Blog — Field notes on identity security

The blog 01

Field notes from the identity frontier.

Breach teardowns, threat research and product dispatches from the team stopping identity attacks in production — written for the people who get paged.

Latest dispatch

Security·Jun 1, 2026

Analysis of the 2026 Stryker Breach: Weaponizing Cloud Endpoint Management

On March 11, 2026, attackers turned Stryker Corporation's own Microsoft Intune device-management plane into a non-encrypting wiper, factory-resetting roughly 200,000 endpoints across 79 offices worldwide without dropping a single piece of custom malware. This analysis reconstructs the Living-off-the-Land attack chain — from infostealer logs and AiTM session theft through privilege escalation to the Intune control-plane pivot — and shows how SlashID's MITM/AiTM detection, phishing-resistant authentication, behavioral anomaly detection, and just-in-time privileged access stop it.

Vincenzo Iozzo
Co-founder & CEO

Read the analysis →

Analysis of the 2026 Stryker Breach: Weaponizing Cloud Endpoint Management

// security · Jun 1, 2026

61 dispatches

Field notes from the identity frontier.

Analysis of the 2026 Stryker Breach: Weaponizing Cloud Endpoint Management

Vercel April 2026 Security Incident: How a Compromised OAuth App Led to a Major Breach

Deepfake Impersonation Attacks (Part 2): Defending with SlashID Mutual TOTP

Deepfake Impersonation Attacks (Part 1): Anatomy of Modern Deepfakes

NYDFS 2026 Vishing Advisory: Detection and Defense with SlashID

Scattered Spider Tradecraft: Identity Abuse, Attack Flow, and Defense

Microsoft Actor Token Forgery

Access tokens strike again, the Salesloft Drift breach

Illicit Consent-Granting & App Backdooring – Obtaining persistence in Entra

Achieving Least Privilege: Unused Entitlement Removal

Protecting against malicious OAuth 2.0 applications

Navigating PCI DSS 4.0: The Challenge of Non-Human Identities

Identity Security: The problem(s) with federation

Non-Human Identities Security: Breaking down the problem

Detecting Man-in-the-Middle Attacks with SlashID

A deep dive in the AWS credential leaks reported by Palo Alto Networks

SlashID RBAC: Globally-available role-based access control

Protecting against Snowflake breaches

Introducing the SlashID Local Deployment

ODPR: A Framework for Securing Non-Human Identities

Credential Tokenization: Protecting third-party API credentials

Secure API and M2M Access with OAuth2 Client Credentials and SlashID's sidecar

Introducing Organization Attributes

Introducing Anonymous Users: Balancing First-Party Data Collection and User Experience

SlashID SDK for PHP and Laravel authentication

Adding custom claims to identity tokens

SlashID: Building a globally distributed Identity Platform

Passkeys Adoption Trends: Survey from Large Deployments

Single Sign-On implementation: Safely retrieving the email claim

Single Sign-On implementation: Security Issues and Best Practices

Introducing the SlashID Remix SDK: Authentication made easy

Firebase Authentication and Google Identity Platform User Enumeration Vulnerability

GDPR Compliance: Consent Management

OAuth 2.0 Fine-Grained API Authorization with Gate and OpenAPI

Rate Limiting for Large-scale, Distributed Applications and APIs Using GCRA

Context-aware authentication: fight identity fraud and qualify your users

Backend Authentication and Authorization Patterns: Benefits and Pitfalls of Each

JWT Implementation Pitfalls, Security Threats, and Our Approach to Mitigate Them

No-code anti-phishing protection of internal apps with Passkeys

Firewalling OpenAI APIs: Data loss prevention and identity access control

Ditch your organizations table

Protecting Exposed APIs: Avoid Data Leaks with SlashID Gate and OPA

Docusaurus - Authentication and authorization with SlashID

Authenticate your Shopify customers with SlashID

Synchronous Webhooks

Building a React Login Page Template

SlashID Analytics Webhooks

Passkeys - Threat modeling and implementation considerations

Authentication flows with SlashID

Using Google Tink to sign JWTs with ECDSA

React SDK support for <Groups>

Sign-in and Sign-up React component release

Fetching Google Groups with SlashID SSO

In-browser HSM-backed Encryption with Tink and Wasm

Official React SDK release

Adding Identity to Docusaurus

Introducing Data Vault - Secure HSM-backed PII storage directly from the frontend

Social logins in 5 minutes or less

App-layer cryptographic primitives for secure storage of user data

The good, the bad and the ugly of Apple Passkeys

The Security and Regulatory Compliance Benefits of WebAuthn

Phishing Attacks – WebAuthn to the rescue

Get the dispatch in your inbox.