OAuth grants are the quiet back door of modern SaaS, and as the recent Klue breach showed, attackers are taking notice. This checklist gives you a repeatable way to uncover risky OAuth grants and MCP ...

A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials.

LAPSUS$ is just one cybercriminal group that has breached networks of large companies such as Uber and Microsoft by spamming employees with MFA authentication requests. Credential compromise has been ...

Microsoft 365 passkeys replace SMS MFA with secure cryptographic public-private key pairs. Configure Entra profiles and manage device rollouts.

Microsoft's public cloud computing platform, Azure, was recently targeted by a cyberattack that led to a multi-hour outage. While a newly announced mandatory two-factor authentication login ...

A sophisticated phishing campaign is targeting organizations that rely on Microsoft’s Active Directory Federation Services (ADFS), using spoofed login pages to harvest credentials and bypass ...

CISA explains how to activate this security factor to protect personal accounts, with an identity confirmation method.

A vulnerability in Microsoft’s Multi-Factor Authentication (MFA) system has left millions of accounts susceptible to unauthorized access. Exploited successfully, the flaw could allow attackers to ...

What is the difference between "Authentication" and "Authorization"?Chapter 2: Why can't passwords alone protect you?Chapter ...

Last time, I wrote about how one layer of security is missing. Today, I'm talking about a state where that layer is only half ...