Avatier

14h

FBI and CISA say Akira ransomware actors got in through VPNs that had no MFA configured, mostly by exploiting known vulnerabilities. Enforce MFA on every VPN and remote access account, and patch fast. https://attackcost.com/en/threat-actors/akira

Privilege creep: access that piles up with each job change. A Sept 2022 DHS OIG audit found USCIS had no process to adequately verify access after staff moved offices. Review access at every role change. Avatier's Access Governance automates it. https://attackcost.com/en/glossary/privilege-creep

CISA says Black Basta affiliates flooded inboxes with spam, then called posing as tech support. Hang up and call your help desk back on a number you know. Avatier's Assisted Reset routes MFA to the user, not the agent. https://attackcost.com/en/threat-actors/black-basta

Offboarding gap: the main login is off, but app accounts and tokens stay live. Block said in an April 2022 SEC filing that a former employee downloaded reports after their employment ended. Deprovision every app from the HR exit event. https://attackcost.com/en/glossary/offboarding-gap

A weak password gets blocked at the domain controller before it's ever saved. Each new password is checked against your policy, common-password lists and known breaches as it's set. Covers AD, Entra ID and legacy systems. credentialgovernance.com

Orphaned account: no valid owner, still active. CISA and MS-ISAC said in Feb 2024 that a state government organization found documents had been accessed through a former employee's compromised account. Give every account a named owner. https://attackcost.com/en/glossary/orphaned-account

FBI and CISA, citing public reporting, say Scattered Spider actors posed as employees to get help desks to reset passwords and move MFA to devices they control. Verify every caller before a reset or MFA change. https://attackcost.com/en/threat-actors/scattered-spider

Imagine an airline billing you for a seat every day, whether you fly or not. That's how enterprise software has been bought for decades. With Avatier Identity Anywhere 2027, you pay per verified Secure Outcome: a reset done, an account unlocked. No outcome? No charge. Pay for the destination.

MFA fatigue: the attacker has the password and keeps sending prompts until a tired user taps approve. Citing public reporting, CISA and the FBI said Scattered Spider did this to employees. Stop it: phishing-resistant MFA or number matching. https://attackcost.com/en/glossary/mfa-fatigue

A friendly call to the help desk can get around your password policy. That's vishing. Verify callers with what an attacker can't look up: a push to their existing authenticator or a callback to a number on file. Privileged resets need a second approver. https://attackcost.com/en/glossary/vishing

Keeping a leaver's access open "just for the handover" is common. CrowdSec shared how it went wrong. Malware stole a former developer's tokens and his account pulled private repos. Give every exception an end date and an owner, and revoke tokens with the account.

Smishing is phishing by text. In April 2024 the FBI's IC3 said it had over 2,000 complaints since early March about texts posing as road toll services in at least three states. Phishing-resistant MFA means a password typed into the fake page isn't enough. https://attackcost.com/en/glossary/smishing

Is your identity management solution costing you more than one FTE? Licenses, renewals for users who left, consultants, help desk hours, resets. Avatier: month-to-month billing, Pay Per Identity Action™, run from Copilot, Claude or ChatGPT. Keep what works. Pay for what gets done.

Rate my password: Password1, Pumpkin2026!, or my cat's name and birthday? Pumpkin2026! looks tough but falls fast: word + year + ! is one of the first patterns attackers guess. Four random words beat all three. Test a made-up one: https://credentialgovernance.avatier.com/en/password-firewall

A boarding pass isn't proof you arrived. Identity has the same kind of steps: a request submitted, a workflow started, a login attempted. None of them mean the job got done. A Secure Outcome asks: did it land, and can you prove it? That's what Identity Anywhere 2027™ is built around.

Imagine an airline reserving 50,000 seats for you every day, then billing for all of them, whether anyone flies or not. That's how identity software gets bought: licensed users, not completed work. Identity Anywhere 2027™ charges for Secure Outcomes instead. Empty seats shouldn't be the metric.

Phone-based MFA on employees' personal phones costs taxpayers. Illinois makes cities, counties and school districts reimburse required personal-phone use. The Avatier Identity Challenge Card drops the phone requirement. Free to start. Watch the video here ->> https://youtu.be/n2K8yLz7Eus

Another episode of Call Center Karen. Karen gets a call from "IT Help Desk." Caller ID says so, so it must be true. The CISO tries to explain vishing and quishing. Karen isn't having it. It's a cartoon, but the call is real.

This week Astrana Health disclosed in an SEC 8-K that attackers impersonated staff and spoofed the company's main phone number while calling employees. Most people who fall for these calls aren't Karens. The number looks right and the voice sounds like IT.

Training asks every employee to win every call. Better rule: IT never calls asking for credentials. Hang up and ring the desk back, and let the desk check who you are with our Identity Challenge Card. https://identitychallengecard.avatier.com/en

Every headline says AI is returning nothing. We pointed one at license data instead of chat windows. It found the seats you pay for that nobody logs into.

This flips our own pricing too, which we sat with for a while. It only holds up if every action shows on a ledger you can inspect. If we can't point to the line item, we probably shouldn't be charging for it.

