CP Morey

Posture Management: A Modern Approach to Building Security That Holds

Security posture is the ability of your environment to withstand real-world threats, not just meet compliance requirements. Strong posture doesn’t just reflect what’s present. It reflects how well your protections are working, how proactively you reduce risk, and how resilient your systems are when tested.

Adopting & Implementing Zero Trust: Moving from Concept to Execution

Zero Trust isn’t a product or a one-time implementation, it’s a strategic approach to cybersecurity that continuously evolves. Yet, many organizations struggle to move beyond theoretical frameworks and turn Zero Trust into real-world security improvements.

Microsoft E3, E5, and E7 Security Licenses: A Data-Driven Upgrade Guide

Upgrading Microsoft enterprise licensing from E3 to E5 or P1 to P2? Whether your company is upgrading or considering the move, you may be facing questions about how to leverage this shift for your security team’s advantage.

Exposure Management Explained: How to Go Beyond Vulnerability Scanning

In today’s rapidly evolving cybersecurity landscape, exposure management has become a critical practice for organizations looking to stay ahead of potential threats. Unlike traditional approaches that focus solely on vulnerabilities, exposure management examines the broader context of how and why specific issues could impact an organization and prioritizes actions based on risk. A key aspect of this practice is understanding the exposure of employees, contractors, and even executives as attackers often attempt to exploit human vulnerabilities as well as critical systems.

Security Hardening Explained: Why is it Critical for Your Security Program?

To achieve effective system hardening, a systematic approach is crucial. This involves identifying, auditing, managing, and mitigating cybersecurity vulnerabilities throughout your IT infrastructure. Additionally, it requires continuous monitoring and optimizing of security controls to address threats targeting and impacting your environment. This article explores the importance of system hardening.

Rethinking Security Posture Assessments

Security posture assessments are a foundational part of any security program. They’re how organizations take stock of their defenses, evaluate coverage, and identify gaps. But in practice, many posture assessments have become stuck in a pattern.

What is Configuration Drift? 5 Best Practices for Your Team's Security Posture

Left unchecked, configuration drift increases exposure to cyber threats. Yet, many organizations remain unaware of how much drift has occurred until an audit, incident, or breach exposes the issue. Understanding what configuration drift is, how it happens, and how to prevent it is critical for maintaining a strong security posture.

What is an automated security control assessment?

To address this growing challenge, the concept of Automated Security Control Assessment (ASCA) was defined and named by Gartner, setting a new standard for how organizations evaluate and optimize their security controls. By automating these processes, ASCA empowers organizations to reduce exposure, enhance their defenses, and stay ahead of emerging threats.

What is Security Optimization? How to Find Gaps in Your Stack

True security optimization isn’t about buying more technology; it’s about maximizing the impact of the tools you already have. This means shifting from a reactive, tool-centric approach to a proactive, outcome-driven strategy; one that ensures security investments deliver measurable risk reduction.

Security Control Management: The New Mandate for Risk-Driven Security

Security teams today aren’t short on tools. Most environments are packed with security controls—spanning email, identity, network, endpoint, and cloud. But despite this abundance, risk remains stubbornly high. Attacks continue to land. Exposure persists.

Compensating Controls: The Unsung Heroes of Cyber Resilience

Most security teams know what the “right” controls look like on paper. But real-world environments rarely match the blueprint. Between legacy systems, limited staffing, and overlapping tools, the gap between what’s ideal and what’s feasible is often wide.

Threat Exposure Management: A Better Way to Answer "How Exposed Are We?"

Threat exposure management refers to the continuous process of assessing how vulnerable an organization is to actual attack paths across all systems, applications, and environments. This includes both direct assets and external dependencies like cloud services, SaaS platforms, and third-party integrations.

Bridging the Last Mile: Reach’s New ServiceNow Integration Enhances Cybersecurity Maturity

As we continue to navigate the complexities of cybersecurity, our focus remains on providing solutions that not only secure but also streamline operational processes. The new ServiceNow integration is a testament to our dedication to mastering the last mile, ensuring that our clients can achieve and maintain the highest levels of security maturity.

Zero Trust on NYSE Taking Stock: A Conversation with Reach's CEO

Reach Security CEO & Co-Founder Garrett Hamilton sits down with Trinity Chavez of the NYSE to explore how Reach takes organizations from “architecture to action” with Zero Trust.

Reach Security Named in Gartner® Emerging Tech Research on the Future of Exposure Management

The Definitive Guide to Security Misconfiguration

The constant evolution of today's threat landscape has organizations counting on security controls to keep the bad actors out and safeguard their people, sensitive data, critical infrastructure, operations, and brand. However, even the most sophisticated security tools can present a risk to organizations when they are improperly configured. And unfortunately, even the best security teams can make mistakes. Whether it’s a firewall rule left too permissive, a mismanaged IAM rule, or an EDR process monitoring bypass, the implications can range from severe financial loss to risks with the customer base that can lead to significant and sometimes irreparable reputational damage.

