Harden unmanaged identities

User accounts on SaaS applications that exist outside your identity provider's control — where users authenticate with a direct password rather than SSO, and your organization has no visibility into password strength, MFA status, or login activity.

These accounts represent a significant and largely invisible portion of your identity attack surface. IdPs only see federated applications. Everything else — direct signups, legacy apps, shadow SaaS — sits outside identity governance. Push addresses this by observing login behavior in the browser and applying guardrails at the point of login, regardless of whether the app is IdP-managed.

You need browser visibility to catch them in real time. Push identifies non-SSO logins by observing authentication events in the browser — for each login, it records the authentication method (SSO, password, social login, passkey), the application, password strength, and MFA status.

The alternative approaches each have significant gaps. Your IdP only reports on applications it manages — it can't tell you about apps where employees log in directly with passwords. CASBs detect application access from network traffic but can't determine the authentication method. Email-based discovery (scanning signup confirmation emails and receipts) generates high false positive rates — matching email patterns to actual active accounts is unreliable, and it misses accounts created with personal email addresses. API-based discovery is limited to applications you already know about and have integrated with, and integration availability depends on the app, the pricing tier, and whether the vendor exposes the right APIs at all.

Push's browser-level observation is the most reliable approach because it sees the actual login event with full authentication context, with no integration dependencies.

Push enforces MFA through in-browser guardrails. When a user logs into an application without MFA, Push surfaces a prompt encouraging them to enable it. This works for any application accessed through the browser, regardless of whether it's federated.

IdPs can only enforce MFA on federated applications. Push bridges this gap by operating at the browser layer, where it sees every login event.

Push detects weak, reused, and breached passwords at the point of login. All password analysis uses locally generated salted SHA256 partial hashes — plaintext passwords are never transmitted or stored.

Traditional approaches — periodic password audits, directory-level analysis — only cover IdP-managed accounts. Push sees password quality for every application accessed through the browser, including shadow SaaS and direct signups outside your directory. See compromised credential detection.

Push's telemetry shows 1 in 4 enterprise logins are password-based rather than SSO. Among those password logins, 2 in 5 lack MFA and 1 in 5 use a weak, breached, or reused password.

This represents a significant identity governance gap — a quarter of all authentication events happen outside the IdP's visibility and policy enforcement. Read about identity security data. See Push's password enforcement.

Push provides login method visibility for every application accessed through the browser — SSO, password, social login, or passkey, along with password strength and MFA status.

Your IdP shows federated logins. The reality is muddier — employees use password fallback on SSO-enabled apps, still create direct accounts on apps that support SSO, and sign up for tools your IdP doesn't know about. Push shows the full picture.

No. IdPs are structurally blind to non-federated applications. Your IdP only sees login events that flow through it. It has no visibility into employees signing up directly on SaaS apps, creating local accounts, or using social login.

Push closes this gap by observing login events in the browser — seeing every authentication regardless of whether it goes through the IdP.

Push enforces password policies at the point of login through in-browser guardrails. When a user logs into a non-SSO app with a weak, reused, or breached password, Push prompts them to change it.

There's no other scalable way to enforce password policies on non-federated SaaS apps. You can't push policies to applications you don't administer. Push is the enforcement layer for apps outside IdP governance.

Password reuse is the root cause of credential stuffing attacks. If an employee uses the same password on a breached consumer service and their corporate SaaS apps, an attacker can replay those credentials without phishing or exploits.

The risk compounds with the number of apps. Push detects password reuse across applications at login and enforces unique password policies via in-browser guardrails.

Browser-level identity visibility and enforcement — the only layer that sees both managed and unmanaged applications. Your IdP handles federated apps; Push handles everything else.

Push provides: compromised credential detection, password strength enforcement, MFA enforcement, SSO login guidance, ghost login detection, shared account detection, and browser sync monitoring — all working regardless of whether the application is IdP-managed.

The practice of discovering, mapping, and hardening every identity and account across your SaaS estate — including accounts your IdP doesn't manage. Identity attack surface management (IASM) goes beyond identity governance (which covers federated applications) to include ghost logins, shadow SaaS accounts, shared credentials, dormant accounts, and non-SSO logins.

Push provides the browser-level visibility that IASM requires — discovering every login event, authentication method, credential strength, and MFA status across every application employees access.

AiTM phishing (capturing post-MFA session tokens), credential stuffing (exploiting password reuse from breaches), session hijacking (replaying stolen session tokens from infostealers), OAuth consent phishing (obtaining persistent API access), device code phishing (redirecting OAuth tokens), MFA downgrade attacks (forcing fallback from phishing-resistant to weaker methods), and ghost login exploitation (accessing local accounts that bypass SSO).

These attacks target the identity layer rather than the endpoint or network. Push detects each of them through browser-level behavioral detection and identity security controls.

SAMLjacking exploits the trust relationship between identity providers and SaaS application tenants. The attacker gains control of a shared tenant (or creates a poisoned one), then redirects the SAML authentication flow to an attacker-controlled IdP. Users who authenticate through the poisoned tenant unknowingly issue credentials and tokens to the attacker.

Push originally documented SAMLjacking and detects federation trust changes. Like device code phishing and consent phishing, the attack abuses legitimate infrastructure — the user authenticates on real pages, but the underlying trust chain has been compromised. Read Push's SAMLjacking research.

Push monitors OAuth consent flows across 20+ authorization servers, capturing every consent event — application client ID, requested scopes, authorization server, and authorizing user. This gives you a real-time inventory of what applications have been granted access and what permissions they hold.

IdP admin consoles show admin-consented applications but often miss user-consented grants, especially from BYOD or unmanaged browsers. Push captures consent events at the browser layer regardless of device management.

The discipline of protecting user accounts, credentials, and authentication flows from compromise — encompassing identity governance, identity attack surface management, credential security, and identity threat detection. Identity security extends beyond IAM (managing access) to actively defending against attacks that target the identity layer.

Most identity security investments focus on the IdP — but a significant portion of the identity attack surface sits outside IdP visibility. Ghost logins, shadow SaaS accounts, non-SSO logins, and weak credentials on unmanaged apps are invisible to IdP-centric tools. Push extends identity security to the browser layer, where these gaps are visible.

Continuously assessing and improving the security hygiene of identities across your environment — password strength, MFA adoption, SSO coverage, dormant accounts, shared credentials, and OAuth grants. It's the identity-layer equivalent of CSPM (cloud security posture management).

IdP-based posture management only covers federated applications. Push provides identity posture data for every application accessed through the browser — SSO coverage gaps, password quality, MFA adoption, ghost logins, shared accounts, and credential compromise status — including apps your IdP doesn't manage.

Identity governance manages access — provisioning, deprovisioning, access reviews, and policy enforcement for known, managed applications. Identity attack surface management (IASM) discovers and hardens every identity, including those outside governance — ghost logins, shadow SaaS accounts, non-SSO logins, and OAuth grants your governance tooling doesn't see.

Governance assumes you know what exists. IASM finds what you don't know about. Push provides the discovery layer IASM requires — surfacing every login event, authentication method, and credential status across every application employees access.