Mega IdP attack chains expose the limits of centralized identity

At a glance

What this is: This white paper argues that Mega IdP architectures concentrate systemic identity risk and shows how attack chains progress from phishing to token capture, consent abuse, persistence, and exfiltration.

Why it matters: IAM, PAM, and NHI teams need to account for post-authentication abuse because centralized trust models can turn one compromised identity path into tenant-wide impact.

By the numbers:

• 80% of breaches use valid credentials, showing why token and session abuse now matters as much as password compromise.
• 277 days is the average breach detection time cited in the paper’s risk analysis, which leaves attackers a long window inside trusted identity paths.
• 1,000+ enterprises can be affected by a single Mega IdP breach, according to the paper’s blast-radius analysis.
• $4.45M is the average cost of a data breach used in the paper’s quantitative risk assessment, underscoring the business impact of identity compromise.

👉 Read SecureAuth’s analysis of Mega IdP attack chains and identity blast radius

Context

Mega IdP environments concentrate authentication, token issuance, and policy enforcement into a small number of high-value control planes. That concentration changes the identity risk profile because attackers do not need to defeat every application when a single identity path can unlock broad access across sessions, tenants, and APIs. In this model, identity security becomes a question of blast radius as much as access control.

The paper’s core point is that login-time trust is no longer enough. Once valid credentials, session cookies, OAuth consent grants, or app registrations are abused, the attacker is operating inside legitimate identity pathways rather than outside them. For IAM and NHI programmes, that means the control point has shifted from authentication only to continuous governance of every action.

The source positions this as an architectural problem, not a deployment mistake. That framing is typical of modern identity-first adversary campaigns, where predictable auth flows and shared trust assumptions are the real prize.

Key questions

Q: What breaks when identity platforms trust tokens after login?

A: Static trust breaks because the attacker can keep using a valid session after the original authentication event. Once a cookie, access token, or refresh token is stolen, the platform may continue to treat it as legitimate unless authorization is re-evaluated at the moment of action. That creates a long exploit window for lateral movement and exfiltration.

Q: When should organisations prioritise continuous authorization over longer token lifetimes?

A: Organisations should prioritise continuous authorization when the protected action is more sensitive than the login event that created the token. Longer token lifetimes may improve usability, but they also extend exposure if the session is hijacked. Action-time checks matter most for mail, files, directory, payment, and admin workflows.

Q: What are the signs that OAuth consent governance is failing?

A: Common signs include broad scopes granted to unfamiliar applications, app registrations that survive beyond their business purpose, and consent events that are logged but not acted on. If reviewers only see the abuse in hindsight, governance is too slow for the risk level. The control needs policy, not just audit trails.

Q: How should security teams respond when an identity platform is a shared attack surface?

A: They should reduce concentration risk by isolating critical deployments, tightening delegated access, and separating the trust boundary for high-value applications. Shared identity infrastructure should be treated as a systemic dependency, not a neutral utility. The practical goal is to keep one compromise from becoming an enterprise-wide event.

Technical breakdown

Initial access and token capture in Mega IdP attacks

The attack chain starts with phishing or AiTM techniques that capture credentials or session artefacts, then moves into token theft. In a centralized identity model, the attacker does not need to break cryptography if they can replay a valid session cookie or access token. The key technical weakness is that issuance is treated as proof of continuing trust, even though the session is now under adversary control. This is why authentication success and authorization safety are not the same thing.

Practical implication: teams need controls that treat session integrity as a live condition, not a one-time login outcome.

OAuth consent abuse and app registration persistence

OAuth consent abuse turns delegated permissions into a durable foothold. A malicious app can request broad scopes, obtain user approval, and then access mail, files, or directory data through normal API channels. App registrations extend that foothold because persistence survives beyond the original login event and often blends into routine administration. The architecture issue is that delegated access can outlive the user interaction that created it, which makes audit-only detection too slow for active abuse.

Practical implication: consent grants and app registrations need policy-based review, not just periodic audit sampling.

Continuous governed authority versus token lifetime trust

The paper contrasts static token lifetime with continuous authorization at the point of action. That matters because access tokens and refresh tokens create a long window in which risk can change after issuance. Continuous governed authority collapses that gap by evaluating contextual signals such as device posture, geolocation, transaction type, and anomaly patterns each time an action is requested. The mechanism is less about shortening tokens and more about refusing to let token possession alone determine trust.

Practical implication: authorization policy should be evaluated at action time for sensitive resources, not only at authentication time.

Threat narrative

Attacker objective: The attacker wants durable, trusted access to enterprise data and administrative pathways without triggering the usual login controls.

1. Entry occurs through phishing or AiTM theft, which captures credentials or session cookies and places the attacker inside a legitimate identity flow.
2. Escalation follows when the attacker abuses OAuth consent, app registration, or token replay to extend access beyond the original user session.
3. Impact comes from Graph API abuse and ongoing data exfiltration that blends into normal identity traffic and can persist for days or months.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach — unsecured GitLab authentication tokens exposed 31M Internet Archive accounts.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Centralized identity has become a concentration risk, not just an efficiency layer. When authentication, session control, and delegated authorization all converge in a Mega IdP, the blast radius of a single compromise scales across many downstream services. That changes identity governance from access administration to systemic risk management. Practitioners should treat IdP concentration as an architectural exposure that must be governed like any other critical control plane.

