Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
Tokens & SessionsYou re redesigning your workload identity architecture. The question isn t whether ephemeral credentials are better, most security professionals agree they are. The real question is whether your organ
Multi-Factor MethodsScope This guide focuses on redesigning authentication systems when traditional layering fails to reduce risk. It s for IAM architects who need to shift from more authentication to building resilient
Governance & ComplianceYour Cybersecurity Framework (CSF) was created before generative AI became a staple on every developer s desktop, before agentic systems began making autonomous decisions, and before your Security Ope
Authorization ConceptsWhen Andrej Karpathy coined vibe coding in early 2025, he highlighted a trend many development teams already recognized: using AI to generate code quickly without fully understanding it. This approach
Get weekly security insights and compliance updates delivered to your inbox.
Tokens & SessionsApple s Intelligent Tracking Prevention and Google s Privacy Sandbox have dismantled the shared-cookie patterns that powered mobile-to-web session handoff for years. If you re still relying on browser
FIDO & PasskeysYou ve deployed FIDO2 passkeys . Your vendor promised interoperability. Your pilot users love not typing passwords. Then a contractor with a different device manufacturer can t authenticate, or your m
Federation & SSOIAM architects are increasingly tasked with evaluating mobile driver s license (mDL) integration for their organizations. Whether they re building systems for financial services or healthcare, or cons
Authorization ConceptsYour organization likely runs AI agents today. They re summarizing tickets, updating records, calling APIs, and reading sensitive data. The question isn t whether to secure them. It s how you authenti
OAuth & OIDCYou ve got OAuth 2.0 working for your mobile app. Users authenticate, get tokens, and call APIs. Everything s smooth. Then, your product team wants users to tap a button in the app and land in a web v
Governance & ComplianceThe Conventional Wisdom Identity management often falls solely on IT. You hire an IAM architect, buy a platform, configure your Identity Provider, and consider it done. Security reviews policies, comp
Directory ServicesYou ve spent the last year rolling out passkeys, FIDO2 security keys , and Okta FastPass to your workforce. Your authentication policy blocks credential phishing cold. Users can t share secrets they d
Governance & ComplianceIf you re running a digital identity verification service in the UK, you need to understand a critical development. Kantara Initiative is now the first Conformity Assessment Body (CAB) accredited unde
FIDO & PasskeysYour team has approved passwordless authentication, choosing FIDO2 . Now, you need a repeatable enrollment process that works for 500 users or 5,000. This script automates passkey registration while m
OAuth & OIDCScope This guide explores OpenID Connect Key Binding, a proposed Implementer s Draft under review by the OpenID Foundation . We ll discuss what the specification addresses, how it differs from existin
Identity LifecycleYour organization just rolled out passkeys to eliminate phishing. Now attackers are targeting the enrollment process itself. Since April 2026, the threat actor O-UNC-066 has operated a phishing kit sp
OAuth & OIDCThe Australian Department of Finance s consultation on verifiable credentials policy closed with a clear warning from the OpenID Foundation s Australian Digital Trust Community Group: prioritize inter
Governance & ComplianceThe Conventional Wisdom If you re a Credential Service Provider aiming for federal contracts, the path seems clear: get Kantara Initiative certification, land on the Trust Status List, and you re set
Governance & ComplianceNIST is developing a program to adapt the Cybersecurity Framework for AI-specific risks and opportunities. This guide translates that initiative into actionable steps for your SecOps team to manage AI
Governance & ComplianceNIST SP 800-63A Revision 4 is now the active standard for identity proofing assessments. If your team is managing Identity Assurance Level certification processes or planning to pursue IAL2/IAL3 trust
FIDO & PasskeysYou re getting questions about passkeys. Your security team wants to know if they re ready. Your developers are asking how they work. Your CISO is asking what happens to your existing MFA stack. These
