who's inside?
Practical guides on identity, access and data security for the people who run a company's tools, data and workflows without a security team behind them. One mechanism at a time, each with a step you can take this week.
get the offboarding checkliststart reading
incident files on the site
sources: CISA, FBI, SEC, FTC, company disclosures
who's inside your company right now?
the people you hiredon payroll and on the org chart
the people who leftaccounts and tokens that outlived the jobthe apps you clicked Allow onOAuth grants still reading mail and drivesthe admins nobody rememberstemporary rights that became permanentthe tools nobody approvedSaaS on a card and AI wired into your dataaccess creep
Granting access takes one click and someone is asking for it. Taking it back has nobody asking, so it waits until someone remembers. Usually nobody does.
Every leftover permission is a way in. The incidents on this site keep starting the same way: a leaver's account, an old token, an app nobody remembered. See them.
Guides that explain one mechanism and end with a step for this week, plain explainers on each risk, and numbers with their sources.
Six ways in, depending on what keeps you up. Each one starts with the question it answers.
Picture a contractor who finished in March. In November their email, the team chat and the shared password vault still open for them, because nobody owned their last day.
Picture a sales tool someone connected two years ago with one click on Allow. It still reads every inbox it was granted, and the person who connected it left last spring.
Picture an assistant switched on for the whole company. On its first day it can answer questions from every file anyone ever shared too widely.
Picture a code host where every developer can see every repository, and an old personal token from someone long gone can still push code.
start with
all 3 in the platforms →Picture an auditor asking who had super admin on one Tuesday in March. The answer exists only if someone exported the logs before they expired.
Five longer pieces: why the people who stay collect more access than the people who leave, why every inventory you have is wrong, and the order to fix it all in.
Real incidents, each told as the belief it retired. Every one ends with what to check in your own company this week.
the letter · every two weeks
Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.