7 Practical Steps to Implement Zero Trust

Zero Trust is no longer a novel idea, it's a security imperative. While most organizations have embraced Zero Trust in principle, putting it into practice is another story.

The Last Mile in Cybersecurity: Turning Assessments into Action

The last mile is a critical component of cybersecurity operations. By embracing a comprehensive approach that goes beyond mere reports to actionable and automated implementation, Reach ensures that your organization is not only secure but also agile and efficient. Stay tuned for our upcoming posts where we will delve deeper into specific use cases and solutions that exemplify our commitment to mastering the last mile in cybersecurity.

Exposure Assessment Platforms: Turning Noise into Action

Security teams are buried in findings. Whether it scans for vulnerabilities, evaluates configurations, or monitors runtime behavior, every tool delivers its own version of “what’s wrong.” The result is a sprawling list of issues, all marked urgent, with little consistency in how they’re scored or what should happen next.

Security-Focused Configuration Management: Getting Beyond the Checkbox

In many organizations, configuration management is treated as a background process. It’s something handled during deployment or reviewed during compliance audits. But when viewed through a security lens, configuration becomes one of the most important factors in reducing exposure.

A Framework for Vulnerability Mitigation

Vulnerability management has long been seen as one of the most straightforward areas in security. Scan your assets, identify vulnerabilities, prioritize the findings, and patch what you can. On paper, it looks like a repeatable process. But in reality, vulnerability mitigation is anything but simple.

Reach Security Quarterly Product Update 2Q2025

As security teams face growing complexity across tools, identities, and threats, Reach Security continues to deliver targeted capabilities to help organizations mitigate risk sooner, align controls to real-world threats, and drive operational clarity. This quarter’s updates are all about proactive defense - helping you adapt in real time as your environment evolves.

A Blueprint for Stronger Defenses: MITRE D3FEND

Staying ahead of adversaries is a constant challenge due to the evolving tactics and techniques that they leverage to gain access and achieve their objectives. While frameworks like MITRE ATT&CK have become an industry standard for understanding and discussing adversary behaviors, it can be challenging for defenders to map their own defenses.

Tailoring Configurations and Last Mile

One of the key value propositions of Reach is that our platform not only increases your security posture by providing critical insights, but it also allows customer to take action and deploy configurations with automation.

Top 10 Security Misconfigurations to Watch For in 2024

Through collaboration among our teams, we've identified the top 10 misconfigurations that often slip through the cracks and significantly impact an organization's security.

Reach Licensing View: Turning Visibility into Value

We're excited to announce the launch of Reach’s Licensing View, which was built to help customers better understand the value they are getting from the licensed features they are paying for in their security products.

Going Above and Beyond Microsoft’s Impending MFA Requirement

Beginning in October, Microsoft will mandate multi-factor authentication (MFA) for multiple Azure components, including the Entra admin portal. Given Microsoft’s research indicates that MFA can prevent over 99.2% of account compromise attempts, this is great news! For those utilizing Entra Conditional Access to govern how users authenticate to mission-critical applications, there are additional measures you can take within Entra to further reduce the risk of credential compromise. Let’s explore some strategies to elevate your Conditional Access implementation beyond MFA using the features you’re licensed for.

Reach Security mentioned in the 2024 Gartner® Innovation Insight: Automated Security Control Assessment

While Gartner is helping to shape this new market category, companies like Autodesk and Nutanix are already realizing the benefits of this approach through Reach’s platform. By focusing on continuous security control assessments that leverage both business and adversarial threat context, Reach helps organizations like Autodesk and Nutanix understand the specific risks they face. Reach automates configuration changes to align with these risks, while also ensuring that organizations maximize the value of their existing security tools.

Cloudy with a Chance of Account Takeover

Integrating Reach with Okta is a game-changer for boosting your security in the event of credential compromise. With Reach’s advanced analytics and proactive recommendations, organizations can better defend against threats from attackers looking to spoof their location and gain access to sensitive infrastructure. This combo not only maximizes the value of Okta’s Adaptive features, but also adds an extra layer of security for a more comprehensive approach to your IAM deployment.

The Power of Automation with Reach

At Reach, we prioritize the safety and control of our users by leveraging a staged environment for automation. This approach not only safeguards the production environment but also ensures that changes are meticulously tested and approved before going live. Whether it’s implementing Conditional Access policies or deploying other critical updates, Reach’s staged automation empowers organizations to increase their cybersecurity posture with confidence, efficiency, and ease.

Why an identity-centric approach to Tools Rationalization is the place to start

You may hear terms like "tools rationalization" or "maximizing tool effectiveness," but their meanings can vary. Are you following a vendor best practice checklist, mapping CVEs to specific configurations, or tracking workforce risk and ensuring your licensed capabilities address this risk? Whichever path you choose, understanding the value of each approach is crucial.