Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
Identity LifecycleKantara Initiative has just published the SP 800-63B-4 Service Assessment Criteria, and your inbox is probably already filling with vendor pitches about becoming compliant. Before you schedule another
Passwords & HashingYou ve spent years getting your team to adopt a password manager. Multi-Factor Cryptographic Devices protect privileged accounts. Your security awareness training finally mentions phishing. Now you re
OAuth & OIDCMicrosoft customers are experiencing a 15x increase in device code phishing attacks this year, according to Push Security . These attacks exploit OAuth 2.0 s Device Code Authorization Grant, facilitat
Directory ServicesYou re ready to deploy passkeys. You ve read the NIST SP 800-63-4 guidance, you understand WebAuthn domain -binding, and your executive sponsor wants phishing-resistant authentication live by Q2. Now
Get weekly security insights and compliance updates delivered to your inbox.
OAuth & OIDCYou re building a digital identity system that needs to work across multiple sectors, integrate with government frameworks, and remain viable as standards evolve. The shift from prescriptive architect
FIDO & PasskeysYou ve read the NCSC announcement. FIDO2 credentials are more secure than traditional multi-factor authentication against common attacks. Your CISO forwarded the paper. Your board is asking questions.
FIDO & PasskeysYou re facing a decision that affects every authentication flow in your organization: how aggressively should you move toward passwordless authentication with passkeys ? The FIDO Alliance reports that
Identity LifecycleYou re confident your team can revoke a departing employee s access within 24 hours. Yet, more than one-third of organizations in a FIDO Alliance and HID survey shared that confidence, only to admit t
FIDO & PasskeysThe question isn t whether to adopt passkeys . With 93 percent of organizations on the adoption path and 65 percent reporting high technical familiarity, the technology is well understood. The real qu
Authorization ConceptsThe Challenge The OpenID Foundation s AuthZEN Working Group tackled a key interoperability issue: AuthZEN offers a standardized API for authorization decisions, but each protocol and system uses diffe
Tokens & SessionsThe Persistent Problem This isn t about a single breach. It s about a widespread issue: the ongoing use of static credentials for machine-to-machine authentication, despite the existence of ephemeral
OAuth & OIDCWhen your AI agent needs to book a hotel, approve a transaction, or access member-only data, you re managing authentication, authorization, and transaction approval across different trust levels. OAut
Federation & SSOScope This guide explores the technical requirements and implementation considerations for mobile driver s license (mDL) presentation under ISO/IEC 18013-5 (in-person) and ISO/IEC 18013-7 (remote). Yo
Zero Trust ArchitectureThe Question at Hand Your AI agents need to query production databases, modify cloud resources, and execute privileged commands. How do you secure that access? Traditionally, agents are treated like a
FIDO & PasskeysYou ve read the vendor whitepapers. Passkeys eliminate phishing, improve user experience, and align with FIDO2 standards. The business case looks solid. Then you brief your architecture team, and the
OAuth & OIDCYou ve spent years building OAuth flows, SPIFFE identities, and OIDC federation. Now, AI agents are spinning up in production, and your first instinct is to treat them as a new problem needing new sta
Governance & ComplianceYour organization has an IAM program. You have tools deployed, processes documented, and policies approved. But when your CISO asks, Where do we stand? or the board wants to know, How mature is our id
FIDO & PasskeysTrust isn t something you add to an authentication flow after the fact. It s what happens when your identity system works the way users expect it to work, every time. Most IAM architects inherit syste
FIDO & PasskeysThe Challenge In 2025, Japan s financial sector was hit by a wave of phishing attacks targeting securities firms. The Financial Services Agency (FSA) responded with guidelines mandating phishing-resis
