New: Account Recovery+ for Entra ID Read Now

Blog

Working notes on account takeover, help desk social engineering, deepfake fraud and identity verification, written for the security and IT teams who handle account recovery.

76 pieces

Blog
MFA fatigue, MFA bypass, and the reset desk: three ways MFA actually fails

Teams that have deployed phishing-resistant MFA often still leave the reset path wide open.

August 21, 2026
Blog
What is identity proofing? NIST 800-63 in plain English

Authentication asks if this is the same account holder as last time. Identity proofing asks who they are. An attacker with the account passes…

August 21, 2026
Blog
How to reset MFA safely: Entra ID, Microsoft 365, Okta, and Duo

Resetting MFA is a minute's work, and every vendor documents it. Deciding whether the person asking should get one is the part nobody documents.

August 21, 2026
Blog
What is account takeover?

The account is occupied rather than broken. It keeps working normally, which is what makes a takeover hard to see.

August 21, 2026
Blog
What is vishing? How voice phishing became the front door to the enterprise

The technique is decades old. What changed is that a voice on the phone stopped being evidence of who is speaking.

August 21, 2026
Blog
Corporate account takeover: why business accounts fall differently

Corporate account takeover borrows an employee's authority and spends the company's money with it.

Ori Eisen August 19, 2026
Blog
Why help desk account takeover protection stalls in deployment

Most teams try detection first, and it is useful to understand why that goes the way it does.

Ori Eisen August 25, 2026
Blog
Verifying users without making them install an app

Identity verification rollouts tend to hit the same wall, and it is rarely a technical one.

Ori Eisen August 21, 2026
Blog
Account takeover protection for financial services: call centers, wire approvals, and the calls in between

Someone calls a bank's support line pretending to be a customer, or calls a customer pretending to be the bank, and the conversation itself…

Ori Eisen August 20, 2026
Blog
How to evaluate account takeover protection for IT help desks

Most account takeover does not start with a broken password. It starts with a phone call that sounds completely reasonable.

Ori Eisen August 19, 2026

Browse other categories

trusona icon
Powered by  GDPR Cookie Compliance (opens in a new tab)
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.