The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.