The SaaS ecosystem has evolved at incredible speed — but security standards haven’t kept up. We saw this with the Salesloft incident, where attackers used stolen tokens to jump between applications. To ease the concerns of our customers, @okta and @auth0 weren’t impacted. Our defenses, including IP restrictions and token-binding protections like DPoP, held firm. The new reality is that security can no longer live inside a single app; it needs to move at the speed of integration. That's why we're championing the IPSIE standard with the OpenID Foundation. It's a framework that creates a common language for identity-based security, enabling shared alerts and instant token revocation across different SaaS providers. This is how we close the gaps and prevent the next wave of token replay attacks from spreading. It's about securing the entire ecosystem, not just one piece of it. Learn more in the 🧵