Sam Erde

👀

@rvrjason @NathanMcNulty I’ve been very pleasantly surprised LATELY with M365 Copilot (even in Excel, which I never thought I’d be able to say) and Work IQ. Otherwise, yeah, it has generally been garbage up until now.

@NathanMcNulty Garbage

Oh windowslatest.com/2026/06/22/mic…

@NathanMcNulty @CynicLib For real! Instead, it’s the other way around: if you want to use Scout, you need M365 Copilot, GitHub Business/Enterprise aaaand GitHub Copilot Business/Enterprise through which your consumption-based billing will flow.

@CynicLib If I could figure out how to attach M365 Copilot to VS Code and burn my GPT/Claude tokens that way, I would be all over it :P

@pierceboggan Nice. Any differences between the two packages and installation methods?

The GitHub Copilot app is now available on the Microsoft Store! apps.microsoft.com/detail/xpdck2l…

@SLNTPLNT Noooooooooooo! 😱😖🙏

hey british airways I hope you are doing well. unfortunately you misplaced like $20,000 of our equipment today so we are really gonna need that back thanks

Fun memories from my Active Directory days! If you EVER touch AD, these are tips you should get familiar with BEFORE you need them!

@NathanMcNulty @da5ch0

@Slav636 @pierceboggan We just got bumped up to Max today! 👏

@Slav636 @pierceboggan MVPs get GitHub Pro Plus, which includes…some Copilot credits. 😅 It was a bounty prior to the switch to consumption based billing!

Copilot Max subscribers have $200 in extra credits through the end of June. Perfect time to try the GitHub Copilot app :) gh.io/app

@jorgeasaurus @zsattler Oh, my dude, I can’t wait to see this!

This experiment I am working on turns Microsoft Intune and Entra ID into an interactive Three.js relationship map. Search a user, device, app, policy, group, or role and see how assignments, ownership, filters, and scope tags connect across your tenant.

@SamErde And of course building on what I just said in reply to you everyone brings something unique to the table. The good leader utilizes everyone's unique skills in order to be successful as a team.

😂 This did not happen, mostly because they use a shit ton of air gapped systems. Lateral movement is not possible, BY DESIGN. Meaning it is literally designed so that the claim in this screenshot, makes it very unlikely to happen. READ THIS NEXT PART CAREFULLY, PLEASE to understand exactly what I am saying here. This is not a Stuxnet scenario. Which involved other humans by the way. The centrifuges did not infect themselves. There have been hackers who have breached air gapped systems in various ways and I'm not going to discuss them here, the papers are available on the Defcon servers if you would like to read them, but I highly doubt those at the NSA set up the environment in such a way to make that possible. The NSA itself is also very good at breaching air gapped systems, but the various techniques almost always involve other humans, not distributed machines. Meaning, without a human transporting the malware or payload via USB to that air gapped machine, it is not otherwise possible. I seriously do not think that they temporarily changed their entire network architecture, which would have taken several months, to make all these air gapped systems non-air-gapped nor do I think that they transferred Mythos directly to these systems as they probably are not equipped to be running LLMs, either. So the more likely scenario is that Mythos made a payload which NSA staff then ran on those air gapped systems. That does not mean Mythos breached the air gapped system, it just means that it suggested the likely attack vector path but without a human involved, it would not be possible. Also, seriously, consider the source, or in this case, the second and third hand source. See: AIRGAP SIDTODAY (from the Snowden archive) OUTPARKS CNSS directives (dozens) they publish NSA cyber security guidance and hardening best practices For an understanding of NSA architecture as it has been leaked and publicized in places like the Intercept. Lastly, why would one of our chief spy agencies show their cards like this? This is just common sense and logic. Let's all see what pet projects the Senator is interested in and how Mythos being capable of doing these miraculous things scare the hell out of enough people in DC to enable those pet projects checks to be funded. Because that's the real story. Not this fantasy.

@blackroomsec True! Let’s not oversell my specific experience 🙃 but you’re spot on in the ways that matter!

All we can do Sam is keep calling out this nonsense. And hopefully our non-techy followers will understand that those of us who have the jobs we do in cyber security only have those jobs because we have been trained the exact same way doing the exact same techniques as those who work in the NSA, the FBI, the CIA and elsewhere in the world. We know what we're talking about because we do these things for a living. And if someone doesn't believe you will then just ignore them because they don't know what they're talking about but you and I do and we know that this is insane and didn't happen.

@techspence @ZackKorman Ugh, it would be humorous if it wasn’t so tiring.

@ZackKorman The gift that keeps on giving

Guys it’s Father’s Day. The mythos hacked NSA stuff is gonna have to wait until tomorrow

Why do people so often repost headlines from Polymarket as if it’s some form of legitimate news and information? Please reconsider! 🙃 Not targeting anyone specifically here; just surprised to see how much of my feed is comprised of these dramatic, FUDdy reposts by fellow pros.

@rootsecdev Nah. Just bad journalism and ignorant politicians at work here, I think. This has been torn apart already. 😅

👀

Secrets Secrets Everywhere and Shadow Admins in Places you didn't think about! Merill and I talked about this last year too but this time we go a bit more in depth with how Midnight Blizzard found API Client Secrets and used them to compromise Microsoft's production tenant. We talk about managing secrets, managing owners, a couple examples of dangerous API permissions where the threat may be overlooked. In Zero Trust to Hero Trust, we talk about what a managed device is! We share funny stories of times past about PIM expiring during automations, experiences with 80k to millions of service principals and approaches to decreasing your attack surface, Intune Admins applying ALL the CIS Benchmarks (surprise! the devices wouldn't turn on), and lots of other fun stuff I'm sure I'm forgetting. Anyone who knows me well knows I don't usually sugar coat things and there's no changes here in the latest episode of Entra Chat. Check it out and please share! In this case, sharing is caring! ❤️

@2600Hz_ @merill Ah. Respect for owning the oof at least. 😀

@SamErde @merill Got my money's worth at the Learing Center I tell you h'wut x.com/2600Hz_/status…

Ex Microsoft PM doesn't understand why blocking screenshots via policy is bad. Kinda explains a lot actually.