The perimeter is gone — and everyone knows it. What many organizations are still catching up to is what replaced it. Identity is now the primary attack surface, and attackers are exploiting it with increasing precision. Instead of smashing through firewalls, they steal refresh tokens, abuse OAuth consent, hijack sessions, and quietly persist as legitimate users. Recent industry reporting shows that 67% of organizations have seen an increase in identity-based incidents, with third-party access and stolen credentials dominating breach investigations. For blue teams and IAM operators, this changes the job. Preventive controls alone are no longer enough. You need Identity Threat Detection and Response (ITDR) that can spot subtle abuse inside trusted identity systems like Okta and Microsoft Entra, and respond fast enough to contain blast radius. This playbook focuses on the threats defenders are actually seeing — and how to detect, respond, and measure success in the real world. Why Identity Attacks Are Harder to Catch Identity attacks don’t look like traditional intrusions. There’s no malware beaconing, no port scans, no obvious lateral movement. Everything happens through legitimate APIs, tokens, and sessions. Once an attacker steals a refresh token or compromises an OAuth app, they don’t need to reauthenticate. They can mint fresh access tokens, move between services, and blend into normal user behavior for days or weeks. Session hijacking compounds the problem by allowing attackers to inherit device trust, MFA state, and conditional access context. This is why identity incidents are often detected late — and why blast radius matters as much as detection. Detecting Refresh Token Theft in Okta and Entra Refresh tokens are high-value targets because they outlive access tokens and often bypass MFA once issued. Detection hinges on spotting behavior that breaks normal patterns, not just failed logins. In Entra, one of the strongest signals is token usage from unexpected locations or device contexts, especially when the access token claims indicate a different sign-in posture than the original authentication event. When refresh tokens are replayed from infrastructure or geographies never associated with the user, defenders should treat it as probable compromise, not a false positive. Okta environments show similar patterns. Watch for sudden spikes in token refresh events, particularly outside business hours or immediately following OAuth app consent. A single refresh token generating access tokens across multiple resources in rapid succession is another common indicator. The key mistake teams make is treating these as “interesting logs” instead of actionable alerts. Token misuse is rarely benign. Rogue OAuth Apps and Consent Abuse OAuth consent is one of the quietest persistence mechanisms attackers have. By tricking a user into approving a malicious or over-privileged app, attackers gain durable API access without needing to maintain a live session. The app continues working even after the user logs out or resets their password. Detection starts with visibility. Teams need to baseline which apps normally request consent, what permissions they ask for, and who approves them. In both Okta and Entra, high-risk signals include newly registered apps requesting broad scopes like offline access, mail read/write, directory access, or files permissions — especially when consent comes from non-admin users or outside expected workflows. Another overlooked signal is unused but still-authorized apps. OAuth grants that remain active without corresponding user activity are often persistence artifacts. Effective ITDR treats OAuth apps as identities in their own right, subject to the same scrutiny as users and service accounts. Session Hijacking: When MFA Is Already Bypassed Session hijacking is particularly dangerous because it often defeats MFA and conditional access entirely. If an attacker steals a session cookie, they inherit the trust state of the original login. In Entra, defenders should watch for session reuse across IP addresses or devices that would normally trigger reauthentication. Sudden changes in user agent strings, browser fingerprints, or access patterns mid-session are strong indicators. Okta logs can reveal similar anomalies, especially when a session continues long after expected expiration or survives events that should invalidate it, such as password resets or device posture changes. The defensive challenge here isn’t detection alone — it’s speed. Session hijacking demands fast containment before the attacker pivots deeper into SaaS or cloud resources. Response Automations That Actually Work Detection without response is just telemetry. For token theft, immediate revocation is non-negotiable. That means invalidating refresh tokens, terminating active sessions, and forcing reauthentication with MFA. In both Okta and Entra, this should be automated for high-confidence detections rather than left to manual workflows. OAuth abuse requires a slightly different approach. The response should disable or delete the offending app, revoke its grants tenant-wide, and notify affected users. Crucially, security teams should also audit what data the app accessed while active — something many incident responses skip entirely. For session hijacking, the response window is narrow. Automated session termination combined with conditional access tightening is often the only way to cut off attacker momentum. The most mature teams pre-wire these actions into SOAR or native automation, reducing response time from hours to minutes. Measuring ITDR Effectiveness: KPIs That Matter ITDR success isn’t measured by alert volume. It’s measured by outcomes. Mean time to detect identity misuse is a critical metric, but mean time to contain is even more important. Teams should also track how often identity incidents are detected before data access occurs, and how frequently compromised identities lead to secondary incidents. Another overlooked KPI is blast radius per incident. How many apps, datasets, or sessions were reachable from a single compromised identity? Reducing that number is as important as improving detection fidelity. This is where ITDR intersects with identity architecture. Reducing Blast Radius While ITDR Fights the Fire ITDR focuses on detecting and responding to active threats. But even the fastest response can’t undo overexposed data. This is where Ensto, as a control plane in the Keywix ecosystem, fits into the story. By minimizing standing access, reducing unnecessary data exposure, and enforcing tighter identity-to-data boundaries, Ensto limits how far an attacker can move even after identity compromise.
