The Butterfly Blog

Notes from the
recovery layer

Engineering, market analysis, and product writing from the team building backup and disaster recovery for the identity layer. Substance over slogans.

Disaster RecoveryMonitoring

Our monitoring went silent for 25 hours and production was perfectly healthy

Two scheduled canaries stopped running because of a billing event, not a bug. The jobs died two seconds in with zero steps recorded, the status page said everything was operational, and the only honest message was hidden in a check annotation. A monitor that stops and a system with nothing to report produce the same artifact, which is silence. Here is what we found, what we moved, and the blind spot we deliberately did not close.

Mick JohnsonSep 2, 20267 min read

LaunchiOS

Butterfly Security for iPhone is on the App Store

A companion to the Okta Admin Console for the minutes when you're on call and nowhere near a laptop. Suspend a user, clear sessions, activate a network zone, and read your recovery posture from your phone, with two independent gates on every change that the server enforces rather than the app. Running a full restore stays on the desktop on purpose, and here is the reasoning behind that line.

Mick JohnsonAug 12, 20266 min read

Identity SecurityDeepfakes

Deepfake vishing: when the executive on the call was never there

Voice phishing used to mean a convincing stranger on the phone. Now the caller can look and sound like the executive you report to, built from footage that executive published themselves. One engineering firm lost twenty five million dollars to a video call where everyone but the victim was a deepfake. The defenses that actually work are procedural, and so is the question you have to answer afterward.

Mick JohnsonAug 8, 20268 min read

Identity SecurityIncident Response

After a vishing takeover, can you prove what changed in your org?

Vishing is phishing that arrives as a phone call. Okta has been warning customers about a campaign that uses one to walk employees through a fake passkey enrollment while the attacker quietly registers their own. Most of the guidance being written about it is prevention guidance. The harder question lands after you have kicked the attacker out.

Mick JohnsonAug 3, 20267 min read

OktaIdentity Security

Your identity provider can restore nothing. And they know it.

Every layer of your stack has point-in-time recovery except the one that gates access to all of it. Customers have asked identity vendors for config backup and restore for years and gotten silence. And AI will not close the gap, because recovery is a state problem, not an intelligence problem.

Mick JohnsonJul 31, 20263 min read

OktaIdentity Security

Eight years at Okta, and the one thing customers kept getting surprised by

Okta runs the identity platform, and they run it well. Your configuration inside it is still yours. That split is not a gap in the product, it is how every serious cloud platform works, and it is the part I spent eight years watching people discover at the worst possible moment.

Mick JohnsonJul 30, 20266 min read

Identity SecurityDisaster Recovery

Pre-release AI models breached Hugging Face. The lesson is about identity.

OpenAI's pre-release models escaped a testing sandbox, went hunting for credentials, and pulled data from Hugging Face's production database in thousands of automated actions. The entry point was a software bug. The pivot was credentials. Here is why machine-speed attacks change the math on identity recovery.

Mick JohnsonJul 21, 20265 min read

Disaster RecoveryMicrosoft Entra ID

Now live: disaster recovery for Microsoft Entra ID and Google Workspace

Butterfly now backs up, restores, and diffs Microsoft Entra ID and Google Workspace with the same preview-first discipline we ship for Okta. Five identity providers, one recovery contract. Here is exactly what is live, and what still stays Okta-first.

Mick JohnsonJul 6, 20263 min read

Identity SecurityDisaster Recovery

Identity resilience should not stop at one provider

Okta recovery is where Butterfly started. The roadmap is broader: bringing the same backup, dry-run restore, and drift detection to Google Workspace, Microsoft Entra ID, and Workato. Here is what is live today, and where we are headed, stated plainly.

Mick JohnsonJun 30, 20263 min read

Artificial IntelligenceOkta

AI in admin work does not remove human risk

Teams are already using AI for identity admin workflows. That's smart, and faster, but one bad command can change an entire login path in seconds. Butterfly Security gives every admin a restore plan, not just a shiny UI.

Mick JohnsonJun 24, 20263 min read

Identity ResilienceDisaster Recovery

When Claude went dark: identity-mediated access is one directive away from gone

Anthropic disabled Claude Fable 5 and Mythos 5 worldwide to comply with a US Commerce Department directive. 24 hours from launch to lights-out. The story isn't about AI safety. It's about how fast identity-mediated services can disappear.

Mick JohnsonJun 15, 20264 min read

LaunchDisaster Recovery

Shipping Butterfly v1: identity disaster recovery for Okta-first organizations

Butterfly Security is generally available. Point-in-time backups, dry-run restore previews, signed audit evidence, and warm-standby continuity for Okta, Okta Workflows, and Auth0.

Mick JohnsonJun 3, 20263 min read

Shared ResponsibilityDisaster Recovery

Identity Is a Shared Responsibility (And Most Teams Don't Realize It)

Your identity provider guarantees uptime, not your configurations. Understanding the shared responsibility model for Okta and Auth0 is the first step to real disaster recovery.

Mick JohnsonMar 2, 20265 min read

New posts ship as the recovery layer evolves. Check back, or follow Mick on LinkedIn for the next one.

Notes from therecovery layer