Independent, vendor-neutral knowledge hub for identity and access management. Guides, standards, breach teardowns, and IAM jobs.
San Fancisco
Joined November 2019
- Tweets1.3K
- Following390
- Followers422
- Likes214
Most AI agents in production run on a borrowed identity: your session or a shared cloud role. Any injected prompt inherits what that identity can reach.
Give each agent its own identity. Use RFC 8693 delegation so the token names you and the agent.
startwithidentity.com/blog/g…
Entra ID is ending Microsoft-sent SMS and voice codes.
Feb 1, 2027: everyone else
Jul 1, 2027: global admins and external users
The most privileged accounts get the longest runway on the weakest factor. Move admins first.
startwithidentity.com/blog/2…
One leaked token pushed a secret-stealing workflow into ~345 GitHub repos (StepSecurity). Socket now sees it in tens of thousands.
Search for security-audit.yml or github_actions_security.yml. If you find it, revoke and rotate everything.
startwithidentity.com/guides…
Four identity habits for every team:
1. Passkeys on your work account and personal email
2. A password manager, with shared logins in it
3. An MFA prompt you didn't start: deny and report
4. Asked for a code or reset? Call back on a number you already had
Start with Identity retweeted
Two critical security vulnerabilities affecting PHP have been identified that result in unauthenticated remote code execution (RCE) for any PHP application. Ubuntu has released fixes for the affected packages for all supported releases.
Read more: ubuntu.com/blog/php2shell-vu…
#Ubuntu #Security #CVE
FBI and Secret Service: FortiBleed is still active.
86,644+ Fortinet devices with working credentials in 194 countries. No new CVE, just reused and sniffed passwords.
Phishing-resistant MFA on VPN and admin logins. Rotate. Hunt new admins.
startwithidentity.com/glossa…
Start with Identity retweeted
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. cfl.re/488w8dc
SCIM rarely breaks on create. It breaks on leave.
Deactivate a test user in your IdP. One sync later: does the session still load? Does the API token work? Does the OAuth grant refresh?
Any yes means offboarding needs an explicit revoke step.
startwithidentity.com/blog/s…
ALT Leaver test for SCIM. Deactivate a test user in the IdP. One sync later, check three things: can the session still load data, does the API token still work, does the OAuth grant still refresh. Any yes means offboarding needs an explicit revoke step.
Patch day has to be rotation day.
In four October cases (BeyondTrust, Ivanti, FortiGate, FortiBleed), attackers left with the credentials the appliance held. Patching doesn't revoke them.
Rotate its admins first, then directory binds, then the rest.
startwithidentity.com/blog/r…
Passkey Index 2026: 36% of successful sign-ins used a passkey, up from 26%. Sign-in success: 93% vs 78% for passwords and traditional MFA.
The gap to fix: 38% have a passkey, and at 8 of 10 services use still trails enrollment. Show the passkey first.
startwithidentity.com/blog/p…
Start with Identity retweeted
AI made impersonation cheap. Standard logins made it easy.
Verified Trust continuously validates the real human behind every action in milliseconds. No friction, no blind spots.
See how Ping secures every step: ow.ly/1OpA50ZYwKm
Snowflake 2024: about 165 customer environments hit with no vulnerability needed.
Infostealer credentials from years earlier were used that were never rotated. No MFA was required.
The moral of the story? Check your service and legacy accounts.
go.compile7.org/mAgFbP
Almost nobody plans a career in identity. How did you get in?
A. IT support or help desk
B. Security operations
C. Software engineering
D. Something else entirely
Reply with your response and your story.
How does your country prove who you are online?
Ex: Sweden uses bank IDs, India uses Aadhaar, and there's an EU wallet on the way.
We mapped 86 digital ID schemes across 51 countries. Which one do you use?
startwithidentity.com/digita…
Start with Identity retweeted
That's amazing, Microsoft and large companies have to setup Auth and security
Folks, did you know Entra ID has a default password policy that blocks weak passwords like Summer2026? Even ones you'd think are complex with upper-case and special characters but are easily guessed.
No tenant can turn it off. Admins don't have to think about it. In fact, most Entra and M365 admins don't even know it exists.
Isn't it great when your platform is evergreen and keeps updating as the threats evolve?
Now the Entra team felt bad. It's not fair that Entra ID gets all the cool stuff. So they built Entra Password Protection for Active Directory and made it FREE!
TADA!!
Sorry, no. Joking. Only Entra ID gets it free. Password Protection for AD needs P1 or P2. (I know right, greedy Micro$oft 🤬)
But if you're on M365 E3/E5 or Business Premium, you already have P1. So good news!!!
Deploy it to AD and give your on-prem users the same protection.
Your welcome! learn.microsoft.com/en-us/en…
Start with Identity retweeted
AI access has a resale value now. And criminals have noticed.
As demand for frontier models rises, an underground market is offering premium AI access at prices that look almost too good to be true.
Sometimes the “discount” comes from stolen session tokens and API keys. Sometimes it's fueled by fake accounts and abused promotional credits.
Either way, someone else is picking up the tab.
Okta Threat Intelligence went inside the underground AI economy to understand how AI access is being stolen, manufactured and resold—and what security teams can do about it.
→ Read the research: okta.com/newsroom/articles/i…
Your AI agent is not a service account.
It needs to be:
Scoped: least privilege per task
Delegated: carries the human who authorized it
Auditable: every action traceable
Revocable: easily done via a button
startwithidentity.com/guides…
For MGM and Caesars in 2023, attackers didn't hack the login. They called the help desk, posed as employees, and asked for password and MFA resets.
The recovery path is a login path. Protect it like one.
startwithidentity.com/breach…
Logged in is not the same as allowed.
Authentication: who are you? Once, at sign-in.
Authorization: what can you do? Every request.
Make sure your users are both authenticated and authorized.
startwithidentity.com/guides…
23.8M secrets were leaked on public GitHub in 2024. 70% of leaked them were still valid two years later (GitGuardian 2025).
A leaked password gets reset. A leaked API key keeps working.
startwithidentity.com/guides…