The savings part you can test right now. Point the AI at your license data through MCP and get the idle list back. Details here: https://ia2027.avatier.com/

Every headline says AI is returning nothing. We pointed one at license data instead of chat windows. It found the seats you pay for that nobody logs into.

Per-seat pricing hides this by design. The invoice counts who could log in. Whether anything actually happened never shows up. So idle spend and productive spend look identical on paper.

Which is why we're moving identity to pay per action. A password reset, a provisioning run, an access review. You pay when the action executes. An idle seat costs you nothing.

Every headline says AI is returning nothing. We pointed one at license data instead of chat windows. It found the seats you pay for that nobody logs into.

The MCP connection is the boring part that makes it work. It lets the AI read actual assignments across your apps. Last login, who holds what, which licenses moved this quarter.

First run on our own stack was uncomfortable. Uncomfortable is soft, honestly. Embarrassing. Seats for people who changed roles a year ago. A tool bought for a project that ended. Still billing.

18 Sept

Last of four on MFA by moment, and it is the one I would lead with if I only got one. Unlock and password reset is the moment the user is locked out. Which is the moment your authenticator app is least likely to be reachable. The phone is dead, or lost, or on a desk in another building.

And it does not fall over quietly. It falls over into someone's queue. So the requirement inverts. Everywhere else you want the strongest factor the user can hold. Here you want the strongest factor that does not depend on anything currently broken. Above: prove first, then change.

18 Sept

The reset waits on a coordinate off the printed card and a private PIN. A printed grid in a wallet has no battery, no network, no session and no app store. Pick per moment, not per company.

The laptop will not let them in. The app that proves who they are lives behind the login they cannot complete. A factor that sits behind the door it is supposed to open is not a factor. It is a dependency. The failure here is not a breach. It is a person standing at a desk not working.

17 Sept

Third of four on MFA by moment. Passwordless login. The test: if the password still works when the passwordless path fails, you did not go passwordless. You added a second door and left the first one unlocked. Attackers do not queue at the new door. This is the highest-volume moment in the set.

And friction compounds. Four seconds once a quarter is invisible. Four seconds on every login for every employee is a line item. Biometrics win this moment on devices that already have the sensor. The honest catch: none of this reaches the user with no device to be passwordless on.

17 Sept

That user is not an edge case. They are a shift. Which is why the list has a printed card on it. Above: a shared workstation. Password accepted, then a coordinate off the printed card and a private PIN, with directory identity resolving on its own. Pick per moment, not per company.

Every user, every day. Two things follow from that. Phishing resistance matters more here than anywhere else, because volume is what attackers fish in. FIDO2, WebAuthn and hardware keys bind the credential to the site. A convincing replica of your login page gets nothing worth having.

16 Sept

Second of four on MFA by moment. Account verification. A help desk agent picks up. Someone says they are locked out, and the agent has about a minute to decide whether the voice is who it claims. Most shops text a code to the caller's phone.

It has to survive a new hire on day one. A contractor whose phone is not a company asset. A frontline worker who cannot carry a phone into the area. And the caller who could be anyone. The Identity Challenge Card puts the question somewhere else. The agent reads a coordinate.

16 Sept

The caller reads back the word in that square. That value is spent once it is used. Above: the card mid-challenge, one square spent. Never online, never on a device. Knowledge questions can be researched. The service desk has been carrying that risk for years. Pick per moment, not per company.

That works right up until the phone is the thing the attacker already controls. Account verification is the moment where the user has nothing yet. No session. Often no enrolled device. Whatever proves them has to work from a standing start. That is what separates it from login.

15 Sept

"Which MFA do you support?" is the question we get asked. It is the wrong one. The list matters less than the moment. Three moments, three different problems. 1. Account verification 2. Passwordless login 3. Unlock and password reset Most rollouts stall because one method got picked for all three.

Printed Challenge Card, no phone or app needed. OTP. Biometrics. FIDO2, WebAuthn, YubiKey, RADIUS, Entra ID via OIDC. One method chosen for all three will be wrong twice. That is why the integration list is long on purpose. First of four. The next three take one moment each, with a short video.

15 Sept

Pick per moment, not per company.

Verification has to work for someone with no session and sometimes no device. Passwordless is the everyday path, so phishing resistance leads: FIDO2, WebAuthn, hardware keys, biometrics where the device already has them. Unlock and reset is the interesting one.

15 Sept

The user is locked out, which is exactly when the authenticator app is least likely to be reachable. A factor that lives behind the login you cannot complete is not a factor. Avatier runs all three off one policy engine, and it does not care whose authenticator you already bought.

10 Sept

Federation is a trust decision, and most teams never write down what they are actually trusting. Sign-in through an outside identity provider means trusting that provider's claim that the person controls the email address.

This class of failure is common for a boring reason. A federated integration gets built once, and the assumption underneath it never becomes anyone's standing job. The trust holds until the other side changes something.

10 Sept

It is knowable in advance. List every identity provider your systems accept and count what each one can reach, which turns a vague worry into a number. We built a calculator for what that would cost. https://attackcost.com/en

If that claim can be manufactured, the provider becomes a second front door into every account registered to the same address.