The amount of effort they invested into breaching Okta is probably way more they'd invest in breaching any single company's SSO. If "LAPSUS$" is after big comp

The amount of effort they invested into breaching Okta is probably way more they'd invest in breaching any single company's SSO. If "LAPSUS$" is after big companies with significant IP they can hold ransom for millions of dollars, it's most likely not even worth their time to find let alone attack your small company's on-prem SSO even if it was a single shell command away, so you'd still be more secure.