> deep access to all customer data "All" is not correct, they outlined what data was in the Superuser utility. It certainly has access, but not "all" data. >

> deep access to all customer data "All" is not correct, they outlined what data was in the Superuser utility. It certainly has access, but not "all" data. > the "SuperUser" app can apparently have logged in users idling around in a VM, waiting for someone to come along and use it without any automatic logout and re-authentication Well it was an employee laptop, not a VM (so the news says). But regardless of this, the question is what is the session length of superuser? It could be 20mn, it could be 1hr, it could be 8hr. There is some balance for security and usability of the team who actually uses that tool. Even if the session length is reasonably short, this was an insider willingly giving up access to their machine. So likely the insider logged in and sent the attackers a message saying "here you go" and let them work for as long as the session would last. Heck, the insider may even repeatedly login for them. > a single account accessing 300+ customers in a few days doesn't trigger any alerts Almost every support interaction would likely require the access of that customer in the superuser utility. Just a dozen cases an hour for an 8 hour day, is nearly 100 accounts accessed per day. That doesn't even seem like a lot of cases per hour. I'm not saying Okta is in the right here. But throwing around a lot of FUD doesn't help the situation.