Insights
What's still annoying about SOC 2 in 2026
We completed our first SOC 2 audit. We still suffered through manual access reviews, scattered evidence, and proving compliance with bygone requirements.
CEO
CEO
Maya is the co-founder and CEO of Oblique. She is a product leader with experience in enterprise infrastructure and security tools. She previously led product at Tailscale, software supply chain security products at GitHub, and worked on Kubernetes security and encryption at Google Cloud.
Insights
What a great users page looks like
Your users are probably looking at your application’s user list because they're completing an audit or dealing with an incident. Here’s what they need to know.
CEO
CEO
Insights
What is separation of duties, anyways?
Separation of duties is framed as about blocking toxic role combinations, but what you really want is to stop someone from approving their own transactions.
CEO
CEO
Insights
The security policy rollout survival guide
The hardest part of a security policy isn't writing it, it's rolling it out. The controls have to work, and your users can't hate you when it's all done.
CEO
CEO
Engineering
The $0 security stack
As part of our initial SOC2 audit, we wanted to put in place actually useful security tools. Luckily, in 2026, world-class security costs literally nothing.
CEO
CEO
Insights
Fit access controls to your org, not the other way around
Groups used for access controls can be based on department, reporting chain, or projects. The right answer is whatever maps best to how your org actually works.
CEO
CEO
Insights
Access requests are a bandaid, not a fix
IT teams are overwhelmed with never-ending access requests. Getting off the identity treadmill means getting to fewer tickets over time, not faster tickets.
CEO
CEO
Insights
The real SSO tax
The SSO tax shouldn't be about having SSO — it should be about enforcing it. The value of SSO is to centrally manage access and require strong authentication.
CEO
CEO
Insights
What we can learn from real-world authentication failures
Recent breaches at Okta, Snowflake, and Twitter help us learn how to prevent authentication failures like credential theft, MFA bypass, and session hijacking.
CEO
CEO
Insights
Internal security tools rarely get the UX they deserve
Security teams underestimate the investment needed for internal tools, and so underinvest in UX. When security tools are painful to use, people bypass security.
CEO
CEO
Insights
Modern access controls: takeaways on what actually works
We interviewed IT and security teams to ask them how they actually define, implement, and improve their access control policies. Get the report to learn more.
CEO
CEO
Insights
Delegate authority to those with context
Business teams have context for access decisions but lack authority. Delegate to those closest to the resources by defining clear ownership for each app.
CEO
CEO
Insights
Stop trying to make git happen
Internal tools built as code come with version control and audit logs for free, but git becomes a barrier for non-engineers to use these tools.
CEO
CEO
Insights
Why your RBAC roles aren't actually roles
A role in RBAC should represent what someone actually does in your environment. Your job title makes a bad RBAC role: it's your position, not your function.
CEO
CEO
Insights
Comms groups inevitably become access groups
Comms groups map to how people actually work, but often access groups don't. Comms groups always become access groups. It's not a matter of if, but when.
CEO
CEO
Insights
The evolution of authentication, from passwords to passkeys
Authentication has evolved from simple passwords to federated systems with passwordless logins, continuously balancing security and usability.
CEO
CEO
Insights
Good justifications write themselves
Organizations ask users to fill out justification fields when requesting access, but these are useless explanations. You should already have the context.
CEO
CEO
Insights
Chesterton's fence doesn't apply to access controls
IT teams are scared to remove access they don't understand, leading to sprawling entitlements. Removing unused access isn't risky — never removing access is.
CEO
CEO
Company
Identity management is harder than it should be
Identity management is surprisingly hard: access controls change constantly and require context. We founded Oblique to work on impactful security problems.
CEO
CEO
Ready to simplify access management?
Experience the joy of fewer IT tickets
We’d love to help you get to more maintainable access controls