How to Become an APEX Defender
Anthropic's security leadership is reported this week to have said that AI-discovered software flaws will get worse before they get better, and to have put a number on the waiting: roughly eighteen months. Their Frontier Red Team is described as having audited 25 open-source projects and found 493 security issues. Separately the company has warned that models small enough to run almost anywhere are close to completing the steps needed to replicate themselves, and that publicly available agent frameworks can now automate every stage of the kill chain. We are working from press coverage rather than primary wording, so treat the exact figures as reported rather than confirmed.
Take all of it at face value. The forecast still rests on an assumption nobody says out loud: that the defenses on the other side are the ones we think they are.
So we measured the defenses. Not ours — theirs. The companies that sell security, scored on the free controls they tell everyone else to turn on.
Seven of twelve run an unsigned zone
Twelve security vendors, measured against public DNS. No scanning, no traffic sent to any of them, one query per record, every cell reproducible with dig in about five minutes.
Signed and validating: Check Point, Tenable, Qualys, Palo Alto Networks, CrowdStrike.
Unsigned: Zscaler, SentinelOne, Proofpoint, Rapid7, Trellix, Fortinet, Okta.
No CAA record at all, meaning any public certificate authority may issue for the name: Palo Alto Networks, CrowdStrike, Fortinet.
Bottom of the table at three of six: Fortinet, unsigned with no CAA and DMARC only at quarantine. And Okta, unsigned, which we will come back to.
Credit where it is owed, because otherwise this is a hit piece and not a measurement. All twelve enforce DMARC. Not one sits at p=none. That is materially better than the general population — Sony, measured the same way on the same afternoon, publishes no CAA and leaves DMARC at monitoring. These companies' mail identity is in good order. Their zone integrity is not.
Every gap listed above is closed by a free record. A DS record at the registrar. A CAA record. Nothing here is a product, a license or a quarter of engineering time.
Identity is a mess, and the zone file says so first
Across those same twelve zones we counted 28 identity-plane records published to anyone who asks: autodiscover, lyncdiscover, enterpriseregistration, enterpriseenrollment, and the SIP federation records.
Okta publishes all six. So does Proofpoint. Fortinet publishes three.
That pair — enterpriseregistration and enterpriseenrollment — is the device-enrollment path. The join endpoint for the identity platform. Not a website.
This is not a misconfiguration. Autodiscover has to exist for Outlook to work, and these records are how the identity plane functions. The finding is not that the records are wrong. The finding is about reconnaissance economics: if you are doing assume-breach planning, the first question is how an adversary locates your identity plane, and the answer is one DNS query, from anywhere, free, with no packet sent to you and nothing to alert on. Nobody scans you. They dig you.
And identity is the one layer that went all-in on delegated trust. OAuth is a chain of assertions where somebody else vouches for the subject. SecurID was a shared secret in a plastic fob. The modern version is better, but it is still trust that was borrowed rather than verified — which is the same trade as the rest of this post, one layer up.
The company whose entire product category is identity scores three of six on the controls that protect its own name. That is not a gotcha. It is the shape of the problem.
Your security stack starts at step five
Four parties decide what your hostname resolves to before any control you paid for is consulted.
The registry holds the delegation. The registrar account can rewrite every record you own without touching your servers, your code or your network. The DNS host decides what every record in the zone is allowed to say. The vendor holding a CNAME decides what reaches that hostname at their edge.
Then, fifth, comes everything you bought.
None of the first four appear in your WAF logs. All four can answer for your name, which is the working definition of being able to speak as you. We call them apex predators, and the point is not that they are hostile. The attacker is almost never the apex predator. The attacker is a scavenger who finds the tenant you stopped paying for and takes the hostname the predator left behind.
That is why DNS primacy is an ordering principle and not a preference. Coverage at the zone multiplies. Coverage below it cannot compensate. A flawless WAF on a hostname your zone hands to somebody else is not bypassed. It is absent.
Assume breach became a way to move the risk
The honest version of assume breach is containment: segmentation, blast radius, the discipline to decide what crosses a boundary. Hardly anyone bought that, because it costs usability. The real implementation is a disconnected network, and nobody wants it.
What got bought instead was credibility. We cannot secure this data, so we will inherit vendor X's posture and satisfy specification Y. The data never got safer. It got moved, and re-stamped with somebody else's certification.
That is securitization, not security, and it rhymes with 2007 harder than anyone wants to admit. The bad loan never improved. It got tranched, and a ratings agency stamped it AAA.
DNS is where that trade physically lives. Every CNAME to a SaaS tenant is a liability transfer. Every SPF include is a party whose compromise becomes yours, usually added by somebody solving a deliverability ticket on a Tuesday. Every dangling record is the residue of a transfer whose counterparty walked away and left your name behind. Mergers, spin-outs and SPAC combinations generate these by the dozen, because the tenant lapses while the DNS record outlives the contract — which is why a serial acquirer has maximum sprawl by construction.
