You can block your users from signing into apps with their Google account, and granting access to their inbox. But not knowing what they're using is worse.

After many years of complaining about how insecure SAML is, I decided to try to prove it by using Claude Code to hack every SAML implementation I could find.

We completed our first SOC 2 audit. We still suffered through manual access reviews, scattered evidence, and proving compliance with bygone requirements.

Code reviews aren’t just about ensuring engineering quality, they’re also about building team culture. Focus on communication and understanding rather than nit-picking style quirks.

As part of our initial SOC2 audit, we wanted to put in place actually useful security tools. Luckily, in 2026, world-class security costs literally nothing.

Groups used for access controls can be based on department, reporting chain, or projects. The right answer is whatever maps best to how your org actually works.

IT teams are overwhelmed with never-ending access requests. Getting off the identity treadmill means getting to fewer tickets over time, not faster tickets.

The SSO tax shouldn't be about having SSO — it should be about enforcing it. The value of SSO is to centrally manage access and require strong authentication.

Recent breaches at Okta, Snowflake, and Twitter help us learn how to prevent authentication failures like credential theft, MFA bypass, and session hijacking.

We interviewed IT and security teams to ask them how they actually define, implement, and improve their access control policies. Get the report to learn more.

Business teams have context for access decisions but lack authority. Delegate to those closest to the resources by defining clear ownership for each app.

Internal tools built as code come with version control and audit logs for free, but git becomes a barrier for non-engineers to use these tools.

A role in RBAC should represent what someone actually does in your environment. Your job title makes a bad RBAC role: it's your position, not your function.

Comms groups map to how people actually work, and often, access groups don't (but they should). Comms groups always become access groups. It's not a matter of if, but when.

Guest post by Maya Kaczorowski

Authentication has evolved from simple passwords to federated systems with passwordless logins, continuously balancing security and usability.

Instead of minting long-lived APIs keys and warning users “keep this secret,” let's use GitHub Action's OpenID Connect support instead.

TL;DR: I sat down with Maya Kaczorowski who’s building Oblique Security. I chatted about her early beginnings studying math and cryptography to building security products at Google Cloud, GitHub, and ...

Organizations ask users to fill out justification fields when requesting access, but these are useless explanations. Your authorization system should already have the context it needs.

IT teams are scared to remove access they don't understand, leading to sprawling entitlements. Removing unused access isn't risky — never removing access is.

Identity management is surprisingly hard, as access controls change constantly, and getting them right requires context. We founded Oblique to work on impactful security problems.