Nudge Security offers a variety of nudges to help you communicate with your employees. For example, you can send nudges prompting users to enable MFA, accept your generative AI usage policy, or delete an account, among other options.
‍
Now, you can customize the language in these nudges to suit your organization. You can edit the subject line and body copy for each nudge template and use variables to insert context-specific copy. Nudge customization options can be found within Settings.Â
‍
Nudge Security designates a technical contact for every app in your environment. This should be someone with administrative privileges within the app who can serve as the point-person for all questions and requests related to the technical aspects of managing that app, including access controls. While the first user of an app can often fill that role, employee turnover and team changes can sometimes make it challenging to figure out who to turn to for help with tasks like onboarding or offboarding users.
‍
Now, we’ve introduced a new nudge to help you find and validate the right technical contact for an app. With this nudge, you can send an email or Slack message to the person currently designated as an app's technical contact asking them to confirm whether or not they’re the right person for that role. If they aren’t the right contact, they’ll have the opportunity to identify the right contact, helping you keep this information up to date.
‍
Nudge Security has introduced the ability to multi-select filter options. Now, you can choose more than one option in each filter category, making it easier to find what you need with filters. For example, you can use filters to see all apps with approval statuses of Approved, Acceptable, and In Review, rather than looking at one of these approval statuses at a time.Â
‍
‍
Nudge Security has enhanced our SaaS discovery engine with support for Google Single Sign-On (SSO). This update enables our system to recognize and analyze the use of Google SSO in authenticating user accounts. Now we can provide deeper insights into authentication patterns, improving security and compliance across your SaaS applications by offering detailed visibility into how Google SSO is employed in your environment.Â
‍
We’ve enhanced Nudge Security’s OAuth management functionality with the ability to take bulk actions to audit and revoke OAuth grants. Now, you can multi-select any Google and Microsoft OAuth grants and choose to either auto-revoke them or send a nudge to the employees who created the OAuth grants asking them to review whether or not they are still needed.
‍
If a user selects the nudge response indicating that they’re still using the application, Nudge Security will simply record their response under Nudge History. If a user replies that the grant is no longer needed, the grant will be revoked automatically.
‍
You may have specific employees who you want to opt out of receiving nudges, such as senior executives or contractors.Â
‍
We’ve introduced a way to make sure these users won’t receive nudges going forward. Under Organization Settings, you can create a list of users to opt out of nudges. Take a look in the interactive demo below.
‍
‍
We’ve added a custom field to nudges, allowing you to send a note to your employees any time you send a nudge. This allows you to add any contextual information that might help your users with a specific nudge.
‍
We’ve added new filters to help you navigate the OAuth grants in use at your organization. Now, you can filter grants by authorizing application, type, risk, permissions, user account status, admin privileges, or OAuth grant status. For example, you can use filters to quickly find high-risk OAuth grants, or OAuth grants from suspended or disabled users.
‍
‍
We've added a new dashboard to help you understand what AI tools are in use at your organization and who is using them.
‍
Now, you can:Â
‍
Read today’s blog to learn more or check out our interactive demo below.
‍
Certain playbooks in Nudge Security may send more than one nudge to the same employee. For example, when you run the playbook to remove abandoned accounts, some employees might have accounts with several of the apps you choose to audit. Previously, they would receive a nudge for each application.Â
‍
Now, when the same nudge applies to multiple apps, we’ll consolidate them into one Slack message or email to help cut down on notifications for your employees. The interactive demo below will show you what your users will see in either situation.
‍
We've added a new filter to help you view your employees' accounts by authentication type to see how they're accessing different apps. For example, you might want to look at all accounts created with a username and password, meaning the logins aren't unmanaged by your organization. You can also filter by authentication methods such as Okta, Azure, Google Workspace, Slack, Office, and Github.
‍
We’ve added three new ways for you to customize the nudges you send to your employees. Now, you have the option to:
‍
We've improved the information we provide for each application account by adding more detail around the authentication methods used by the application. For each account, we are adding insights about which authentication methods are used, the last activity, and the MFA status for each of them. The authentication methods include accounts being accessed via SSO providers like Okta or Azure AD, and Oauth (such as sign-on with Google or Microsoft), as well as accounts created via username and password. We’ve also added the ability to filter accounts by authentication type.
‍
We’ve upgraded the Nudge Security dashboard with key statistics highlighting your organization’s app usage and a new graph to visualize your SaaS adoption rates. You can also see who within your organization is most likely to experiment by adopting new SaaS products, as well as which apps in your supply chain have been breached.
‍
Nudge Security has added a new filter enabling you to filter apps by technical contact. Now, you can see a list of all applications assigned to a particular technical contact and, if needed, edit them in bulk to reassign them.
‍
‍
We’ve released a new playbook to help you equip your employees to engage with AI tools safely. Using the playbook, you can find all the AI tools your employees are using and nudge them to review and accept your AI acceptable use policy. (Note that administrative privileges are required to view and run the playbook.)
