Transmission 10 · Identity

Identity Is the Attack Path

Attackers stopped breaking in. They log in. Stolen credentials, hijacked sessions, abused OAuth consents, and quiet privilege escalation now carry more intrusions than any exploit class. The perimeter did not disappear — it moved into the identity plane, and most organizations have never mapped it.

The escalation graph

Your directory is a graph: identities, sessions, group memberships, delegated rights, service principals. Attackers traverse it edge by edge — a helpdesk account that can reset a stronger account, a service principal with directory write, a stale admin group nobody audits. Map the graph the way an attacker would (the BloodHound discipline), and the “short path to domain control” stops being a surprise found during an incident.

Severing the path

• Phishing-resistant MFA (hardware-backed, origin-bound) — codes and push prompts are phishable and replayed daily.
• Short-lived tokens and revocation that works in seconds; a stolen session that outlives the theft is a standing grant to the thief.
• No standing privilege: just-in-time elevation with expiry, so the graph’s most dangerous edges exist only minutes at a time.
• Audit consent grants and service principals quarterly — machine identities outnumber humans and rot faster.

Phase-lock, applied

This is continuous phase-lock at its sharpest point: every session re-verified against source truth, every edge in the graph deliberate, drift treated as a detection. An identity plane tuned this way turns credential theft from a master key into a cracked bell — audible the moment it is struck against your baseline.

The attacker sings with a stolen voice. A tuned field hears the difference. We synchronize.