Is Your SSO Protected Against Modern Credential Attacks?

A $60B Vote of Confidence

The University of Pennsylvania breach in 2025 is a stark reminder of the risks associated with single sign on (SSO). According to reports, attackers compromised a PennKey SSO account and used that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint. The attack also resulted in the theft of data on 1.2 million individuals.

While SSO is not inherently insecure, it is only as secure as the measures taken to protect it. When configured and protected properly, SSO can improve security by reducing password sprawl, centralizing access policies, and making it easier to enforce multi-factor authentication (MFA).

However, organizations can only enjoy these benefits when SSO is treated as a critical security control. If one login opens the door to multiple systems, that login needs robust protection.

Why Cursor?

To answer the question of whether your SSO login is protected enough, organizations need to look beyond whether SSO is switched on, and focus on how it is secured. This includes implementing strong SSO passwords, adding multi-factor authentication (MFA), and securing the assets behind the SSO login.

The Road Ahead

Implementing strong SSO passwords is crucial to securing SSO. The latest guidance from NIST puts the emphasis on length and usability, alongside screening for weak or compromised passwords. For scenarios where single-factor passwords are still acceptable, NIST recommends at least 15 characters. Passwords used alongside MFA must be at least eight characters, and systems should allow users to create passwords up to 64 characters.

NIST also advises against some legacy password rules that still appear in many organizations. Mandatory complexity requirements and routine password resets can push users toward predictable patterns, such as changing one digit or adding a symbol at the end.

Adding MFA is also essential to securing SSO. Infostealers have made it easier than ever for attackers to scrape passwords and other authentication information, and even passwords that meet regulatory requirements appear regularly in these logs. MFA adds another layer of protection, making it harder for an attacker to turn a compromised password into a successful login.

For SSO, MFA should be enforced consistently. That means applying it across users, apps, and access scenarios, rather than only enabling it for a handful of 'high-risk' accounts. It is also worth looking at the type of MFA in place. SMS codes and basic one-time passwords are better than passwords alone, but they are not the strongest option. Where possible, organizations should move toward phishing-resistant methods such as FIDO2 security keys, WebAuthn, or passkeys, especially for privileged users and access to sensitive systems.

Finally, organizations need to secure the assets that sit behind SSO and control how identity is issued, trusted, and delegated. This includes protecting IdP administrator accounts, signing certificates and keys, OAuth secrets and credentials, and reviewing consent grants and delegated permissions.