Independent, vendor-neutral knowledge hub for identity and access management. Guides, standards, breach teardowns, and IAM jobs.
San Fancisco
Joined November 2019
- Tweets1.3K
- Following390
- Followers421
- Likes207
Start with Identity retweeted
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. cfl.re/488w8dc
SCIM rarely breaks on create. It breaks on leave.
Deactivate a test user in your IdP. One sync later: does the session still load? Does the API token work? Does the OAuth grant refresh?
Any yes means offboarding needs an explicit revoke step.
startwithidentity.com/blog/s…
ALT Leaver test for SCIM. Deactivate a test user in the IdP. One sync later, check three things: can the session still load data, does the API token still work, does the OAuth grant still refresh. Any yes means offboarding needs an explicit revoke step.
Patch day has to be rotation day.
In four October cases (BeyondTrust, Ivanti, FortiGate, FortiBleed), attackers left with the credentials the appliance held. Patching doesn't revoke them.
Rotate its admins first, then directory binds, then the rest.
startwithidentity.com/blog/r…
Passkey Index 2026: 36% of successful sign-ins used a passkey, up from 26%. Sign-in success: 93% vs 78% for passwords and traditional MFA.
The gap to fix: 38% have a passkey, and at 8 of 10 services use still trails enrollment. Show the passkey first.
startwithidentity.com/blog/p…
Start with Identity retweeted
AI made impersonation cheap. Standard logins made it easy.
Verified Trust continuously validates the real human behind every action in milliseconds. No friction, no blind spots.
See how Ping secures every step: ow.ly/1OpA50ZYwKm
Snowflake 2024: about 165 customer environments hit with no vulnerability needed.
Infostealer credentials from years earlier were used that were never rotated. No MFA was required.
The moral of the story? Check your service and legacy accounts.
go.compile7.org/mAgFbP
Almost nobody plans a career in identity. How did you get in?
A. IT support or help desk
B. Security operations
C. Software engineering
D. Something else entirely
Reply with your response and your story.
How does your country prove who you are online?
Ex: Sweden uses bank IDs, India uses Aadhaar, and there's an EU wallet on the way.
We mapped 86 digital ID schemes across 51 countries. Which one do you use?
startwithidentity.com/digita…
Start with Identity retweeted
That's amazing, Microsoft and large companies have to setup Auth and security
Folks, did you know Entra ID has a default password policy that blocks weak passwords like Summer2026? Even ones you'd think are complex with upper-case and special characters but are easily guessed.
No tenant can turn it off. Admins don't have to think about it. In fact, most Entra and M365 admins don't even know it exists.
Isn't it great when your platform is evergreen and keeps updating as the threats evolve?
Now the Entra team felt bad. It's not fair that Entra ID gets all the cool stuff. So they built Entra Password Protection for Active Directory and made it FREE!
TADA!!
Sorry, no. Joking. Only Entra ID gets it free. Password Protection for AD needs P1 or P2. (I know right, greedy Micro$oft 🤬)
But if you're on M365 E3/E5 or Business Premium, you already have P1. So good news!!!
Deploy it to AD and give your on-prem users the same protection.
Your welcome! learn.microsoft.com/en-us/en…
Start with Identity retweeted
AI access has a resale value now. And criminals have noticed.
As demand for frontier models rises, an underground market is offering premium AI access at prices that look almost too good to be true.
Sometimes the “discount” comes from stolen session tokens and API keys. Sometimes it's fueled by fake accounts and abused promotional credits.
Either way, someone else is picking up the tab.
Okta Threat Intelligence went inside the underground AI economy to understand how AI access is being stolen, manufactured and resold—and what security teams can do about it.
→ Read the research: okta.com/newsroom/articles/i…
Your AI agent is not a service account.
It needs to be:
Scoped: least privilege per task
Delegated: carries the human who authorized it
Auditable: every action traceable
Revocable: easily done via a button
startwithidentity.com/guides…
For MGM and Caesars in 2023, attackers didn't hack the login. They called the help desk, posed as employees, and asked for password and MFA resets.
The recovery path is a login path. Protect it like one.
startwithidentity.com/breach…
Logged in is not the same as allowed.
Authentication: who are you? Once, at sign-in.
Authorization: what can you do? Every request.
Make sure your users are both authenticated and authorized.
startwithidentity.com/guides…
23.8M secrets were leaked on public GitHub in 2024. 70% of leaked them were still valid two years later (GitGuardian 2025).
A leaked password gets reset. A leaked API key keeps working.
startwithidentity.com/guides…
23.8M secrets leaked on public GitHub in 2024.
70% of leaked secrets were still valid two years later (GitGuardian 2025).
A leaked password gets reset. A leaked API key keeps working. Give every one an owner and a short lifetime.
startwithidentity.com/guides…
Your user passed MFA. The attacker got in anyway.
Infostealer copies the session cookie. Attacker replays it. No password, no MFA prompt.
A password reset does nothing. Revoke sessions and refresh tokens.
startwithidentity.com/breach…
6 steps to your first IAM job:
1. Learn OAuth, OIDC, SAML, SCIM deeply
2. Build a demo you can explain
3. One relevant cert
4. Outcomes-first resume
5. Practice protocol questions
6. Apply to IAM, IGA, PAM, CIAM roles
startwithidentity.com/jobs/
SAML vs OAuth vs OIDC in three lines:
SAML: who is this user? Enterprise SSO, XML.
OAuth: what may this app access? Not login.
OIDC: who is this user? OAuth plus an ID token.
startwithidentity.com/guides…
Uber, 2022: the attacker didn't break MFA. They sent push after push, posed as IT, and waited for one tap on approve.
Fixes: number matching, prompt rate limits, phishing-resistant MFA for admins.
startwithidentity.com/breach…
