Related Big Read: When legitimacy is synthetic
Related assets: Can you still trust your localhost?; AI supply chain verification
MFA protects an event; it does not automatically protect the session, token, or device that follows.
Identity controls often fail after they appear to have succeeded.
That is the practical lesson of OAuth token theft and MFA bypass. The attacker does not need the password if they can obtain the session. They do not need to defeat MFA if the token issued after MFA can be reused. They do not need to breach the perimeter if a personal device, personal email account, or connected app gives them a valid path around it.
The economics of trust are collapsing because impersonation is cheaper, sessions are portable, and executive digital surfaces are wider than many enterprise security models assume.
What this toolkit is
This is a decision-support toolkit for reviewing OAuth, MFA, session, and executive identity controls after a suspected token, personal email, or high-risk account incident.
It is not a protocol deep dive.
The aim is to help you ask whether the organisation is protecting the continuing session, not only the login ceremony.
Use this toolkit to review identity controls after a suspected token, personal email, or high-risk account incident. Work through the current state, control improvements, and key considerations before deciding whether the organisation can still trust the session.
Understand your current state
- Audit OAuth grants for privileged and executive accounts.
- Revoke any grant older than 30 days that is not actively in use.
- Review high-risk scopes, not only grant age.
- Require re-authentication for sensitive actions, regardless of active session status.
- Enable session anomaly detection or token binding where available.
Strengthen identity and session controls
- Implement continuous session validation for privileged users.
- Trigger re-verification on geography, device, access-pattern, and impossible-travel anomalies.
- Govern personal devices used for professional calendaring, contacts, email, or identity-linked workflows.
- Deploy executive honeytokens or equivalent tripwires in high-risk personal storage surfaces.
- Test whether conditional access policies apply to token refresh, not only initial login.
Key considerations
Key questions for security review
- What is the token lifetime configuration for your highest-privilege accounts?
- Do conditional access policies apply to token refresh or only initial authentication?
- Which executive personal devices or accounts have enterprise-connected OAuth grants?
- How would you detect a valid OAuth token being used from an unexpected geography?
- Who can revoke the session under pressure?
The executive test
Ask whether MFA is being treated as proof of continuing trust.
If the answer is yes, the organisation has a session problem.
The real control question is what happens after the user is believed.
