> something like Okta is an infinitely more attractive target than we are Agreed. Centralization of attack surface is a major risk. I understand the allure an

> something like Okta is an infinitely more attractive target than we are Agreed. Centralization of attack surface is a major risk. I understand the allure and have been in situations where even knowing the risks, the path is forced upon us because "nobody is fired for buying IBM". But yes, a centralized service holding all the marbles is an infinitely more attractive target than lots of disjoint little systems which aren't individually very interesting. The centralized system may be better run (arguable, but at least they have the resources and it is their primary job) but they also face a much higher attack concentration. A compromise solution is to have both. I've been in one company where okta was used as the primary SSO and for most internal systems the only one. But for the very sensitive resources, one had to be authenticated via okta but also via a homegrown MFA system.