4 min read
Auth0’s Detection Catalog Ships the Queries and Leaves You the Hard Part
Auth0's open-source detection catalog provides pre-built threat queries for SOC teams. The rules are useful, but only after you build the log…
Identity & Security
6 min read
The Management API key in your .env is dead. Scoped agent tokens won.
Auth0's new MCP server lets Claude Code call your Management API with scoped, short-lived tokens instead of static secrets. Here's how to…
7 min read
Phishing-Resistant Auth Beats Detection in Okta Hotelier Attacks, But Only One Ships Today
When attackers specifically target hospitality Okta accounts with adversary-in-the-middle phishing, you face a strategic choice: the control that actually prevents credential theft,…
8 min read
Three Things That Broke When a Malicious MCP Server Asked Your Client for a Token
Anthropic's MCP Python SDK shipped with a flaw that let malicious servers extract OAuth credentials during connection setup—no prompt injection required. If…
4 min read
If Your Phishing Defense Is a Blocklist, VoidProxy Already Won. So What’s Actually New?
VoidProxy fingerprints every request before deciding what to serve. Security scanners see benign content; real users get a live credential-stealing proxy. By…
6 min read
Storm-3068 Turned One Developer Login and a Pipeline Secret Into Azure Control
A single compromised developer account gave Storm-3068 access to source code, then pipeline secrets, then cloud credentials, and finally control of Azure…
6 min read
SOC 2 Was Already the Pooled Audit. We Just Forgot to Use It.
Okta customers are now pooling resources to fund shared SOC 2 audits of integration vendors. The first year proved the concept works—and…
7 min read
I tested Entra’s new native-to-webview SSO. Here’s which handoff actually wins
Nothing tanks a checkout funnel like forcing users to log in twice. Microsoft's new GA feature passes native app sessions to embedded…