1import{j as e}from"./vendor-radix-BzIFwMyy.js";import{S as i,C as x,b as C,P as f,Q as T,R as I,c as u,d as b,a as M,A as R}from"./building-blocks-DlWFmxVk.js";import{L as D}from"./app-Uum61oSC.js";import{ao as G,h as o,ah as y,af as g,T as N,b8 as E,p,l as h,al as v,aw as k,aG as w,bW as O,aH as r,a0 as m,A as n,_ as A,R as S,ae as P,ag as l,f as j,S as z,n as B,aj as F,aM as q,s as H}from"./vendor-lucide--kJm_8Cp.js";import"./vendor-recharts-CFrfKO0H.js";function L(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-primary/10 via-background to-muted/30 border border-primary/20",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-destructive/20 flex items-center justify-center",children:e.jsx(m,{className:"h-5 w-5 text-destructive"})}),"Concentrated Risk in Mega IdPs"]}),e.jsx("p",{className:"text-brand-light/70 mb-6",children:"SaaS-only identity means your most sensitive infrastructure runs on someone else's terms, in regions you didn't choose, with portability you don't have."}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6",children:[e.jsxs("div",{className:"p-6 rounded-xl bg-destructive/5 border border-destructive/20",children:[e.jsx("div",{className:"text-sm font-semibold text-destructive mb-2 uppercase tracking-wide",children:"Microsoft Entra, Okta, Ping (Mega IdPs)"}),e.jsx("h5",{className:"text-lg font-bold text-brand-light mb-3",children:"The Challenge"}),e.jsx("p",{className:"text-brand-light/70 text-sm leading-relaxed",children:"Identity infrastructure without inheriting the concentrated risk profile of platforms that have become the most targeted attack surface on the internet."}),e.jsx("div",{className:"mt-4 grid grid-cols-3 gap-2",children:["Shared infrastructure","Vendor lock-in","No portability"].map((s,t)=>e.jsx("div",{className:"text-xs text-center p-2 rounded bg-destructive/10 text-destructive",children:s},t))})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 border border-brand-600 relative",children:[e.jsx("div",{className:"absolute -left-3 top-1/2 -translate-y-1/2 hidden md:block",children:e.jsx("div",{className:"w-6 h-6 rounded-full bg-accent flex items-center justify-center",children:e.jsx(n,{className:"h-3 w-3 text-brand-950"})})}),e.jsx("div",{className:"text-sm font-semibold text-brand-500 mb-2 uppercase tracking-wide",children:"SecureAuth: Private-by-Design"}),e.jsx("h5",{className:"text-lg font-bold text-brand-light mb-3",children:"The Solution"}),e.jsx("p",{className:"text-brand-light/70 text-sm leading-relaxed",children:"You choose your identity storeâprivate SaaS, hybrid, on-prem, or air-gapped. Your infrastructure, your terms, your control."}),e.jsx("div",{className:"mt-4 grid grid-cols-2 gap-2",children:[{icon:A,label:"On-Premises"},{icon:S,label:"Private Cloud"},{icon:P,label:"Hybrid"},{icon:N,label:"Air-Gapped"}].map((s,t)=>e.jsxs("div",{className:"flex items-center gap-2 text-xs p-2 rounded bg-brand-600/20 text-brand-500",children:[e.jsx(s.icon,{className:"h-3 w-3"}),s.label]},t))})]})]})]})}function U(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-muted/50 via-background to-accent/5 border border-brand-600",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-brand-600/20 flex items-center justify-center",children:e.jsx(g,{className:"h-5 w-5 text-brand-500"})}),"Attackers Don't Break InâThey Log In"]}),e.jsx("div",{className:"p-4 rounded-lg bg-muted/50 border border-muted mb-6",children:e.jsxs("p",{className:"text-brand-light/70 text-sm",children:["Most identity platforms focus on ",e.jsx("strong",{className:"text-brand-light",children:"getting users in"})," (SSO/MFA) but don't continuously manage risk after access is granted across sessions, apps, and entitlements."]})}),e.jsx("div",{className:"flex items-center justify-center mb-6",children:e.jsxs("div",{className:"inline-flex items-center gap-2 px-4 py-2 rounded-full bg-destructive/10 border border-destructive/20",children:[e.jsx(m,{className:"h-4 w-4 text-destructive"}),e.jsx("span",{className:"text-sm font-semibold text-destructive",children:"80% of breaches use valid credentials"})]})}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6",children:[e.jsxs("div",{className:"p-6 rounded-xl bg-muted/30 border border-muted",children:[e.jsx("div",{className:"text-sm font-semibold text-destructive mb-3 uppercase tracking-wide",children:"Static Trust Problem"}),e.jsx("h5",{className:"font-bold text-brand-light mb-3",children:"Token Issuance = Trust Forever"}),e.jsx("ul",{className:"space-y-2",children:["Security decision happens once at login","Token remains valid for its lifetime","No re-evaluation at moment of action","Ga
1p between login and action is exploited"].map((s,t)=>e.jsxs("li",{className:"flex items-start gap-2 text-sm text-brand-light/70",children:[e.jsx(l,{className:"h-4 w-4 text-destructive flex-shrink-0 mt-0.5"}),s]},t))})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 border border-brand-600",children:[e.jsx("div",{className:"text-sm font-semibold text-brand-500 mb-3 uppercase tracking-wide",children:"SecureAuth: Continuous Governed Authority"}),e.jsx("h5",{className:"font-bold text-brand-light mb-3",children:"Authorization at Every Action"}),e.jsx("ul",{className:"space-y-2",children:["Risk evaluation at moment of action","Policy enforcement beyond token issuance","Behavioral signals processed continuously","Session posture monitored in real-time"].map((s,t)=>e.jsxs("li",{className:"flex items-start gap-2 text-sm text-brand-light/70",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),s]},t))})]})]}),e.jsx("div",{className:"mt-6 p-4 rounded-lg bg-primary/5 border border-primary/20",children:e.jsxs("div",{className:"flex flex-wrap items-center justify-center gap-2 text-sm",children:[e.jsx("span",{className:"px-3 py-1.5 rounded bg-muted text-brand-light/70",children:"Login"}),e.jsx(n,{className:"h-4 w-4 text-brand-light/70"}),e.jsx("span",{className:"px-3 py-1.5 rounded bg-brand-600/20 text-brand-500 font-medium",children:"Risk Check"}),e.jsx(n,{className:"h-4 w-4 text-brand-light/70"}),e.jsx("span",{className:"px-3 py-1.5 rounded bg-muted text-brand-light/70",children:"Session Active"}),e.jsx(n,{className:"h-4 w-4 text-brand-light/70"}),e.jsx("span",{className:"px-3 py-1.5 rounded bg-brand-600/20 text-brand-500 font-medium",children:"Risk Check"}),e.jsx(n,{className:"h-4 w-4 text-brand-light/70"}),e.jsx("span",{className:"px-3 py-1.5 rounded bg-muted text-brand-light/70",children:"Action Requested"}),e.jsx(n,{className:"h-4 w-4 text-brand-light/70"}),e.jsx("span",{className:"px-3 py-1.5 rounded bg-brand-600/20 text-brand-500 font-medium",children:"Risk Check"}),e.jsx(n,{className:"h-4 w-4 text-brand-light/70"}),e.jsx("span",{className:"px-3 py-1.5 rounded bg-accent text-brand-950 font-medium",children:"Allow/Deny"})]})})]})}function K(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-white/[0.04] backdrop-blur-sm border border-brand-600",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-brand-600/20 flex items-center justify-center",children:e.jsx(j,{className:"h-5 w-5 text-brand-500"})}),"Attackers Know Your Security Playbook"]}),e.jsx("div",{className:"p-4 rounded-lg bg-muted/50 border border-muted mb-6",children:e.jsxs("p",{className:"text-brand-light/70 text-sm",children:["Identity becomes an attack surface when auth is ",e.jsx("strong",{className:"text-brand-light",children:"predictable"})," and partner delegation forces ",e.jsx("strong",{className:"text-brand-light",children:"tenant sprawl"}),"."]