[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKG-3ftvgKiYgYwRES_zsm-y9dcMm1zkd_nZfUoe-jiY":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":115},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"40463937-a8ad-4480-8397-e2b8851f48f9","Why Even the Best Edge Security Still Misses High-Risk Sessions","why-even-the-best-edge-security-still-misses-high-risk-sessions-884272","Attackers can hide behind residential proxies, VPNs, and other infrastructure that makes malicious sessions appear legitimate to existing edge security controls. Spur explains how session enrichment adds data points that help organizations identify risky sessions and make stronger enforcement decisions. [...]","Attackers are increasingly bypassing existing edge security controls by using residential proxies, VPNs, and other anonymizing infrastructure. These methods make malicious sessions appear legitimate, as current tools often focus on individual aspects of a session rather than the underlying network context. Spur's Monocle platform aims to address this by enriching sessions with real-time infrastructure data, enabling better detection of risky connections.","Attackers exploit gaps in edge security by using residential proxies and VPNs to mask malicious sessions.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fwhy-even-the-best-edge-security-still-misses-high-risk-sessions\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F08\u002F28\u002Fdata-points-to-a-lock.jpg","2026-09-01T14:01:11+00:00","2026-09-01T16:00:24.068762+00:00",7,[17,20,23,26,28],{"name":18,"type":19},"Monocle Session Enrichment","product",{"name":21,"type":22},"Spur Intelligence","vendor",{"name":24,"type":25},"Residential proxies","technology",{"name":27,"type":25},"VPNs",{"name":29,"type":25},"Edge security","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},[49],{"type":50,"value":51,"context":52},"ip","146.70.202.60","Example IP address used in a session trust assessment, potentially indicating anonymized or proxied traffic.",[21,18],{"controls":55,"vendors":114},[56,85],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":86,"name":87,"problem":88,"products":89},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-firewall","Sophos Firewall","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fnext-gen-firewall","Next-generation firewall with intrusion prevention.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",[],{"slug":116,"title":117,"body":118,"framework_refs":119,"framework_notes":130},"residential-proxies-and-vpns-are-defeating-edge-security-controls","Residential Proxies and VPNs Are Defeating Edge Security Controls","Attackers are exploiting a critical blind spot in traditional edge security: the inability to distinguish malicious sessions that originate from residential proxies or VPNs from legitimate user traffic. Because most security tools evaluate individual session attributes in isolation rather than the broader network infrastructure context, anonymizing services effectively launder attacker origins. This matters because perimeter defenses are often the last line of defense before attackers reach sensitive systems or data. Organizations that rely solely on IP reputation lists or basic geo-blocking are operating with incomplete threat visibility, leaving high-risk sessions undetected until damage is done.",[120,121,122,123,124,125,126,127,128,129],"CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-207: Zero Trust Architecture","NIST AC-2: Account Management","NIST SI-4: System Monitoring","NIST IA-3: Device Identification and Authentication","MITRE ATT&CK T1090: Proxy (Defense Evasion)","MITRE ATT&CK T1090.002: External Proxy","ISO\u002FIEC 27001 A.9.4: System and Application Access Control","GDPR Article 32: Security of Processing (risk-appropriate technical measures)",{}]