Identity & Access
Authentication, credentials, IAM and zero-trust access control.
How AI-Driven Credential Theft Challenges Every Security & Compliance Analyst
AI makes credential theft easier to scale. A practical guide for security and compliance analysts on identity security beyond successful authentication.
Read Article
MFA Stops at the Login: Governing OAuth Access After Consent
Multifactor authentication blocks credential theft, but OAuth consent hands attackers a persistent path into enterprise data. Learn how to govern OAuth access, enforce least-privilege scopes, and monitor grants against modern threats.
AI Agent Identity Access Management Was Never Designed for This — And Patches Make It Worse
Traditional IAM assumes humans with predictable session lifecycles. AI agents shatter every one of those assumptions, and bolting agent controls onto legacy frameworks amplifies risk instead of containing it. A lifecycle-first approach — discover, secure, deploy, monitor — offers a way out.
AI Agent Identity and Access Management Breaks When Agents Stop Borrowing Logins
Persistent AI coworkers retain access indefinitely, collapsing the borrowed-credential model that worked for short-lived agents. Here is what identity and access management looks like when the agent never leaves.
Top Identity Access Management Tools for Enterprise Security 2024
Review of leading IAM tools including ManageEngine ADManager Plus, Okta, Microsoft Entra ID, IBM Security Identity Governance and Intelligence, Ping Identity, CyberArk, Entrust, OneLogin, Auth0, and RSA ID Plus, covering features, pricing, pros/cons, and target use cases.
Securing Autonomous Agents: Why AI Gateways Need Network Boundaries, Not Just Faster Patches
Why securing autonomous agents requires identity-based contextual access and Zero Trust Workload Connectivity—not just faster patching of exposed AI gateways and MCP servers.
Gheist Turns Stolen Developer Tokens Into a Cloud-Secret Hunt
A look at how the Gheist campaign abused GitHub credentials and Actions workflows, what defenders should search for, and why deleting a suspicious branch is not enough.
Storm-0940’s ConnectWise Campaign: What the Reported Evidence Shows
Dark Reading reports that Storm-0940 used ARTEX and compromised application credentials in a campaign involving ConnectWise Cloud Backup. Here’s what is known—and what remains unproven.
Authentication Workarounds: Reduce Friction, Preserve Accountability
How authentication workarounds reveal sign-in friction and accountability gaps—and how to test practical access-control improvements.
Zeabur’s 2026 breach: credential gaps, platform exposure and the shutdown
Zeabur disclosed how leaked internal credentials and unrotated access contributed to a second security breach before its shutdown.
State and Local Cybersecurity: Making CJIS v6.1 Controls Visible
A practical approach to authentication, account security and audit evidence for CJIS v6.1, with clear separation between secondary-source claims and policy verification.
OVHcloud CLI supply-chain breach prompts urgent credential rotation
OVHcloud says attackers altered CLI releases 0.11.0–0.15.0 to steal developer secrets. Learn what was affected and how to respond.