Reco Blog

Learn how non-human identities for AI agents create new access risks across SaaS environments, and how to govern them with the right identity types, security controls, and enterprise-scale best practices.

ServiceNow categorized the resulting risk as data exfiltration. They did not, however, explain what the bug was, and how it was exploited. Reco's security researchers quickly studied the patch. We deduced the June 5th patch was actually just the first step - the vulnerability wasn't completely fixed until July 9th.

Learn how AI-scale vulnerability discovery is reshaping SaaS security. This article breaks down the exposures it surfaces across identities, integrations, applications, and AI agents, how attackers can turn the same capability against you, and the practical steps your team can take to find and close those gaps before attackers do.

Learn how Claude Mythos Preview and Mythos-class AI are reshaping the SaaS threat landscape by accelerating vulnerability discovery, exploit development, and attack execution. Discover what security teams can do now to harden applications, identities, tokens, and AI agents against faster, increasingly automated threats.

Most security conversations about agents start in the wrong place.‍“How do we know what it’s doing?” That’s a reasonable question, but it’s not the right one if you want to understand what an agent can actually do in your environment.

When Anthropic and Okta announced enterprise-managed authorization for MCP connectors, it would be easy to view it as another integration announcement.‍ I think it is much more than that.‍ Anthropic has already shown, more than once, that when it introduces a new architectural pattern for AI, the rest of the industry pays attention.

When Anthropic shipped Claude Fable 5 on June 9, it was pitched as something different from the rest of the Claude line. Not a chat model with agentic features bolted on, but a purpose-built agent backbone, the first generally available Mythos-class model, designed for "the most demanding reasoning and long-horizon agentic work," with a 1M-token context and a server-side safety layer that screens high-risk (cyber/bio) traffic.

A few weeks ago I was speaking with a CISO at a large financial institution. I asked him which AI tools his company was using. He said: "We're only on Copilot."‍We pulled up Reco. Number one usage across his org was Claude. Number two was OpenAI. Copilot was number three.

Learn how OpenAI Daybreak and Codex Security work, the security risks AI agents introduce, and how organizations can govern Codex agents, non-human identities, and AI-driven workflows across modern SaaS environments.

AI is changing the security landscape. More and more threat groups incorporate LLMs into their reconnaissance and exploitation workflows. The notion that some vulnerabilities are too complex to implement is now obsolete. Using LLMs, hackers can automatically find and exploit complex vulnerabilities.

Anthropic published its first Glasswing update last week. The numbers are worth taking seriously.‍In 30 days, roughly 50 partner organizations found more than 10,000 high and critical vulnerabilities across the most systemically important software on the internet.

This article explores why AI compliance is shaping up to be the next GDPR moment for enterprises. Learn how the EU AI Act, GDPR, NIST AI RMF, and ISO/IEC 42001 are reshaping expectations around AI oversight, transparency, identity governance, and SaaS security. The piece also breaks down the operational realities of governing AI agents, shadow AI, embedded AI capabilities inside SaaS apps, and non-human identities, along with practical frameworks for building sustainable AI compliance programs at scale.

The question boards are asking their CISOs right now isn't 'are we using AI?' It's 'do we know what our AI is doing?' Mythos made that question unavoidable.

The attack surface isn't in your unknown unknowns. It's in the defaults your team inherited three years ago and never went back to check.‍ The uncomfortable truth about Mythos-class AI as an attack tool is that it doesn't need sophisticated targets. It just needs defaults.

30 million users locked out during finals week. Universities scrambling. Students unable to access coursework, submit assignments, or sit exams.‍The ShinyHunters breach of Instructure — the company behind Canvas LMS — wasn't a sophisticated zero-day exploit. According to reports, attackers used voice phishing and fake login pages to harvest employee credentials. The oldest trick in the book. And it worked.

As the foremost CRM solution, Salesforce is often considered the preeminent SaaS platform. It is used by companies from small start-ups to major corporations. And many of those companies use Salesforce Experience Cloud to run native sites

Between late February and late March 2026, a threat actor group called TeamPCP executed one of the most damaging software supply chain attacks we've ever investigated. The campaign began with a single misconfigured CI/CD workflow in Aqua Security's Trivy vulnerability scanner.

