Tag: identity management
84 articles
US Army Wrestles with Zero Trust Identity Challenge
The US Army faces a daunting task: folding 5,000 disparate IT systems into a single, secure platform that verifies the identity of every connected user and device, a crucial step towards achieving Zero Trust Identity by 2027. To get there, they're developing flexible onboarding pathways to bring all systems under one roof.
Credential Layer Expands Faster Than Security Teams Can Contain
The software landscape is evolving at a breakneck pace, with GitHub's commit count skyrocketing from 1 billion in 2025 to 2.9 billion by August 2026 - a staggering rate that hints at an explosion of credentials and identities that need to be secured. This rapid growth leaves security teams scrambling to keep up with the expanding attack surface.
Zero Trust Vulnerable to Onboarding Attacks
The often-overlooked onboarding process is a glaring weak spot in Zero Trust security, leaving companies vulnerable to attacks that exploit the "Day One window" when new hires are first brought into the environment. Stolen credentials, involved in nearly 45% of breaches, can easily be stolen during this chaotic period when service desk agents are busy activating accounts and issuing initial credentials.
AI Coworkers Expose New Security Risks
Meet the new security challenge: AI coworkers that operate on borrowed credentials with no owner and no off switch, posing a risk that threatens to upend traditional access governance. As AI agents become more autonomous and persistent, they require robust provisioning and lifecycle controls to prevent a security nightmare.
Identity Telemetry Bolsters Defense Against Escalating Threats
As organizations expand their cloud presence and connect with more external accounts, traditional identity controls - like periodic reviews and static role definitions - simply aren't enough to keep pace with escalating threats. A proactive approach requires continuous, real-time awareness that only a unified platform with identity governance and event-level telemetry can provide.
Identity Management for AI Agents Requires New Frameworks
Traditional identity management systems can't keep up with AI agents, which can autonomously execute tasks and chain tools together, revealing a gap between policy intent and actual behavior. This intent-to-execution gap undermines operational assurance, highlighting the need for new frameworks that can reliably prove what AI agents do.
Identity Infrastructure Exposes Hidden Risks in Active Directory
In today's cybersecurity landscape, identity has become the new perimeter - and Active Directory and Entra ID are the control centers that keep it all connected, making them prime targets for attackers. Compromising these identity infrastructures can give hackers access to an entire environment, not just a single system.
AI Security Startups Target $1 Billion Agentic Identity Gap
As AI capabilities grow, it's no shock that agents are finding clever ways to get the job done - but that also means we need to get serious about governing their behavior. The real challenge now is setting clear limits on what they can access and do, and keeping a close eye on their actions.
Identity Visibility Emerges as Critical IAM Challenge
In today's digital landscape, identity visibility has become a pressing challenge for modern enterprises, requiring a clear view of every identity, its access capabilities, and actual usage. This crucial visibility boils down to three key functions: a complete inventory of users, a mapped model of entitlements, and real-time insights into how access is being used.
Microsoft Disables Domain Login Fix Amid Windows Update Issues
If your Windows 11 device is on a corporate domain, you might be in for a frustrating login struggle - valid credentials won't work, and you'll face domain trust errors after installing September's security updates. This is because the updates cause Windows to enforce Machine Identity Isolation settings, leading to domain login failures.
Fraudulent Hires Evade Detection, Gain Network Access Before Exposure
Imagine getting hired, passing background checks, and receiving your official login credentials - all without being who you claim to be. Once inside, malicious hires can wreak havoc for days, with the average fraudulent employee enjoying 5.73 days of unrestricted access to sensitive corporate networks.
Cloud Identities Exposed Through Behavioral Clustering Analysis
Mapping the complex roles of human, machine, and autonomous agent identities in cloud environments is a daunting security challenge - but a practical, data-driven solution can turn audit logs into a revealing behavioral map. By analyzing API activity across 125 cloud environments, researchers have developed a clever method for grouping identities into functional roles, shining a light on what they actually do.
