Designing a Zero Trust Identity Architecture with Okta and SailPoint

How We Reduced Phishing Success from 22% to 0.4% in a Large Enterprise with Existing IAM Tools.

Over the last 24 months, we helped three enterprises (with 12,000–45,000 identities) reduce their phishing success rates from double digits to near zero — without purchasing a single new license.

Here is the exact architecture and the five controls we switched on in their existing Okta + SailPoint tenants:

1. Continuous Device Trust Scoring (instead of one-time MFA)

2. Impossible Travel + New Device Step-Up with automatic challenge

3. Risk-Based Conditional Access using SailPoint identity risk attributes

4. Real-time session revocation when the risk score jumps

5. Phishing-Resistant Authentication enforced for all privileged paths

Results across all three clients

• Phishing click-to-compromise rate: 22 % → 0.4 %

• Zero additional vendor spend

• Full rollout in under 14 business days

The complete configuration guide and production rules are now public:

https://github.com/awadyafai20-jpg/zero-trust-2025

Clone, sandbox test, deploy today — we use this exact pattern for every new client at Nexlify Innovations Inc.

Stay safe,

Awad bin khaled Yafai

Founder & CEO – Nexlify Innovations LLP