Discover how real AI security incidents unfold in enterprise environments and what they reveal about modern attack paths. This article examines common failure points across AI tools, SaaS integrations, and identity layers, including data exposure, over-permissioning, and third-party risk. Learn how to detect early warning signs, investigate incidents across systems, and improve governance over AI usage, access, and data interactions.

alesforce's Apex is a powerful server-side language, but its security model is subtle enough that even experienced developers often misconfigure it. This could lead to data exposure, from sensitive fields to full database dumps — sometimes accessible to unauthenticated guest users.

On April 19, 2026, Vercel disclosed a security incident that, based on the company's own public statement, appears to have originated somewhere most security teams aren't watching: a third-party AI tool used by a Vercel employee.

Reco and Cyera are partnering to close the gap between SaaS security and data security, delivering an integrated solution that combines Cyera's data classification intelligence with Reco's visibility across 225+ SaaS and AI applications. Together, they give enterprise security teams a unified, context-rich view of data risk — from storage and access to sharing and exfiltration — without the manual work of reconciling two separate tools.

The recent breach of Anodot, an AI analytics platform acquired by Glassbox in November 2025, exposed a growing attack vector: SaaS supply chain compromise. Threat actors used stolen Anodot credentials to access 12+ Snowflake customer environments, bulk-extracting data and demanding ransom.

As AI agents increasingly communicate with each other across enterprise SaaS platforms, they create implicit, runtime trust chains that existing security tools — built for human identities and explicit permissions — cannot observe or control. Organizations must build dedicated visibility into agent interaction graphs and enforce chain-level controls before these blind spots become serious security liabilities.

When the New York Times' Kevin Roose described Project Glasswing as a frontier AI model “so powerful that Anthropic is not releasing it to the public,” he wasn’t being sensational.

Prompt poaching is an attack technique that allows browser extensions to silently capture and exfiltrate AI chatbot conversations without any employee error. Recent cases have affected millions of users, from fake AI sidebar tools to a popular VPN extension that secretly harvested prompts from eight AI platforms. Traditional security tools largely miss it, which is why real-time visibility into AI activity across your SaaS environment is essential.

AI agents are rewriting the rules of cyber threats. Unlike traditional attackers who must fight through each stage of the kill chain, a compromised AI agent hands adversaries instant access, pre-mapped environments, and legitimate cover for data movement making most existing detection tools blind to the threat. Securing your SaaS ecosystem starts with knowing exactly which agents are operating, what they can access, and when their behavior deviates from the norm.

Five malicious Chrome extensions disguised as enterprise productivity tools stole session tokens from Workday, NetSuite, and SuccessFactors while simultaneously blocking admins from revoking access or resetting credentials. The attack exposed a blind spot in SaaS security: the browser, where stolen session cookies render SSO and MFA irrelevant.

AI adoption is accelerating across modern enterprises, but the rapid growth of AI tools and agents often introduces hidden operational and security risks. This article explores the hidden cost of AI sprawl, including duplicate tools, fragmented workflows, and expanding SaaS integrations. It also outlines practical frameworks and best practices that help organizations detect uncontrolled AI adoption and maintain visibility, governance, and security across enterprise environments.

The Model Context Protocol (MCP) is an emerging standard that enables AI agents to seamlessly connect with SaaS tools and APIs, allowing them to perform actions like fetching files, updating records, and sending messages autonomously. However, this power introduces significant security risks, including identity drift, weak authentication, data leakage, and invisible access that bypasses traditional monitoring. Organizations can mitigate these risks by enforcing least-privilege OAuth scopes, using short-lived tokens, binding agents to human owners, and adopting platforms that provide continuous visibility into MCP-based trust paths.

A few weeks ago, Cloudflare published “How we rebuilt Next.js with AI in oneweek.” One engineer and an AI model reimplemented the Next.js API surfaceon Vite. Cost about $1,100 in tokens.

When an employee is flagged as a potential insider threat, traditional investigations can take analysts hours of manual cross-referencing across dozens of fragmented tools — but Reco and Torq's new Agent-to-Agent workflow changes that entirely. By combining Reco's deep SaaS identity intelligence with Torq's HyperSOC orchestration, the workflow autonomously pulls context from across the security stack — EDR, DLP, SASE, and cloud security — to deliver a confident, natural-language verdict in seconds. The result is fewer false positives, dramatically reduced MTTR, and analysts who can focus on remediation instead of chasing data.

