who's inside?
25 guides to the access nobody is watching.
Grouped by who's inside: the people, the apps, the AI, the platforms and the evidence. Every guide explains one mechanism and ends with an exercise you can run on Monday. About 4 hours of reading in total, so start with the series closest to your problem.
if you read one
series A · 5 guides
the people.
Joiners, movers, leavers and the identities that never had a start date: contractors, service accounts and the tokens they leave behind.
- day one, already too muchaccess creep starts before the first coffee of the first day.you'll do Shrink the default bundle for your largest role.
- the reorg nobody deprovisionedevery organizational change is a mass mover event. none of them trigger mass deprovisioning.you'll do Remove last year's reorg leftovers.
- the contractor who's been gone for eight monthsemployees get offboarded. contractors get forgotten.you'll do Find the contractors who are gone but still inside.
- the identity you can't offboardhumans come and go. service accounts are forever.you'll do Disable the service accounts that do nothing.
- the token that lives foreveryour SSO logout doesn't log anyone out. it just clears a cookie.you'll do Check whether your leavers' tokens still work.
series B · 4 guides
the apps.
The SaaS nobody approved, the connected apps nobody remembers, and what an acquisition quietly adds to your stack.
- the acquisition gave us 40 new adminsevery M&A closes a deal and opens an identity problem.you'll do Audit what your last acquisition left behind.
- the SaaS list is a finance exportthe CFO can answer the question IT and security can't.you'll do Get the real SaaS list from finance.
- salesforce has thirty connected apps you can't nameyour CRM is an identity provider you didn't realize you ran.you'll do Clean up connected apps in your five most sensitive platforms.
- the shadow IT that IT builtthe tool nobody approved was purchased by the head of IT.you'll do Reconcile what IT remembers with what IT runs.
series C · 4 guides
the AI.
Assistants, agents and search indexes that read what your permissions allow, which is usually more than anyone intended.
- shadow AI is the fastest-growing shadow IT in historyin 2024, shadow IT took a year to show up on finance reports. AI takes a week.you'll do Write the one-page AI use policy.
- the agent had your permissionsagentic AI inherits the identity it runs under. that identity probably has too much.you'll do Find out which identity each of your agents runs as.
- what your RAG index actually indexedthe vector database is a copy of your data, stripped of the permissions.you'll do Test whether your AI search leaks restricted documents.
- embeddings are not encryptionthat vector you think is opaque can be inverted back into text.you'll do Classify every vector database by what went into it.
series D · 3 guides
the platforms.
GitHub, Salesforce and SharePoint: three systems where access piles up in layers nobody can read in one place.
- github is your identity surfaceevery developer has more access at your company than your most senior exec.you'll do Run a GitHub identity audit.
- the profile creep nobody talks aboutsalesforce has eleven permission types. your admin uses three of them.you'll do Untangle who can do what in Salesforce.
- sharepoint is a graveyardthe document from 2019 is still there. so is the sharing.you'll do Clean SharePoint before Copilot reads it.
series E · 4 guides
the evidence.
What audits, tool counts and old firewall rules say about your security, and what they leave out.
- the SOC 2 report doesn't mean what you thinkyour vendor passed an audit. your vendor was not made secure.you'll do Read five vendors' SOC 2 reports in full.
- 47 tools, and no saferthe security stack is bigger than ever. breach counts are higher than ever.you'll do Ask four questions about every security tool.
- the only number that matters is blast radiusevery metric in your security dashboard misses the one that predicts the breach.you'll do Put eight blast radiuses on one slide.
- nobody remembers why that rule existsthe last admin left three years ago. the firewall rule they wrote is still there.you'll do Explain or remove one category of mystery artifacts.
essays · 4 guides
the long reads.
Four essays on the ideas underneath the series: stayers, real inventories, AI as an accidental audit, and security as a measurement problem.
- promoted three times. access revoked zero timesoffboarding is the visible problem. role accumulation is the bigger one.you'll do Map the access of your longest-tenured engineer.
- three lists. three numbers. none of them realwhy the real SaaS inventory lives in finance.you'll do Count your SaaS four ways.
- copilot just read your ghost accountsAI didn't break your security. it surfaced what was always broken.you'll do Ask the assistant what a senior leader can find.
- security is a measurement problemwalls keep failing. ledgers don't. accountants figured this out in 1494.