Google spent a decade training the internet to hover before you click. Then it shipped opaque search redirects that hide the destination until you’ve already committed. Malwarebytes documented the change: you can no longer inspect a result’s real URL from the results page the way your awareness slide still tells people to. Same week, Unit 42 published a clustering model because cloud identity roles in audit logs also refuse to describe what they actually do. If your cybersecurity program still treats a visible label as threat-protection, this week made the joke official.

Google took the last honest tooltip

You know the briefing. “Hover over the link. Check the domain. Don’t click until you see where it goes.” Helpdesk scripts still say it. Phishing tabletop decks still print it. A lot of defense in depth quietly assumed the browser would tell the truth before the GET.

Google says the new redirects exist to fight evolving abuse. Fine. The operational cost lands on you. Users lose the one check they were actually willing to perform. Security teams lose a cheap, human-scale filter that sat in front of every search-driven click. Your firewall never saw that hover anyway. It sees the session after the user has already followed Google’s hop.

This is a bad look for anyone still grading user risk by “did they pause on the tooltip.” The click path now starts inside a trusted search brand, lands on an opaque redirect, and only then reveals the site. Attackers already live in that gap. Brand impersonation, poisoned SEO, and malware-laced downloads do not need a clever exploit when the destination is hidden by design.

Train the report button. Train the “open in a sandbox / isolate the tab” habit. Train people that a Google result is a referral, not a reputation score. Stop rehearsing a check the product no longer offers.

Your role names are fanfic

Search results are the obvious case. Cloud IAM is the expensive one.

Unit 42’s latest research maps cloud identity roles from audit logs with behavioral clustering, then turns those clusters into continuous detection you can express in ordinary SQL. That sentence should bother you. They built a model because the declared role, the friendly name in the console, and the actual API diet of a principal are three different stories. Readonly roles that mint. CI bots that wander into object stores. Human break-glass accounts that look like nightly batch jobs if you only alert on the string in the RoleName field.

You already knew this in your gut. A service principal called billing-reader that suddenly enumerates IAM and dumps storage is not a naming problem. It is a detection problem you postponed because the label was comforting. Behavioral clustering is just a formal way of saying: group principals by what they do, then flag the ones that change diet.

Machine and AI identities make the naming fiction worse. Entrust’s latest CBOM pitch is product news, and you can ignore the logo. The underlying mess is real. Certificate lifetimes keep shrinking. Workload keys keep multiplying. Post-quantum migration talk keeps landing in the same meetings as “we still find TLS certs in a shared drive.” A cryptographic inventory that never becomes a revoke, a rotate, or a deny is a spreadsheet with anxiety. Same failure mode as IAM: you cataloged the label and skipped the behavior.

Brute-force noise against SSH and RDP still fills the SIEM. That traffic is loud and familiar. Quiet identity drift is how you actually lose the tenant. If your analysts spend the morning dismissing password-spray tickets and never query “which principals grew a new API cluster this week,” you are staffing the wrong fire.

Stop inspecting labels this week

You do not need Unit 42’s notebook or a new platform SKU to act. You need to stop treating names, hover states, and inventory rows as controls. Concrete moves, vendor-neutral, usable on a Tuesday:

• Immediate: Pull last 14 days of cloud audit logs for your highest-privilege and wildcard-trust principals. Cluster on action + resource family, not on role title. Anything that grew a new cluster, especially IAM, storage, secrets, or key-management APIs, gets a human review before the weekend. Disable or constrain unused keys the same day you find them.
• Immediate: Rewrite the user-facing guidance that still says “hover to verify.” Point people at reporting, isolation, and “don’t authenticate into a site you reached from a search ad.” Update the phishing sim copy so you are not scoring a control Google just removed.
• Immediate: Export every certificate, workload identity, and service key that can authenticate to production. Mark expiry, last-used, and owner. Revoke the orphans. This is security hardening, not a compliance souvenir.
• Ongoing: Keep a SQL-or-equivalent detection that compares each principal’s action set to its 30-day baseline. Alert on diet change, not on “Admin” in the name. Feed those hits into incident response as identity events: revoke sessions, rotate keys, shrink the role to the observed baseline, then decide if the host even matters.
• Ongoing: Treat search, mail, and chat as untrusted referrers. URL rewriting in the secure web gateway should log the final destination you actually allow, because the user will not see it first. Pair that with least-privilege egress so a bad click has a small blast radius.

Do the cloud hunt even if “nothing looks wrong” in IAM. Wrong is a name that still matches last quarter’s intent. Right is a principal whose API graph still matches last week’s job.

When something does fire, start IR at the identity. Kill the token. Invalidate the refresh. Cut the role. Then image the box if you still care. Teams that image first and leave the principal alive get to do this twice.

Cybersecurity that trusts nametags will miss the next one

Plenty of programs still buy the nametag. The SERP looked like Google, so the click was fine. The role said read-only, so the key was fine. The CBOM listed the cert, so crypto was fine. That is how you get a clean dashboard and a dirty tenant.

Real cyber security work here is boring on purpose. Observed behavior over declared purpose. Final destination over the pretty referrer. Last-used over last-inventoried. You already have the logs. Unit 42 is just reminding you they cluster if you bother to look. Google is reminding you the user-facing preview was never a substitute for those logs.

Threat detection that still keys off display names will keep missing diet changes. Incident response that still opens on the hostname will keep missing the principal that already hopped. Defense in depth that still includes “hover the link” as a layer is a slide, not a stack.

You can keep the awareness lunch-and-learn. Change the homework. Make people prove they reported a weird result, not that they hovered a tooltip that no longer exists. Make engineering prove that yesterday’s service account still eats yesterday’s APIs. Make crypto owners prove the key in the inventory still exists, still rotates, and still has a human who will revoke it at 2 a.m.

Labels are for tickets. Behavior is for detection. This week just made it harder to pretend otherwise.

Sources

• Google’s new search redirects make links harder to check before you click
• Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
• Entrust turns cryptographic inventory data into security action