John Gunn, CEO, Token
2 minute read
Recommended Posts
An Analysis of the Canvas Breach
Canvas was not compromised one school at a time. The breach appears to have originated at a single, high-trust layer—the privileged access tier that spans the entire platform. The evidence now supports a clear conclusion: this was almost certainly an identity compromise at the privileged access layer. Not a student credential incident. Not 9,000 separate school intrusions. Not a novel zero-day exploit that somehow reached every campus simultaneously.
Kevin Surace
3 minute read
The Vercel Incident Shows the New Shape of Identity Attacks
The most important lesson in Vercel’s April 2026 security bulletin is not simply that internal systems were accessed. It is the likely path the attacker took to get there. According to Vercel, the incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee. The attacker then used that access to take over the employee’s Vercel Google Workspace account, which in turn enabled access to some Vercel environments and non sensitive environment variables.
Kevin Surace
2 minute read
Hospitality and Retail Breaches Prove MGM Was Not a One-Off
The MGM Resorts and Caesars breaches were not anomalies. They were demonstrations of a structural fact: identity that can be reset remotely will eventually be reset by someone who should not have access. What made those incidents significant was not the sophistication of the attack. It was its simplicity. Attackers did not exploit code vulnerabilities. They impersonated employees, contacted help desks, and had authentication reset. Legitimate access followed. Everything else — ransomware, data theft, operational disruption — was a consequence of that first failure.
Kevin Surace
2 minute read