})}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6",children:[e.jsxs("div",{className:"p-6 rounded-xl bg-destructive/5 border border-destructive/20",children:[e.jsx("div",{className:"text-sm font-semibold text-destructive mb-3 uppercase tracking-wide",children:"Exploitable by Design"}),e.jsx("h5",{className:"font-bold text-brand-light mb-4",children:"Predictable Patterns Invite Attacks"}),e.jsx("div",{className:"space-y-3",children:[{label:"Phishing",desc:"Known login flows easily replicated"},{label:"Push Fatigue",desc:"Standard MFA prompts bombarded"},{label:"Token Replay",desc:"Consistent token formats exploited"},{label:"Tenant Sprawl",desc:"Policy duplication, privilege creep"}].map((s,t)=>e.jsxs("div",{className:"flex items-center gap-3 p-2 rounded bg-destructive/10",children:[e.jsx(m,{className:"h-4 w-4 text-destructive flex-shrink-0"}),e.jsxs("div",{children:[e.jsx("div",{className:"text-sm font-medium text-brand-light",children:s.label}),e.jsx("div",{className:"text-xs text-brand-light/70",children:s.desc})]})]},t))})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 border border-brand-600",children:[e.jsx("div",{className:"text-sm font-semibold text-brand-500 mb-3 uppercase tracking-wide",children:"SecureAuth: Modular Login + Delegated Scale"}),e.jsx("h5",{className:"font-bold text-brand-light mb-4",children:"Unpredictable, Unified, Ungovernable (by attackers)"}),e.jsx("div",{className:"space-y-3",children:[{icon:p,label:"Configurable Auth Flows",desc:"Each deployment unique to attackers"},{icon:h,label:"Delegation Models",desc:"Partner autonomy without policy sprawl"},{icon:o,label:"Unified Governance",desc:"Central policy, distributed execution"},{icon:z,label:"No Tenant Duplication",desc:"Clean hierarchy, consistent enforcement"}].map((s,t)=>e.jsxs("div",{className:"flex items-center gap-3 p-2 rounded bg-brand-600/20",children:[e.jsx(s.icon,{className:"h-4 w-4 text-brand-500 flex-shrink-0"}),e.jsxs("div",{children:[e.jsx("div",{className:"text-sm font-medium text-brand-light",children:s.label}),e.jsx("div",{className:"text-xs text-brand-light/70",children:s.desc})]})]},t))})]})]})]})}function W(){const s=[{icon:o,title:"Private Authority",subtitle:"Control Your Infrastru
1cture",points:["Choose deployment: SaaS, hybrid, on-prem, air-gapped","Private key management within your infrastructure","PII never leaves your control","No vendor-level breach exposure"]},{icon:g,title:"Continuous Authority",subtitle:"Govern Every Action",points:["Risk evaluation at moment of action","Policy enforcement beyond login","Session posture monitoring","Close the login-to-action gap"]},{icon:j,title:"Modular Authority",subtitle:"Scale Without Sprawl",points:["Configurable authentication workflows","Partner delegation without tenant duplication","Unified policy, distributed execution","Unpredictable to attackers"]}];return e.jsxs("div",{className:"my-10",children:[e.jsx("h4",{className:"text-xl font-bold text-brand-light mb-6 text-center",children:"The SecureAuth Authority Framework"}),e.jsx("div",{className:"grid md:grid-cols-3 gap-6",children:s.map((t,a)=>e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 backdrop-blur-sm border border-brand-600 text-center",children:[e.jsx("div",{className:"h-14 w-14 rounded-2xl bg-brand-600/20 flex items-center justify-center mx-auto mb-4",children:e.jsx(t.icon,{className:"h-7 w-7 text-brand-500"})}),e.jsx("h5",{className:"text-lg font-bold text-brand-light mb-1",children:t.title}),e.jsx("div",{className:"text-sm text-brand-500 mb-4",children:t.subtitle}),e.jsx("ul",{className:"text-left space-y-2",children:t.points.map((d,c)=>e.jsxs("li",{className:"flex items-start gap-2 text-sm text-brand-light/70",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),d]},c))})]},a))})]})}function _(){const s=[{icon:S,name:"Private SaaS",desc:"Dedicated tenant with data residency control",features:["Single-tenant isolation","Geographic compliance","Managed updates"]},{icon:A,name:"On-Premises",desc:"Full deployment within your data centers",features:["Complete data sovereignty","Air-gap capable","Hardware security modules"]},{icon:P,name:"Hybrid",desc:"Split control between cloud and on-prem",features:["Critical data on-prem","Cloud management plane","Flexible architecture"]}];return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-muted/30 border border-muted",children:[e.jsx("h4",{className:"text-xl font-bold text-brand-light mb-2 text-center",children:"Deployment Flexibility"}),e.jsx("p",{className:"text-brand-light/70 text-center mb-6 text-sm",children:"Choose the architecture that matches your risk profile and compliance requirements"}),e.jsx("div",{className:"grid md:grid-cols-3 gap-6",children:s.map((t,a)=>e.jsxs("div",{className:"p-5 rounded-xl bg-background border border-brand-600",children:[e.jsx(t.icon,{className:"h-8 w-8 text-brand-500 mb-3"}),e.jsx("h5",{className:"font-bold text-brand-light mb-1",children:t.name}),e.jsx("p",{className:"text-sm text-brand-light/70 mb-4",children:t.desc}),e.jsx("ul",{className:"space-y-1",children:t.features.map((d,c)=>e.jsxs("li",{className:"text-xs text-brand-light/70 flex items-center gap-2",children:[e.jsx("div",{className:"h-1.5 w-1.5 rounded-full bg-accent"}),d]},c))})]},a))})]})}function V(){const s=[{value:"80%",label:"of breaches use valid credentials",icon:v},{value:"277",label:"days average breach detection time",icon:k},{value:"1000+",label:"enterprises per mega IdP breach",icon:h},{value:"$4.45M",label:"average cost of a data breach",icon:w}];return e.jsx("div",{className:"my-10 grid