Identity & Access
-
Recording Privileged Sessions Changes Behaviour Before Anyone Reviews the Tape
Most session recording value comes from the fact that administrators know it exists, not from anyone actually watching the footage…
Read More » -
Automated Provisioning Handles Joiners and Forgets Leavers
Onboarding is visible and fails loudly. Offboarding is invisible and fails silently, leaving working accounts for people who left months…
Read More » -
Zero Trust Is an Identity Problem, Not a Network Product
Vendors sell zero trust as a network appliance. It is actually a shift from location-based trust to per-request verification, and…
Read More » -
Passkeys Only Help Once You Can Turn Passwords Off
Adding passkeys alongside passwords adds convenience without removing risk, because the password remains a working path an attacker can use.
Read More » -
Break-Glass Access Is the Account Nobody Monitors
Emergency administrative credentials exist because normal access paths can fail. They are also the least governed identity in most organisations.
Read More » -
Non-Human Identities Now Outnumber Your Employees
Service accounts have broad permissions, credentials that never expire, no owner and no lifecycle, which makes them the most attractive…
Read More » -
OAuth Consent Screens Ask for More Than Applications Need
A calendar plugin requesting full mailbox access is normal, and the user clicking accept has no way to grant less.
Read More » -
Standing Admin Access Is the Vulnerability You Approved
Permanent administrative rights mean every compromise of that account is an immediate full compromise. Just-in-time elevation converts a standing risk…
Read More » -
Attackers Follow Permission Chains, Not Single Grants
No single permission looks dangerous in isolation. The path from a helpdesk account to domain administrator is built from four…
Read More »