendly workflows and the need to interrupt user experience with bot protection techniques like CAPTCHA. We’re all tired of the user-experience of having an extra bit of work to do when filling out and submitting web forms. Who’s got time for that? However, malicious bots can and do cause real harm for countless organizations, especially as credential stuffing and account takeover attacks grow more and more sophisticated.

We're watching evolution in real-time. The bad guys have industrialized the attack toolbox. They're a step ahead of firewalls. They know where the tripwires and detection thresholds are for DDOS and Bot Detection solutions. Staying low and slow is cheap and productive. They’re sappers and deftly understand how to stay below the threshold of detection.  

Ed Amoroso, Chief Executive Officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company, recently published a great article on the potential for DDOS attacks to disrupt the upcoming election. In it, he gives great insight into how L3/L4 volumetric DDOS works and how they can be used against the facilities that collect and tabulate votes from regional sites. 

“We are all just prisoners here of our own device.” 
--The Eagles  

“Help me get rid of some of this stuff, or I’m gonna f’n lose it.”
--Anonymous CISO