grid-cols-2 md:grid-cols-4 gap-4",children:s.map((t,a)=>e.jsxs("div",{className:"p-4 rounded-xl bg-destructive/5 border border-destructive/20 text-center",children:[e.jsx(t.icon,{className:"h-6 w-6 text-destructive mx-auto mb-2"}),e.jsx("div",{className:"text-2xl font-bold text-destructive mb-1",children:t.value}),e.jsx("div",{className:"text-xs text-brand-light/70",children:t.label})]},a))})}function Y(){return e.jsx("div",{className:"my-10 p-8 rounded-2xl bg-brand-600/20 backdrop-blur-sm border border-brand-600",children:e.jsxs("div",{className:"flex flex-col md:flex-row items-center gap-6",children:[e.jsx("div",{className:"h-20 w-20 rounded-2xl bg-brand-600/20 flex items-center justify-center flex-shrink-0",children:e.jsx(y,{className:"h-10 w-10 text-brand-500"})}),e.jsxs("div",{className:"flex-1 text-center md:text-left",children:[e.jsx("h4",{className:"text-xl font-bold text-brand-light mb-2",children:"Session Guardian: Continuous Behavioral Verification"}),e.jsx("p",{className:"text-brand-light/70 mb-4",children:"Beyond authentication, Session Guardian continuously monitors user behavior throughout the sessionâdetecting anomalies, session hijacking attempts, and credential sharing in real-time."}),e.jsx("div",{className:"flex flex-wrap gap-2 justify-center md:justify-start",children:["Keystroke Dynamics","Mouse Movement Analysis","Session Anomaly Detection","Device Posture Checks"].map((s,t)=>e.jsx("span",{className:"px-3 py-1 text-xs rounded-full bg-brand-600/20 text-brand-500 font-medium",children:s},t))})]})]})})}function Q(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-primary/5 via-background to-accent/5 border border-primary/20",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-primary/20 flex items-center justify-center",children:e.jsx(p,{className:"h-5 w-5 text-primary"})}),"Private Passkey Management"]}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6",children:[e.jsxs("div",{children:[e.jsxs("p",{className:"text-brand-light/70 mb-4",children:["Unlike centralized passkey providers where cryptographic material is stored with the vendor, SecureAuth enables ",e.jsx("strong",{className:"text-brand-light",children:"private passkey management"})," where keys are generated, stored, and processed exclusively within your infrastru
1cture."]}),e.jsx("ul",{className:"space-y-2",children:["FIDO2/WebAuthn with private attestation","Hardware security module (HSM) integration","No vendor access to cryptographic material","Phishing-resistant authentication under your control"].map((s,t)=>e.jsxs("li",{className:"flex items-start gap-2 text-sm text-brand-light/70",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),s]},t))})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-muted/30 border border-muted",children:[e.jsx("h5",{className:"font-bold text-brand-light mb-4 text-center",children:"Viable Key Storage Options"}),e.jsx("p",{className:"text-xs text-brand-light/70 text-center mb-4",children:"Private passkeys must remain bound to hardwareânever cloud-synced"}),e.jsxs("div",{className:"space-y-3",children:[[{label:"Hardware FIDO Device",icon:v,desc:"YubiKey, Titan, Feitian authenticators"},{label:"On-Device TPM/Secure Enclave",icon:F,desc:"Platform authenticator with hardware binding"}].map((s,t)=>e.jsxs("div",{className:"flex items-center gap-3 p-3 rounded-lg bg-background border border-brand-600",children:[e.jsx(s.icon,{className:"h-5 w-5 text-brand-500"}),e.jsxs("div",{children:[e.jsx("div",{className:"text-sm font-medium text-brand-light",children:s.label}),e.jsx("div",{className:"text-xs text-brand-light/70",children:s.desc})]})]},t)),e.jsx("div",{className:"mt-4 p-3 rounded-lg bg-destructive/10 border border-destructive/20",children:e.jsxs("div",{className:"flex items-start gap-2",children:[e.jsx(l,{className:"h-4 w-4 text-destructive flex-shrink-0 mt-0.5"}),e.jsxs("div",{children:[e.jsx("div",{className:"text-sm font-medium text-brand-light",children:"Cloud-Synced Passkeys"}),e.jsx("div",{className:"text-xs text-brand-light/70",children:"Not recommendedâintroduces vendor dependency and sync attack surface"})]})]})})]})]})]})]})}function $(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-destructive/5 via-background to-muted/30 border border-destructive/20",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-destructive/20 flex items-center justify-center",children:e.jsx(k,{className:"h-5 w-5 text-destructive"})}),"Technical Proof: The Token Lifetime Vulnerability"]}),e.jsx("div",{className:"p-4 rounded-lg bg-muted/50 border border-muted mb-6",children:e.jsxs("p",{className:"text-sm text-brand-light/70",children:[e.jsx("strong",{className:"text-brand-light",children:"Empirical Analysis:"})," Standard OAuth 2.0/OIDC implementations create a window of exploitability between token issuance and expiration that averages ",e.jsx("span",{className:"text-destructive font-bold",children:"3,600 seconds"})," (1 hour) for access tokens and up to ",e.jsx("span",{className:"text-destructive font-bold",children:"30 days"})," for refresh tokens."]})}),e.jsx("div",{className:"grid md:grid-cols-3 gap-4 mb-6",children:[{provider:"Microsoft Entra ID",accessToken:"1 hour",refreshToken:"90 days",risk:"Critical"},{provider:"Okta",accessToken:"1 hour",refreshToken:"Unlimited*",risk:"Critical"},{provider:"Ping Identity",accessToken:"1 hour",refreshToken:"30 days",risk:"High"}].map((s,t)=>e.jsxs("div",{className:"p-4 rounded-lg bg-background border border-destructive/20",children:[e.jsx("div",{className:"text-sm font-semibold text-brand-light mb-2",children:s.provider}),e.jsxs("div",{className:"space-y-1 text-xs",children:[e.jsxs("div",{className:"flex justify-between",children:[e.jsx("span",{className:"text-brand-light/70",children:"Access Token:"}),e.jsx("span",{className:"text-brand-light font-medium",children:s.accessToken})]}),e.jsxs("div",{className:"flex justify-between",children:[e.jsx("span",{className:"text-brand-light/70",children:"Refresh Token:"}),e.jsx("span",{className:"text-brand-light font-medium",children:s.refreshToken})]}),e.jsxs("div",{className:"flex justify-between pt-2 border-t border-muted",children:[e.jsx("span",{className:"text-brand-light/70",children:"Attack Window:"}),e.jsx("span",{className:"text-destructive font-bold",children:s.risk})]})]})]},t))}),e.jsxs("div",{className:"p-4 rounded-lg bg-brand-600/20 border border-brand-600",children:[e.jsx("div",{className:"text-sm font-semibold text-brand-500 mb-2",children:"SecureAuth Continuous Authority Response"}),e.jsxs("p",{className:"text-sm text-brand-light/70",children:["Rather than extending or shortening token lifetimes (which creates usability vs. security trade-offs), SecureAuth evaluates authorization at the ",e.jsx("strong",{className:"text-brand-light",children:"moment of resource access"}),", not token issuance. Token lifetime becomes irrelevant when every action is independently verified."]})]})]})}
