Securing the Workspace Attackers Already Live In with Rajan Kapoor

Your email gateway isn't enough anymore, attackers are already inside the workspace through OAuth apps, browser extensions, and account takeover. 

In this episode, Ron sits down with Rajan Kapoor, VP of Security at Material Security, to break down the real risks hiding inside Google Workspace and Microsoft 365. They cover how phishing has evolved into full-blown business email compromise, why malicious OAuth apps are the new favorite attack vector, and what security teams, especially lean ones, can do right now to lock down their cloud workspace. Rajan also drops practical advice on passkeys, document sharing hygiene, and why data lifecycle management is a problem no one is solving well enough.

Impactful Moments
00:00 – Introduction
03:30 – The current state of phishing
05:30 – Outbound email compromise risk
09:30 – OAuth apps as attack vectors
15:00 – AI agents accessing your workspace
16:00 – Prompt injection is the new SQL injection
18:00 – Allow listing apps immediately
24:30 – Google Workspace vs Microsoft 365 security
27:30 – Custom detections require API expertise
28:00 – Why passkeys matter right now
32:00 – Data lifecycle management for shared docs

Links
Connect with our guest, Rajan Kapoor, on LinkedIn: https://www.linkedin.com/in/rajankkapoor/

Learn more about Material Security: https://material.security 

___
Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

Check out our upcoming events: https://www.hackervalley.com/livestreams 

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com