CISA Recommends Privileged Access Controls for Endpoint Management After Stryker Incident 

CISA issued an urgent advisory after a March 11, 2026 compromise of a Microsoft Intune administrator account at Stryker that allowed attackers to create a global admin and wipe managed devices; the post emphasizes that credential-driven attacks against endpoint management platforms (like Intune) are an emerging high-risk vector and advocates deploying modern Privileged Access Management (PAM) controls—session brokering, MFA, credential vaulting, approval workflows, and session monitoring—to enforce least privilege and enable real-time control and visibility.