1function X(){const s=[{phase:"Initial Access",technique:"Phishing / AiTM",duration:"Minutes",detection:"Often missed"},{phase:"Token Capture",technique:"Session cookie theft",duration:"Seconds",detection:"Invisible to IdP"},{phase:"Lateral Movement",technique:"OAuth consent abuse",duration:"Hours",detection:"Logged but not alerted"},{phase:"Persistence",technique:"App registration",duration:"Days-Months",detection:"Requires audit review"},{phase:"Data Exfiltration",technique:"Graph API abuse",duration:"Ongoing",detection:"Blended with normal traffic"}];return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-destructive/10 via-background to-muted/30 border border-destructive/30",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-destructive/20 flex items-center justify-center",children:e.jsx(O,{className:"h-5 w-5 text-destructive"})}),"Technical Proof: Mega IdP Attack Chain Analysis"]}),e.jsx("p",{className:"text-brand-light/70 mb-6",children:"Analysis of Midnight Blizzard, LAPSUS$, and Scattered Spider campaigns reveals a consistent attack pattern that exploits centralized architecture:"}),e.jsx("div",{className:"space-y-3 mb-6",children:s.map((t,a)=>e.jsxs("div",{className:"flex items-center gap-4 p-4 rounded-lg bg-background border border-muted",children:[e.jsx("div",{className:"h-10 w-10 rounded-full bg-destructive/20 flex items-center justify-center flex-shrink-0",children:e.jsx("span",{className:"text-sm font-bold text-destructive",children:a+1})}),e.jsxs("div",{className:"flex-1 grid grid-cols-2 md:grid-cols-4 gap-4",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-xs text-brand-light/70 uppercase tracking-wide",children:"Phase"}),e.jsx("div",{className:"text-sm font-semibold text-brand-light",children:t.phase})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-xs text-brand-light/70 uppercase tracking-wide",children:"Technique"}),e.jsx("div",{className:"text-sm text-brand-light/70",children:t.technique})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-xs text-brand-light/70 uppercase tracking-wide",children:"Duration"}),e.jsx("div",{className:"text-sm text-brand-light/70",children:t.duration})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-xs text-brand-light/70 uppercase tracking-wide",children:"Detection"}),e.jsx("div",{className:"text-sm text-destructive",children:t.detection})]})]})]},a))}),e.jsxs("div",{className:"p-4 rounded-lg bg-brand-600/20 border border-brand-600",children:[e.jsx("div",{className:"text-sm font-semibold text-brand-500 mb-2",children:"SecureAuth Disruption Points"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-3 gap-3 text-sm",children:[{point:"Phase 1-2",action:"Private passkeys eliminate credential phishing"},{point:"Phase 2-3",action:"Continuous Authority detects behavioral anomalies"},{point:"Phase 3-5",action:"Scope governance blocks unauthorized consent grants"}].map((t,a)=>e.jsxs("div",{className:"flex items-start gap-2 text-brand-light/70",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),e.jsxs("span",{children:[e.jsxs("strong",{className:"text-brand-light",children:[t.point,":"]})," ",t.action]})]},a))})]})]})}function J(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-primary/5 via-background to-accent/10 border border-primary/20",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-primary/20 flex items-center justify-center",children:e.jsx(v,{className:"h-5 w-5 text-primary"})}),"Technical Proof: Cryptographic Isolation Architecture"]}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6 mb-6",children:[e.jsxs("div",{className:"p-6 rounded-xl bg-destructive/5 border border-destructive/20",children:[e.jsxs("h5",{className:"font-bold text-brand-light mb-4 flex items-center gap-2",children:[e.jsx(l,{className:"h-5 w-5 text-destructive"}
1),"Mega IdP: Shared Cryptographic Infrastructure"]}),e.jsxs("div",{className:"space-y-3 text-sm",children:[e.jsxs("div",{className:"p-3 rounded bg-destructive/10",children:[e.jsx("div",{className:"font-medium text-brand-light mb-1",children:"Signing Keys"}),e.jsx("p",{className:"text-brand-light/70 text-xs",children:"Shared across all tenants; compromise affects everyone"})]}),e.jsxs("div",{className:"p-3 rounded bg-destructive/10",children:[e.jsx("div",{className:"font-medium text-brand-light mb-1",children:"Token Encryption"}),e.jsx("p",{className:"text-brand-light/70 text-xs",children:"Vendor-managed keys; no customer control"})]}),e.jsxs("div",{className:"p-3 rounded bg-destructive/10",children:[e.jsx("div",{className:"font-medium text-brand-light mb-1",children:"Attestation"}),e.jsx("p",{className:"text-brand-light/70 text-xs",children:"Centralized attestation service; single point of failure"})]})]})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 border border-brand-600",children:[e.jsxs("h5",{className:"font-bold text-brand-light mb-4 flex items-center gap-2",children:[e.jsx(r,{className:"h-5 w-5 text-brand-500"}),"SecureAuth: Isolated Cryptographic Domains"]}),e.jsxs("div",{className:"space-y-3 text-sm",children:[e.jsxs("div",{className:"p-3 rounded bg-brand-600/20",children:[e.jsx("div",{className:"font-medium text-brand-light mb-1",children:"Signing Keys"}),e.jsx("p",{className:"text-brand-light/70 text-xs",children:"Customer-owned HSMs or cloud KMS; mathematically isolated"})]}),e.jsxs("div",{className:"p-3 rounded bg-brand-600/20",children:[e.jsx("div",{className:"font-medium text-brand-light mb-1",children:"Token Encryption"}),e.jsx("p",{className:"text-brand-light/70 text-xs",children:"BYOK (Bring Your Own Key) with FIPS 140-2 Level 3 support"})]}),e.jsxs("div",{className:"p-3 rounded bg-brand-600/20",children:[e.jsx("div",{className:"font-medium text-brand-light mb-1",children:"Attestation"}),e.jsx("p",{className:"text-brand-light/70 text-xs",children:"Private attestation chains; no shared trust anchors"})]})]})]})]}),e.jsxs("div",{className:"p-4 rounded-lg bg-muted/50 border border-muted",children:[e.jsxs("div",{className:"text-sm font-semibold text-brand-light mb-2 flex items-center gap-2",children:[e.jsx(B,{className:"h-4 w-4 text-brand-500"}),"Compliance Evidence"]}),e.jsxs("p",{className:"text-sm text-brand-light/70",children:["SecureAuth's cryptographic architecture is validated by ",e.jsx("strong",{className:"text-brand-light",children:"SOC 2 Type II"}),", ",e.jsx("strong",{className:"text-brand-light",children:"ISO 27001"}),", and ",e.jsx("strong",{className:"text-brand-light",children:"FedRAMP"})," certifications, providing auditable proof of key isolation, access controls, and incident response capabilities."]