Identity Attacks
Trace failure paths and test defenses.
Research structure
Document the incident background, confirmed timeline, identity attack path, compromised identities and credentials, trust boundaries, control failures, defensive architecture and lessons learned. Distinguish confirmed facts, evidence-supported inferences and hypothetical scenarios.
Hypothetical starter investigations
Recovery abuse after a lost authenticator
Fictional attack scenario: Usability and offline availability must be weighed against recovery abuse and residual sessions.
L1 · Explain · D02
An overbroad deployment trust policy
Fictional attack scenario: A short token lifetime limits exposure but does not compensate for overly broad trust or permissions.
L2 · Analyze · D10
A leaked shared database credential
Fictional attack scenario: Credential expiry and existing database connection lifetimes are different controls; validate both.
L2 · Analyze · D09
An agent exceeds its delegated task
Fictional attack scenario: OAuth token exchange can express delegation, but product support and enforcement must be validated. Agent-specific controls here are a design proposal.
L4 · Design · D12