Jon Schipp demonstrates how Rapid7 Exposure Command finds accounts without MFA across your organization. The platform pulls identities from Azure AD, Slack, Google Workspace, and other sources, then filters to show 95 high-risk admin accounts lacking MFA out of 43,000 total identities. Security teams can combine MFA status with risk signals like phishing susceptibility to prioritize which accounts to fix first.
Chapters
Find your security controls coverage gaps for identities in the Rapid7 Exposure Command platform. So we're going to immediately pivot over to the identities page, and it's going to show us all the identities in our environment. And so it's pulling these identities from all the different connectors and sources that you have configured. And so what we're going to do is we're going to immediately filter and find all identities that have multi-factor authentication set to false. And so we went from 43,000 identities down to 17,000. That's still a lot for the team to actually go prioritize, remediate. Let's find the next most important ones. Let's filter on identities that have MFA disabled but also have admin access to some business application or system. And so now we went down from 4,000 to 95 identities and we can actually keep filtering based on certain parameters that we're looking for. What I want to do now is pivot into an identity. So we're going to look at Abdullah and this particular identity shows us all the different sources that he has— is pulling identity information from. It's pulling from Azure Active Directory, from Slack, from ServiceNow, Google Workspace, KnowBe4, etc. And so we have all this information, the source of truth from every one of these APIs that we're connecting to to give us information about this identity. And then we get the correlated view of the identity, all the best information in one place. Under the General tab. We also get correlation information that shows how these decisions were made when there's multiple sources that say the same or different things. This is a key data transparency and confidence feature. But what we're going to do is we're going to pivot a little bit more. Let's take a look at Nobu 4. Nobu 4 has our business context around this user. We can actually see that this user is 22% likely to click on a phishing email. They do not have multifactor enabled. They have administrative access to business application and they're 22% likely to click on a phishing email. This is something the security team can work with and start to reduce the risk by the most impact. So I hope that's helpful and thank you for your time.
