Garrett Hamilton

CEO & Founder

About the Author

Garrett Hamilton brings deep expertise in SaaS product management, go-to-market strategy, and cybersecurity leadership. As CEO and Co-Founder of Reach Security, he draws on his experience at industry leaders like Palo Alto Networks, where he guided the WildFire product from launch to over 60,000 customers. With a hands-on background in threat analysis, training, and consulting, Garrett is committed to driving Reach's mission of transforming how organizations assess and remediate their security posture.

Expertise

SaaS product management
Threat analysis
Memory forensics

Education

BS in Economics, University of California, San Diego

Certifications

Articles by this author

The Missing Layer in Network Security: Continuous Assurance

Attackers operate continuously. Most network security controls are still reviewed periodically. Firewall rule management, change workflows, documentation, and compliance all matter. Yet they do not tell security teams whether live controls enforce policy as intended, every minute of every day. Continuous assurance across every security control is now essential in a world where the adversary is finding every needle in every haystack at AI-speed. Security teams need to continuously validate security controls, detect configuration drift and hidden exposure, and realign controls before attackers exploit hidden weaknesses.

Continuous Assurance Across Every Network Security Control

As rules are altered, controls drift from baselines and risk gets buried in the rulebase. Stale firewall rules stay live, shadowed rules obscure exposure, and overly permissive any/any rules sneak in. Periodic manual rule reviews rarely add value and fail to validate live enforcement posture. Months pass between audits, widening the gap for AI adversaries to exploit weaknesses and breach defenses. In fact, 42% of all configuration-related breaches, or near misses, are due to firewall rule misconfigurations. Reach continuously finds and fixes these weaknesses before AI attackers can exploit them.

Misconfigured Security Controls Open the Door for Storm-2949

The Microsoft Defender Security Research Team and Microsoft Threat Intelligence documented a campaign in which Storm-2949 abused Microsoft Entra ID accounts to exfiltrate data from Microsoft 365 and Azure environments. The attack path depended on a chain of security control gaps across identity, SharePoint access, endpoint protection, application control, and event visibility. Each misconfigured security control gave the attackers an opening and more room to move after the initial identity compromise. We took a closer look at the security controls mapped directly to the steps that Storm-2949 actually executed, and how proper configuration could have likely thwarted forward progress for Storm-2949.

What is Security Debt and What Should Your Organization Do About it?

This growing issue not only increases an organization’s exposure to potential cyberattacks but also wastes money and time spent by security analysts chasing down alerts that could have been stopped upstream. By understanding the implications of security debt and implementing strategies for security hardening, organizations of all sizes can minimize risk and maximize their return on investment.

The Configuration Drift Behind the Teams Helpdesk Breach

n April 22, 2026, Google's Threat Intelligence Group and Mandiant disclosed a campaign by a threat actor they're tracking as UNC6692. What's notable about UNC6692 is what they didn't do. They didn't use a zero-day. They didn't exploit a software vulnerability. They didn't bypass any of the security controls Microsoft has built into Teams. They used the controls as configured.

Security Tools Optimization Spotlight: Microsoft Entra ID Conditional Access

Conditional Access contains simple yet powerful sign-on attributes that can be tailored to your business with a risk-based approach. Whether you're undergoing security tool consolidation efforts or embarking on an IAM hardening project, consider starting with a series of tailored sign-on policies that address risk where most breaches start.

Introducing Compliance View: Satisfy GRC Requirements with Security Product Configurations

We’re thrilled to introduce the new Compliance View within Reach! Built to support Governance, Risk and Compliance (GRC) teams, Reach customers can now drill in to see how the configurations in their enterprise security products tie back into prominent GRC frameworks, and how they can use these products to improve their maturity with a given framework.

Roads, Not Roadblocks: Empowering User Experience with Secure Access

One of the most exciting parts of joining an early-stage company is the opportunity to do things differently. Shortly after I joined Reach, I learned that customers were using Reach to help streamline authentication processes for low-risk users, particularly those who log in from the same locations and devices each day. Rather than constantly prompting for multi-factor authentication, Reach enables security teams to identify and control exposure in place for users in familiar scenarios, reducing the friction for users, while maintaining security.

Integration Architecture and Why Reach Took the Hard, But Best Route

In today’s fast-evolving cybersecurity landscape, integration architecture is not just a necessary feature, but the backbone of how security systems communicate and protect organizations. Reach has approached integrations from a unique perspective, opting to take the hard road of building a system that is not tied solely to best practices, but fundamentally designed to adapt, learn, and integrate with purpose-built AI. It’s a decision that reflects our commitment to innovation, a deep understanding of the cybersecurity market alongside the products within a customer’s ecosystem, and a belief that the best path is rarely the easiest one.

Countering Phishing and Credential Theft with MITRE D3FEND: How Reach Keeps You Ahead of the Threats

Phishing and credential theft remain two of the top methods adversaries use to breach networks. To counter these effectively, it’s not enough to understand the attacks themselves—you also need a strong defensive strategy. That’s where a framework like MITRE D3FEND can make all the difference, providing a structured approach to securing your organization.

The Fast and the Furious – Configuration Drift

As organizations expand and evolve, the relationship between IT and security becomes equally as important as it is complex. The rapid pace of technology changes to drive revenue and streamline operations, coupled with an increasing number of sophisticated cyber threats, forces both IT and security teams to constantly adapt. This dynamic environment makes it challenging to maintain the integrity of security controls while ensuring operational efficiency and availability. For security teams, this challenge is especially evident when it comes to monitoring and maintaining established security controls from a configuration lens.