Operational resilience
Incident-response playbooks.
When identity is the incident, you need a plan before the pager goes off. Each playbook covers detection signals, containment steps, customer communication, forensics, and the hardening that stops a repeat.
- high
Credential stuffing attack
Credential stuffing replays username/password pairs leaked elsewhere against your login. You will see a spike in login attempts with a high failure rate from many IPs. Contain with rate limiting, bot defense, and breached-password checks; recover by forcing resets on compromised accounts and accelerating passwordless adoption.
4 detection signals · 5 containment steps
- critical
Account takeover spike
An account-takeover spike shows up as clusters of successful logins from new devices or geographies followed by sensitive changes (email, password, payout). Contain by invalidating sessions, forcing step-up and re-verification on sensitive changes, and locking affected accounts; recover with risk-based monitoring and hardened recovery flows.
4 detection signals · 4 containment steps
- critical
MFA outage or bypass
An MFA outage locks legitimate users out (SMS/push provider down, TOTP clock skew), while an MFA bypass lets attackers skip the second factor (misconfigured fallback, recovery abuse). Triage which one you have first: an outage needs safe fallback, a bypass needs the gap closed immediately, never disable MFA globally to 'fix' an outage.
4 detection signals · 4 containment steps
- high
Social login provider outage
When an upstream identity provider (Google, Apple, Facebook) is down or has rotated keys, users who signed up with that provider cannot log in. Contain by surfacing an alternate login path and clear messaging; recover by ensuring every social account has a recoverable email identity and by monitoring provider health.
4 detection signals · 4 containment steps
- critical
Session or token theft
Stolen session cookies or tokens (via XSS, malware, or a leaked refresh token) let an attacker act as the user without their password or MFA. Contain by revoking the affected sessions and refresh tokens and rotating signing keys if a signing secret leaked; recover by shortening token lifetimes and adding token binding.
4 detection signals · 4 containment steps
- critical
B2B tenant administration misconfiguration
A misconfigured tenant, an over-broad SSO connection, a wrong domain claim, or a leaked admin role, can expose one customer's data to another or grant unintended admin access. Contain by scoping down the offending configuration and revoking sessions; recover by tightening tenant isolation and adding config guardrails and audit alerts.
4 detection signals · 4 containment steps