Non-profit · open · built by practitioners
Free lessons, attack breakdowns and honest tool reviews from the identity security community. Sourced, dated and free of sponsorship.
Learn
Each path strings together guides, standards pages and glossary entries already on the site, in the order we would read them. Start anywhere; nothing is gated.
Learn it in a minute
Six steps between you, an identity provider and the app. Each one has a glossary entry, and each one is a place attackers aim for.
The app does not check your password itself. It sends your browser to the identity provider it trusts.
Glossary: Identity provider →You prove the first factor: a password, or better, a passkey bound to this site.
Glossary: Passkey →A second factor, ideally phishing-resistant, so a stolen password alone is not enough.
Glossary: MFA →An ID token says who you are. A separate access token says what the app may do for you.
Glossary: ID token →It verifies the signature, the audience and the expiry before it trusts a single claim.
Glossary: Access token →The app sets a session cookie. Steal that cookie and every step above is skipped.
Glossary: Session hijacking →Updated every day
Binance said on October 30 that attackers used a DevOps engineer's compromised laptop to reach a service container and submit unauthorized withdrawals, moving about $6.3 billion on October 29. TRM Labs attributes the theft to North Korea's TraderTraitor; about $2.7 billion was frozen.
Affects Ivanti Connect Secure. Disclosed Oct 13, 2026.
The digest · Issue 19
A LiteLLM admin key deleted in May but never revoked led to a poisoned release in October, Storm-0940 turned consented ConnectWise app identities on 2,250 Microsoft 365 tenants, Gheist dumped GitHub secrets through Actions logs, and Arctic Wolf counted 400-plus fake help desk chats on Teams.
Get it every week, free →
Non-profit and open
Start with Identity is written and reviewed by volunteer practitioners. There is no sponsorship and no paid placement, and everyone who contributes is credited.
Every guide, brief and profile is open. No paywall, no signup wall.
Spot something wrong or missing? Tell us, or write it with us.
Shipped work carries your name and a contributor profile.
Your name goes here when your first contribution ships. How credit works
Public figures we profile in our experts directory. They are not members of this community and their profiles are not endorsements of it.
Sourced, dated and vendor-neutral.
Highest scored
Against our published capability matrix
Identity security, by the numbers
of breaches start with stolen credentials
Source: Verizon DBIR 2026 ↗machine identities outnumber humans
Source: Palo Alto Networks 2026 Identity Security Landscape ↗passkeys are now in use worldwide
Source: FIDO Alliance 2026 ↗of identity attacks blocked by phishing-resistant MFA
Source: Microsoft Digital Defense Report 2025 ↗Join free
This Week in Identity: the breaches, standards and vendor moves that matter, with sources linked. Free, no sponsorship, and every past issue is public.