your tools keep getting access. who's keeping track?

who's inside your company right now?

Usually not who you think. These are the four this publication keeps finding.

• the people who left

  Accounts, sessions and shared logins that outlived the job.

  identity and lifecycle

• the apps you clicked Allow on

  OAuth grants still reading mail, calendars and drives months later.

  AI and data

• the admins nobody remembers

  Temporary rights that became permanent, in the systems that matter most.

  access and permissions

• the tools nobody approved

  SaaS on a card and AI tools wired into company data without an owner.

  process and ownership

start here

• access & permissionsaccess debt: why permissions outlive their purposeEvery permission is granted for a reason. The reason ends, the permission stays. What that looks like in a company without a security team, why nobody catches it, and the one review that pays most of it down.
• identity & lifecycleday one, already too muchaccess creep starts before the first coffee of the first day.
• identity & lifecyclethe reorg nobody deprovisionedevery organizational change is a mass mover event. none of them trigger mass deprovisioning.
• identity & lifecyclethe contractor who's been gone for eight monthsemployees get offboarded. contractors get forgotten.
• identity & lifecyclethe identity you can't offboardhumans come and go. service accounts are forever.
• identity & lifecyclethe token that lives foreveryour SSO logout doesn't log anyone out. it just clears a cookie.

all 25 guides →