The assumption that login-time trust is sufficient has already failed. That assumption was designed for conditions where a credential or token remained a stable proxy for the user after authentication. It fails when attackers can capture a session, abuse delegated scopes, or persist through app registrations while behaving like legitimate traffic. The implication is that identity programmes must stop treating issuance as the end of the security decision.

Continuous authorization is now a governance requirement for high-value identity paths. The paper’s emphasis on moment-of-action checks reflects the reality that post-authentication abuse is where modern identity attacks spend most of their time. Static controls can still reduce exposure, but they do not eliminate the gap between access grant and malicious use. Practitioners should align governance with runtime behaviour rather than rely on token lifetime as a safety boundary.

Scope governance is the control plane that most teams underuse. OAuth consent, app registrations, and delegated permissions are often handled as administrative artefacts when they should be governed as live attack surfaces. Once an attacker obtains durable delegated access, visibility alone is not enough because the abuse path is already authorized. Teams should reframe scope governance as a high-priority identity security domain, not a back-office approval process.

Identity security for NHI and human users is converging at the control point of action. The same design flaw appears across service accounts, sessions, and AI-assisted workflows: a trusted identity can act for too long without re-evaluation. That convergence makes continuous verification, scoped delegation, and lifecycle governance the common language across human IAM, NHI governance, and autonomous access models. Practitioners should unify those controls rather than manage them as separate problems.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to the 2024 ESG Report: Managing Non-Human Identities.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
• That pattern reinforces the need to govern delegated machine access with the same seriousness as human identity and to use the Ultimate Guide to NHIs as the next operational baseline.

What this signals

Identity concentration changes the security programme from perimeter control to blast-radius control. When a single trust plane can underpin login, delegation, and session persistence, the practical question becomes how much of the enterprise can be reached after one control failure. That is why identity architecture, not just authentication tooling, should be part of every platform-risk review.

Token lifetime is becoming a poor proxy for trust. In environments where attackers can replay sessions or abuse delegated scopes, the safer operating model is to evaluate risk at the point of use. Security teams should expect more pressure to align IAM, PAM, and NHI governance around action-time decisioning rather than static issuance events.

What organisations need next is a governable delegation model, not just stronger login friction. The control problem now spans human sessions, service accounts, and AI-assisted workflows that may all inherit privileges from the same identity fabric. With 72% of organisations having experienced or suspecting an NHI breach, per the 2024 ESG Report: Managing Non-Human Identities, the governance gap is already operational, not theoretical.

For practitioners

• Map the login-to-action gap Inventory where your identity stack grants trust at authentication time but allows sensitive action later without re-evaluation. Prioritise applications that rely on long-lived access tokens, refresh tokens, or delegated API scopes.
• Review OAuth consent and app registration governance Treat consent grants, app registrations, and delegated scopes as governed entitlements with explicit approval, monitoring, and revocation criteria. Focus on high-risk scopes such as mail, files, and directory access.
• Move sensitive access to action-time checks Apply conditional authorization for privileged or high-impact operations so device posture, location, and behavioural signals are evaluated when the resource is requested. This reduces reliance on the token lifetime as the trust boundary.
• Reduce identity blast radius through deployment isolation Segment critical identity functions so a compromise in one deployment does not automatically expose every tenant, partner domain, or application. Architect for containment before considering convenience.

Key takeaways

• The paper shows that centralized identity creates a high-value attack plane where one compromise can scale across many applications and tenants.
• Its quantitative framing makes clear that valid-credential abuse, long detection times, and shared blast radius turn identity governance into a board-level risk issue.
• Teams should move from login-centric trust to continuous authorization, scoped delegation governance, and deployment isolation.

Key terms

• Mega IdP: A Mega IdP is a large, centralized identity provider that serves many applications, tenants, or business units from one trust plane. The security concern is concentration risk: when the provider or its delegated pathways are abused, the attacker can inherit broad access across the connected environment.
• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.
• OAuth Consent: The approval that allows an application to access resources on behalf of a user or tenant. In practice, consent can create durable access paths that outlive the original interaction if permissions are broad, unmanaged, or never reviewed. For security teams, it is both an access decision and a lifecycle event.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

SecureAuth's full white paper covers the technical implementation detail this post intentionally leaves at the architectural level:

• Quantitative attack-chain mapping across Midnight Blizzard, LAPSUS$, and Scattered Spider patterns
• Detailed comparison of token issuance, session risk, and action-time authorization controls
• Deployment examples for private, hybrid, on-premises, and air-gapped identity architectures
• Case study metrics showing how continuous authority was applied in a regulated enterprise environment

👉 The full SecureAuth white paper covers the attack-chain analysis, quantitative risk model, and deployment architecture options.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.