We call it failed armor. Armor is a claim of impermeability, usually somebody else's claim, and it fails in one piece. A membrane makes no such claim. It decides what passes, contains what is inside, and is measurable at a boundary you actually own.
The one dangling record, and why we are not calling it a takeover
One zone in the twelve has a dangling CNAME. store.okta.com points at an AWS load balancer that no longer exists. We confirmed it returns NXDOMAIN from two independent resolvers.
Our own tool flagged it as a subdomain-takeover risk. Our tool was wrong, and we fixed it before writing this.
A dangling CNAME is only a takeover when somebody else can make the target resolve. That depends on whether the vendor lets you choose the hostname. On a tenant platform you can — register the name, get the hostname and a valid certificate. An AWS load balancer hostname carries an account-scoped numeric identifier that AWS assigns and nobody can request. It is not re-registrable.
So this is a hygiene finding: a record pointing at nothing, worth deleting, at an identity company. It is not an exposure, and we decline to dress it up as one. Inflating a severity aimed at a named company is exactly the theater this post is about.
What we got wrong building the thing that measures this
The check that produced these numbers was written in a single afternoon, roughly seven hundred lines, deliberately, with an automated reviewer firing on every commit. It shipped these defects:
It went to production completely inert — computed on every audit and discarded before the response. HTTP 200 throughout.
It was wrong for every multi-label domain, keeping the last two labels of a name, so it reported that the registry owns the BBC's zone and measured DNSSEC, SPF, DMARC and CAA against co.uk instead of bbc.co.uk. Every .co.uk, .com.au and .co.jp organization would have received a confident wrong answer to the only question the tool exists to ask.
The first fix was worse: it followed a CNAME and named Fastly as the owner of the BBC's DNS.
A privacy guard fabricated a high-severity finding, reporting takeover risk on a hostname that resolves perfectly well.
Another guard hid a true finding and relabeled it as our own secret.
A sanitizer silently deleted an underscore, turning every DMARC lookup into a lookup for a record that does not exist. The visible result: "no DMARC record", reported confidently, for every domain on earth.
And then the Okta severity above.
Seven, in an afternoon, under review, by people whose entire job is checking instruments. Every one of them green until somebody looked.
Now apply that rate to a zone file nobody has owned since the acquisition closed, where no reviewer exists and nobody runs dig. The gap between the defenses in the model and the defenses on the ground is what the eighteen-month forecast is resting on.
The five minutes
In primacy order, because the order matters more than the effort.
Ask who serves your zone. Query your NS records. Whoever answers decides what every other record says. If you cannot name that party from memory, nothing below this line is reliable.
Check whether DNSSEC is actually anchored. Signing at your DNS host does nothing alone — the DS record must exist at the registrar. Query DS at the parent, then ask a validating resolver for your domain with DNSSEC enabled and look for the ad flag. A signed zone with no DS is protection zero while the dashboard says enabled. Ours was in that exact state yesterday morning. It is anchored and validating now.
Publish a CAA record. Without one, any public CA may issue for your name.
Count your SPF lookups. The limit is ten, and it is a hard failure rather than a warning. Over the cap, SPF silently stops protecting the domain. Removing vendors you no longer use usually fixes it.
Move DMARC to enforcement. At p=none you are already collecting the reports that tell you how to reach quarantine safely.
Delete records nobody owns. A hostname pointing at a vendor tenant that no longer exists is a working certificate and your brand in somebody else's address bar.
All free. All checkable in one command. All upstream of everything being sold to you.
Ours, since otherwise this is just a scoreboard
We score five of six, and we left ourselves out of the table on purpose because the comparison is not the point.
The one we fail is request-path visibility. Three of our hostnames answer with address records and no CNAME, and DNS cannot see past a proxy. Our website's front door is served from a hosted platform's edge, which means our own blocklist, our own WAF rules and our own edge shield are not on that road. We published that failure separately this week — we publish a blocklist, it does not protect our own website — because we found it by being attacked on the one path our own product does not defend.
That layer is the one no DNS record can close. Only a log settles it.
Twelve zones is a sample, not a census. The number worth quoting is the sweep across the 250-plus domains already on our leaderboard, and we have not run it yet. When we do it gets published whatever it says.
Eighteen months is the forecast. The free controls are off. The attack is cheaper than the audit.
Get tougher skin.
Every measurement here came from public DNS over an encrypted resolver, one query per record. Nothing was scanned and no traffic was sent to any organization named. This measures what a zone file says — it is not an assessment of anybody's products. All of it is reproducible in about five minutes with dig, and we would rather be corrected than right: if we have your zone wrong, the rating widget below reaches us, and so does patrick@dugganusa.com.
Her name was Renee Nicole Good.
His name was Alex Jeffery Pretti.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=how-to-become-an-apex-defender
Comments