Cracking Hidden Identities: Understanding the Threat Surface of Hidden Identities and Protecting them Against Password Exposure

The talk starts from the idea that many accounts employees use fall outside what an organization's identity provider and password policies can see. The speaker, whose company runs a browser extension that observes real employee activity, defines hidden identities as personal accounts used for work, non-SSO corporate logins, temporary and third-party accounts, and chained identities. Using aggregated telemetry, the talk reports that over a 90-day window most software-as-a-service use was non-corporate, and that about half of corporate accounts sat outside single sign-on.

The middle section turns to password quality and exposure. Using a common strength-estimation library, the speaker reports that passwords used for personal activity are no stronger than those used at work, and that some stay unchanged for years. A small group, around two percent of users, combines heavy shadow SaaS use, weak passwords and frequent appearances in breaches. Reused credentials and personal webmail takeovers are presented as a route into business systems, illustrated by a publicly reported incident in which a contractor's personal email led to corporate access.

For practitioners, the advice centres on visibility first, then enforcement. Restrict non-work SaaS, enforce SSO wherever possible, and for non-SSO accounts validate that passwords rotate, sessions and cookies are flushed, and credentials are strong, ideally through a corporate password manager. Focus controls on the small high-risk group, and recognise that hostname-based network tools miss how users actually log in. The Q&A covered user buy-in, personal logins on sensitive systems, and balancing data security against access security.