For most of the history of cyber defense, an intrusion had a shape: find a vulnerability, exploit it, drop a payload, take control. You looked for the malicious file. But that shape is dissolving, and the person who put it most bluntly in our conversation was Aaron Rolph.
Aaron has spent over a decade in security, from defending critical financial markets infrastructure (NYSE Euronext, nearly ten years at CME Group) to now leading threat intelligence and vulnerability management at Veeam® Software . He describes himself as someone “known for caring about the people behind the pew pew maps more than checklists,” and “committed to the right outcome, not the easy one.”
We talked about what threat intelligence actually is, why identity has become the attacker’s path of choice, and a term he uses to reframe the problem, “identity debt,” which he explains along the way. The views he shares are his own, not an official position of Veeam® Software. What follows are his answers, unfiltered.
_
8Layers: You've spent over a decade defending critical financial markets infrastructure, from NYSE Euronext to nearly ten years at CME Group, and now lead threat intelligence and vulnerability management at Veeam® Software. Those are very different worlds: a derivatives exchange versus a data resilience company. How does what "security" means change from one to the other?
Aaron: I think security isn't what changes, it's the business priority of what and how assets are protected that changes. Considering financial services for a moment, which of these would you choose if you had to pick one?
A) Your bank balance mistakenly showed a negative instead of a positive and bills failing to clear, or B) Your bank balance being leaked or C) Your online banking portal is down for 12 hours.
I'd suggest integrity matters the most for financial services and that's without the alphabet soup of regulation. When you mention security and financial services I think: transaction integrity, separation of duties, multiple approvals, immutable audit trails and regulatory compliance. Prioritising the CIA triad for a software company, particularly SaaS companies, it's got to be availability. Yes we could debate that confidentiality is the main contender (and even integrity) but all the confidentiality in the world and the most integral build pipeline won't matter if you cannot convince your customers your product is actually available for them to use.
When you mention security and the software industry I think: SDLC, CI/CD pipeline hygiene, tenant isolation, identity architecture, supply chain governance and vulnerability management (bug bounty / vulnerability disclosure etc.). Ultimately, security is still trying to protect the confidentiality, integrity and availability of assets but what changes is which of these three gets prioritised, what threats are relevant and what does the business deem as acceptable risk.
8L: Your role centers on threat intelligence. For someone outside that world: how would you describe what threat intelligence actually is in your day-to-day, and what does it tell you that other security tools can't?
Aaron: Threat intelligence is essentially a product that helps a stakeholder make a more informed decision about a topic they are interested in such as M&A (mergers and acquisitions), locations for hosting events or opening an office, which threats to focus on etc. It can be strategic, operational or tactical. The product could be a report, a series of hashes, a threat actor profile, detection rules and take many other forms but it needs to meet three criteria to be of any use. Intelligence needs to be timely - there is little point in my team telling you something you can read yourself in the news. Intelligence needs to be actionable - a report is useless if it doesn't help a stakeholder make an informed decision, that's why you have engaged CTI (cyber threat intelligence) in the first place.
Intelligence needs to be relevant - there are loads of really cool cyber related stories and events going on in the world but if you as a stakeholder have no interest in middle eastern geo-politics, why would I give you a report on the current cyber capabilities of observed Iranian threat actors?
It's also important to note what threat intelligence is not. It's designed to help stakeholders make informed decisions, not make the decisions for the stakeholder. To get to the final product, threat analysts will start by collecting raw data from various sources (internal such as logs and external such as feeds), process this data i.e. corroborate, correlate, enrich, de-duplicate and normalise it to filter out noise and convert it into a format suitable for analysis. At this point the data has gone from raw to processed. Analyze the processed data to generate insights, and finally, disseminate the now actionable intelligence to the stakeholders (and if you want to close the loop, feedback would be nice).
Day to day activity is matched to our PIRs (prioritised intelligence requirements) and any RFIs (request for information) that come in. Two larger examples would include, vulnerability intelligence and threat actor mapping for detection engineering.
As for what it can tell us that other tools can't. A lot of tools are inward looking and retrospective. They can say "hey, something suspicious happened here" based on a signature match, something anomalous being observed or a behavioural rule firing but they typically cannot provide threat actor attribution, information on whether this is a one off or part of an ongoing or new attack campaign and what is likely to happen next. An example might be something like network traffic has been detected going to an unknown IP address. Threat intelligence would be able to add, this IP address belongs to Bulletproof hosting, a provider commonly used by FIN7 who recently launched a new attack campaign. Or another example, would you rather wait for a valid login to be detected because it's suspicious or be alerted that an IAB (initial access broker) is selling VPN access to a company that matches your description?
8L: And when you look at how attackers are operating today, how central have identity-based attacks become to their playbook, compared to a few years ago?
Aaron: Great follow on from the IAB (Initial Access Broker) example. Look at CrowdStrike's 2026 Global Threat Report, ~82% of detections were malware free. That's crazy. That means adversaries are no longer popping vulnerabilities and dropping payloads for initial access, they are just authenticating! It also matches what we are seeing in the wider landscape, massive uptick in compromised credentials being an initial access vector instead of vulnerability exploitation. Whether from an IAB, a data leak, or social engineering, it's easier to walk in than break in. When I think about it from the industry I'm currently in, it frightens me to think of an attacker authenticating to the backup console.
