identity - AlphaHunt Converge

deep

[DEEP RESEARCH] The account stealing your data may not be human

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

gametheory

[GAME THEORY] AI gateways are becoming the new IAM chokepoint

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.

weekly

[SIGNALS WEEKLY] Converging Threats Across SaaS, Web Edge, and OT

OAuth consent made SaaS data theft look normal. Niche web plugins kept handing attackers first doors. OT debug ports reminded everyone that “engineering access” can age into exposure.

forecasts

[FORECAST] TeamPCP shows why package cleanup is not containment

Supply-chain attacks are becoming access pipelines. The defender move is to follow credentials, not just packages.

weekly

[SIGNALS WEEKLY] Perimeter Pressure, Supply Chain Drift, and Identity Theft

The perimeter blinked. VPN portals and CI tokens are still doing incident cosplay.

weekly

[SIGNALS WEEKLY] Identity-First Intrusions and AI-Driven Attack Surface Shifts

The login was real. The control plane did the rest. Storm-2949 is the ugly part: one Entra ID identity can turn into SaaS theft and Azure abuse. Nobody owns this until incident day.

forecasts

[FORECAST] Device-Bound Sessions Are Coming. Defaults Are the Hard Part.

“Secure by default” sounds great until it meets BYOD, VDI, federated SSO, and the help desk exception list from hell. Device-bound sessions help. Waiting for every SaaS vendor to flip the default is not a strategy.

forecasts

[FORECAST] Two New App-Layer Campaigns by Year-End? Watch the Attribution Line

Teams keep hardening the front door while the “trusted integration” gets waved through reception with a box truck. No core-platform exploit required. Just approval fatigue with API access.

weekly

[SIGNALS WEEKLY] Edge Devices, Identity Abuse, and KEV-Driven Exploitation Converge

The industry still talks like identity compromise begins at the login page. Meanwhile the path is edge box → DNS games → token theft → bad week for everyone pretending “strong auth” was the whole plan.

forecasts

[FORECAST] Beyond PLCs: Are Iran-Linked Operators More Likely to Chase New Targets, New Tooling, or New Impact? UPDATED 2026-04-08!

Everyone saw the PLC headline and immediately built their whole Iran take around exposed controllers. Cool. The nastier question is what happens when the next move comes through identity, admin planes, or some target class nobody staffed for.

weekly

[SIGNALS WEEKLY] Converging Control-Plane Threats Across Modern Infrastructure

Everyone loves “endpoint visibility” until the incident starts in the control plane they treated like support infrastructure. Routers, CI/CD, token flows, web admin panels — same neglect, better attacker ROI.

forecasts

[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs - UPDATED: 2026-03-26

Iran cyber risk is not about whether they’ll be active. They will. The real question is whether the next 8 weeks produce a publicly attributed, materially disruptive hit with a new twist beyond the usual password-spray sludge. Tenant sabotage is the part to watch. 👀🔥