Skip Navigation
Get a Demo
 
Principal Threat Researcher

Matt Graeber

Matt has worked the majority of his security career in offense, facilitating his application of an attacker’s mindset to detection engineering which involves developing detection evasion strategies. By pointing out gaps in detection coverage, Matt is able to effectively offer actionable detection improvement guidance. Matt loves to apply his reverse engineering skills to understand attack techniques at a deeper level in order to more confidently contextualize them, understand relevant detection optics, and to understand the workflow attackers use to evade security controls. Matt is committed to making security research both accessible and actionable.
By This Author
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account
June 1, 2026
Threat detection
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Autonomous agents
May 27, 2026
Threat detection
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Autonomous agents
ChatGPT in your inbox? Investigating Entra apps that request unexpected permissions
February 24, 2026
Threat detection
ChatGPT in your inbox? Investigating Entra apps that request unexpected permissions
Take back control: A modern guide to mastering application control
February 10, 2026
Security operations
Take back control: A modern guide to mastering application control
The art and science of effective security storytelling
October 27, 2025
Threat detection
The art and science of effective security storytelling
Artificial authentication: Understanding and observing Azure OpenAI abuse
October 30, 2024
Threat detection
Artificial authentication: Understanding and observing Azure OpenAI abuse
Safely validate executable file attributes with Atomic Test Harnesses
September 28, 2023
MITRE ATT&CK
Safely validate executable file attributes with Atomic Test Harnesses
When MFA isn’t an option: The legacy of ROPC
June 14, 2023
Microsoft
When MFA isn’t an option: The legacy of ROPC
 

See Red Canary in action

Watch the 10-minute demo now.
Watch the demo

Security gaps? We got you.

Sign up for our monthly email newsletter for expert insights on MDR, threat intel, and security ops—straight to your inbox.

 
 
 
 
Back to Top