Jared Atkinson

💡 WHAT IS PURPLE TEAMING AT SPECTEROPS? SpecterOps recently introduced our Purple Team service offering, but what is it? We define it as "the evaluation of security control efficacy through atomic testing using deliberately selected test cases." ghst.ly/3EUVRHB

AI and non-human identities are changing identity security. Join @jaredcatkinson & @JustinKohler10 for a webinar on our latest research into Identity APM adoption, challenges, and operational maturity. Save your spot: ghst.ly/3QQDhcJ

If MSSQL isn't in your attack path visibility yet, this is your sign. @Mayyhem just shipped a major MSSQLHound upgrade with Javier Azofra Ovejero (github.com/jazofra): faster, cross-platform, and pathfinding-ready in BloodHound. Check it out! ghst.ly/4cUKgtJ

A compromised AI tool became an attack path into enterprise identity. @jaredcatkinson breaks down the lesson from the recent Vercel breach: AI tools are non-human identities w/ delegated access. If compromised, attackers inherit it. Read more ⤵️ ghst.ly/4sSGW7p

Anthropic’s Mythos points to a future of machine-speed attacks. What changes for defenders? 🤔 Join @JustinKohler10 & @jaredcatkinson and learn how AI is accelerating compromise, why identity attack paths matter, and what you can do now. Register → ghst.ly/47PJs6E

Not all attackers want data or money. Some aim for disruption. @jaredcatkinson spoke w/ @TechJournalist on why orgs need to model impact, not just attacker type. If your risk model is still centered on theft or #ransomware, it’s outdated. ghst.ly/41K0jnS

@_David_Naylor Thank for the shout out Dave! Hope you are doing well brother!

6 years later @jaredcatkinson 's detection spectrum post (and his whole series) still slaps - funnel of fidelity and detection spectrum are such powerful concepts that have really stuck with me specterops.io/blog/2020/02/2…

Don't miss this one! Join @JustinKohler10 & @jaredcatkinson TOMORROW for a walkthrough of how BloodHound Enterprise now maps risk across Okta, GitHub, and Mac environments. There's still time to register 👉 ghst.ly/4bFEnir

Identity moves across systems like AD, Okta, Entra, & GitHub. A compromise in one place can quickly turn into control somewhere else. @jaredcatkinson breaks down how we modeled Okta in BloodHound Enterprise to make those attack paths visible. Learn more: ghst.ly/3PpLKmJ

@ImposeCost @ctlyle1 @zacharyebell Yea it was 100% genuine. She was like, you don’t qualify… get your ass to the back. The rack and stack conversation just reminded me of that moment where my civilian wife participated.

@jaredcatkinson @ctlyle1 @zacharyebell Damn.

The veteran community has got to stop tearing each other apart. Oh you were a reservist but not active? Not veteran enough. Oh you were active but didn’t deploy? I did so you aren’t veteran enough. Oh you deployed but didn’t see combat? Not veteran enough. Oh you saw combat but didn’t receive a Purple Heart or commendation? Not veteran enough. Oh you were decorated but not special operations? Yes, we all know there is difference between a lifelong special operations veteran with 8 combat deployments vs. someone who held a support role for 4 years and didn’t deploy. And we should rightfully hold reverence for those who did the hardest things and acquitted themselves with honor. But that reverence shouldn’t be weaponized to diminish the value of those who raised their right hand, in a time of war, when less than 1% do it on an annual basis in an all-volunteer force. The argument shouldn’t be those who served minimal time and didn’t see combat don’t have a right to resources from VA. The argument is how to make sure those who deserve it, get it. And believe me, there are plenty of people in DC, including at @DeptVetAffairs, who have dedicated their lives trying to make that happen. Sure, fraud exists. But for all the stories we see online about legitimate cases, @VetAffairsOIG data indicates it is not, in fact, rampant. And it leaves out historical context of VA being historically very slow to award benefits to generations of veterans until they’re old or already dead. Trying to claim fraud is run amok at VA serves to disincentivize those who need help from getting it, for fear they’re somehow taking resources away from veterans who need it more. It doesn’t. Ironically, these claims usually come from people who - despite being young and healthy for the last 20 years - never raised their right hand. Which is clear not because their claim is disrespectful (though it is), but because it’s lazy and not based on an understanding of the system itself. Any veteran will tell you, based on direct experience or through a person they served with, the VA healthcare and benefits system is a complex leviathan and difficult to navigate, which is why accredited representatives through orgs like @AmericanLegion exist. I wish it were easier, and it’s literally my full-time job trying to make it so. But it’s not. I run a team of 20+ accredited people representing veterans in initial claims, appeals, debt collection, pensions, etc. I just had a veteran’s claim finally granted after 12 years…12 YEARS…of fighting VA. He was in medical debt after paying for surgeries out of pocket because his condition hadn’t been determined service-connected. His backpay took care of most of it. And while this was an extreme case, it’s sadly not uncommon for claims and appeals to take years. So if you’re somehow operating under the illusion this is a slush fund of $ for a bunch of fraudsters gaming the system, especially if you have no experience with it, you should exercise your right to shut the hell up.

@ImposeCost @ctlyle1 @zacharyebell My wife once told me I was not allowed to park in the veteran spot at The Home Depot. When I asked why, she genuinely thought I wasn’t a veteran because I sat in basement in San Antonio the whole time.

@ctlyle1 @zacharyebell I agree with your thesis. I also think racking and stacking people is so embedded in our veteran community that even posts trying to say the right thing end up stack ranking veterans.

What do hundreds of incident response engagements reveal? Identity is the battleground. ⚔️ Steve Elovitz from @Unit42_Intel joins #KnowYourAdversary to break down how attacks unfold, from phishing to privilege escalation to SaaS expansion. 🎧: ghst.ly/4uFeMie

GitHub isn’t just a code platform anymore. It’s a security boundary. New from @jaredcatkinson: how GitHub creates real attack paths into repos, secrets, CI/CD, and even cloud environments. Read more: ghst.ly/4cU3QHd

BloodHound Enterprise is expanding. New OpenGraph extensions now uncover identity attack paths across Okta, GitHub, and Jamf-managed macOS—connecting identities, repositories, and endpoints across hybrid environments. ghst.ly/3N7X7yY 🧵: 1/3

Can AI agents conduct advanced cyber-attacks autonomously? We tested seven models released between August 2024 and February 2026 on two custom-built cyber ranges designed to replicate complex attack environments. Here’s what we found🧵

Releasing PrivHound — Bloodhound collector to model Windows local Privilege Escalation as a graph. Still early — bugs and PRs welcome. github.com/dazzyddos/Priv…

Check out GoLinHound: - Discovers Linux & SSH attack paths - Outputs OpenGraph JSON for BloodHound ingestion - Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths github.com/RantaSec/golin…

Incredibly proud of the team over here at @HuntressLabs as we announce a new really cool feature in our EDR - the “Attack Disruption Engine”. This new capability allows us to identify threats quicker on the endpoint and change response time from minutes to seconds. Full blog: huntress.com/blog/disruptin…

Identity risk isn’t just about who has access. It’s about how access connects. @jaredcatkinson dives into how Attack Path Management reframes modern security strategy in his article for @IdentityWeek_ID. ghst.ly/4txClZI

Introducing BloodHound Scentry: Accelerating Attack Path Management Join Duane Michael and Robby Winchester as they discuss BloodHound Scentry specterops.zoom.us/webinar/regist…

Seeing identity attack paths is one thing. Eliminating them safely is another. @ChannelInsider breaks down BloodHound Scentry and how it helps teams operationalize Identity APM faster. ⤵️ ghst.ly/3OioUg2