In today's threat landscape, some threat actors' entire playbooks begin with hacking people, not systems e.g., in one campaign Scattered Spider operated roughly 500 phishing domains impersonating platforms such as Okta, Salesforce and Microsoft SSO. A favourite technique of theirs is to impersonate helpdesks and socially engineer victims. This could lead to SSO credentials, MFA bypass and broad enterprise access, no technical exploit needed.
8L: Going deeper into identity-based intrusions specifically: what trends are you seeing? Where do you think this is heading? Are stolen credentials and valid-access attacks becoming the dominant way in, and what's driving that shift?
Aaron: When it comes to trends, the reality is we are seeing AI driven or empowered attacks across the board and two elements specifically from that concern me. AI lowers the barrier of entry for low skilled attackers and can automate at scale and don't even get me started about agentic AI...let's deploy millions of agents, each needing credentials or some form of access, each capable of taking actions without humans in the loop. That will be the next target.
Remember when teams used to talk about 'technical debt'? I once worked at an organization that froze development until a large portion of outstanding vulnerabilities were fixed to reduce technical debt.
I think what we will see is identity debt becoming more relevant. How many dormant or orphaned accounts are in your company now? What data and services can they access? Do you have legacy environments that are being kept alive 'just in case' and if so, are they suitably isolated? What about the question "what permissions does this account need"? How many times have we seen the answer be admin or root to ensure it works? Stealing accounts to deploy ransomware or exfil data is one thing but there's more than just credential theft.
Think about this more as the dominant way through rather than in. If a vulnerability drops on an edge device, that is going to get popped so vulnerability exploitation as an initial access vector goes up and stolen creds goes down, however, credential abuse will nearly always occur somewhere in the attack chain so combined, it's present in a pretty high percentage of attacks. I believe a few factors are driving this shift. There are so many infostealer infections churning out credentials for sale that means they are cheap and plentiful.
When I say plentiful, look at SpyCloud's annual identity exposure report, they are now tracking 65.7 BILLION distinct identities and that is up 23% on last year. Secondly, the perimeter seems all fuzzy now. With cloud and SaaS infrastructure, the traditional network boundary we once defended and used as a choke point is gone. Now we have distributed work forces and API calls, token access and third-party integrations. This casts the spotlight firmly on identity.
8L: If you could fix one single thing in how organizations handle threat intelligence or exposure management today, with no budget or technology constraint, what would it be?
Aaron: I love this question and tend to ask something similar when interviewing. I recently turned down a new shiny tool that would do all sorts of things because the answer wasn't a purchase of a new shiny, it was needing to change something structurally to extract better value from existing tooling and processes.
The two have to talk together. If your threat intel program is not influencing decisions or actions, then it's probably providing more noise than value. On the flip side, if your vulnerability management program is patching by score and not risk, it's backwards. Threat actors aren't going to care if a vulnerability is a 9.8 or a 7.2, they want to know if they can exploit it.
"Patch this 9.8 critical please" is different from saying "This critical vulnerability is actively being exploited in the wild by nation state threat actors we believe have an interest in our organisation, please remediate asap". Joining the two together provides context which allows for prioritisation, accountability and executive buy in when they recognise the urgency.
8L: Do you have an unpopular opinion about threat intelligence, vulnerability management, or identity security that you'd defend even knowing a lot of people would disagree?
Aaron: Ok here goes...Most threat intel feeds are a waste of money...
First off, if you are not running a mature intel program yet, don't rush into buying feeds to populate your TIP (threat intelligence platform). If you do, you'll be informed, or at least you think you will. Let's say a week goes by and you ingested lots of shiny IOCs. You are now aware of the threat landscape (to an extent) but has the security posture of the organisation changed from the previous week before you got all those IOCs? Probably not and most likely this is because if you are running an immature program you lack the capacity to act on what you've just ingested. So adding more feeds just adds more indicators, more that your team needs to triage.
Do you even need multiple premium intel subscriptions? A lot of times threat actors are recycling indicators so fast the feed data is stale. When you are ready, pick the one that will give you the most context based on your organisation's business needs (ISACS and other peer groups are good too). Realistically, your best source of intel is internal telemetry, so instead of buying your 27th intel feed, talk to your IAM and SOC teams about logging for sign-in anomalies, impossible travel, token abuse, reviewing privilege escalation logs in your cloud tenants and build an inventory of service accounts with their access mappings. That will give you significantly higher fidelity intel than another feed.
If anything stays from this conversation with Aaron, it's a shift in where "bad" lives. The malicious file is gone; what's left is a valid credential, used by the wrong hands. And the debt that builds up quietly like the dormant accounts, the orphaned access, the service account that runs as admin "to make it work", is exactly the ground attackers now walk across. Less spending on the 27th intel feed, more attention to the identities you already own. That, in the end, is where the signal is.
Identity Attack, Unfiltered
Identity Attack, Unfiltered is 8Layers' biweekly series where we give security experts the floor to talk, unfiltered, about identity risk: how they see it from the field, what worries them, and what they'd do differently. Each conversation adds a different perspective, from governance to digital forensics, from the SOC to threat intelligence.
The series grows out of what we do at 8Layers: uniting in a single view of identity what normally lives apart: posture, detection, and compliance.
Do you work in identity security and feel you have something to contribute? We'd love to hear from you. Write to us at marketing@8layers.io and tell us your perspective; you could be the next voice in the series.