Identity & Access

Identity is now the perimeter. Remote work killed the network-based one. Every breach report for the last five years starts with a compromised credential — almost always one without MFA on something old that 'we were going to migrate.'

The VDI gateway, the RDP jump box, the legacy CRM with no SAML support — these are where attackers spend their time. The organizations that patch this systematically are the ones that don't appear in the quarterly breach headlines.

MFA on every VDI entry point, every RDP gateway, every legacy app — with the method chosen per risk profile, not by what's cheapest. SSO for the 40 line-of-business tools that never got modern auth.

Adaptive policy that tightens for privileged users and relaxes for low-risk ones. One identity provider as source of truth, federating to everything downstream. FIDO2 keys for admins and push MFA for everyone else, managed from one console.

MFA everywhere except the last mile — the legacy app, the vendor portal, the on-prem admin interface — which is exactly where the attacker lives. Helpdesk calls from users bouncing between six unrelated login screens, reusing the same password because it's the only way to function.

Audit findings every year for the same service account that never got rotated. A 'zero-trust' project that stalled because three apps couldn't be federated and nobody wanted to rewrite them.