‍
With this new functionality you can:
Read today’s blog to learn more or check out our interactive demo below.
‍
We’ve enhanced our playbook for employee offboarding with the ability to have multiple active playbooks in progress at the same time. Now, you can start the playbook for one departing employee, save your progress, start one or more others, and go back and forth between them.
‍
‍
Now, you can more easily update statuses or add context to your applications within Nudge Security by selecting and editing multiple apps at once. From the App view, you can bulk edit fields like an application’s labels, category, technical contact, approval status, and compliance scope, among others.
‍
We’ve released a new playbook to automate the process of removing abandoned accounts. Now, you can reduce unnecessary risks by minimizing your attack surface and eliminate wasted SaaS spend on unused accounts. Using the playbook, you can:
Learn more in today’s blog.
‍
We’ve added a new chart showing the rate of adoption for each of your organization’s applications, helping you understand how and when an app has gained traction among your employees. Visualize how your users have adopted an app over time by filtering the chart to see how many users have been added in the last day, week, month, year, or all-time.
‍
Nudge Security provides a variety of editable fields for each application and account in your environment, such as approval status, compliance scope, and SSO provider. Now, we’ve made it easier for you to understand how and when these fields are modified over time.Â
‍
Any time a field update occurs, Nudge Security tracks when it happened and which user or automated process initiated it. You can view a timestamped list of each field’s history to understand when changes have occurred and who made them.
‍
Nudge Security has added new ways for you to identify and track whether your employees’ accounts are still active, enabling you to delete abandoned accounts, reclaim unused licenses, and clean up orphaned data.Â
‍
Now, when you nudge users to ask if they’re still using an account, their answers will automatically apply account statuses within Nudge Security. In addition, for applications provisioned through SSO, Nudge Security will now automatically mark accounts as inactive after 90 days of inactivity.Â
‍
To visualize this information, we’ve added a graph displaying account statues on each application’s overview page that can be changed manually or updated automatically in the following ways:Â
‍
‍
When Nudge Security identifies abandoned accounts at your organization, you may need help from a user with administrative privileges for that app to delete them. To help you identify users with admin privileges, Nudge Security automatically designates a technical contact for each application, starting with the first user of that app. You can also reassign technical contacts manually as needed.
‍
Now, Nudge Security has added the ability to nudge technical contacts to assist with deleting or suspending abandoned accounts and reclaiming unused licenses. The technical contact will receive a list of abandoned accounts and instructions to confirm once they have performed the appropriate actions. Once they confirm that the accounts have been removed, the account statuses will be updated automatically within Nudge Security.
‍
To provide customers with more granular access controls, Nudge Security has added a new user role that enables use of the employee offboarding playbook without requiring administrative access. Now, Nudge Security provides the following user roles:
‍
We’ve added a new nudge to help you verify whether OAuth grants for Google Workspace or Microsoft 365 are still in use before revoking them, so you can avoid any potential business disruption. When you nudge a user about an OAuth grant you hope to revoke, your user will receive an email or Slack message asking them to confirm whether they’re still using the integration. Once the user confirms that the integration is no longer in use, the OAuth grant will be revoked automatically.
‍
We’ve added the ability to export user group data with the addition of an “Export CSV” button on the Groups page. Now, you can download a CSV file containing all of your organization’s groups and each one’s primary email, number of members, number of accounts, and risk score, as well as permissions to join, read messages, and manage members.
‍
We’ve just released a new playbook that guides you through complete employee offboarding in alignment with Google and Microsoft best practices and automates common SaaS offboarding tasks, so you can transition employees securely and completely every time.Â
‍
Now, you can:
‍
Check it out in the interactive demo below, and read more about it in today’s blog.
‍
For each application your employees are using, Nudge Security provides contextual information that you can use to accelerate security reviews.
‍
We've enhanced this security context by adding a summary of the forms of multi-factor authentication each application offers. Now, you can easily assess which options are most appropriate for your workforce, or determine if an application doesn’t meet corporate security guidelines if the available options aren’t sufficient.
‍
We’ve just released the ability to revoke OAuth grants for Google Workspace and Microsoft 365 directly within Nudge Security. This new feature builds on the OAuth risk scores we delivered earlier this year by making it faster and easier to respond to risky OAuth grants. We’ve also added more context to our OAuth overviews to help you understand the permissions a grant has authorized. When Nudge Security shows you an OAuth grant with overly-permissive scopes, you can revoke it in just two clicks.Â
‍
With this new functionality, you can:
‍
Check it out in the interactive demo below, and read more in our blog post.
‍
We’ve released a new feature to give you more visibility of groups at your organization and their privacy settings, along with how and when they’re being used to create shared accounts.Â
‍
The new group analysis functionality allows you to:
‍
‍
Learn more about the security risks of using groups for SaaS access in our blog post.