Organizations have thousands of AI agents operating across their SaaS environments, yet security teams have no visibility into what's running or what permissions these agents hold. AI agents create toxic combinations by connecting systems in ways that produce permission breakdowns traditional tools can't detect. Reco's AI agent security discovers every agent, maps the connections between systems, and gives teams control to manage risk.

Reco is actively investigating a ShinyHunters campaign targeting organizations running Salesforce Experience Cloud sites with misconfigured guest user profiles. By exploiting publicly accessible Aura API endpoints, the threat actor claims to have compromised between 300 and 400 organizations — with cybersecurity companies deliberately targeted to enable downstream supply chain attacks. This post covers the campaign's IOCs, the detection logic needed to hunt for it in Salesforce Event Monitoring, and the underlying misconfiguration that makes it possible.

OpenClaw, the viral open-source AI agent with over 135,000 GitHub stars, has triggered the first major AI agent security crisis of 2026 with multiple critical vulnerabilities, malicious marketplace exploits, and over 21,000 exposed instances. When employees connect these autonomous agents to corporate systems like Slack and Google Workspace, they create shadow AI with elevated privileges that traditional security tools can't detect. Reco's platform provides the visibility security teams need to identify OpenClaw integrations, audit permissions, and assess risk before incidents occur.

After 400% growth, Reco raises $30M Series B to address the AI SaaS security gap, where traditional tools can't see the thousands of AI apps, agents, and integrations that now power modern enterprises. This round was led by Zeev Ventures, with participation from all our existing investors—Insight Partners, boldstart ventures, and Angular Ventures—and new corporate investors including Workday Ventures, TIAA Ventures, S Ventures, and Quadrille Capital.

As AI becomes deeply embedded across SaaS platforms, it is increasingly operating with trusted internal access once reserved for employees and service accounts. This article examines how AI can function as an insider threat, why these risks are harder to detect than traditional insider activity, and what signals security teams should watch for. It also explores common governance gaps, real-world scenarios, and practical approaches organizations can take to reduce AI-driven insider risk without limiting legitimate AI use.

Clawdbot, the viral AI assistant that went mainstream in January 2026, exposes a new class of shadow AI risk: autonomous agents with shell access, plaintext credential storage, and over 1,200 misconfigured instances leaking API keys and chat logs. Unlike traditional shadow AI tools, Clawdbot represents a qualitative shift in attack surface—if your employees installed it and connected it to work systems, you now have an unmanaged endpoint with persistent access to sensitive data and zero visibility.

Google's Mandiant released AuraInspector, a tool that exploits misconfigured guest user sharing rules in Salesforce Experience Cloud sites through GraphQL endpoints. While the first public tool to use this specific technique, the underlying vulnerabilities have been exploitable since at least 2022 through other tools. Organizations should audit their Salesforce permissions, disable unnecessary guest user API access, and implement continuous monitoring to prevent data exposure.

Reco Device Inventory consolidates MDM, EDR, and identity provider data into a single view, eliminating fragmented dashboards and automatically surfacing rogue devices, unmanaged endpoints, and compliance gaps. Security teams can now proactively close coverage gaps before attackers exploit them, achieving a true single source of truth for all devices.

This article examines the evolution of CISO responsibilities in the AI era, from identity-first security and SaaS risk management to governance, compliance, and exposure-based decision-making. We will also learn how CISOs can maintain visibility, prioritize risk, and keep pace with AI-driven SaaS adoption without losing control over their environment.

Over 900,000 Chrome users had their ChatGPT and DeepSeek conversations stolen by two malicious browser extensions impersonating the legitimate AITOPIA AI sidebar tool. One extension even carried Google's "Featured" badge, creating a false sense of security.

CIS Microsoft 365 v6 introduces 140 controls across six services. Learn what’s new in v6, why it matters, and how continuous monitoring helps prevent drift between audits.

An expert review of the most significant AI and cloud security breaches of 2025, showing how OAuth abuse, shadow AI, prompt injection, and deepfake fraud reshaped enterprise risk and security assumptions.

Legacy SSPM solutions like AppOmni often struggle to keep pace with modern SaaS environments, exhibiting limited app coverage, shadow IT blind spots, and lack of integrated threat detection.This blog identifies five critical signs that indicate it's time to migrate. Organizations experiencing these issues should consider upgrading to a modern platform like Reco that offers broader coverage (225+ apps), automated shadow IT discovery, integrated threat detection, rapid app onboarding, and intelligent risk-based alert prioritization.

