Series
What Posture Actually Means
Identity posture for the people who operate it, not the people who buy it — how to measure it, the failure modes compliance never catches, and why a dashboard isn't posture.
The MFA Coverage Audit: Finding the Doors Without Locks
"MFA is enabled" is not a posture statement. Coverage is. A working checklist for finding every door that can still authenticate without it — legacy protocols, service accounts, and the recovery paths that quietly undo everything.
The Identity Control Map: What Each Control Covers, and Where It Doesn't
Controls aren't on/off. Each one covers a slice of the problem and leaves a residual that someone has to own. A map of the major identity controls, what they actually cover, and the exact gap where the last mile lives.
Posture as a Continuous Process, Not a Quarterly Audit
The quarterly audit is a photograph of a moving river. Identity drifts daily; here's what it takes to operate posture as a loop instead of an event.
Seven Posture Failure Modes Compliance Never Catches
Each of these passes a compliance audit and shows up green on a dashboard, and each one has put a real company in the headlines. The gap between 'defined' and 'holding.'
How to Measure Identity Posture When You Have 200 Clients and No Two Tenants Alike
A single posture checklist falls apart the moment you run it across hundreds of heterogeneous client tenants. Here's how to measure something comparable anyway.
ISPM Without the Marketing: Posture Is Not a Dashboard
Identity security posture is sold as a screen full of green checks. The screen is an input, not the posture. Here's the difference, and why it matters operationally.