Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
FIDO & PasskeysWhen GOV.UK One Login reported that more than 300,000 users adopted passkeys during their trial, with nearly 10% of daily sign-ins now using biometric authentication, enterprise security teams were sk
OAuth & OIDCYour organization is deploying a digital wallet or credential issuance system. Your counterparty s implementation claims to support OpenID for Verifiable Presentations (OpenID4VP) and OpenID for Verif
Authorization ConceptsIf you re using F5 BIG-IP APM as an OAuth authorization server , you need a monitoring baseline before an exploit appears in your logs. The recent CVE-2026-94127 vulnerability, with a 9.8 CVSS score,
FIDO & PasskeysScope This guide explores the technical and operational steps for integrating passkey authentication into enterprise IAM systems, inspired by the UK Government Digital Service s rollout to 23 million
Get weekly security insights and compliance updates delivered to your inbox.
Tokens & SessionsThe Conventional Wisdom Every incident response playbook advises the same: revoke the tokens. When you confirm an identity compromise, you reset the password, kill the sessions, invalidate the refresh
OAuth & OIDCWhat Happened CISA and NIST released Interagency Report 8587 in response to a shift in how attackers target identity infrastructure. The report highlights a pattern: tokens and assertions, which prove
OAuth & OIDCThe question at hand Your Conditional Access policies probably don t cover device-code authentication . That s a problem because attackers are using Microsoft s OAuth 2.0 device authorization grant fl
OAuth & OIDCYour OpenID Connect infrastructure will need post-quantum signatures. The question isn t whether to migrate, it s which migration path matches your current constraints and risk tolerance. The Decision
FIDO & PasskeysThe Challenge The FIDO Alliance built FIDO2 on asymmetric cryptography that quantum computers will inevitably break. The standard relies on elliptic curve cryptography (ECC) and RSA for public-key ope
Access Control ModelsIn the past 72 hours, our Slack channels and team meetings have focused on one issue: the Cisco ISE authentication bypass. With CVE-2026-76460 scoring a perfect 10.0 on the CVSS scale and active explo
OAuth & OIDCYour team might see token security as just an IAM configuration issue. You build authorization policies, enforce token lifetimes, and audit access logs. Then a contractor s laptop ends up in a GitHub
Tokens & SessionsAWS Security Token Service (STS) has consolidated its session token size limits into a single 4,096-byte ceiling and added monitoring capabilities to track token growth. If your team relies on session
OAuth & OIDCThe OpenID Foundation approved OpenID Connect Key Binding 1.0 as an Implementer s Draft with 73 votes in favor, 5 against, and 20 abstentions. For IAM architects, this approval signals a shift from be
Privileged AccessScope This guide focuses on the technical controls directory services engineers need to implement when AI agents authenticate through enterprise identity systems. It covers: Identity modeling for agen
Authorization ConceptsThe question at hand Your web shell scanner comes back clean. File integrity monitoring shows no changes. Hash verification passes. Yet, your F5 BIG-IP Access Policy Management environment is serving
FIDO & PasskeysThe Challenge Microsoft Security Research has tracked a campaign since May where attackers compromised Microsoft 365 accounts by posing as IT helpdesk staff. These attacks succeeded because organizati
Authorization ConceptsYou ve built AI workflows that read support tickets, parse GitHub issues, or process form submissions. But these workflows might be letting unauthenticated users trigger privileged actions in your ent
generalThe Conventional Wisdom There s a push for post-quantum cryptography (PQC) adoption. Security leaders are urged to migrate to NIST s FIPS 203-205 standards now, before quantum computers compromise RSA
Multi-Factor MethodsThese questions started showing up in our security Slack channel after CloudSEK s BigBear 2.0 report landed. The operation harvested 5,137 credential records and 4,148 session cookies from 461 organiz
Governance & ComplianceYour organization s identity verification is only as secure as your vendor s infrastructure. The breach of 153 million driving license records at IDscan.net , a supplier for Hertz, Target, FedEx, and