Shadow AI is emerging faster and more quietly than traditional Shadow IT, creating new risks around data exposure, governance, and identity-driven workflows. This article explores the Shadow AI adoption curve, explains why legacy SaaS controls fail to detect AI-driven activity, and outlines practical strategies that help organizations manage unapproved AI use safely. It also highlights how Reco enables unified access intelligence to uncover, assess, and govern Shadow AI across SaaS environments.

SaaS-to-SaaS integrations are the backbone of modern productivity, and your biggest blind spot. Each OAuth connection requests permissions that can read sensitive data, modify records, or trigger actions across multiple systems, yet most organizations have no idea which scopes exist or who approved them. Reco's SaaS-to-SaaS Scopes feature gives you complete visibility into these hidden connections, helping you detect risky permissions and enforce least-privilege access before a breach happens.

Salesforce issued an urgent security advisory today after detecting unusual activity in Gainsight-published apps. All access tokens have been revoked and the apps removed from AppExchange. If your organization currently uses or has ever used Gainsight's Salesforce integration, you need to audit your environment and take immediate remediation steps.

This article explains how organizations measure their readiness to secure and govern artificial intelligence through a structured maturity model. It outlines maturity levels, key assessment criteria, operational challenges, access risk analysis, and practical steps that help teams progress with confidence. Readers gain a clear view of how thoughtful governance, strong controls, and consistent monitoring support safer and more effective AI adoption across the enterprise.

In the GTG-1002 campaign, attackers manipulated Claude into autonomously executing 80-90% of a cyberattack across 30 targets at thousands of requests per second—the first documented AI-led espionage operation. Static security tools that can't baseline behavior or correlate cross-app activity miss the patterns AI attacks exploit, making dynamic, real-time defenses essential for modern SaaS environments.

Agentic AI is reshaping enterprise security from static defense to dynamic oversight. Its advanced security protects workflows, reinforces governance, and ensures compliance as intelligent agents make real-time decisions. It helps organizations to build trust, maintain control, and operate confidently within increasingly autonomous digital ecosystems.

This article explores the hidden costs of generative AI in SaaS, including infrastructure, governance, and security risks, and outlines strategies to manage expenses while driving safe adoption.

The ShinyHunters and Salesloft Drift breaches highlight how interconnected SaaS platforms create cascading security risks, where a vulnerability in one integration can quickly spread to multiple connected services. To address these evolving threats, organizations need dynamic SaaS security platforms that provide real-time visibility, adaptive access governance, and anomaly detection across their entire cloud app ecosystem.

Shadow AI is spreading fast. The 2025 State of Shadow AI Report shows that popular apps aren’t secure by default. Learn how leaders can restore visibility.

The Salesloft-Drift breach impacted over 700 companies when attackers exploited Github OAuth tokens to pivot through SaaS integrations into Salesforce and Gmail environments. This supply chain attack succeeded because traditional security tools lack visibility into SaaS-to-SaaS connections and cannot detect threats spanning multiple applications.

In mid-2025, ShinyHunters breached Salesforce instances at Google and Workday using voice phishing and malicious OAuth apps. Learn what happened and how Reco’s SaaS security platform could have stopped it.

Discover the top cloud security trends, challenges, and strategies shaping 2026, with expert guidance on Zero Trust, AI security, and SaaS risk management.

Our threat intelligence team broke Cursor’s background agent and took over an EC2 instance machine. Learn how we did it, implications and next steps.

Ruby Life's CISO successfully secured budget for Reco by strategically aligning with both technical and business stakeholders, demonstrating how SaaS security would enable safe AI adoption and drive revenue growth rather than just mitigate risks. Discover the key to his success that helped Ruby Life gain executive support.

Discover how Coinbase's $400M breach was linked to an outsourced call center, where employees accessing sensitive data triggered phishing scams and social engineering attacks

A Deel insider used Slack to spy on Rippling. This case reveals how SaaS tools expose companies to insider threats and how Reco helps stop them.

ChatGPT now natively connects to Google Drive, Outlook, SharePoint, Box, Dropbox, and more. A valuable productivity boost – paired with a plethora of data security risks. Read this blog to understand SaaS-to-Ai Risks, plus how Reco can help.

