Cyber Security
Identity is where authorisation decisions are made and where most intrusions now begin. This domain covers workforce, customer, machine and autonomous-agent identity - issuance, authentication, entitlement, elevation, certification and revocation.
What we deliver
Every engagement is scoped to your environment - deploy a single capability or the full stack.
One coherent identity plan across the directories, tenants and clouds the organisation accumulated.
One centrally revocable login across the application estate, including the awkward legacy tail.
Authentication that survives the adversary-in-the-middle kits currently in circulation.
No standing administrative access anywhere, with every privileged session accounted for.
Joiner, mover and leaver handled by process and event rather than by ticket and memory.
Registration and sign-in that is fast, resistant to abuse, and lawful in every market you sell in.
Service accounts, tokens and workloads brought under the same lifecycle discipline as people.
Autonomous agents get registered identities, bounded authority and an auditable chain of delegation.
Catch the intrusion that arrives holding valid credentials and a valid token.
Close the escalation paths every operator finds first, and be able to rebuild if they are used.
Right-size the tens of thousands of cloud permissions nobody has ever reviewed.
Technical deep dive
Applies to every organisation using federated sign-in with push or one-time-code MFA - the technique is commodity, sold as a service, and works against any factor a user can relay.
What this is
An identity control plane where the credential is bound to the origin and the device, the issued token is bound to the client that requested it, and post-authentication behaviour is monitored as its own detection surface. The design assumes the user will be phished and removes the value of what the phishing captures.
The problem being solved
A reverse-proxy phishing kit sits between the user and the real identity provider. The user sees a genuine sign-in page because it is the genuine sign-in page, proxied. They enter the password; the proxy relays it. The provider sends an MFA challenge; the user approves it. The provider issues a session token; the proxy captures it and replays it from its own infrastructure. Every control reports success: correct password, satisfied MFA, valid token. The attacker is now inside the session, and the first material action is usually a mailbox rule and an OAuth grant that survives a password reset.
Why it is hard
Reference architecture - step through it
policy: workforce-signin
authentication:
allowed_methods: [webauthn_platform, webauthn_roaming, cert_based]
disallowed: [sms, voice, push_approve, totp] # all user-relayable
legacy_protocols: blocked # no basic-auth fallback
factor_registration_requires: existing_phishing_resistant_factor
token:
binding: client_key_required # stolen token is non-portable
access_token_lifetime: 15m
refresh_binding: device_key
continuous_evaluation:
revoke_on: [risk_elevated, device_noncompliant, account_disabled,
network_change_to_untrusted]
conditional_access:
- if: {app_class: privileged, action: any}
require: [phishing_resistant, compliant_device, jit_elevation]
max_session: 8h
- if: {device_state: unmanaged}
require: [phishing_resistant, browser_isolation]
block: [file_download, token_persistence]
detections: # post-authentication, high fidelity
- id: IDN-011 on: mailbox_rule_created
where: action in [delete, move_to_rss, forward_external]
severity: high respond: contain_identity
- id: IDN-014 on: oauth_grant_created
where: scope contains [Mail.ReadWrite, offline_access]
and publisher_verified == false
severity: high respond: revoke_grant + contain_identity
containment_playbook: # order matters - reset alone leaves persistence
1: revoke_refresh_tokens
2: terminate_active_sessions
3: remove_attacker_registered_factors
4: revoke_oauth_grants_created_in_window
5: delete_malicious_inbox_rules
6: force_credential_resetMeasured change
| Measure | Before | After |
|---|---|---|
| Relayable authentication factors in use | 3 (push, code, SMS) | 0 |
| Value of a captured session token | full account access | non-portable, bound to client key |
| Mean time to contain a compromised identity | 4.5 hours | under 60 seconds, automated |
| Persistence artefacts surviving containment | typically 2–3 | 0 - playbook removes before reset |
The design stops trying to prevent the user from being phished, which is a losing objective, and instead removes the value of everything the phishing captures.
Schedule a free consultation and our team will connect within 12 hours to understand your environment and map out the right approach.
We respond within 12 hours