We’ve made it easier to focus on your most relevant accounts by introducing better default filters. Now, we’re filtering deleted accounts and suspended Google Workspace users out of account lists by default. If you want to see the accounts that have been excluded, all you need to do is modify the filter settings at the top of the page. Â
‍
‍
We’ve enhanced the data we display for Google Workspace users, giving you a better snapshot of each employee’s profile at your organization. Now, you can see an employee’s department, division, cost center, location, organization name, and title from directly within the user summary view. We’re updating these fields automatically using metadata from Google Workspace and displaying it in the UI at the user level.
‍
‍
We’ve made it easier to manage your company’s AWS footprint by adding two new dashboard views to the Amazon Web Services app overview. Now, you can see your AWS Organizations and the accounts associated with them, as well as your unmanaged accounts. You can search, filter, and export the data.
‍
You can see a full list of your AWS Organizations, with the accounts associated with each AWS Organization nested underneath for easy navigation.
‍
You can also see a list of the unmanaged AWS accounts that aren’t currently associated with an AWS Organization, helping you catch rogue or abandoned accounts before they introduce unnecessary costs or risks.
Together, these two new views make it easier for organizations with large numbers of AWS accounts to explore and manage their AWS infrastructure.
We’ve just released a brand new Slack integration to help you reach employees right where they’re working.Â
‍
With this new functionality, you can:
‍
Take a tour of the new functionality below:
‍
‍
Learn more about the power of nudging with Slack in our latest blog post.
We’ve released a new view to show the history of all the nudges your organization has sent in one centralized page, making it easier for you to follow the messages you’re sending to employees. You can also see the nudge history for each individual application at your organization.Â
‍
With this new view, you can:
‍
We’ve simplified the process for customers to export data from Nudge Security.
‍
Now, all you need to do to export data is click the “Export CSV” button in the upper right hand corner of each screen.Â
‍
Check it out in the screenshot below. In this example, exporting data from the Apps view will give you a CSV file of all of your organization’s applications, including each app’s name, labels, category, number of accounts, first user, and date first seen in your environment.Â
‍
The social media tab within our attack surface dashboard is now generally available. Nudge Security discovers all the social media accounts tied to your corporate email domains and helps you understand who owns them.
‍
With this functionality, all customers and trial users can now:
‍
Check it out in the screenshot below, and learn how this fits into our overall SaaS attack surface management capabilities in our recent blog post.
‍
‍
Today, we’ve enhanced our SaaS access management support and Azure AD integration with a new automated playbook to streamline the process of onboarding applications to Azure AD SSO.Â
‍
With this new playbook, customers and trial users can:
‍
‍
Read more about how Nudge Security supports SSO onboarding, including this new functionality, in our latest blog post.
We’ve just released a new automated playbook to make running SOC 2 access reviews with Nudge Security even easier.Â
‍
Now, customers and free trial users can:
‍
Here’s an interactive tour of the new feature:
‍
‍
For a closer look, read the release blog post here.
We recently added a new attack surface dashboard, so you can readily monitor your cloud and SaaS attack surface as it changes.Â
‍
Leaning on our security expertise and experience, we organize the data we discover about your SaaS estate and supply chain into key focus areas, including:
‍
‍
Here’s an interactive tour of the new feature:
‍
To learn more about how it works and how you can modernize your attack surface management strategy with Nudge Security, check out our blog.
Today, we released a new OAuth risk scoring feature and improved the way we visualize and classify OAuth grants for easier management and risk prioritization. Additionally, you can now build custom notification rules based on flexible OAuth criteria, including setting an OAuth risk score threshold.
‍
Here’s an interactive tour of the new and improved features:
‍
‍
For more information about these new capabilities, read our release blog post here.
‍
As always, we encourage your feedback!
Nudge Security customers can now subscribe to SaaS breach notifications.Â
‍
When a data breach disclosure is discovered for a third- or fourth-party SaaS provider in your SaaS supply chain, Nudge Security will send you an email notification, alerting you to the potential impact of the breach. Here’s a recent example we sent to customers:
‍
‍
So, now whenever a SaaS data breach hits the headlines, you can quickly determine if your organization is in the blast radius.
‍
To subscribe to breach notifications in the product, go to Settings and check “Receive breach notifications.”
‍
‍
Hello, world! Today, we officially launch Nudge Security with a 14-day free trial.
‍
Nudge Security is a SaaS security platform that discovers SaaS assets historically and continuously across distributed organizations, maps digital supply chain risk, and automates SaaS security tasks, including nudging employees to adopt and use SaaS securely.Â
‍
Built for hybrid and remote work, Nudge Security gives IT, security, and compliance teams immediate visibility of shadow IT risks and helps them to curb SaaS sprawl by working with employees, not against them.
For more info, read our launch blog post and press release.