Discover effective strategies for managing AI sprawl within your SaaS stack. Implement practical governance to address security, compliance, and data risks efficiently.

In May 2025, CISA issued a warning that Commvault's Metallic cloud backup service had been compromised by threat actors, enabling the adversaries to steal secrets from Commvault customers. Read this blog to learn what happened, how to remediate if you were affected, and how Reco can help you stop attacks like this.

The old days of SaaS, when companies only had a handful of core apps, are long gone. Today’s SaaS environments are no longer static—they’re dynamic, interconnected and AI-infused. Learn why the next revolution in SaaS security is Dynamic SaaS Security.

Threat detection and response for SaaS apps is critical. But should you build it or buy it? Read this blog to learn why building a homegrown solution with your SIEM may be prohibitively complex, costly, and fall short of providing adequate protection.

JPMorgan’s CISO Pat Opet issued a blunt warning that SaaS sprawl is “quietly enabling cyber attackers” and creating systemic vulnerabilities. He calls for new cybersecurity solutions and standards. Read this blog to understand why Dynamic SaaS Security is the answer.

An overpermissioned contractor with malicious intent led to a devastating SaaS security breach. Learn about Kate, Reco's Director of Demand Generation, and her true story of being part of a SaaS security attack.

Discover why browser extensions can harm SaaS security, creating risks and blind spots, and how agentless, dynamic solutions offer safer, smarter protection.

We’re here to lead the SaaS Security market — a space we believe is on the verge of massive growth. Learn why our investors are betting on Dynamic SaaS Security with an additional $25M.

Reco tackles the dangerous configuration sprawl by providing real-time visibility into security setting changes across your integrated applications. Learn about the associated risks and how with its Knowledge Graph technology and business context, Reco helps you quickly identify, prioritize and remediate critical configuration changes.

SaaS identity sprawl refers to the unchecked proliferation of user identities, access permissions, and authentication credentials across an organization's growing SaaS ecosystem. This phenomenon occurs as companies adopt more SaaS apps, each requiring separate user accounts, role definitions, and access controls.

Find out how Reco keeps Microsoft 365 Copilot safe by spotting risky prompts, protecting data, managing user access, and identifying threats - all while maintaining productivity.

Learn how Reco’s AI agents reduce alert overload for Security teams and improve SaaS security by turning unnecessary noise into clear, useful insights.

Learn how one CISO measures the ROI of SaaS security and 5 tips for increasing speed to value.

MFA fatigue attacks exploit user frustration by bombarding them with authentication requests until they approve one just to make the notifications stop. This sophisticated social engineering tactic turns a security measure into a vulnerability, threatening sensitive data and systems across an organization's SaaS ecosystem. Learn more about the risks with MFA fatigue and how by recognizing the warning signs of these attacks—such as unusual spikes in MFA declines or authentication attempts from suspicious locations —security teams can prevent attackers from bypassing this critical security layer.

Detecting ransomware in SaaS environments requires more than traditional security approaches as malicious files can spread through file synchronization and messaging platforms like Teams. While Microsoft and Google provide native scanning capabilities, Reco enhances detection by correlating alerts across platforms, providing crucial context about how ransomware originated, and enabling automated response before threats can spread through interconnected SaaS applications.

As SaaS applications grew increasingly AI powered, CSK needed to visibility and control over AI usage at the organization. The goal was to support AI innovation, without slowing the business down. CSK turned to Reco to help. Read this blog from CSKs Chief Information Officer, Jason Thomas, to learn more.

Organizations face significant security and compliance vulnerabilities when third-party vendors share sensitive data with their own vendors (fourth parties) without adequate oversight. Learn how these fourth-party relationships create blind spots in your security posture that can lead to regulatory penalties and reputational damage when breaches occur.

The Oracle cloud breach underscores how vulnerable identities are, as hackers continuously find ways to expose credentials. This blog discusses what happened, how Oracle cloud users can mitigate risks, and how you can protect your SaaS apps, even when your credentials are exposed by a vendor.

Self-Service Password Reset (SSPR) systems enable users to reset passwords independently but create new security risks that require monitoring for unusual patterns. Learn how effective SSPR monitoring can help prevent account takeovers and how to integrate monitoring into security architecture.

