Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Justin Kohler
ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant
Last updated October 17, 2026 An attacker used a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to customers’ Microsoft 365 tenants. The credential belongs to the application itself, so the attacker inherited the permissions granted to it. Here’s what’s known so far and what to check in your own tenant. This blog will be updated and cross-linked as more information becomes available.
What the 2026 Microsoft Digital Defense Report reveals about AI, identity, and the future of cybersecurity
Identity is the common thread. The Microsoft Digital Defense Report 2026 shows identity sprawl, non-human identities, and AI agents driving interconnected risk. Cloud identity abuse was the most observed technique against critical infrastructure, at 78%. A graph shows real reach.
Expanding attack path management to the AI frontier
Attackers don’t move through isolated systems. They move through the relationships between those systems and identities, chaining privileges to move laterally across the attack surface until they reach critical assets. Hybrid, decentralized environments and the rapid growth of AI agents and other non-human identities (NHIs) have dramatically expanded the trust relationships defenders must secure.
Agentische KI: Warum Identitäten zum kritischen Angriffspfad werden
Agentische KI hat 2025 den Sprung in den produktiven Betrieb geschafft. Was als einzelne Assistenzfunktion begann, hat sich vielerorts zu autonomen Agenten entwickelt, die eigenständig Code schreiben und ausrollen, Infrastruktur provisionieren und auf produktive Datenbestände zugreifen. Damit erhalten diese Agenten dieselben weitreichenden Berechtigungen wie erfahrene Entwickler und bewegen sich auf denselben Pfaden durch Cloud- und Entwicklungsumgebungen.
Hybrid Attack Paths, New Views and your favorite dog learns an old trick
When we introduced Azure Attack Paths into BloodHound, they were added as a completely separate sub-graph. At no point did Active Directory (AD) and Azure connect within a BloodHound dataset. Ever since adding Azure (honestly, even before that), we've wanted to solve that problem.
Final Steps to BloodHound Federal - FedRAMP High Compliance
Ever since SpecterOps first launched BloodHound Enterprise (BHE) in July 2021, one of our team's biggest frustrations involved a lack of FedRAMP qualifications, which prevented us from supporting a large set of desired users; specifically in the federal space. This is why I am both proud and happy to share that BHE is now in the final stages of the Palantir FedStart program and is expected to be FedRAMP High compliant in April 2024.
Mapping Access - and Attack - Paths in Active Directory
33 minutes ago bankinfosecurity Justin Kohler of SpecterOps on Using BloodHound to Identify Attack Paths and Manage Risk Steve King • November 28, 2023 24 Minutes Active Directory is a directory service for enterprise networks that gives users access to resources across the enterprise. But it can also be described as the mother lode of all vulnerabilities. A directory service should be a "source of truth," said Justin Kohler, vice president of products at Spector Ops.
5 Reasons Organizations Need Comprehensive AD Security Across Cloud and On-Prem
Why Organizations Need to Secure Directory Services in a Hybrid Deployment from Attack Paths By Justin Kohler, Director of BloodHound Enterprise at SpecterOps Microsoft Active Directory is one of the most common identity and access management platforms in the world, which unfortunately makes it a prime target for attackers.
Getting Started with Active Directory Security
Evaluating, Benchmarking and Creating a Strategy By Justin Kohler, Director of BloodHound Enterprise, SpecterOps Over 90% of the Fortune 1000 use Microsoft Active Directory (AD) for identity and access management. This ubiquity makes AD a prime target for attackers because compromising it almost always gives them the access they need to achieve their goals. Additionally, attackers can compromise AD easily by manipulating common errors in user identity and privilege.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Justin
Contact Justin, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack