The Definitive Chronicle of Identity & Access Management
BREACH: Major healthcare provider confirms 2.3M patient records exposed via misconfigured SCIM endpoint
CVE-2026-31847: Critical RCE in FortiAuthenticator — CVSS 9.8 — Patch immediately
BREACH: European fintech platform leaks OAuth tokens affecting 890K users
I lead Identity & Access Management engineering for one of Canada's largest corporations, where I architect and manage IAM infrastructure protecting millions of identities across hybrid cloud environments.
I started Identity at the Core because I believe the IAM community deserves a central, independent source for real-time intelligence — not vendor marketing, but the raw signal: breaches, vulnerabilities, policy shifts, and the hard lessons that come with managing identity at enterprise scale.
When I'm not building identity infrastructure, I'm building tools to help other IAM professionals work smarter. I also speak about identity security, Zero Trust architecture, and the evolving threat landscape at industry events.
After reviewing dozens of enterprise Zero Trust deployments, the pattern is clear: organizations invest in network segmentation and endpoint security but treat identity as an afterthought.
I recently audited an environment with 12,000 service accounts — only 3,400 were still in active use. Here is the methodology I used and what we found.
A step-by-step guide to building a real-time alerting pipeline that catches suspicious privilege escalation patterns in Entra ID, using KQL queries and Logic Apps.
The System for Cross-domain Identity Management was supposed to solve identity provisioning. Instead, every vendor implements it differently.
Five years of lessons compressed into the things I wish someone had told me on day one: lifecycle management, governance automation, and the politics of access.
Got a question about identity security, architecture, or career advice? Ask away — I answer every week.
No published answers yet. Be the first to ask a question — I answer the best ones every week.
Available for keynotes, workshops, advisory engagements, and podcast appearances