Wellstar Health uses Reco to manage shadow SaaS. In this blog, Wellstar Health's Executive Director of Security & GRC provides 9 actionable tips for reducing shadow IT. By employing these strategies, you too can reduce your shadow SaaS footprint and create a manageable, sustainable, and effective program.

One of the biggest challenges of SaaS security is that SaaS ownership is fragmented. So how do you get app owners to embrace SaaS security in order to drive change? Read this blog from Jennifer Langford at CSK. She improved her posture score from 45 to 75. Learn 5 tips for success.

Microsoft Copilot helps businesses be more efficient, but it also allows malicious actors to potentially exploit your business data. Reco uses prompt analysis to identify and flag risky behavior within Microsoft Copilot. Read this blog to understand how Reco can help you keep Microsoft Copilot secure.

Legacy SSPM is static – it can't keep up with the SaaS rate of change. SSPM+ is the next revolution in SSPM. It covers not only existing apps you know about, but also new apps as soon as they hit your infrastructure. It offers visibility into the entire SaaS lifecycle, and adjusts as your environment changes and grows. ‍

Reco now supports over 160 SaaS apps. Through the SaaS App Factory™, Reco can release new integrations on request in just days.

RFA is a managed IT services provider. They wanted to offer Managed Detection & Response services for Microsoft365 to clients. They signed up with Reco to power this service. Read the blog from RFA's CIO to learn how they did it.

BigID was struggling to build a threat detection and response program for SaaS applications. They signed up with Reco and eliminated months of work. Today, Reco is an integral part of BigIDs SOC automation.

Implementing a robust SaaS security program can help you improve your company's overall security posture. But simply purchasing a security tool won't be enough – you must pay attention to certain critical organizational factors as well. This blog details 6 steps for success.

SaaS has taken over our enterprise world. But it's constantly outscaling Security due to five types of sprawl. Read this blog to understand why traditional solutions, like CASB and SSPM, are not enough for SaaS security and why you need a Dynamic SaaS Security Platform.

Learn more about ESET uncovering PlushDaemon, a China-linked APT behind a 2023 supply chain attack on IPanyVPN. The attackers trojanized the installer to deploy the SlowStepper backdoor, enabling long-term espionage across multiple regions.

Learn more about ESET uncovering PlushDaemon, a China-linked APT behind a 2023 supply chain attack on IPanyVPN. The attackers trojanized the installer to deploy the SlowStepper backdoor, enabling long-term espionage across multiple regions.

Reco identified an ongoing, global campaign targeting SaaS identities originating from Phoenix, Arizona. This technical analysis report identifies attack patterns, attacker infrastructure, targeted accounts, and security measures that prevented or allowed account takeovers.

SaaS supply chain attacks occur when a malicious actor compromises a third-party SaaS vendor and uses that as a launching pad to target the vendor’s customers. By exploiting the interconnected nature of SaaS ecosystems, attackers can scale their reach and impact more victims. Read this blog to learn about the risks and how to mitigate them.

DeepSeek has quickly upended the AI market. But is it safe to use? Short answer: probably not. Read this blog to understand the biggest DeepSeek security risks for organizations.

Deep dive into Reco's shadow app discovery technology, covered by The Hacker News. Reco uses AI-based graph technology and email filtering to discover shadow apps and shadow AI. Learn what Reco can do – and what Reco cannot do – for shadow IT security at organizations.

Mike D'Arezzo, Executive Director of Security and GRC at Wellstar Health, turned to Reco to help him manage shadow IT and secure SaaS deployments at the organization. Learn how Reco empowers him to effectively secure PHI in SaaS apps.

On December 24, 2024, Cyberhaven experienced a security breach involving its Chrome browser extension. What started as a phishing email led to a poisoned Chrome extension, resulting in an estimated 400,000 compromised browsers.

Pat Opet, Chief information Security Officer (CISO) at JPMorgan Chase, recently named SaaS security as a top priority for 2025. Learn why it should be your top priority, too, and best practices for securing SaaS applications.

CISA recently released requirements for federal agencies to secure SaaS applications like Microsoft 365. Learn five steps to get SaaS security right.

Reco's shadow SaaS and shadow AI discovery solution can identify all applications and copilots being used by employees, rank their level of risk, and provide insight into who is using what and how.