nab

In security operations, few terms get thrown around with as much confusion as NAB. Depending on which vendor whitepaper you read, it stands for Network access Broker - a human operator who specializes in breaching corporate networks and selling that access to ransomware crews, data thieves. Or state-sponsored groups. But for the engineers on the receiving end of those alerts, the real definition is simpler: a NAB is an identity you failed to classify before it became an incident.

I've spent the last several years instrumenting cloud and on-prem environments for detection engineering. In production environments, we found that chasing the malware binary was a losing game. Brokers rarely use custom implants to get inside. They use stolen session tokens, exposed RDP endpoints, and misconfigured single sign-on. To actually nab one, you need to shift your telemetry from endpoints to the identity plane. Most teams try to block brokers at the firewall. The engineers who actually nab them treat every login event as a potential transaction.

This article breaks down the broker economy, the detection gaps that let NABs operate undetected. And the concrete engineering controls - from OpenTelemetry pipelines to honey identities - that give your team a fighting chance. No magic AI, and no vendor silver bulletJust systems thinking.

What Is a Network Access Broker (NAB) Really Selling?

A Network Access Broker doesn't usually sell zero-day exploits. They sell legitimate access. A typical offering includes VPN credentials, a Citrix session, an RDP account, or a set of cloud cookies for a Microsoft 365 tenant. Some packages even include the victim organization's revenue band, employee count. And a screenshot proving access to the internal dashboard. That's the product.

This matters because the commodity malware mindset doesn't apply. If you're hunting for a malicious binary, you'll miss the broker who logs in with a stolen session token from a residential proxy. The NAB's entire business model depends on blending in. The access itself is the exploit, and the transaction happens days