The fortnightly read for identity practitioners.
Clear breakdowns of the standards, tools and threats shaping the industry.
Views and interviews from identity practitioners doing the work.
What vendors are launching, what is changing and what is actually worth paying attention to.
THIS NEWSLETTER IS POWERED BY CLUTCH
The team tested 31 people using accounts across Google, PayPal and LinkedIn. The test was pretty simple. An attacker gets access to the account and adds their own Passkey, then the real user has to work out what happened and secure the account.
Not one of the 31 participants managed to completely secure it without help from the researchers.
The part that stood out to me was how many people changed their password and thought they were done. Which makes complete sense when we have spent years telling people that if their account is compromised, the first thing they should do is change their password.
The problem is that changing the password does not necessarily remove a Passkey the attacker has already added. So somebody can follow what they think is the correct security process, change their password and still leave the attacker with another way back into the account.
The researchers called these "false finishes".
People also struggled to work out which Passkeys belonged to them, where active sessions were sitting and even where they needed to go inside the account to fix everything.
I don't think the takeaway is that Passkeys are bad. The Passkey itself is generally still doing its job. The problem is more what sits around it.
We have now covered Passkey enrolment attacks, poor implementations, account recovery problems and compromised devices across the last few issues and the same thing keeps coming up. Authentication has moved forward pretty quickly, while a lot of the processes around it haven't.
Join over 100 identity leaders from across the world on our Identity Leaders Network WhatsApp Group.
Microsoft published a pretty interesting incident this fortnight involving Storm 3168 and compromised Azure service principals.
One of the compromised identities spent more than 15 hours looking around the environment before the destructive activity started. Once it did, the attacker attempted to delete more than 100 Azure Storage accounts in around seven minutes, with most of them successfully deleted.
They also deleted a Key Vault, Function App and App Service plan and attempted to delete SQL databases and recovery protections.
Seven minutes is probably the bit that should get the attention of Identity teams.
A lot of security processes still assume there is going to be time for somebody to see an alert, investigate what happened and then decide what to do. There wasn't much time for any of that here.
The attacker also did not need some brand new Azure vulnerability. The service principal already had the permissions, so once they controlled the Identity they could use the access it already had.
Microsoft found that credentials belonging to one of the service principals had previously been posted publicly in a GitHub issue as well. The issue was later edited, but the credential was still sitting in the edit history.
Microsoft couldn't confirm that this was how the attacker got access, but it is still a useful reminder that deleting a secret from GitHub does not actually revoke it. It keeps working until somebody rotates or revokes it.
Some of the controls that worked were also pretty basic. Resource locks and storage deletion protection stopped some resources being deleted even though the compromised Identity had permission to do it.
If one of your service principals was compromised today, do you actually know what it could do? And how quickly could you disable it?
We talked about attackers using AI Agents back in Issue #4 and this feels like the next part of that story. Whether all of this is fully autonomous or heavily automated probably matters less than the fact attackers can move very quickly once they get the right Identity.
IDPro also published a piece this fortnight looking at the OpenAI and Hugging Face incident. Most of the attention went to the AI models escaping their sandbox, while IDPro's view was that underneath it was a much more normal machine Identity problem involving shared credentials, reusable tokens, broad permissions and not enough individual attribution between workloads.
Obviously very different incidents, but a lot of the Identity problems are pretty similar.
Companies are creating more service principals, machine identities and AI Agents than ever, and a lot of teams still don't really know what all of them have access to or who owns them.
Microsoft has now put some pretty clear dates around retiring its own SMS and voice authentication in Entra.
From 1 February 2027, Microsoft provided SMS and voice authentication starts being retired for most users, with Global Administrators and external users following later in July.
That doesn't mean SMS completely disappears. Companies that still need it will be able to use an external telephony provider, but Microsoft is clearly trying to move users towards stronger authentication and Passkeys.
If somebody only has Microsoft SMS or voice registered, they will eventually be pushed to register a Passkey instead.