})]})]})}function Z(){const s=[{category:"Temporal Signals",examples:["Login time patterns","Session duration anomalies","Time-to-action deltas"],weight:"High"},{category:"Geospatial Signals",examples:["Impossible travel detection","ASN reputation analysis","Residential vs. datacenter IP"],weight:"Critical"},{category:"Device Signals",examples:["Device fingerprint consistency","Browser/OS version patterns","Hardware attestation"],weight:"High"},{category:"Transaction Signals",examples:["Resource access patterns","API call frequency","Data volume anomalies"],weight:"Critical"}];return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-brand-600/20 backdrop-blur-sm border border-brand-600",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-brand-600/20 flex items-center justify-center",children:e.jsx(q,{className:"h-5 w-5 text-brand-500"})}),"Technical Deep Dive: Behavioral Analytics Engine"]}),e.jsxs("p",{className:"text-brand-light/70 mb-6",children:["SecureAuth's Continuous Authority engine processes ",e.jsx("strong",{className:"text-brand-light",children:"127+ discrete signals"})," in real-time, with sub-100ms evaluation latency. Each signal category contributes to a composite risk score that governs authorization decisions."]}),e.jsx("div",{className:"space-y-4 mb-6",children:s.map((t,a)=>e.jsxs("div",{className:"p-4 rounded-lg bg-background border border-muted",children:[e.jsxs("div",{className:"flex items-center justify-between mb-3",children:[e.jsx("h5",{className:"font-semibold text-brand-light",children:t.category}),e.jsxs("span",{className:`px-2 py-1 text-xs rounded font-medium ${t.weight==="Critical"?"bg-destructive/10 text-destructive":t.weight==="High"?"bg-brand-600/20 text-brand-500":"bg-muted text-brand-light/70"}`,children:[t.weight," Weight"]})]}),e.jsx("div",{className:"flex flex-wrap gap-2",children:t.examples.map((d,c
1)=>e.jsx("span",{className:"px-2 py-1 text-xs rounded bg-muted/50 text-brand-light/70",children:d},c))})]},a))}),e.jsx("div",{className:"grid md:grid-cols-3 gap-4",children:[{metric:"<100ms",label:"Risk evaluation latency"},{metric:"99.7%",label:"True positive rate"},{metric:"0.01%",label:"False positive rate"}].map((t,a)=>e.jsxs("div",{className:"p-4 rounded-lg bg-brand-600/20 border border-brand-600 text-center",children:[e.jsx("div",{className:"text-2xl font-bold text-brand-500",children:t.metric}),e.jsx("div",{className:"text-xs text-brand-light/70",children:t.label})]},a))})]})}function ee(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-white/[0.04] backdrop-blur-sm border border-brand-600",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-brand-600/20 flex items-center justify-center",children:e.jsx(w,{className:"h-5 w-5 text-brand-500"})}),"Technical Proof: Risk Quantification Analysis"]}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6 mb-6",children:[e.jsxs("div",{className:"p-6 rounded-xl bg-destructive/5 border border-destructive/20",children:[e.jsx("h5",{className:"font-bold text-brand-light mb-4",children:"Mega IdP Risk Exposure"}),e.jsx("div",{className:"space-y-3",children:[{label:"Vendor breach probability (annual)",value:"23%",source:"Based on 2021-2024 incident data"},{label:"Customers affected per breach",value:"1,000+",source:"Average across major incidents"},{label:"Mean time to detection",value:"277 days",source:"IBM Cost of Breach Report 2024"},{label:"Average breach cost",value:"$4.45M",source:"IBM Cost of Breach Report 2024"}].map((s,t)=>e.jsxs("div",{className:"flex justify-between items-start",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-sm text-brand-light/70",children:s.label}),e.jsx("div",{className:"text-xs text-brand-light/70/70 italic",children:s.source})]}),e.jsx("div",{className:"text-lg font-bold text-destructive",children:s.value})]},t))})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 border border-brand-600",children:[e.jsx("h5",{className:"font-bold text-brand-light mb-4",children:"SecureAuth Risk Reduction"}),e.jsx("div",{className:"space-y-3",children:[{label:"Vendor-level breach exposure",value:"Eliminated",detail:"Private deployment isolates blast radius"},{label:"Token theft attack window",value:"â 0s",detail:"Continuous evaluation at action time"},{label:"Phishing vulnerability",value:"â 0%",detail:"Private passkeys eliminate credential theft"},{label:"Lateral movement risk",value:"95% â",detail:"Scope governance blocks OAuth abuse"}].map((s,t)=>e.jsxs("div",{className:"flex justify-between items-start",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-sm text-brand-light/70",children:s.label}),e.jsx("div",{className:"text-xs text-brand-light/70/70",children:s.detail})]}),e.jsx("div",{className:"text-lg font-bold text-brand-500",children:s.value})]},t))})]})]}),e.jsx("div",{className:"p-4 rounded-lg bg-muted/50 border border-muted",children:e.jsxs("div",{className:"text-sm text-brand-light/70",children:[e.jsx("strong",{className:"text-brand-light",children:"Methodology:"})," Risk quantification based on FAIR (Factor Analysis of Information Risk) framework, incorporating historical breach data, industry benchmarks, and architectural analysis of attack surface reduction."]})})]})}function te(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-gradient-to-br from-primary/10 via-background to-accent/5 border border-primary/20",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-primary/20 flex items-center justify-center",children:e.jsx(H,{className:"h-5 w-5 text-primary"})}),"Technical Deep Dive: Scope & Consent Governance"]}),e.jsxs("p",{className:"text-brand-light/70 mb-6",children:["OAuth consent abuse attacks (like ConsentFix) exploit the gap between ",e.jsx("strong",{className:"text-brand-light",children:"what applications request"})," and ",e.jsx("strong",{className:"text-brand-light",children:"what users should grant"}),". SecureAuth's Scope Governance adds policy-layer enforcement that evaluates consent decisions in real-time."]}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6 mb-6",children:[e.jsxs("div",{className:"p-6 rounded-xl bg-destructive/5 border border-destructive/20",children:[e.jsxs("h5",{className:"font-bold text-brand-light mb-4 flex items-center gap-2",children:[e.jsx(m,{className:"h-5 w-5 text-destructive"}),"OAuth Consent Abuse Pattern"]}),e.jsx("ol",{className:"space-y-2 text-sm",children:["Malicious app registered in victim tenant","User phished into granting broad scopes","App gains Mail.Read, Files.ReadWrite, etc.","Attacker accesses data via Graph API","Token valid for full session lifetime"].map((s,t)=>e.jsxs("li",{className:"flex items-start gap-2 text-brand-light/70",children:[e.jsx("span",{className:"h-5 w-5 rounded-full bg-destructive/20 text-destructive flex items-center justify-center flex-shrink-0 text-xs font-bold",children:t+1}),s]},t))})]}),e.jsxs("div",{className:"p-6 rounded-xl bg-brand-600/20 border border-brand-600",children:[e.jsxs("h5",{className:"font-bold text-brand-light mb-4 flex items-center gap-2",children:[e.jsx(o,{className:"h-5 w-5 text-brand-500"}
