Changelog

For each application your employees are using, Nudge Security provides contextual information that you can use to accelerate security reviews.

‍

We've enhanced this security context by adding a summary of the forms of multi-factor authentication each application offers. Now, you can easily assess which options are most appropriate for your workforce, or determine if an application doesn’t meet corporate security guidelines if the available options aren’t sufficient.

‍

We’ve just released the ability to revoke OAuth grants for Google Workspace and Microsoft 365 directly within Nudge Security. This new feature builds on the OAuth risk scores we delivered earlier this year by making it faster and easier to respond to risky OAuth grants. We’ve also added more context to our OAuth overviews to help you understand the permissions a grant has authorized. When Nudge Security shows you an OAuth grant with overly-permissive scopes, you can revoke it in just two clicks. 

‍

With this new functionality, you can:

• Detect, investigate, and revoke risky OAuth grants without switching between different environments.
• Easily clean up OAuth grants for departing employees during IT offboarding.
• Swiftly quarantine a breached app in your SaaS supply chain by identifying and revoking active OAuth grants.

‍

Check it out in the interactive demo below, and read more in our blog post.

‍

We’ve released a new feature to give you more visibility of groups at your organization and their privacy settings, along with how and when they’re being used to create shared accounts. 

‍

The new group analysis functionality allows you to:

• Identify the groups in use at your organization and discover any accounts that have been created using that group
• Check which users can see a group’s emails, which gives them the ability to reset passwords for any accounts set up for the group
• Ensure each group has appropriate privacy settings

‍

‍

Learn more about the security risks of using groups for SaaS access in our blog post.

We’ve made it easier to focus on your most relevant accounts by introducing better default filters. Now, we’re filtering deleted accounts and suspended Google Workspace users out of account lists by default. If you want to see the accounts that have been excluded, all you need to do is modify the filter settings at the top of the page.  

‍

‍

We’ve enhanced the data we display for Google Workspace users, giving you a better snapshot of each employee’s profile at your organization. Now, you can see an employee’s department, division, cost center, location, organization name, and title from directly within the user summary view. We’re updating these fields automatically using metadata from Google Workspace and displaying it in the UI at the user level.

‍

‍

We’ve made it easier to manage your company’s AWS footprint by adding two new dashboard views to the Amazon Web Services app overview. Now, you can see your AWS Organizations and the accounts associated with them, as well as your unmanaged accounts. You can search, filter, and export the data.

‍

You can see a full list of your AWS Organizations, with the accounts associated with each AWS Organization nested underneath for easy navigation.

‍

You can also see a list of the unmanaged AWS accounts that aren’t currently associated with an AWS Organization, helping you catch rogue or abandoned accounts before they introduce unnecessary costs or risks.

Together, these two new views make it easier for organizations with large numbers of AWS accounts to explore and manage their AWS infrastructure.

We’ve just released a brand new Slack integration to help you reach employees right where they’re working. 

‍

With this new functionality, you can:

• Send nudges to users in Slack, so users can respond directly from the Slack app
• Track users’ responses within your Nudge Security dashboard
• Receive Slack messages based on your custom notifications, such as when a new breach affects your organization’s supply chain or a user signs up for a new application

‍

Take a tour of the new functionality below:

‍

‍

Learn more about the power of nudging with Slack in our latest blog post.

We’ve released a new view to show the history of all the nudges your organization has sent in one centralized page, making it easier for you to follow the messages you’re sending to employees. You can also see the nudge history for each individual application at your organization. 

‍

With this new view, you can:

• See all the nudges that have been sent to your users, along with when, why, and who sent them
• Find out whether users have seen your nudges yet
• Track your users’ responses to queries, such as why they’ve signed up for a new application
• See how long ago users were nudged so you can determine whether they need additional outreach

‍

We’ve simplified the process for customers to export data from Nudge Security.

‍

Now, all you need to do to export data is click the “Export CSV” button in the upper right hand corner of each screen. 

