Can anyone enroll a replacement or recover an account without the employee's issued device? If yes, that's the gap. How attestation and hardware-bound FIDO2 close the help desk route Scattered Spider favors: hubs.la/Q04z_BkM0 #BiometricAuthentication #IdentitySecurity

An agent that prepares a wire transfer is valuable. One that executes it without proof a human approved it is a liability. Email, push and software credentials are all agent-traversable. Where biometric hardware completes Google’s governance layer: hubs.la/Q04z_x070

#Google built agent governance into Gemini Enterprise. It answers which agent can act and what it may do. It doesn't answer who approved the action. If an agent can approve another agent, it is not a human gate. hubs.la/Q04z_w_V0 #BiometricAuthentication #IdentitySecurity

Your #MFA policy is only as strong as your reset procedure. Scattered Spider often skips the login entirely. It calls the help desk and asks for a new factor. Recovery deserves the same scrutiny as sign-in. hubs.la/Q04zh06G0 #cybersecurity #NextGenMFA #IdentitySecurity

Cyber belongs in the boardroom. So does identity. Can our MFA be phished? Can account recovery or a help desk call bypass our strongest controls? Directors should be asking. Our perspective: hubs.la/Q04yWrLX0 #IdentitySecurity #cybersecurity #CredentialSecurity

Scattered Spider isn't beating #MFA. It's beating the reset button. Why account recovery needs the same phishing-resistant, hardware-bound proof as the login itself: hubs.la/Q04zg-0_0 #IdentitySecurity #PhishingResistant #CredentialSecurity

Codes, push and SMS verify that a challenge was completed. Not where it came from. Token requires the real domain, the device present, a live fingerprint and a hardware-signed challenge. How AiTM works, and how to stop it: hubs.la/Q04yz2sp0 #cybersecurity #PhishingProof

Most board cyber discussions assume the attacker is already inside. Increasingly, attackers don't break in. They log in. The governance question: what evidence do we have that the person accessing critical systems is the authorized person? hubs.la/Q04yWq-20

An attacker never has to defeat authentication when the legitimate user can be convinced to complete it. SMS codes. Push prompts. Authenticator apps. All end in a human decision made under conditions the attacker controls. Remove the decision: hubs.la/Q04y6TX-0

AiTM phishing kits now rent for $320 a month. The attacker relays your login in real time, MFA included, then keeps the session token. The password stops mattering. So does the code. Authentication has to be bound to the real domain. hubs.la/Q04yz2fG0 #cybersecurity

There probably wasn't an #Azure breach. Someone logged in. Millions of #Entra directory records reportedly for sale. Infrastructure intact. The platform authenticated the wrong person. Attackers rarely defeat #MFA. They get someone to complete it. hubs.la/Q04y6Tys0

Generative AI removed every signal phishing training taught employees to spot. Grammar. Formatting. Branding. Tone. There is nothing obviously fake about the message anymore. Training people to recognize what AI made unrecognizable is not a strategy. hubs.la/Q04y6Tkq0

MFA confirms someone completed the challenge. It cannot tell you it was the wrong person. Domain-bound credentials. A live fingerprint on dedicated hardware. Keys that never leave the secure element. How the Apollo attack worked: hubs.la/Q04xx1-l0

Firewalls, EDR, SIEM, threat intel all operate downstream of the login. Once an attacker is recognized as an employee, your team inherits the harder job. Why the Azure headlines are really an identity story: hubs.la/Q04xKypK0

Apollo wasn't hacked. Their own employees authenticated the attackers. Attackers impersonated internal IT. Employees entered credentials on a fake login page, then approved the MFA prompt. No exploit. No malware. Authentication was the attack. hubs.la/Q04xx1F90

Some IdPs accept assertions from credentials whose signature counter never advances. A copy signs alongside the original and nothing looks unusual. What enterprises should require for privileged access: hubs.la/Q04x4yrl0 #IdentitySecurity

#AI agents can recommend, prepare, and execute routine work. Irreversible actions get approved by a human — trusted device, biometric verification. Email confirmations, basic pop-ups, and second agents don't clear that bar. hubs.la/Q04xfYJ50

Your passkey is phishing-resistant. That does not mean you would know if it had been copied. Most synced passkeys return a signature counter of zero. Zero cannot regress. There is nothing to compare. Phishing resistance is not clone detection. hubs.la/Q04x4xQW0

They never got inside. They didn't need to. A DDoS campaign has disrupted Norway's national identity gateway since 3:38am Monday. Kevin Surace, Token CEO: "Keeping people from getting in is enough." hubs.la/Q04vsdsJ0

~850,000 files leaked from one water-sector supplier. "Protecting the water utility itself is only half the problem," says @Token CEO Kevin Surace. CISA's ask is the least glamorous one: get OT off the public internet when it doesn't need to be there. hubs.la/Q04vs02f0