Is your SSO on point, or is it more like Single Sign-Oh-no?
summary
Savvy claims it deploys on the IDP, email server and browser to compare policy vs actual use, discovering that about 43% of apps supposedly onboarded to SSO still accept direct logins and that organizations have 4× more active SaaS apps than their SSO inventory. The tool detects shared/reused/compromised credentials and machine/app-to-app identities, continuously checks MFA status, and can block direct logins by frosting the page and redirect users into the enforced SSO flow.
AI-written summary · about
chapters (6)
- 0:00Introduction to SSO risks
- 3:22Shadow IT and business-led adoption
- 6:53False sense of SSO security
- 9:41Automating password resets
- 12:09Why identity hygiene matters
- 13:13Gaining SSO visibility and checks
related talks
30mOMG WTF SSO: A Beginner’s Guide to Single Sign-On...
46mSecure SSO Authentication: Strategies to Eliminate Vulnerabilities
22mO Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On
21mVetting Single Sign-On SDK Implementations via Symbolic Reasoning
18mOne Identity to Rule Them All
40mModern Single Sign-On: On the Security of Single Sign-On ...
23mOne Login to Rule Them All: Cross-App Access for MCP
18mShifting Authentication at Scale