The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns
Julie Agnes Sparks
BSidesSF 2026 · Day 1 · AMC IMAX
In "The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns," Julie Agnes Sparks, a security researcher at Datadog, delivers a fast-paced and highly technical deep dive into the evolving landscape of identity compromise, specifically focusing on **Okta** environments. The talk addresses the critical challenge faced by security professionals navigating the extensive — yet often overwhelming — logging capabilities of Okta, an identity provider widely adopted across enterprises. Sparks' presentation aims to equip attendees with actionable strategies for threat hunting within their Okta logs, emphasizing practical approaches to detect emerging threats and respond effectively to sophisticated attack campaigns.
AI review
Competent, practitioner-focused talk from someone who clearly works in this space daily. Sparks knows her Okta logs cold, and the policy misconfiguration angle plus the FastPass failure-as-phishing-signal tip are genuinely useful. But nothing here crosses into original research territory — this is distillation and operational guidance, not novel discovery.