Independent, vendor-neutral knowledge hub for identity and access management. Guides, standards, breach teardowns, and IAM jobs.
San Fancisco
Joined November 2019
- Tweets1.4K
- Following438
- Followers427
- Likes228
Amazon: 500M+ customers have turned on passkeys.
The tactic to copy: ask during sign-in, when the user is already authenticated.
The number to track: share of sign-ins made with a passkey, not enrollments.
startwithidentity.com/blog/2…
Cybersecurity Awareness Month ends today. What actually changed on your team?
A. Turned on passkeys
B. Cleaned up old accounts
C. Tightened help desk resets
D. Honestly, nothing yet
It's okay if your answer is D!
Start with Identity retweeted
Recognized for CIAM.
We’ve been named a Leader in the 2026 @Gartner_inc Magic Quadrant™ for Customer Identity and Access Management, positioned highest in Ability to Execute.
Announcement: ow.ly/4okp5102x55
An account with the username Test2 created in 2012 with Password1 as the pw.
Ransomware came in through it and exposed 3,300 people, mostly children. The UK ICO reprimanded both organizations on Oct 20.
An account nobody owns never gets offboarded.
startwithidentity.com/blog/2…
An MFA reset is credential issuance. Whoever approves it can mint a login for anyone.
Arctic Wolf counted 400+ intrusions where attackers posed as IT on Teams.
Verify on a channel you already control, not with facts anyone can buy.
startwithidentity.com/blog/h…
ALT Stat card. Attackers now play the help desk. 400 or more fake IT support intrusions over Microsoft Teams external chat. Under 15 minutes to payload execution in the fastest cases. Source: Arctic Wolf Labs, October 26, 2026.
Start with Identity retweeted
IAM Analyst explained simply:
You manage who gets access to what inside an organization.
Common responsibilities:
→ User provisioning
→ Access reviews
→ MFA and SSO support
→ Role and permission management
→ Identity audits
The role sits at the center of security and operations.
Start with Identity retweeted
I've seen some of these tweets and I think what people fail to realize is that a lot of the fundamental skills needed inside of IAM are typically what a lot of "IT" employees are already doing. My second gripe is that to be effective at identity you have to have a good understanding of most technical domains. The same requirements that are needed for any competent cybersecurity engineer is needed for an IAM engineer. Identity is the perimeter simply because everything now has an identity and it's been this way for a while now. Cloud, endpoint management, SOC, red team, Devops, networking. Speaking from personal experience I've had to be able to perform duties from all those domains to be effective. IAM isn't just the analyst role anymore and anyone working in the field would tell you that. I think it's simply that people don't know what all is happening at the identity layer so it's easier to use the buzzwords and make it seem simple than actually saying I don't know what all it required, and I'd say this is all before AI became as big as it is.
Start with Identity retweeted
IAM stands for Identity and Access Management.
Your job is deciding who gets into what.
Creating accounts. Setting permissions. Removing access when someone leaves. Making sure MFA is on.
Every breach story you hear usually starts with access nobody cleaned up.
Start with Identity retweeted
Day 4/30: I used 1 prompt to have my AI agent build an enterprise employee onboarding lab.
The idea is to make building complex IT labs as easy as describing what you want to an AI agent.
Today’s use case:
When a company hires someone, IT needs to determine:
→ Which accounts to create
→ Which applications they need
→ Which permissions to grant
→ What access should be denied
The tools:
• midPoint — Identity management
• Active Directory — User accounts
• Keycloak — Authentication
• Ollama — AI access recommendations
AI recommends access based on similar employees.
IAM policies and human approvals control what gets granted.
The result:
20 simulated employees successfully onboarded with no excessive access granted.
My AI agent then documents the implementation, including a GUI walkthrough, test evidence, and architecture diagrams.
All published to my GitHub portfolio.
The goal of this 30-day challenge:
Build practical IAM skills with AI doing much of the heavy lifting, so I can spend more time understanding how the systems work.
Today’s architecture below.
Day 3/30: Building IT labs with AI.
Today I built SAML SSO for Jenkins using Microsoft Entra ID.
The lab itself took 2 minutes.
— THE PORTFOLIO —
What took longer was refining how my AI agent automatically documents and publishes each day’s progress to GitHub.
It was already working. I wanted a better, more consistent process.
Now I send ONE voice note. Not multiple prompts.
My AI agent handles the rest:
- Builds the lab
- Documents what was built and why
- Provides steps to replicate it
- Generates screenshots
- Updates my GitHub portfolio
— THE RESULTS —
The Day 1–3 portfolio cards below were generated by my AI agent directly from my lab environment.
One voice note. A couple minutes to build the lab. An automatically updated portfolio.
That’s it.
Start with Identity retweeted
94% of IT and security decision-makers said they could revoke all access within 24h of someone leaving. 35% reported delays or failures doing it (FIDO Alliance and HID, 2026).
Moving into IAM? The leaver path is your best first project.
startwithidentity.com/blog/w…
ALT Stat card. Confidence vs reality on the leaver path. 94% said they could revoke all access within 24 hours of someone leaving. 35% reported delays or failures doing it in the past two years. Source: FIDO Alliance and HID survey of 500 IT and security decision-makers, June 15, 2026.
Start with Identity retweeted
🎉NEW @NIST BLOG!
Design Tenets for Agent Identity Management Systems
We’ve defined an initial set of “Design Tenets” for agentic identity, authentication & authorization
nist.gov/blogs/cybersecurity…
Start with Identity retweeted
Online filing reduces avoidable errors by prompting applicants to complete required fields and use the correct format.
More complete submissions support stronger fraud detection, identity management, and national security screening.
Learn more: uscis.gov/online-filing-opti…
Start with Identity retweeted
Looking for IAM job?
Don't just collect certifications. Do market research! I'm starting a series analyzing real IAM job descriptions.
🔍 Today's pick: NVIDIA
Role: Senior Cybersecurity Engineer – Identity Platform & Access Management
Here are 5 skill areas that stood out. 🧵
Start with Identity retweeted
Thank you @DuckDuckGo! We are truly proud to be recognized as a crucial part of the digital privacy ecosystem. Good to be in this work together.
We're proud to donate $1M to a diverse group of organizations around the world that promote privacy, digital rights, access to information online, and a healthier online ecosystem.
This is made possible through your support of DuckDuckGo, thank you! 🎉
spreadprivacy.com/2026-duckd…
Start with Identity retweeted
An AI agent’s next action could expose patient data. Can your security controls stop it?
Healthcare needs runtime verification before an agent takes an unauthorized step.
Here is how those controls work: ow.ly/puK2510169H
GOV.UK One Login now offers passkeys to 23M+ people.
Nearly 1 in 10 daily sign-ins already use one. Up to 8x faster. Close to £600 a day saved on SMS.
Passwords stay as a fallback, so recovery is the next hard part.
startwithidentity.com/blog/2…
94% of IT and security decision-makers said they could revoke all access within 24h of someone leaving. 35% reported delays or failures doing it (FIDO Alliance and HID, 2026).
Moving into IAM? The leaver path is your best first project.
startwithidentity.com/blog/w…
ALT Stat card. Confidence vs reality on the leaver path. 94% said they could revoke all access within 24 hours of someone leaving. 35% reported delays or failures doing it in the past two years. Source: FIDO Alliance and HID survey of 500 IT and security decision-makers, June 15, 2026.
New phishing kit poses as AI ad tools for ChatGPT, Gemini, and Claude (Island).
A fake sign-in popup is drawn inside the page, while a live operator replays your password and MFA code in real time.
Codes can be relayed. Passkeys can't.
startwithidentity.com/glossa…
