Insights from the SpyCloud Customer Advisory Board Annual Meeting
We recently held our annual Customer Advisory Board (CAB) onsite in Austin, and I’m just going to say it: This might have been the BEST one yet.
The room was full of brilliant Defenders who showed up curious, opinionated, and generous with their time. They asked sharp questions and pushed back when something could be better, which is exactly what we ask of our customers. We want the unvarnished truth – what’s working, what isn’t, what we should build next. Then we try very hard to stop talking and listen.
If there was one thread through both days, it’s this: The login isn’t the finish line anymore.
Some of what we shared
Trevor Hilligoss, Chief Intelligence Officer, opened with the uncomfortable part: how attackers are getting around the strongest of authentication measures. Phishing never really went away, but it’s an increasingly commoditized attack. Adversary-in-the-middle (AiTM) kits sit between a victim and the real sign-in page and relay everything, including the MFA prompt.
Browser-in-the-middle attacks run the whole login inside a browser controlled by the attacker. Device-code phishing gets the victim to approve the attacker’s own sign-in. The mechanics differ, but the prize is the same: a live session.
Passkeys and hardware keys protect the login, and that matters. Fully enforced phishing-resistant MFA closes real doors. BUT fallback methods tend to stay open, and once a session token has been issued, whoever is holding that token can replay it. On your side of the screen it looks like one clean, MFA-satisfied sign-in. Attackers have noticed. It’s a bit of a whack-a-mole era out there, and the room had plenty of thoughts about it, including how many times a day people are willing to log in before they riot.
We asked the room who feels truly phishing-resistant. Not one hand went up.
We hold regular virtual Threat Briefings for customers – ask your CSM for an invite to the next one.
What we heard
The food was amazing (the breakfast bacon was a mega hit), the venue was stunning, and let me tell you, nobody plans an event like our CMO and our Sr. Events Manager. Oh, but you want to know what we heard from customers…
A few themes kept coming up:
Stolen access is on everyone’s mind. Many people in the room are already seeing post-login theft in their own environments, and many said their options for fighting it are limited. Most teams have invested heavily in hardening the login. The question now is what happens when an attacker gets in anyway, and how fast that access can be shut down. Identity Guardians can act on phished and malware-exfiltrated access automatically, including revoking sessions.
Showing your work. Defenders want evidence they can verify before they trust a score or let automation act on it. Nobody wants a verdict from a magic box. They want the records and the connections behind it. Luckily, objective proof and automation are our specialties.
Automate the safe stuff, but keep a human on the big calls. Most folks are happy to let password resets and session revocation run on their own. Disabling an account? They’d like a person to make that call, thank you very much.
Customers took center stage
Two customers presented, and both were stellar. One shared how their team uses SpyCloud to take a hard look at the security posture of the companies they’re acquiring. Because when you buy a company you inherit its risk, and the due diligence questionnaire doesn’t always tell the whole story. Another company showed an investigation workbench their team built on our Investigations API, complete with guardrails dictating that the AI agent proposes, but the analyst decides.
Then came the win stories, which are usually everyone’s favorite part. I am glad our customers love hearing from us, but part of the magic of a CAB is customers hearing from and being inspired by their peers. Some inspiring use cases we heard:
- How a supplier sailed through the security questionnaire while the data told a very different story. (The questionnaire got an A. The infostealer logs did not.)
- How SpyCloud protects a company’s executives and their families by watching personal accounts, because attackers tend to go after the personal stuff first.
- How SpyCloud helped turn one clue into a criminal identity in a single evening.
Some of these folks go way back.
The people in the room are not just customers, they are Defenders, and they are our PARTNERS. And a lot of them have been with us a long time – some for years across more than one company – they bring SpyCloud with them when they change jobs, and I can’t think of a nicer compliment. A few go back to the early days, when we did one thing: Recapture stolen credentials. That was the pitch – your passwords are out there, and here’s how to find them before someone else does.
The pitch has a sequel: Your sessions are out there too, and the goal is to find them and end them before they’re used. We’ve gone from guarding credentials to full-blown identity threat protection, and these customers have been with us every step of the way, given us honest feedback at each turn, and are still here, still curious, and still excited about what comes next. With trust as a cornerstone of any security product worth its weight, we’re grateful to have earned that and have their loyalty.
The question we’re asking everyone
Here’s the one we’re asking everyone right now: After a successful phish, how do you kill the stolen session?
If the honest answer is “we reset the password,” that’s a gap. Depending on your identity provider and configuration, a reset often doesn’t affect a session that’s already been issued, and a stolen refresh token can keep minting new ones.
A few things worth checking this week:
- Can you revoke sessions and refresh tokens on demand, and does that happen automatically after a confirmed phish, or only when someone remembers?
- Do you know which of your identity providers and apps can actually kill a session? (Not all of them can.)
- Does your awareness training still lean on spotting typos and odd phrasing? Modern lures rarely have those tells.
Until next time
To every customer who joined us, laughed with us, shared their candid feedback, and collaborated on what the future of disrupting cybercrime together can look like: Thank you.
If you’re a SpyCloud customer and you want a seat at the table next time, tell your customer success manager. If you’re not a customer yet, you now know what you’re missing: brilliant people, honest conversation, useful solutions…and an alarming amount of good food.
Y’all made it a good one. See you next year.
Your organization's data may already be exposed.
Keep reading
