A vishing (voice phishing) call convinced an ADT employee to hand over their Okta SSO credentials. No malware. No email link. No perimeter crossing — just a phone call.
ADT Attack Sequence
Three separate attack vectors across 18 months — vendor blind spot, phishing, ransomware — each exploiting a different layer of the same gap.
Breach 1 — FBCS Vendor Blind Spot (Feb 2024)
Breach 2 — Phishing + Lateral Movement (Jan 2025)
Breach 3 — Medusa Ransomware (Sep–Oct 2025)
The Pattern These Vendors Share
ADT and Comcast had different vendors, different attack vectors, and different industries. But the failure mode is identical across all four incidents:
- Perimeter tools (firewalls, DNS filtering, email scanning) protect entry points — not what happens inside after a valid credential authenticates.
- Identity tools (SSO, MFA) validate who you are — not whether a session's behavior is consistent with policy.
- MDR and SIEM detect and analyze — they are retrospective by design. They tell you a breach happened; they rarely stop it mid-flight.
- Third-party vendor risk is entirely out of scope for every tool in both stacks.
The gap is not a failure of these individual products. It's a category gap. None of them are designed to enforce data access policy at runtime — between an authenticated session and the data it touches.
This gap has always existed in traditional IT environments. The reason it's becoming critical now is AI agents. When your internal systems include AI agents that autonomously access APIs, query databases, call external services, and act on customer data — that session-to-data layer is no longer monitored by a human who might notice something is wrong. It's a machine, running at machine speed, with the same identity credentials as your trusted employees.
The vishing attack that compromised ADT's Okta SSO works identically against an AI agent that has been issued an SSO token. The FBCS vendor that retained Comcast data is the functional equivalent of a third-party AI tool that has been granted API access to your CRM. The attack surface is the same. The detection gap is the same. The vendors covering it are the same — which is to say, none.
What Actually Stops These Attacks — How RuntimeAI Does It
The gap in both stacks is the same: no product enforces policy at the moment a session — human or AI — actually touches data. RuntimeAI closes that layer. Here's what that means in practice for each scenario.
RuntimeAI enforces policy on what authenticated sessions are allowed to do — not just whether they logged in successfully. Unusual data access patterns are evaluated against policy before they complete. The kind of bulk export that cost ADT 5.5M records doesn't execute silently.
RuntimeAI governs what data third parties can access and for how long — enforced at the policy layer, not audited after the fact. When a vendor relationship ends, so does their access. Comcast's FBCS exposure would have been flagged at contract end, not discovered years later.
Analytics tools tell you a breach happened. RuntimeAI acts while it's happening. Abnormal data movement is caught and flagged in real time — not after 47 compressed files are posted on a dark web leak site.
AI agents operate with the same credentials as employees — and carry the same risk. RuntimeAI governs every agent action: what it can access, what it can move, and what it can send. Every call is policy-gated and logged. No agent operates outside its approved scope.
Every data access event across every system — including third-party vendors — is logged to an audit trail that cannot be modified after the fact. When a regulator opens an investigation, evidence is available immediately. When a vendor says your data wasn't affected, the trail says otherwise — in hours, not months.
Your teams are deploying AI agents against production systems today — outside IT visibility. RuntimeAI surfaces every agent running in your environment, what data it's touching, and whether it's operating within its approved boundaries.
- Unauthorized data access blocked before exfiltration — policy enforced at the data access layer, not at the network edge. Catches what perimeter and identity tools miss.
- Third-party vendor data exposure eliminated — vendor data access governed and time-bounded by policy; exposure ends when the contract ends.
- FCC/regulatory audit readiness on day one — complete, immutable record of every data access event; no forensic reconstruction required after an incident.
- AI agent sprawl under control — every agent discovered, policy-gated, and audit-logged; no agent reaches customer data outside its approved scope.
- Mean time to contain: months → minutes — real-time enforcement means lateral movement and bulk exfiltration are caught at the first unauthorized access, not discovered in an FCC fine or a dark web post.
RuntimeAI adds the enforcement layer your current vendors weren't built for — no rip-and-replace required. Start with Agent Discovery and Audit Trail. Add data governance and behavioral enforcement as you expand. Start your free trial →
Ask your current security vendors if they cover this gap. Then ask RuntimeAI — Request a Demo or Free Trial.
Ask if their XDR or SIEM would have stopped a valid, authenticated session from bulk-exporting CRM records. Ask if their MDR has visibility into a decommissioned vendor's data retention. Ask if their network security blocks post-authentication data movement. If the answer is no — ask RuntimeAI.
Sources & References
- ADT Newsroom — ADT Detects Cybersecurity Incident (April 2026)
- BleepingComputer — ADT Confirms Data Breach After ShinyHunters Leak Threat
- Rescana — ADT Salesforce Breach: ShinyHunters Compromise Okta SSO via Vishing
- Palo Alto Networks — ADT Customer Case Study: Best-of-Breed Security
- BleepingComputer — Comcast to Pay $1.5M Fine After Vendor Data Breach
- SecurityAffairs — FBCS Data Breach Impacted 238,000 Comcast Customers
- HackRead — Medusa Ransomware Leaks 834 GB of Comcast Data
- Comcast — SecurityEdge Launch: Akamai Partnership Announcement
- Telecompetitor — Comcast Business + Akamai Introduce SecurityEdge
- Snowflake — Cybersecurity at Comcast Integrates Snowflake
- Huntress — Comcast Data Breach: What Happened, Impact, and Lessons