identity - AlphaHunt Converge

gametheory

[GAME THEORY] The help desk is becoming the new intrusion broker.

Vishing works because urgency can become SaaS authority. Break the trust transaction without breaking support.

weekly

[SIGNALS WEEKLY] Quiet Fault Lines in Identity, Perimeter, and CI/CD

The quiet failure mode in this week’s signals is trust doing exactly what it was configured to do—for the wrong operator. A TeamCity foothold can expose secrets and poison downstream artifacts..

forecasts

[FORECAST] The SaaS connector is where trust becomes blast radius.

A 30% forecast—and a practical way to reduce the cross-tenant blast radius before the next connector compromise.

weekly

[SIGNALS WEEKLY] Converging Pressures: Identity, Edge Exploits, and Decentralized C2

Edge exploits, helpdesk vishing, stolen CI tokens, and decentralized C2 share one objective: scale access while shrinking defender visibility. Hunt the transitions, not just the opening IOC.

gametheory

[GAME THEORY] The First Access Broker May Be the Recruiter

State-linked actors are competing for workforce trust. Map the handoffs that create access before the SOC sees an employee.

weekly

[SIGNALS WEEKLY] Shifting Access Paths: OT, Identity, and Adversarial AI

Some of this week’s most useful threat signals point to access paths that sit just outside the normal inventory: a cellular modem added by an OT integrator, a hotel captive portal steering a traveler toward token theft, or a passkey implementation that trusts the wrong lifecycle step.

gametheory

[GAME THEORY] The Phish Did Not Steal the Password. It Rented the Protocol.

Device-code phishing turns a legitimate login flow into rented access. The durable defense is to shrink who can use it.

deep

[DEEP RESEARCH] The account stealing your data may not be human

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

gametheory

[GAME THEORY] AI gateways are becoming the new IAM chokepoint

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.

weekly

[SIGNALS WEEKLY] Converging Threats Across SaaS, Web Edge, and OT

OAuth consent made SaaS data theft look normal. Niche web plugins kept handing attackers first doors. OT debug ports reminded everyone that “engineering access” can age into exposure.

forecasts

[FORECAST] TeamPCP shows why package cleanup is not containment

Supply-chain attacks are becoming access pipelines. The defender move is to follow credentials, not just packages.

weekly

[SIGNALS WEEKLY] Perimeter Pressure, Supply Chain Drift, and Identity Theft

The perimeter blinked. VPN portals and CI tokens are still doing incident cosplay.