Non-profit · open · built by practitioners
Free lessons, attack breakdowns and honest tool reviews from the identity security community. Sourced, dated and free of sponsorship.
Learn
Each path strings together guides, standards pages and glossary entries already on the site, in the order we would read them. Start anywhere; nothing is gated.
Learn it in a minute
Six steps between you, an identity provider and the app. Each one has a glossary entry, and each one is a place attackers aim for.
The app does not check your password itself. It sends your browser to the identity provider it trusts.
Glossary: Identity provider →You prove the first factor: a password, or better, a passkey bound to this site.
Glossary: Passkey →A second factor, ideally phishing-resistant, so a stolen password alone is not enough.
Glossary: MFA →An ID token says who you are. A separate access token says what the app may do for you.
Glossary: ID token →It verifies the signature, the audience and the expiry before it trusts a single claim.
Glossary: Access token →The app sets a session cookie. Steal that cookie and every step above is skipped.
Glossary: Session hijacking →Updated every day
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.
Affects Ivanti Connect Secure. Disclosed Oct 13, 2026.
The digest · Issue 17
Shai-Hulud reaches an AI sandbox SDK with a wiper that fires when you revoke the stolen token, npm trusted publishing trusted reclaimable repository names, Denmark's national register was emptied through one company's search account, and Workday moves to buy C1.ai.
Get it every week, free →
Non-profit and open
Start with Identity is written and reviewed by volunteer practitioners. There is no sponsorship and no paid placement, and everyone who contributes is credited.
Every guide, brief and profile is open. No paywall, no signup wall.
Spot something wrong or missing? Tell us, or write it with us.
Shipped work carries your name and a contributor profile.
Your name goes here when your first contribution ships. How credit works
Public figures we profile in our experts directory. They are not members of this community and their profiles are not endorsements of it.
Sourced, dated and vendor-neutral.
Highest scored
Against our published capability matrix
Identity security, by the numbers
of breaches start with stolen credentials
Source: Verizon DBIR 2026 ↗machine identities outnumber humans
Source: Palo Alto Networks 2026 Identity Security Landscape ↗passkeys are now in use worldwide
Source: FIDO Alliance 2026 ↗of identity attacks blocked by phishing-resistant MFA
Source: Microsoft Digital Defense Report 2025 ↗Join free
This Week in Identity: the breaches, standards and vendor moves that matter, with sources linked. Free, no sponsorship, and every past issue is public.