5 ways teams can comply with the FTC’s GoDaddy ruling

COMMENTARY: The FTC's finalized order against GoDaddy last week marks a strategic breakpoint in cybersecurity oversight. For once, a federal directive targets system architecture directly.

This directive skips the narrative and targets core system instability and hidden financial risk. The ruling pushes GoDaddy to roll out baseline controls: non-SMS MFA, encrypted API layers, time-locked firmware updates, and breach telemetry on a 10-day service-level agreement (SLA).

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

The external enforcement stretches out the reality of supply chain weakness. Such a pivot depends on the assessors. Hand off to compliance vendors and we’d merely loop back to the same failures, with zero tangible progress. To turn oversight into deterrence, we need black hat-grade operators who actually understand escalation, session hijack, and exfiltration in the wild.

How enforcement plays out now will show us whether this raises the bar, or signals more industry tolerance for collapse. Absence of a monetary penalty doesn’t matter. Customer trust across 21 million accounts is already fractured.

My prediction: Churn will spike, partnerships will crack, and capital will disappear before fines ever materialize in our industry. Platforms built on checklist logic will capsize under adversarial pressure. Thus, systems don’t harden without live-fire stress. Here’s what a real remediation protocol looks like:

Assessors must operate like threat actors: Test all endpoints, credential paths, and session tokens with quantifiably accurate post-exploit tactics. Evaluate access boundary resilience via mimicked/mirrored multi-vector intrusion attempts.

Validate breach detection windows via telemetry fidelity: Supposing detection relies on log aggregation without entropy anomaly detection, a 10-day SLA is a dead letter.

MFA must anchor to hardware roots of trust: One-time-passwords over SMS or email are compromised by design. Strong auth starts with cryptographic device attestation, hardware-rooted credentials, live biometric challenge-response, and continuous behavioral analytics.

Behavioral analytics should model interaction entropy, rather than exclusively role-based logic: Fraud indicators hide in micro-latency deltas, navigation jitter, and syntactic payload drift. Once a SIEM can’t see it, the platform is already compromised.

Compliance cycles must map to APT-grade live-fire simulations: All certification phases must include a black-box adversarial campaign against production systems. Without it, compliance is a placebo.

The GoDaddy case represents a textbook example of technical failure at scale. Running SMS-based 2FA in 2025 is worse than a punchline at DEF CON. API authentication might as well be an open door sign, with the roof torn off. Session tokens scattered like breadcrumbs across unsegmented networks with zero adaptive throttling. Internal privilege model is flat making lateral movement trivial for anyone with basic tools. Log data collection becomes a joke with no real-time correlation or anomaly detection. It’s the cybersecurity equivalent of expired milk: tech-savvy attackers can bypass or erase at will.

Zero threat modeling was evident: There was no segmentation to contain breaches once inside. Detection relied on reactive logs instead of proactive hunting. The threat actors moved laterally, planting persistent backdoors, as defenders played CSI on mushrooms.

Instead of being deemed a so-called breach, we should look at it as a system designed for hackers to break. GoDaddy opted for speed and convenience over security and resilience. The stack rewarded attackers with frictionless access and blind spots. There were millions of accounts strung up like bait fish in a trust economy with no legit protection. But that’s what happens when security gets outsourced to marketing teams and legacy IT with zero black hat insight.

The GoDaddy case presents us with a line in the sand: security governance either evolves into technical literacy or stays irrelevant. If the FTC ruling actually gets enforced with operator-level depth, a monumental transformation across SaaS and hosting markets will transpire. Otherwise, we’ll see it absorbed into the compliance-industrial complex. Attackers won't care either way. But they will always adjust targeting based on how the industry handles it.

As we say, security remains a myth: unless we break our own system first.

Nic Adams, co-founder and CEO 0rcus

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.