Cybersecurity firm BeyondTrust has formally launched Phantom Labs, a dedicated research team focused on identity security, threat discovery and vulnerability analysis, as it looks to expand its presence in an increasingly complex digital security landscape.
The move marks a strategic shift in BeyondTrust’s research and innovation efforts. Phantom Labs will focus on understanding how attackers exploit identities and escalate privileges in hybrid and cloud environments. The unit builds on the company’s previous research work, which has included uncovering critical vulnerabilities and contributing threat intelligence during high-profile incidents — most notably the breach involving Okta.
Led by Fletcher Davis, a seasoned red team specialist and offensive security researcher, Phantom Labs will formalise the work of BeyondTrust’s existing research team. Davis will oversee efforts to simulate attacker behaviour, expose cross-domain risks and identify hidden paths to privilege across enterprise systems.
The company has also appointed Kinnaird McQuade as Chief Security Architect. McQuade, known for developing the open-source tool Cloudsplaining, which has been downloaded over 40 million times, brings deep expertise in cloud identity security. His work has influenced how security teams detect lateral movement and data exfiltration in cloud-first environments.
“Our goal has always been to think like an attacker,” said Marc Maiffret, Chief Technology Officer at BeyondTrust. “The traditional PAM approach falls short when it comes to tackling the growing threat of identity-based attacks. You can’t bolt on identity security — it has to be built into the core. That’s why Phantom Labs is a critical part of our strategy.”
Phantom Labs will drive original threat research, develop mitigation playbooks and collaborate with BeyondTrust’s product teams to integrate new intelligence into its broader platform. Key areas of recent research include identifying privilege escalation risks in Microsoft Entra guest accounts, building data science models to detect session hijacking and launching the Paths to Privilege framework.
The team also partners with external platforms such as the Adventures of Alice & Bob podcast to help raise awareness around emerging threats and unknown attack vectors.
Phantom Labs operates under the direction of Maiffret, a veteran in both offensive and defensive security. With over two decades of experience – including uncovering early Microsoft vulnerabilities and co-founding one of the first vulnerability management platforms – Maiffret brings a deeply attacker-informed lens to BeyondTrust’s research strategy.
BeyondTrust, which protects over 20,000 customers including 75 of the Fortune 100, says the creation of Phantom Labs strengthens its position as a leader in identity security innovation.
