Device-code phishing turns a legitimate login flow into rented access. The durable defense is to shrink who can use it.

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.

“Secure by default” sounds great until it meets BYOD, VDI, federated SSO, and the help desk exception list from hell.

Device-bound sessions help.

Waiting for every SaaS vendor to flip the default is not a strategy.

Everyone loves a “trusted app” until it turns into a long-lived permission slip with better branding.

The platform can stay technically unbroken and you still get cleaned out. That gap is the problem.

Iran cyber risk is not about whether they’ll be active. They will. The real question is whether the next 8 weeks produce a publicly attributed, materially disruptive hit with a new twist beyond the usual password-spray sludge. Tenant sabotage is the part to watch. 👀🔥

Iran cyber risk isn’t just “watch for wipers.” It’s the same ugly identity-first playbook: password sprays, MFA abuse, cloud access… then maybe admin-plane sabotage. Recent reporting says activity is already reaching U.S. targets. Cute. 🚨🔐🧨