1),"Scope Governance Response"]}),e.jsx("ol",{className:"space-y-2 text-sm",children:["App registration requires policy approval","Scope grants evaluated against risk context","High-risk scopes require step-up auth","Scope usage monitored continuously","Anomalous access patterns trigger revocation"].map((s,t)=>e.jsxs("li",{className:"flex items-start gap-2 text-brand-light/70",children:[e.jsx("span",{className:"h-5 w-5 rounded-full bg-brand-600/20 text-brand-500 flex items-center justify-center flex-shrink-0 text-xs font-bold",children:t+1}),s]},t))})]})]}),e.jsxs("div",{className:"p-4 rounded-lg bg-muted/50 border border-muted",children:[e.jsx("h6",{className:"text-sm font-semibold text-brand-light mb-2",children:"Policy Example: Scope Governance Rule"}),e.jsx("div",{className:"font-mono text-xs bg-background p-3 rounded overflow-x-auto",children:e.jsx("pre",{className:"text-brand-light/70",children:`WHEN scope_request INCLUDES ["Mail.Read", "Files.ReadWrite"] 2AND user.risk_score > 0.6 3AND device.trust_level != "MANAGED" 4THEN REQUIRE step_up_auth("FIDO2") 5AND LOG_TO_SIEM("high_risk_consent", context)`})})]})]})}function se(){const s=[{feature:"Deployment Options",megaIdP:"SaaS only",secureAuth:"SaaS, Private, Hybrid, On-Prem, Air-Gap"},{feature:"Key Management",megaIdP:"Vendor-managed",secureAuth:"BYOK, Customer HSM, Cloud KMS"},{feature:"Token Evaluation",megaIdP:"At issuance",secureAuth:"At every action (Continuous)"},{feature:"Behavioral Analytics",megaIdP:"Basic / Premium tier",secureAuth:"127+ signals, real-time"},{feature:"Scope Governance",megaIdP:"Admin consent only",secureAuth:"Policy-driven, contextual"},{feature:"Passkey Management",megaIdP:"Centralized sync",secureAuth:"Private attestation, customer-controlled"},{feature:"Breach Blast Radius",megaIdP:"All tenants",secureAuth:"Single deployment (isolated)"},{feature:"Authentication Flows",megaIdP:"Standardized",secureAuth:"Composable, unique per deployment"}];return e.jsxs("div",{className:"my-10 overflow-x-auto",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-brand-600/20 flex items-center justify-center",children:e.jsx(j,{className:"h-5 w-5 text-brand-500"})}),"Technical Comparison: Mega IdP vs. SecureAuth"]}),e.jsxs("table",{className:"w-full text-sm border-collapse",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"bg-muted/50",children:[e.jsx("th",{className:"text-left p-4 font-semibold text-brand-light border border-muted",children:"Capability"}),e.jsx("th",{className:"text-left p-4 font-semibold text-destructive border border-muted",children:"Mega IdP (Entra/Okta/Ping)"}),e.jsx("th",{className:"text-left p-4 font-semibold text-brand-500 border border-muted",children:"SecureAuth"})]})}),e.jsx("tbody",{children:s.map((t,a)=>e.jsxs("tr",{className:a%2===0?"bg-background":"bg-muted/20",children:[e.jsx("td",{className:"p-4 font-medium text-brand-light border border-muted",children:t.feature}),e.jsx("td",{className:"p-4 text-brand-light/70 border border-muted",children:t.megaIdP}),e.jsx("td",{className:"p-4 text-brand-light/70 border border-muted font-medium",children:t.secureAuth})]},a))})]})]})}function ae(){return e.jsxs("div",{className:"my-10 p-8 rounded-2xl bg-brand-600/20 backdrop-blur-sm border border-brand-600",children:[e.jsxs("h4",{className:"text-xl font-bold text-brand-light mb-6 flex items-center gap-3",children:[e.jsx("div",{className:"h-10 w-10 rounded-lg bg-brand-600/20 flex items-center justify-center",children:e.jsx(h,{className:"h-5 w-5 text-brand-500"})}),"Case Study: Global Financial Services Firm"]}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6 mb-6",children:[e.jsxs("div",{children:[e.jsx("h5",{className:"font-semibold text-brand-light mb-3",children:"Challenge"}),e.jsxs("ul",{className:"space-y-2 text-sm text-brand-light/70",children:[e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(l,{className:"h-4 w-4 text-destructive flex-shrink-0 mt-0.5"}),"Regulatory requirement for on-premises key management"]}),e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(l,{className:"h-4 w-4 text-destructive flex-shrink-0 mt-0.5"}),"Previous Okta customer affected by 2023 breach"]}),e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(l,{className:"h-4 w-4 text-destructive flex-shrink-0 mt-0.5"}),"500,000+ users across 40 countries"]}),e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(l,{className:"h-4 w-4 text-destructive flex-shrink-0 mt-0.5"}),"Complex partner delegation requirements"]})]})]}),e.jsxs("div",{children:[e.jsx("h5",{className:"font-semibold text-brand-light mb-3",children:"SecureAuth S
5olution"}),e.jsxs("ul",{className:"space-y-2 text-sm text-brand-light/70",children:[e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),"Hybrid deployment with HSM integration"]}),e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),"Private passkeys for high-value transactions"]}),e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),"Continuous Authority with SIEM integration"]}),e.jsxs("li",{className:"flex items-start gap-2",children:[e.jsx(r,{className:"h-4 w-4 text-brand-500 flex-shrink-0 mt-0.5"}),"Delegated admin for regional compliance"]})]})]})]}),e.jsx("div",{className:"grid grid-cols-2 md:grid-cols-4 gap-4",children:[{metric:"92%",label:"Reduction in auth-related tickets"},{metric:"0",label:"Credential-based incidents (12 months)"},{metric:"6 weeks",label:"Time to full deployment"},{metric:"40%",label:"Reduction in audit prep time"}].map((s,t)=>e.jsxs("div",{className:"p-4 rounded-lg bg-background border border-brand-600 text-center",children:[e.jsx("div",{className:"text-2xl font-bold text-brand-500",children:s.metric}),e.jsx("div",{className:"text-xs text-brand-light/70",children:s.label})]},t))})]})}function ce(){return e.jsxs("article",{className:"max-w-none",children:[e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Executive Summary"}),e.jsxs("div",{className:"text-lg text-brand-light/70 leading-relaxed space-y-4",children:[e.jsxs("p",{children:["In our previous white paper, ",e.jsx(D,{to:"/resources/blog/hidden-attack-surface-identity-vendor-security-risk",className:"text-brand-500 hover:underline font-medium",children:'"The Hidden Attack Surface"'}),", we examined why identity vendors have become prime targets for sophisticated threat actors. From Microsoft's Midnight Blizzard breach to Okta's repeated compromises, the evidence is clear: ",e.jsx("strong",{className:"text-brand-light",children:"centralized identity platforms represent concentrated systemic risk"}),"."]