Okta delegated its operations, not its security; it just happens that their operations is your security. Your company isn't delegating any operations away? Not

Okta delegated its operations, not its security; it just happens that their operations is your security. Your company isn't delegating any operations away? Not even support? If they are, what level of access do those people have? Are the internal services they have access to as secure as your perimeter? Even if they aren't, the attack can come through any internal employee, and your least security conscious person is your weakest link. Again, what do they have access to? Will they be able to use them to move laterally? Spear phishing from an internal employee to another employee is really, really effective.