Understand who and what has access before it becomes a risk.
Continuously surface the risks that actually matter.
Reduce risk and operational load at the same time.
with browser phishing prevention, shadow app discovery, and granular access controls.
using 500+ built-in detections across your identity graph—no custom rules needed.
enforce MFA, suspend users, rotate credentials via your SIEM/SOAR.
Retire dormant identities and right-size unused entitlements before they become audit findings or attacker footholds.
Prevent phishing in the browser. Verify users for help-desk calls to stop vishing and deepfake attacks.
Connected view of users, non-human identities, and AI agents across environments. Continuously check configurations against compliance frameworks and fix violations for PCI-DSS, SOC 2, ISO 27001, and more.
500+ ready-to-use detections deliver the most comprehensive coverage of active threats and misconfigurations coupled with automated remediation actions.
Complete inventory of AI usage across SaaS and Cloud. Visibility & control over permissions & data access.
Discover unsanctioned SaaS apps and enforce access controls.
Actor Token Forgery is one of the many techniques adopted by attackers to escalate privileges and move laterally via identity vector. This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.
In mid‑August 2025, GTIG confirmed a large‑scale credential‑harvesting and data‑theft campaign abusing trusted OAuth integrations (Drift) to access Salesforce orgs. Attackers (UNC6395) used stolen Drift OAuth tokens to mass‑query Salesforce, mine embedded secrets (AWS, Snowflake), and pivot into connected platforms. This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.
Attackers are increasingly targeting Entra ID by silently injecting high-privilege OAuth grants and backdooring enterprise apps—achieving persistence without user interaction. This blog provides a technical deep dive into the full attack lifecycle - initial access, consent injection, privilege escalation, and evasion. We map each stage to MITRE ATT&CK, show real-world Graph API and CLI techniques, and outline concrete detection signals and hardening practices for defenders.