So how much are you still relying on SMS today?
How many users still have SMS as their main MFA method, how many recovery processes fall back to it and how many applications still assume it is going to be there?
Payments are moving in the same direction too.
Visa Payment Passkey has now gone live across five public sector banks in India, replacing OTP authentication with Passkeys for participating cardholders.
IDEMIA has also launched infrastructure for AI initiated payments where the person authenticates with a Passkey and the Agent gets a restricted payment token. That token can be limited by things like merchant, amount, category or time period.
I thought that was interesting because we have been talking about these as two separate problems for a while. How do you strongly authenticate the person, and how do you control what the Agent can do?
IDEMIA is basically putting both into the same transaction.
Citrix has patched CVE 2026 88779 affecting NetScaler deployments being used as a SAML Service Provider or Identity Provider.
The vulnerability can cause a denial of service and Citrix says it has been exploited against unpatched systems. This comes straight after another set of NetScaler vulnerabilities, so worth checking even if you patched recently.
SailPoint announced a pretty big set of Agent Identity capabilities at Navigate this week, including Agent discovery, temporary access, runtime authorisation, audit reporting and the ability to disable an Agent.
The Entro acquisition is also now being pulled into SailPoint's Agentic Fabric for things like credential discovery and secret lineage.
We have now seen Okta, SailPoint and quite a few others piling into this. Agent Identity is pretty quickly becoming an actual product category now.
Researchers have found fake AI tools impersonating ChatGPT, Gemini, Claude and other AI products.
The sites ask users to connect advertising accounts and then show fake login screens for services including Google, Meta, TikTok and Okta. A human operator can also control which MFA challenge the victim sees next, which makes the attack quite a bit more convincing.
So even with MFA turned on, the user can still be walked through handing over everything the attacker needs.
Dutch police have arrested a 24 year old man as part of an investigation into ShinyHunters.
The group itself has denied that he is connected to them, so I wouldn't read too much into the arrest yet. We have covered ShinyHunters quite a bit recently though, including the ReliaQuest social engineering incident, so worth keeping an eye on.
WorkOS pulled together three MCP authentication vulnerabilities disclosed over a 30 day period.
Different bugs, but WorkOS reckons they basically came back to the same problem. One system trusted authentication information coming from another system without checking it properly.
MCP authentication is moving very quickly at the moment and more companies are starting to connect Agents into real systems, so I suspect we are going to see quite a bit more of this.
Identity at the Center released episode #452 with Shea McGrew, CTO at Maricopa County, looking at what happens when Identity starts becoming critical infrastructure.
They talk through government Identity, privacy, consent, Digital Identity and how much trust people place in the systems governments build.
Authenticate U.S. 2026 takes place from 19–21 October in Carlsbad, California, with this year's program covering passkeys, Digital Identity and Agent authentication.
The Gartner Identity & Access Management Summit takes place from 7–9 December in Las Vegas.
And our Identity World 2027 series is now live, with five IAM events across Sydney, Melbourne, New York, London and San Francisco: Sydney – 18 February, Melbourne – 17 March, New York – 6 May, London – 16 June and San Francisco – 3 November.
One question I have seen coming up recently is how companies are blocking employees from signing into personal ChatGPT accounts while still allowing them to use the company's own environment.
It sounds like it should be pretty simple, but apparently it isn't.
If you have solved this, or even have something that mostly works, I would be interested to hear what you are doing.
Get in touch at danny@clutchgroup.co.
Identity Briefing is published fortnightly by Clutch Group, which runs the Identity Leaders Network, Identity Briefing and the Identity World events series.
Know someone who should be reading it? Forward this on.
The Identity Leaders Network is a free, global and vendor-neutral identity community.
The group comes together for virtual roundtable discussions, peer-matching meetings, dinners and through the community WhatsApp channel.
The fortnightly read for identity practitioners.
Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.
You're subscribed. Read the latest issue →