‍

Check it out in the screenshot below. In this example, exporting data from the Apps view will give you a CSV file of all of your organization’s applications, including each app’s name, labels, category, number of accounts, first user, and date first seen in your environment. 

‍

The social media tab within our attack surface dashboard is now generally available. Nudge Security discovers all the social media accounts tied to your corporate email domains and helps you understand who owns them.

‍

With this functionality, all customers and trial users can now:

• Quickly see all social media accounts associated with your organization
• Discover employees who have created personal social media accounts using corporate emails 
• Easily identify who to contact in case of security issues with your organization’s social media accounts

‍

Check it out in the screenshot below, and learn how this fits into our overall SaaS attack surface management capabilities in our recent blog post.

‍

‍

Today, we’ve enhanced our SaaS access management support and Azure AD integration with a new automated playbook to streamline the process of onboarding applications to Azure AD SSO. 

‍

With this new playbook, customers and trial users can:

• Track which of your organization’s apps have been added to Azure AD SSO, and which ones haven’t.
• Prioritize onboarding efforts by identifying which of your unenrolled apps are already integrated with Azure AD.
• Kick off an automated workflow to enlist the help of each app’s primary admin and track their responses, rather than hunting them down individually.

‍

‍

Read more about how Nudge Security supports SSO onboarding, including this new functionality, in our latest blog post.

We’ve just released a new automated playbook to make running SOC 2 access reviews with Nudge Security even easier. 

‍

Now, customers and free trial users can:

• Capture and classify all in-scope SOC 2 assets, starting with smart app categorization to speed up your process.
• Easily identify users associated with your SOC 2 assets and verify that they still need access on a regular basis.
• Generate a print-ready report of your SOC 2 access review to demonstrate a repeatable process for auditors.

‍

Here’s an interactive tour of the new feature:

‍

‍

For a closer look, read the release blog post here.

We recently added a new attack surface dashboard, so you can readily monitor your cloud and SaaS attack surface as it changes. 

‍

Leaning on our security expertise and experience, we organize the data we discover about your SaaS estate and supply chain into key focus areas, including:

‍

• External-facing SaaS apps and domains (what attackers can see)
• SaaS apps that commonly store corporate IP and sensitive data
• Critical cloud and software supply chain infrastructure
• Corporate social media accounts
• And, well, much more…

‍

Here’s an interactive tour of the new feature:

‍

To learn more about how it works and how you can modernize your attack surface management strategy with Nudge Security, check out our blog.

Today, we released a new OAuth risk scoring feature and improved the way we visualize and classify OAuth grants for easier management and risk prioritization. Additionally, you can now build custom notification rules based on flexible OAuth criteria, including setting an OAuth risk score threshold.

‍

Here’s an interactive tour of the new and improved features:

‍

‍

For more information about these new capabilities, read our release blog post here.

‍

As always, we encourage your feedback!

Nudge Security customers can now subscribe to SaaS breach notifications. 

‍

When a data breach disclosure is discovered for a third- or fourth-party SaaS provider in your SaaS supply chain, Nudge Security will send you an email notification, alerting you to the potential impact of the breach. Here’s a recent example we sent to customers:

‍

‍

So, now whenever a SaaS data breach hits the headlines, you can quickly determine if your organization is in the blast radius.

‍

To subscribe to breach notifications in the product, go to Settings and check “Receive breach notifications.”

‍

‍

Hello, world! Today, we officially launch Nudge Security with a 14-day free trial.

‍

Nudge Security is a SaaS security platform that discovers SaaS assets historically and continuously across distributed organizations, maps digital supply chain risk, and automates SaaS security tasks, including nudging employees to adopt and use SaaS securely. 

‍

Built for hybrid and remote work, Nudge Security gives IT, security, and compliance teams immediate visibility of shadow IT risks and helps them to curb SaaS sprawl by working with employees, not against them.

For more info, read our launch blog post and press release.