Passwords have been the weakest link in enterprise security for decades, yet they’ve survived because every alternative either hurt usability or shifted complexity to users. Passkeys change that equation for the first time. What’s different now isn’t just the technology — it’s adoption. Industry reporting from the FIDO Alliance and identity-focused publications shows passkeys achieving around 93% sign-in success rates, with billions already in active use across consumer platforms. Enterprises are no longer experimenting in isolation; they’re building on patterns users already trust in their daily lives. For platform security leaders, the question is no longer if passkeys belong in the enterprise, but how to roll them out without breaking workflows, overwhelming the help desk, or creating recovery nightmares. This guide outlines a realistic 90-day rollout plan that balances security, usability, and operational reality — and shows how passkeys naturally support a user-controlled identity model that strengthens authentication without expanding stored personal data. Why Enterprises Are Moving Now Three pressures are converging. First, users are ready. Employees already unlock laptops and phones with biometrics dozens of times a day. Passkeys feel familiar, not foreign, which removes the biggest historical barrier to MFA adoption. Second, the security upside is immediate. Passkeys are phishing-resistant by design. There is no shared secret to steal, no password database to leak, and no push notification to fatigue into approval. For organizations battling credential-based attacks, this is a structural fix, not another patch. Third, operational costs are forcing the issue. Password resets and MFA failures remain among the top drivers of help-desk tickets. Passkeys directly reduce those events instead of trying to manage them more efficiently. The result is a rare win-win: stronger security that users actually prefer. Device-Bound vs Synced Passkeys: Choosing the Right Trust Model One of the earliest decisions enterprises must make is where passkeys live. Device-bound passkeys are stored in hardware-backed secure elements such as TPMs or secure enclaves. They offer the strongest security guarantees and are well suited for administrators, privileged roles, regulated environments, and shared workstations. The trade-off is recovery: when a device is lost or replaced, organizations need clearly defined fallback paths. Synced passkeys, on the other hand, are backed up and synchronized across a user’s devices through platform ecosystems like Apple, Google, or Microsoft. They dramatically improve usability and reduce lockouts, especially for knowledge workers who move between devices. The trust boundary is wider, but for many roles, the UX benefits outweigh the risk. In practice, most mature deployments use both. Risk-based segmentation — not ideological purity — is what makes passkeys work at enterprise scale. Days 0–30: Laying the Groundwork The first month should focus on decisions, not enforcement. Security teams need a clear picture of who will use passkeys and where. Workforce users, contractors, administrators, and partners all have different risk profiles. Access paths matter just as much: SaaS applications, internal portals, VPNs, RDP, and legacy systems all behave differently under modern authentication. This is also the moment to define recovery and break-glass policies. Passkeys reduce lockouts, but they don’t eliminate device loss or human error. Enterprises that succeed treat recovery as a first-class security flow, not an afterthought, with time-bound break-glass access and auditable recovery events. Equally important is deciding what identity data no longer needs to be stored. Passkeys allow strong authentication without passwords, knowledge-based questions, or excessive profile data. This aligns directly with Keywix’s user-controlled identity philosophy: authenticate users cryptographically while minimizing retained PII and reducing breach impact. Days 31–60: Pilot and Enrollment Experience The second phase is where theory meets reality. A small pilot group should be chosen deliberately — users on modern devices who authenticate frequently and are willing to give feedback. Their experience will expose friction early, before it becomes an enterprise-wide problem. Enrollment should feel almost boring. The most successful deployments introduce passkeys immediately after a successful login, explain the value in plain language, and complete enrollment in a single flow using existing biometrics. If users have to read documentation, adoption will stall. During this phase, passwords should remain available as a fallback. The goal is not to prove passkeys can replace everything instantly, but to validate real-world scenarios such as new device provisioning, remote access, VPN connectivity, and device replacement. Metrics matter here. Sign-in success rates, authentication time, and help-desk tickets will tell you far more than theoretical threat models. Days 61–90: Scale and Enforce with Confidence By the third month, passkeys should move from optional to expected. New users can be enrolled by default, while existing users are prompted progressively rather than forced all at once. High-risk access — administrative consoles, finance systems, external entry points — is the right place to enforce phishing-resistant authentication first. As confidence grows, legacy password flows can be retired selectively. Every removed password reduces attack surface, operational overhead, and compliance exposure. At this stage, leadership-level metrics become powerful. Organizations typically see fewer authentication failures, fewer MFA complaints, and a noticeable drop in password-related support tickets — often within weeks. The Reality of VPNs, RDP, and Legacy Systems Skepticism around passkeys often centers on enterprise edge cases, and not without reason. Modern VPNs that support SAML or OIDC integrate cleanly with passkeys, while older appliances may require phased coexistence. Windows environments benefit significantly from device-bound passkeys combined with Windows Hello for Business, particularly for RDP and administrative access. Legacy applications rarely block progress outright, but they do reinforce the need for federation layers rather than direct authentication rewrites. Passkeys don’t instantly modernize legacy infrastructure — but they make the cost of not modernizing far more visible. Help Desk Impact: Fewer Tickets, Better Outcomes One of the most consistent outcomes of passkey adoption is a shift in support load. Password resets and MFA push issues drop sharply. What replaces them are fewer, more meaningful interactions around device lifecycle and recovery. Over time, even those decrease as users become familiar with the model. The net effect is not just lower volume, but better quality support work.
