IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Incident tabletop — a practice drill
2:07 a.m. A tripwire fires. Maya's account has a live session from another continent and a payee she never added. Zara walks through it as a tabletop exercise: a calm drill where you practice the response before you need it. Your goal: put the response steps in the right order.
- Follow a playbook: detect, triage, contain, eradicate, recover, learn.
- Contain first: revoke all sessions and refresh tokens. Then reset the password.
- Hunt for the attacker's back doors before you call it done.
- Learn: write down the control that would have stopped it.
The identity-incident playbook
Panic makes things up as it goes. Professionals follow a playbook. Zara's has six phases, and the order matters. If you skip ahead, you may warn the attacker or destroy evidence.
| Phase | What happens |
|---|---|
| 1 · Detect | The tripwire from the last lesson fires. An alert is not yet an incident. It is a reason to look. |
| 2 · Triage | Is it real? Zara checks: impossible travel, a new device, a payee change minutes after sign-in. Yes, it is real. A VPN blip would have been closed here. |
| 3 · Contain | Stop the damage now. Revoke every session and refresh token everywhere, and force a new sign-in. This buys time and keeps the evidence. |
| 4 · Eradicate | Remove the attacker's foothold. Reset credentials and hunt for the persistence they planted. |
| 5 · Recover | Give Maya access back safely, with verified re-enrollment. Watch the account closely for a while. |
| 6 · Learn | What control would have stopped this at the start? Write it down and ship it. An incident that teaches nothing will happen again. |
Contain before you clean
As soon as triage says "real", Zara revokes every session and refresh token and forces a new sign-in. This is the move from Stolen-token defenses I, now for a whole account.
She does this before she resets the password. A reset alone leaves live tokens working, and it warns the attacker. Contain first and quietly. Clean second.
Containment must reach every app Maya uses, not just the one that raised the alert. ITDR is the kill switch that coordinates the shutdown. CAEP shared signals spread the logout: one signed "session revoked" event drops Maya in every app within seconds.
The most missed step is the hunt for persistence. Revoking sessions and resetting the password feels like "done". But a skilled attacker has already added a way back in. It may be a new passkey, a recovery email pointing to their inbox, a mail-forwarding rule, a new MFA phone, or a standing OAuth grant. These all survive a password change. Miss one and the attacker walks back in tomorrow.
Close the loop
Last comes Learn, the phase everyone skips. Suppose the answer to "what would have stopped this?" is "a passkey Maya never enrolled". That is next sprint's work.
Zara triages (real) and contains (all sessions revoked). Then she eradicates, and here she slows down. She resets the password. She removes a recovery email she does not know. She revokes the token of a "reporting" app Maya never installed. She deletes a passkey from an unknown device. Now the attacker is really out. She recovers Maya with verified re-enrollment. Her lesson: require phishing-resistant MFA for payee changes.
A drill you have run is easier to survive at 2 a.m. The playbook stops you cleaning before you contain. The persistence hunt stops a "resolved" incident from reopening.
Go deeper: The standard cycle
This is a simple teaching version of the standard incident cycle. NIST SP 800-61 Rev. 3, from April 2025, ties incident response to its wider risk framework.
🧪 Interactive lab — enable JavaScript to play with this one.
Make sure your containment works. Grade your issuer's logout and revocation setup with Logout Check. Then confirm you can broadcast a revocation everywhere with SSF Check.