FreeIPA Flaw Enables Anonymous Clients to Create Admin Credentials
A critical vulnerability in FreeIPA, tracked as CVE-2026-76578, allows an unauthenticated client to create admin credentials by exploiting a chain of defects that lets them create a Kerberos identity and join the administrators group. This flaw, with a preliminary CVSS score of 9.8, was fixed in FreeIPA version 4.13.4.
AI Agents Expose Vulnerabilities in Online Identity Verification Systems
In a surprising experiment, an autonomous AI agent called Tenner tested online identity verification systems and found them surprisingly vulnerable, breezing past defenses not once in 20 hours. With just $4.75 to its name, Tenner cleverly navigated the digital landscape, all while operating under strict rules to avoid detection.
Lax Access Controls Enable Ex-Employee to Inflict Hundreds of Thousands in Damages
A single misstep in access control can have devastating consequences: one terminated employee's lingering credentials led to hundreds of thousands of dollars in damages, including data deletion, system lockdowns, and a corrupted database. The breach not only racked up costly recovery fees but also brought a high-priority project to a grinding halt for weeks.
Identity Fabric Emerges as Key to Modernizing Enterprise Identity Security
In today's complex hybrid and multi-cloud environments, an Identity Fabric weaves together disparate identity systems, providing a unified layer of visibility into how identities interact across applications, APIs, and infrastructure. By bridging the gap between access intent and runtime execution, it shines a light on hidden risks and vulnerabilities, eliminating the identity dark matter that attackers exploit.
Keycloak Flaw Exposes Accounts to Unauthenticated Takeover
A critical flaw in Keycloak, rated 9.1 by Red Hat, allows hackers to hijack any account, including admin ones, by manipulating the password reset process. This vulnerability, CVE-2026-18963, lets attackers take control without even logging in.
Thousands of Leaked AWS Keys Remain Active
A recent scan by Truffle Security uncovered a staggering 9,300+ active AWS keys that were leaked online, including hundreds with full administrative rights, putting sensitive data at risk. These compromised keys were found across various public platforms, with a shocking 88% still authentic and vulnerable to exploitation.
AWS Security Quarantine Policy Falls Short Against Credential Abuse
Leaking AWS credentials can lead to a staggering 99% increase in your bill - but a recent finding by Truffle Security reveals that even AWS' Quarantine Policy may not be enough to stop the damage, with hundreds of leaked root keys still active. This alarming discovery highlights the urgent need for tighter security measures to prevent credential abuse.
Microsoft patches exploited Entra ID flaw amid rising attacks
Microsoft has patched a critical vulnerability in its Entra ID platform, known as CVE-2026-69836, which allowed attackers to execute code remotely with ease, and has already been exploited in recent attacks. This flaw enabled unauthorized threat actors to gain control and wreak havoc, making swift action crucial to prevent further damage.
Identity Takes Center Stage in Cybersecurity as Threats Evolve
In today's evolving threat landscape, protecting identity has become the top priority in cybersecurity - treat it like the crown jewels, because it is. By prioritizing identity protection and having a plan in place to recover quickly, organizations can safeguard the foundation of every mission.
NVIDIA Launches Open Secure AI Alliance to Share Threat-Detecting Tech
Join the Open Secure AI Alliance, a groundbreaking coalition of 37 industry leaders, as they revolutionize AI security by sharing cutting-edge threat-detecting technologies and collaborative defense strategies. Together, they're breaking down silos to safeguard the future of AI and software development.
AI Agents Expose Growing Enterprise Attack Surface
The rapid proliferation of AI agents in enterprise environments - up 466.7% in just one year - has created a massive, high-value target for cybercriminals, with these AI identities often being granted privileged access to core systems. This surge in AI adoption has significantly expanded the enterprise attack surface, making it a prime time for cyber threats to exploit these new vulnerabilities.
Microsoft Entra ID Shifts to Passkey Authentication Default
Microsoft is shaking things up with its Entra ID service by making passkey authentication the default method starting September 2026, and users currently relying on SMS or voice authentication will be automatically transitioned to passkeys. By February 1, 2027, SMS and voice authentication will be phased out, marking a significant shift towards more secure passkey technology.