The big picture

You began with Priya's first morning and one password that opened everything. Now you know what sits behind it. Here is one year of her working life as one story, before the quiz.

The story you just lived

Before Priya's first day, an entry appears in the company directory: uid=priya,ou=people,dc=example,dc=com. The directory is the source of truth that every other system reads. Zara fixes a partner app that pasted typed text into its login filter. She escapes the input.

Each morning, Priya's password proves who she is once. After that, Kerberos gives her a TGT, then one service ticket per app. Bot A, the invoice robot, runs as a service account. Zara finds it with a person-chosen password and RC4 allowed. It is Kerberoasting bait. She moves it to a managed service account. She also shrinks the old NTLM traffic.

In spring, Priya moves to Finance Operations. When she asks for the "approve payment" right, identity governance blocks it. She still holds "create vendor". Her manager removes the old right first.

In autumn, she joins the infrastructure team. Privileged access management gives her a separate admin account. It works only from a Tier 0 workstation, with a hardware key. She holds no standing admin rights.

All year, the company follows a password policy that works: 15 characters, a blocklist, throttling. A spray with Summer2026! fails, and detection still pages Zara. Then Priya's laptop is stolen. Zara marks it lost. It becomes non-compliant, and conditional-access rules refuse it. The ZTNA broker in front of each app refuses it too.

The threads that tie it together

Where these ideas go next

Next: adversary-in-the-middle phishing, least privilege for machines, identity telemetry, sender-constrained tokens and continuous evaluation.

Ready? The cheat sheet & pop quiz is one page away.