Daily Brief: SSO costs and identity fan-out breaches
A password manager alerts users to suspicious activity while new data reveals the prevalence of 'SSO taxes' and fan-out identity breaches.
Password manager mSecure told users on November 3 to change their passwords and reset two-factor authentication after detecting suspicious activity [4]. The developer also advised customers to potentially remove passkeys, though the company has not disclosed what happened or if vault data was exposed [4].
Of the 82 business SaaS apps with a documented SSO plan in a Start with Identity matrix, 49 (59.8%) charge extra for the capability [2]. Of the 82 apps with a documented SSO plan, 49 charge a premium for the feature, while 33 apps include SSO on every paid plan [2].
Nineteen of 123 identity breaches in a Start with Identity database were identified as fan-out breaches [3], [9]. These incidents occur when a single compromise at a provider reaches many customers, as seen in breaches involving Gainsight, Salesloft Drift, and Okta support [3].
Envoc is piloting FaceLock, a biometric verification program that creates signed credentials bound to individuals using 3D biometric liveness detection from FaceTec [6]. The system allows for offline digital identity checks via an Envoc reader and can be used for in-browser verification or step-up authentication [6].
Sources
- [2] The SSO Tax Explained: What It Costs, Why It Matters and How to Negotiate It — Start with Identity, Nov 5, 2026
- [3] Third-Party SaaS Token Breaches: How One Vendor Compromise Reaches Hundreds of Tenants — Start with Identity, Nov 5, 2026
- [4] Password manager mSecure tells users to change passwords and remove passkeys, without saying what happened — Start with Identity, Nov 3, 2026
- [6] Envoc completes pivot to custom biometric verification with FaceLock pilot program — biometricupdate.com, Nov 5, 2026
