Just got the marketing email about Auth0's new "breach detection" add-on. The pitch is predictably full of "enhanced security posture" and "proactive threat intelligence." Color me skeptical.
My immediate questions for anyone who's actually using it:
* Is this just repackaged credential stuffing monitoring, or does it do something genuinely useful like checking employee emails against new breaches?
* The pricing is, of course, opaque until you talk to sales. What's the ballpark cost for, say, 5,000 monthly active users? Does it follow the usual "contact us" model that blows any SMB budget?
* Most importantly: is it **reactive** (sending an alert *after* a match is found in a dump) or **proactive** (like forcing a password reset or stepping up MFA *before* the bad actor can use the credentials)?
If it's the former, I'm not sure it's worth the premium over a free service like Have I Been Pwned. If it's the latter, the cost-benefit analysis gets interesting, but only if the numbers make sense.
Show me the bill