Bypassing External Mail Forwarding Restrictions with Power Automate

Defender for Cloud Apps' download blocking is bypassable with magic user-agent strings; the post demonstrates the bypass and recommends native download restrictions in Outlook and SharePoint.

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.

A cheat sheet of fifteen ways to bypass the PowerShell execution policy without local administrator rights, explaining that the Restricted default was never designed as a security control.

Details a bypass of Mimecast URL Protection and file inspection found during a social engineering pentest, responsibly disclosed to Mimecast, underscoring why layered defenses remain essential.

A Q&A with NetSPI's Nabil Hannan on red teaming culture: objective-based assessments, the clever outside-the-box thinkers who thrive, and how operators handle pressure while evading detection.

Hackers strike every 39 seconds, so annual pentesting is not enough; four core elements of an always-on security program built around continuous testing and monitoring of a growing attack surface.