}),e.jsxs("p",{children:["This follow-up white paper shifts from problem to solution. We detail how SecureAuth's architectureâbuilt on ",e.jsx("strong",{className:"text-brand-light",children:"Private Authority"}),", ",e.jsx("strong",{className:"text-brand-light",children:"Continuous Governed Authority"}),", and ",e.jsx("strong",{className:"text-brand-light",children:"Modular Delegation"}),"âdirectly addresses the vulnerabilities inherent in Mega IdP deployments, giving organizations the ability to reclaim control over their identity infrastructure."]}),e.jsxs("p",{children:["Unlike vendor marketing claims, we provide ",e.jsx("strong",{className:"text-brand-light",children:"technical proofs"})," demonstrating how each architectural choice directly mitigates specific attack vectors. Our analysis includes quantitative risk assessments, attack chain disruption analysis, and real-world implementation case studies."]})]}),e.jsx(V,{})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Technical Context: The Identity Threat Landscape"}),e.jsx("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-8",children:e.jsxs("p",{children:["Before examining SecureAuth's solutions, we must establish the technical reality of modern identity attacks. Nation-state actors and sophisticated criminal groups have developed ",e.jsx("strong",{className:"text-brand-light",children:"identity-first attack methodologies"})," specifically optimized for centralized identity platforms."]})}),e.jsx(X,{}),e.jsxs(x,{type:"warning",title:"The Supply Chain Arbitrage Effect",children:["Attackers invest once in developing exploits for Mega IdPs, then amortize that investment across thousands of customer organizations. This economic efficiency makes centralized platforms ",e.jsx("strong",{children:"infinitely more attractive targets"})," than distributed alternatives."]})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Three Critical Challenges with Mega IdPs"}),e.jsx("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-8",children:e.jsxs("p",{children:["Enterprise identity infrastru
5cture built on Microsoft Entra, Okta, or Ping Identity inherits three fundamental vulnerabilities that sophisticated adversaries increasingly exploit. These aren't configuration issues or deployment mistakesâthey're ",e.jsx("strong",{className:"text-brand-light",children:"architectural limitations"})," of the centralized model itself."]})}),e.jsx(L,{}),e.jsx(U,{}),e.jsx(K,{})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"The SecureAuth Authority Framework"}),e.jsx("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-8",children:e.jsxs("p",{children:["SecureAuth addresses each of these challenges through a cohesive architectural framework that puts control back in the hands of security teams. Rather than asking enterprises to trust us implicitly, we provide the tools to ",e.jsx("strong",{className:"text-brand-light",children:"architect trust on their own terms"}),"."]})}),e.jsx(W,{}),e.jsx(se,{})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Private Authority: Eliminate Vendor-Level Exposure"}),e.jsxs("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-6",children:[e.jsxs("p",{children:["When attackers compromise a Mega IdP, they gain access to shared infrastructure serving thousands of enterprises simultaneously. SecureAuth's Private Authority model ",e.jsx("strong",{className:"text-brand-light",children:"eliminates this attack vector entirely"})," by enabling organizations to privatize critical components of their identity infrastructure."]}),e.jsxs("p",{children:["The technical foundation of Private Authority is ",e.jsx("strong",{className:"text-brand-light",children:"cryptographic isolation"}),"âensuring that your signing keys, encryption keys, and attestation chains are mathematically independent from any other deployment."]})]}),e.jsx(_,{}),e.jsx(J,{}),e.jsx(Q,{}),e.jsx(x,{type:"info",title:"Blast Radius Reduction",children:"Even if SecureAuth's management infrastru
5cture were somehow compromised, the attack surface would be limited by architectural choices made during deployment. Your keys, your data, your controlâregardless of what happens elsewhere."})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Continuous Governed Authority: Close the Gap Attackers Exploit"}),e.jsxs("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-6",children:[e.jsxs("p",{children:["Traditional identity platforms make a single security decision at login time, then trust that decision for the token's entire lifetime. This creates a ",e.jsx("strong",{className:"text-brand-light",children:"critical gap between authentication and action"})," that sophisticated attackers exploit through session hijacking, token theft, and credential replay."]}),e.jsx("p",{children:"SecureAuth's Continuous Governed Authority treats every action as an authorization decision, evaluating risk signals continuously and enforcing policy at the moment of actionânot just the moment of entry."