Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
FIDO & PasskeysScope This guide covers the technical fundamentals, implementation requirements, and operational considerations for deploying passkey authentication in enterprise environments. It s designed for IAM a
FIDO & PasskeysThe FIDO Alliance has announced two working groups focused on AI agentic commerce. If you re an IAM architect, you re likely fielding questions from product teams about allowing AI agents to transact
Access Control ModelsYou re about to design a new authorization layer. Your team mentions RBAC or ABAC? and the conversation stalls because nobody s sure what either term really covers anymore. Does RBAC mean you can t us
FIDO & PasskeysThe Conventional Wisdom With WebAuthn Level 3 now a W3C Recommendation, you might think it s time to roll out passkeys at scale. The standard is stable, features are robust, and major platforms have i
Get weekly security insights and compliance updates delivered to your inbox.
FIDO & PasskeysMicrosoft has made passkeys the default authentication method for Entra ID as of September 1. By February 1, 2027, SMS and voice authentication will be phased out. If you re an IAM architect planning
Identity LifecycleYou ve probably seen the pitch: Verifiable Digital Credentials will revolutionize identity verification, eliminate passwords, and make your existing identity infrastructure obsolete. The reality is mo
FIDO & PasskeysWhat Changed Amazon s passkey deployment has reached a significant milestone: 465 million customers now authenticate without passwords. This isn t a pilot program or an obscure option. It s the defaul
Federation & SSOYour organization needs to accept mobile driver s licenses for identity verification. Some states issue ISO/IEC 18013-5 mdoc credentials, while others are exploring W3C Verifiable Credentials . Buildi
Tokens & SessionsYou re redesigning your workload identity architecture. The question isn t whether ephemeral credentials are better, most security professionals agree they are. The real question is whether your organ
Multi-Factor MethodsScope This guide focuses on redesigning authentication systems when traditional layering fails to reduce risk. It s for IAM architects who need to shift from more authentication to building resilient
Authorization ConceptsWhen Andrej Karpathy coined vibe coding in early 2025, he highlighted a trend many development teams already recognized: using AI to generate code quickly without fully understanding it. This approach
Federation & SSOIAM architects are increasingly tasked with evaluating mobile driver s license (mDL) integration for their organizations. Whether they re building systems for financial services or healthcare, or cons
Directory ServicesYou ve spent the last year rolling out passkeys, FIDO2 security keys , and Okta FastPass to your workforce. Your authentication policy blocks credential phishing cold. Users can t share secrets they d
OAuth & OIDCThe Australian Department of Finance s consultation on verifiable credentials policy closed with a clear warning from the OpenID Foundation s Australian Digital Trust Community Group: prioritize inter
Governance & ComplianceNIST SP 800-63A Revision 4 is now the active standard for identity proofing assessments. If your team is managing Identity Assurance Level certification processes or planning to pursue IAL2/IAL3 trust
FIDO & PasskeysYou re getting questions about passkeys. Your security team wants to know if they re ready. Your developers are asking how they work. Your CISO is asking what happens to your existing MFA stack. These
Multi-Factor MethodsWhat Changed In March 2026, law enforcement disrupted 330 domains linked to Tycoon 2FA, a major phishing kit in Okta s Identity Threat Protection telemetry. While detections initially dropped, they so
Identity LifecycleThe Challenge In December 2023, Microsoft filed suit against Storm 1152, a Vietnamese cybercrime-as-a-service group responsible for creating and selling 750 million fraudulent Outlook and Hotmail acco
FIDO & PasskeysWhat Happened The authentication model that s protected enterprise systems for two decades has hit a breaking point. Organizations have treated identity verification as a one-time event: check credent
FIDO & PasskeysMicrosoft s decision to make passkeys the default authentication method in Entra ID and Google s integration of FIDO2 security keys for Google Workspace users Windows login marks a pivotal shift in en
