Should your organization freak out and roll IR because #okta got their source nicked?

Rather than say yes or no, ask yourself what your organization can meaningfully do. Odds are not much. Consider the need to do performative work to keep your executives calm, which sucks but infosec theater pays the bills and keeps auditors happy. Keep in mind that the Windows OS source has been in the hands of threat actors over and over for years and no new sploits came from that so far.

Make sure you're pulling Okta logs into your SEIM and have alerting in place for things like:

• admin membership changes
• abnormal amounts of password changes
• password changes followed by MFA changes
• configuration changes to key components, such as MFA or logon restrictions.