> We pay them exorbitant costs so that they don't make these mistakes. The problem with this approach is that, repeated by hundreds of companies at scale, pain

> We pay them exorbitant costs so that they don't make these mistakes. The problem with this approach is that, repeated by hundreds of companies at scale, paints such a massive target on the vendor, that a breach becomes fundamentally inevitable. I expect this sort of thing happens to all big auth providers, from AWS to Google; it's just dealt with more efficiently and discreetly.