OAuth Live Attack:
Why a Password Reset Won’t Stop It
October 27th @ 1PM ET

See how an OAuth token attack blends in with normal activity, why a password reset won’t stop it, and how CompassOne detects and contains it.

On October 27, we will run a simulated OAuth token attack, where a user signs in with her Microsoft email account and approves a legitimate consent prompt. Everything looks like normal activity, yet the attacker steals an authorization token that can provide access to her email, files, and inbox rules for up to 90 days.

With CompassOne, the activity is detected and contained in minutes, and you’ll see how fast containment protects client data, keeps operations running, and helps you show what protection looks like. We’ll close with the recent CompassOne enhancements, so you know what’s coming.

WHAT YOU’LL SEE 

• How an OAuth token attack blends in with normal activity while giving an attacker lasting access to a user’s email, files, and inbox rules.
• What detection and containment looks like inside of CompassOne.
• A first look at the latest and upcoming CompassOne enhancements and integrations, and what they mean for protecting your clients.

EVENT DETAILS 

Date: October 27, 2026

Time: 1:00 PM ET

Duration: 45 minutes