Identity & Access
Authentication, credentials, IAM and zero-trust access control.
Security & Compliance Analyst Briefing: Identity’s Real Attack Surface
A security & compliance analyst briefing on stolen credentials, evolving NIST identity guidance, and why passkey security depends on implementation.
OpenCode breach and AI model extraction attacks: developer credentials exposed
What is known about the 2026 OpenCode Console breach, reported API-key exposure and AI model extraction activity, plus practical steps for affected developers.
ConnectWise credentials and Microsoft 365 access: What security & compliance analysts should know
Researchers reported ConnectWise-associated credentials authenticating to Microsoft 365 tenants. Here’s what is known, what remains uncertain, and how to assess third-party identity risk.
Folding Privacy Risk Into the Security Decisions You Already Make
How the NIST Privacy Framework and the Risk Management Framework let teams treat privacy as a standing risk, not a one-off compliance checkbox. Grounded entirely in accessible NIST sources, with a note on why this topic replaces an unverifiable credentials-based draft.
Identity Is the New Perimeter: Why Security & Compliance Can't Keep Treating IAM as an Afterthought
Cloud identity providers now sit at the center of every enterprise attack surface. Here's why security and compliance teams need to rebuild their access management strategy from scratch.
VPN Limitations Are the Remote Access Security Gap You Already Have
Attackers don't need to crack MFA when they can spray passwords against a VPN that never checks for it. Here's where the authentication boundaries break across VPNs, RDP, and on-premises Windows systems.
Training the Frontline: Inside EC-Council’s Massive AI Credential Expansion
An analysis of EC-Council's massive expansion into AI certifications and Certified CISO v4, addressing the $5.5 trillion global AI risk exposure and 700,000 U.S. reskilling gap.
When AI Agents Borrow Human Credentials: The Imperative for AI Cybersecurity Governance
Expanded article on AI agents borrowing human credentials, SOC 2 blind spots, and AI cybersecurity governance with over 800 words.
More Than 9,300 AWS Access Keys Still Active After Years of Public Exposure
More than 9,300 Amazon Web Services access keys publicly exposed between August 2022 and August 2026 remain active and valid, with Hugging Face the largest single source of leaked keys. Truffle Security's four-year tracking reveals 817 company-linked keys, 526 AWS root keys, and 242 IAM users with AdministratorAccess. Researchers found that 88% of verified 10,616 re-authenticated keys still work, and once attackers have valid credentials only 37% of actions are blocked.
N-able Warns: Attackers Exploiting N-central Auth Bypass in Active Campaigns
N-able warns of active exploitation in N-central authentication bypass (CVE-2026-18577). Emergency hotfix released to defend against AI cybersecurity threats.
Chick-fil-A Breach: What the Security & Compliance Analyst Needs to Know
Chick-fil-A disclosed a fresh credential stuffing breach hitting customer accounts. Here is what every security & compliance analyst needs to evaluate.
Chick-fil-A Account Attack: What Every Security & Compliance Analyst Must Know
An analysis of the June 2026 Chick-fil-A credential stuffing breach affecting 13,000+ customer accounts, detailing exposed data, IAM risks, and enterprise identity controls.