Field Note 05
Attackers do not need novel techniques when reused passwords keep working against enough accounts to make the math worthwhile.
Credential stuffing persists because it turns a breach somewhere else into access here. The economics are simple and ugly: replay enough passwords and some percentage will still work.
That makes uniqueness more important than cleverness. A weak-looking but unique random password is often better than a strong-looking pattern reused across five services.
The boring fix remains the right one: manager-generated unique credentials, especially for accounts tied to identity, payments, and recovery.
Field Note 01
Passkeys are growing fast, but most users still live in a mixed environment. The manager remains the bridge technology that keeps unique secrets viable everywhere.
Read articleField Note 02
The strongest password in the world does not help if a stale phone number, a weak helpdesk script, or an old backup email can bypass it.
Read articleField Note 03
Treat passkey rollout as an identity graph problem. Start with email, admin consoles, finance, and source control because they affect everything else.
Read article