Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
FIDO & PasskeysWhen GOV.UK One Login reported that more than 300,000 users adopted passkeys during their trial, with nearly 10% of daily sign-ins now using biometric authentication, enterprise security teams were sk
Access Control ModelsIn the past 72 hours, our Slack channels and team meetings have focused on one issue: the Cisco ISE authentication bypass. With CVE-2026-76460 scoring a perfect 10.0 on the CVSS scale and active explo
Multi-Factor MethodsThese questions started showing up in our security Slack channel after CloudSEK s BigBear 2.0 report landed. The operation harvested 5,137 credential records and 4,148 session cookies from 461 organiz
FIDO & PasskeysYour users will encounter passkey prompts whether you re ready or not. Google , Microsoft , and Apple are pushing FIDO2 -based authentication across their platforms, and your enterprise identity stack
Get weekly security insights and compliance updates delivered to your inbox.
FIDO & PasskeysWhat Happened In August, Microsoft removed password support from its authenticator app, keeping passkey functionality intact. This wasn t a bug or a gradual phase-out, it was a deliberate decision. Us
FIDO & PasskeysWith 5 billion passkeys in use and 68% of organizations deploying them for workforce authentication, you d think we d have it figured out. We haven t. The gap between passkeys are live and passkeys ac
Governance & ComplianceWhen your organization operates across borders, your cybersecurity framework must be understood by all your teams. NIST s release of CSF 2.0 translations in French, German, Korean, Polish, Portuguese,
Tokens & SessionsApple s Intelligent Tracking Prevention and Google s Privacy Sandbox have dismantled the shared-cookie patterns that powered mobile-to-web session handoff for years. If you re still relying on browser
Governance & ComplianceThe Conventional Wisdom Identity management often falls solely on IT. You hire an IAM architect, buy a platform, configure your Identity Provider, and consider it done. Security reviews policies, comp
Governance & ComplianceThe Conventional Wisdom If you re a Credential Service Provider aiming for federal contracts, the path seems clear: get Kantara Initiative certification, land on the Trust Status List, and you re set
OAuth & OIDCIf you re implementing OpenID for Verifiable Presentations (OpenID4VP) or OpenID for Verifiable Credential Issuance (OpenID4VCI) , you need a clear path from development to public certification. The O
Governance & ComplianceIf you ve ever tried to report your IAM program s progress to a board, you ve probably hit the same wall: which maturity model do you use? And once you pick one, how do you know if your score actually
Federation & SSOIf your team manages identity federation across trust boundaries, you re about to encounter two new OpenID Federation extension specifications. The OpenID Foundation s review and voting process runs f
OAuth & OIDCThe Challenge A customer-support chatbot needs to access payment history and account details from multiple backend services. The user initiates the conversation, but an AI agent decides which tools to
