Engagement 08
Trust and Identity Audit
Inventory the access an attacker would actually use. None of it has a CVE.
The situation
The incidents that hurt most over the last two years did not arrive through a vulnerable dependency. They arrived through a compromised maintainer account, an OAuth application nobody had inventoried, a workflow that ran on untrusted input, or a marketplace extension holding more access than anyone realized.
None of it produces a finding for a scanner to match, because none of it is a vulnerability. It is access that was granted correctly and never reviewed again.
This is you if
- You are confident your scanning is fine, and you suspect that is not where the risk is.
- Nobody can list the OAuth applications, GitHub Apps or marketplace plugins with access to your estate.
- Long-lived tokens exist in CI and you cannot say how many or who owns them.
How it runs
- Week 1
Inventory the grants
Every OAuth application, service principal and GitHub App with access to the estate, and what each can actually reach — routinely broader than what it was approved for.
- Week 1
Follow the automation
Actions permissions, workflow triggers that run on untrusted input, auto-running IDE extensions and workspace tasks, and marketplace plugins.
- Week 2
Sequence the revocation
Long-lived tokens across CI with owners attached, and an ordered plan for revocation and rotation that does not break a release on the day it runs.
What you are left holding
- Every OAuth grant and service principal in your identity provider, with what it can reach
- GitHub Apps, Actions permissions and workflow triggers that run on untrusted input
- IDE extensions, marketplace plugins and workspace tasks that auto-run
- Long-lived tokens across CI, with an ordered revocation and rotation plan
What we need from you
- Read access to your identity provider's application and consent grants.
- Organization-level read on your source platform, including Actions and App installations.
- A list of the CI systems in use, including the ones the platform team does not own.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a change to your pipeline. Nothing is modified; the output is an inventory and an ordered plan.
- Not a workforce identity program. This covers the access that reaches your build and release path.
What we can already show
This is the ConnectWise and GhostAction lesson as a checklist: both bypassed MFA and scanning entirely.
Why people call about this one
The worst cases had no CVE
Compromised maintainer accounts, OAuth applications, reseller channels and retagged actions produce nothing for a scanner to match. Companies that only scan are discovering what that leaves uncovered.
33 of the 44 supply chain incidents we model had no CVE ever assigned
The shape of it
- Shape
- Two weeks, no pipeline change
- Usually funded by
- CISO · Engineering
- Often leads to
- Supply Chain Modernization