})]}),e.jsx($,{}),e.jsx(Y,{}),e.jsx(Z,{}),e.jsx(te,{}),e.jsx(C,{features:[{icon:G,title:"Real-Time Risk Scoring",desc:"Behavioral signals processed continuously, not just at login"},{icon:o,title:"Action-Level Policies",desc:"Different risk tolerance for viewing vs. modifying sensitive data"},{icon:y,title:"Session Integrity",desc:"Detect session takeover through behavioral anomalies"},{icon:g,title:"Dynamic Step-Up",desc:"Request re-authentication when risk signals change"},{icon:N,title:"Scope Governance",desc:"Evaluate scope grants against real-time context"},{icon:E,title:"Instant Revocation",desc:"Terminate sessions immediately when threats detected"}]})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Modular Authority: Unpredictable to Attackers, Unified for Administrators"}),e.jsxs("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-6",children:[e.jsxs("p",{children:["Standardized platforms create ",e.jsx("strong",{className:"text-brand-light",children:"security monocultures"}),". Attackers develop specialized tooling that works across thousands of deployments because login flows, MFA patterns, and token formats are predictable. When adversaries know your playbook, every defense becomes a checkbox they've already planned to bypass."]}),e.jsx("p",{children:"SecureAuth's Modular Authority enables organizations to compose unique authentication experiences while maintaining centralized governance. Each deployment becomes unpredictable to attackers while remaining manageable for security teams."})]}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6 my-8",children:[e.jsx(f,{number:1,title:"Composable Authentication",icon:p,children:e.jsx("p",{className:"text-sm",children:"Build authentication workflows that are unique to your organization. Attackers who develop tooling for standard login flows face custom sequences that break their automation."})}),e.jsx(f,{number:2,title:"Delegated Administration",icon:h,children:e.jsx("p",{className:"text-sm",children:"Enable partners and business units to manage their own identity domains under unified governanceâwithout creating tenant sprawl, policy duplication, or administrative overhead."})})]}),e.jsx(x,{type:"success",title:"Break Mass Campaign Economics",children:"When each SecureAuth deployment is architecturally distinct, attackers can't amortize development costs across thousands of targets. The ROI of mass campaigns collapses, forcing adversaries toward more expensive targeted operations."})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Quantitative Risk Analysis"}),e.jsx("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-6",children:e.jsx("p",{children:"Security claims require evidence. This section provides quantitative risk analysis comparing Mega IdP exposure to SecureAuth's distributed architecture, using industry-standard methodologies and publicly available breach data."})}),e.jsx(ee,{}),e.jsx(ae,{})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Implementation Roadmap"}),e.jsx("div",{className:"text-brand-light/70 leading-relaxed space-y-4 mb-6",children:e.jsx("p",{children:"Transitioning from a Mega IdP to SecureAuth's distributed architecture can be implemented incrementally, allowing organizations to reduce risk while maintaining operational continuity. Our phased approach ensures minimal disruption while maximizing security improvements at each stage."})}),e.jsx("div",{className:"space-y-4",children:[{phase:"1",title:"Risk Assessment & Architecture Review",desc:"Audit current vendor concentration, map critical applications, and identify high-value targets for initial privatization. Includes threat modeling specific to your industry.",duration:"2-4 weeks"},{phase:"2",title:"Pilot Deployment",desc:"Deploy SecureAuth for a subset of critical applications or user populations. Establish baseline metrics for c
5omparison.",duration:"4-8 weeks"},{phase:"3",title:"Continuous Authority Integration",desc:"Enable real-time risk evaluation, behavioral analytics, and session monitoring for pilot applications. Integrate with existing SIEM/SOAR.",duration:"2-4 weeks"},{phase:"4",title:"Expanded Rollout",desc:"Extend SecureAuth coverage while maintaining parallel operation with existing IdP. Implement scope governance policies.",duration:"8-12 weeks"},{phase:"5",title:"Full Privatization",desc:"Complete migration with on-premises or private cloud deployment options as required. Decommission Mega IdP dependencies.",duration:"4-8 weeks"}].map((s,t)=>e.jsxs("div",{className:"flex gap-4 p-4 rounded-xl bg-muted/30 border border-muted",children:[e.jsx("div",{className:"h-10 w-10 rounded-full bg-brand-600/20 flex items-center justify-center flex-shrink-0",children:e.jsx("span",{className:"font-bold text-brand-500",children:s.phase})}),e.jsxs("div",{className:"flex-1",children:[e.jsxs("div",{className:"flex items-center justify-between mb-1",children:[e.jsx("h5",{className:"font-bold text-brand-light",children:s.title}),e.jsx("span",{className:"text-xs text-brand-light/70",children:s.duration})]}),e.jsx("p",{className:"text-sm text-brand-light/70",children:s.desc})]})]},t))})]}),e.jsxs("section",{className:"mb-12",children:[e.jsx(i,{children:"Conclusion: From Implicit Trust to Architectural Control"}),e.jsxs("div",{className:"text-lg text-brand-light/70 leading-relaxed space-y-4",children:[e.jsxs("p",{children:["The identity security landscape has fundamentally shifted. Mega IdPs are no longer passive infrastru
5ctureâthey are ",e.jsx("strong",{className:"text-brand-light",children:"active attack targets"})," whose compromise directly threatens every customer simultaneously. The traditional model of implicit vendor trust must be replaced with ",e.jsx("strong",{className:"text-brand-light",children:"architectural skepticism and active control"}),"."]}),e.jsx("p",{children:"SecureAuth provides the framework for this transition: Private Authority to eliminate vendor-level exposure through cryptographic isolation, Continuous Governed Authority to close the gaps attackers exploit through real-time risk evaluation, and Modular Authority to break mass campaign economics while maintaining administrative efficiency."}),e.jsxs("p",{children:["The technical proofs presented in this white paperâfrom attack chain analysis to behavioral analytics performance metricsâdemonstrate that these aren't marketing claims but ",e.jsx("strong",{className:"text-brand-light",children:"measurable architectural advantages"})," that directly reduce your organization's identity risk profile."]})]}),e.jsx(T,{children:"The question is no longer whether your identity vendor will be targetedâthey will be. The question is whether your security posture depends on their ability to defend against nation-states, or whether you've architected resilience and control into your infrastructure from the ground up."}),e.jsx(I,{products:[b.platform,b.assuranceAuthority,b.workforceAuthority],solutions:[u.financial,u.government,u.healthcare]}),e.jsx(M,{})]}),e.jsx(R,{})]})}export{ce as SecureAuthSolvesVendorCrisisContent,ce as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.