Skip to main content
Vol. I · No. 1

The Identity at the Core

The Definitive Chronicle of Identity & Access Management

Breach: BREACH: Major healthcare provider confirms 2.3M patient records exposed via misconfigured SCIM endpointVulnerability: CVE-2026-31847: Critical RCE in FortiAuthenticator — CVSS 9.8 — Patch immediatelyBreach: BREACH: European fintech platform leaks OAuth tokens affecting 890K usersAdvisory: ADVISORY: CISA warns of active exploitation of SAML implementation flaws in enterprise SSO productsBreach: BREACH: Major healthcare provider confirms 2.3M patient records exposed via misconfigured SCIM endpointVulnerability: CVE-2026-31847: Critical RCE in FortiAuthenticator — CVSS 9.8 — Patch immediatelyBreach: BREACH: European fintech platform leaks OAuth tokens affecting 890K usersAdvisory: ADVISORY: CISA warns of active exploitation of SAML implementation flaws in enterprise SSO products

BREACH: Major healthcare provider confirms 2.3M patient records exposed via misconfigured SCIM endpoint

CVE-2026-31847: Critical RCE in FortiAuthenticator — CVSS 9.8 — Patch immediately

BREACH: European fintech platform leaks OAuth tokens affecting 890K users

Topic

MFA & Passwordless

Phishing-resistant authentication. Passkeys. The end of "remember 47 passwords".

Multi-factor authentication is the single most effective control against credential-stuffing and phishing — when implemented with phishing-resistant factors. SMS-based MFA, push-notification fatigue MFA, and TOTP-only MFA have all been bypassed at scale (LAPSUS$, Scattered Spider, the wave of MFA-fatigue attacks against Microsoft Entra in 2022-2024). The current bar is FIDO2 / WebAuthn — passkeys, security keys, platform authenticators — which are bound to the legitimate site origin and cannot be relayed by a man-in-the-middle.

Passwordless is the natural next step: replace the password (something you know) with cryptographic proof of possession (something you have) plus user verification (something you are). Apple, Google, and Microsoft have all shipped synced passkeys; FIDO2 hardware tokens still cover the highest-assurance use cases. The hard parts of rollout are recovery flows (what happens when a user loses their device?), legacy-app coverage (the long tail of SAML and OIDC apps that need step-up), and admin / privileged user enrollment.

This page tracks our reporting on phishing-resistant MFA, passkey deployments, MFA-bypass attack analyses, and the state of FIDO2 in the enterprise.

Coverage

No posts yet under this topic.

We're writing. In the meantime, follow our breach feed or CVE dashboard for live intelligence.

Related topics