SaaS-Glued Lean Defense: The Full Breach Trace for Archetype D

Call the operator Pat. Pat is the entire technical function: IT, security, DevOps, helpdesk and vendor management. No capital budget, no on-premise hardware, no SIEM. The business runs on a dozen SaaS products, an identity provider, an identity-aware proxy and hardware keys not everyone has enrolled.

It is easy to read this as a team that has not grown up yet. By the book's cost estimates, this architecture gives the most security per euro of the four archetypes. For the price of a per-user subscription, Pat gets a device posture check that stops a validly authenticated attacker.

Scored against the Octagon's eight axioms (pass, partial or fail), Archetype D passes two (Axioms 1 and 5), fails five outright (Axioms 2, 3, 4, 6, 7) and meets one only partially (Axiom 8), the same verdict as the overview's violation matrix. It passes no intrinsic trust (1), because the identity-aware proxy demands identity before any self-hosted app, so network position grants nothing, and bounded authority (5), where the book's trace finds no grant that exceeds its scope. It fails verifiable policy (2, the vendor's policy engine cannot be replayed), mediation (3, because SaaS apps authenticate straight against the identity provider and never pass the proxy), continuous verification (4), Byzantine fault tolerance (6, one responder) and epistemic integrity (7). It meets bilateral symmetry (8) only partially: the proxy verifies the client, but the client does not verify the destination.

Trust lives instead in the identity provider, which issues the assertions everything else consumes, and in a handful of SaaS admin consoles, each able to grant, revoke and impersonate inside its own product. That is the entire perimeter. Identity is not one control among several; it is the control.

That is not a weakness in itself. A few clearly identified anchors are more tractable than a sprawling network with forgotten corners; it becomes a weakness only when the operator has never enumerated them, and so does not know how much one stolen session unlocks.

The entry point is a spear-phishing campaign against a junior marketing manager. The mail is researched and personalised, it passes spam filtering, and the target enters their password on a convincing imitation of the login page. The attacker now has one of the two factors.

The second factor is mobile push approval, and that is the part that gives. Late at night the attacker sends repeated push prompts. On a plain-approve push setup without number matching (the configuration Uber's contractor faced in 2022), the only way to stop the buzzing is to approve. Microsoft Authenticator has enforced number matching since May 2023 and other vendors offer it, which defeats the blind tap; the attacker's fallback is a call from someone posing as IT who reads out the number, and voice phishing was the second most common initial vector in Mandiant's M-Trends 2026. Either way MFA fatigue is an interface attack on a tired person, not a cryptographic break. At a quarter to two, half asleep, the target approves.

The attacker now holds a valid session that, by default, lasts days: fourteen in Google Workspace, a rolling ninety in Entra ID. They try the finance dashboard behind the identity-aware proxy. The session checks out, but the proxy also requires the device to carry the company management profile. The attacker is on a virtual machine in a hosting centre, so the check fails and access is denied. The cheap control worked, and the trace does not end here.

An identity-aware proxy protects the resources placed behind it. Everything that authenticates directly against the identity provider bypasses it, and for Archetype D that is most of the business: the document store and mailbox (Google Workspace, in the book's version of the trace), the chat platform, the wiki. The attacker never has to defeat the posture check, because they never pass through it.

It goes sideways further. Over the years the team has wired products to each other with OAuth grants: a scheduler that reads calendars, a note-taker that writes into the wiki, an automation platform holding tokens for six other services. Each is a standing delegation that outlives the session that created it. So one identity compromise reaches products nobody has thought about since the day they were connected. This happened for real in August 2025, when OAuth and refresh tokens stolen from Salesloft's Drift integration were used to pull data out of customers' Salesforce instances.

There is no security operations centre, and nobody reads logs: the only person who could is also answering the helpdesk. Worse, most of the evidence is not Pat’s to read. Detailed file-access auditing sits behind a higher pricing tier: Google Workspace records Drive log events only on Enterprise, Frontline, Education Standard or Plus, Enterprise Essentials Plus and Cloud Identity Premium editions, none of the Business plans. At the base tier the logs that would answer the only question that matters — what exactly did the attacker open — are absent, shallow, or short-lived.

That is implicit trust in the evidence layer: if the vendor logged it, it happened. A tenant cannot instrument what they do not run. It is also why deceptive defences do not help — serving an attacker false data requires owning the application that serves it, and here nobody owns the document store.

What happens next depends on one human being. If Pat is asleep with the phone on silent, the response takes 25 minutes at the very least, and in practice the attacker has uninterrupted access until Pat wakes. If Pat is tired, this is the third alert this week and the previous two were false positives, so Pat swipes it away. If Pat is alert, the console shows a burst of denied pushes followed by an approval from an unfamiliar location, and about three minutes later every session is revoked.

Averaging those outcomes gives a mean that looks acceptable and describes none of them. The distribution has two peaks: a fast one the operator remembers, and a slow one that determines the actual loss.

The underlying dimension is human continuity, the one most consistently omitted from zero-trust planning. One human means sometimes unavailable, and an availability gap is an architectural property, not a personal failing.

Start by moving the device check to the identity provider. The proxy check worked; the problem is that it only guarded the proxy. Enforce device posture at sign-in (conditional access, context-aware access or device assurance, depending on the provider and licence edition), and a session from a hosting-centre virtual machine never gets issued, for the document store as much as for the finance dashboard.

Replace push approval with a phishing-resistant factor. A FIDO2 key binds the assertion to the origin: the credential cannot be replayed against a lookalike page, and there is nothing to approve at two in the morning. Keys cost roughly 30 to 60 euros each; buy two per person so a lost key is not a lockout. Ordering and enrolling them takes weeks, not an afternoon, but the order can go out today. This change removes the entry point above, provided push and SMS are switched off as fallbacks for enrolled users: Proofpoint showed in 2025 that a phishing proxy can force a downgrade to a weaker factor if one is still allowed. That is why the only factor worth having is one that cannot be delegated to a tired human.

Write down every system that trusts the identity provider. Open the provider’s application list, copy it into a file, and note what data each entry holds. That list is the real blast radius of one stolen session, and most operators are surprised by its length.

Audit the OAuth grants in the same sitting. The provider lists every third-party application holding a delegated token and the scopes it was granted. Then turn off unrestricted user consent, so future grants land in an approval queue. Microsoft 365 has moved this way on its own: since mid-2025, users can no longer consent by default to third-party apps reading their files and sites.

Reduce administrator accounts and shorten the sessions that matter. Give the operator a separate admin identity that is not used for mail, and cut privileged session lifetimes to a few hours. In Google Workspace that setting needs Business Plus, Enterprise or a comparable edition; Business Starter and Standard cannot change it.

Finally, follow the recovery flows to their endpoints, because account recovery is the path nobody tests. Check where an administrator password reset sends its mail, and whether the domain registrar and the mail provider can be used to take over each other. If recovery terminates in a mailbox the identity provider itself protects, the loop is closed.

A dozen SaaS products behind one identity provider is a defensible position, on one condition: that the few real trust anchors are actually defended. Phishing-resistant factors on every account that can administer anything. A written list of what consumes the identity. Delegated grants reviewed rather than accumulated. Recovery paths that do not loop back on themselves.

It does require admitting which dimension is unfixable at this scale. One person cannot be continuously available, and a tenant cannot audit the vendor policy engine. Those are acknowledged debts, not solved problems, and writing them down as debts is itself a control: it stops the fast response time from being mistaken for the whole distribution.