All news with #identity security tag

🔒 Dashlane's analysis of millions of aggregated, anonymized authentications from July 2025 to June 2026 shows passkey authentications nearly doubled year-over-year to 2.5 million monthly in 2026, and 57% of users now store at least one passkey. Despite growth, passkeys remain a minority of logins on major platforms like Google, PayPal, Amazon and eBay. Dashlane urges businesses and developers to make passkeys visible, default and easier to use to close the adoption gap and reduce account takeover risk.

🛡️ Personal AI agents are proliferating rapidly and will inevitably connect to corporate systems, often without IT approval. These agents access work accounts through OAuth, saved credentials, API keys, or by running on an employee’s laptop, creating novel identity and governance challenges. Rather than wholesale blocking, the article recommends enabling controlled use by treating agents as external entities and applying identity-based controls to discover, attribute, limit, and retire agent access.

🔒 A new SailPoint report exposes a “velocity paradox”: enterprises are adopting autonomous AI agents at machine speed while their identity security remains stuck at human pace. The analysis shows a market stalled in early maturity—60% of organizations still in Horizon 1 or 2—and highlights a growing gap between improving human identity programs and lagging agent identity controls. The report argues organizations must shift from manual, periodic controls to continuous, automated, machine-speed policy enforcement to secure non-human identities effectively.

🔒 Danish authorities are examining security controls after attackers used a company's credentials to query the national citizen registry and retrieve records for roughly 8.8 million people over a 10-day span. The incident, discovered on Oct. 2, involved more than 14 million searches and affected residents, deceased individuals, and those living abroad, though protected identities were spared. The vendor's access has been revoked and the National Special Crime Unit is investigating while officials warn of fraud risks and urge stronger identity checks.

🔎 This vendor-focused overview summarizes how cloud expansion, AI, distributed systems, and complex digital environments are reshaping security. It highlights shifts toward continuous visibility, least-privilege identity controls, telemetry management, AI-native SOCs, and exposure reduction. The piece profiles vendors addressing identity, telemetry, endpoint, human risk, exposure, email, device, AI, and cloud security.

🔁 IAM Identity Center can now be replicated to opt-in AWS Regions and between Regions inside AWS GovCloud (US) and AWS China, extending prior multi-Region coverage beyond enabled-by-default commercial Regions. When enabled, the service automatically replicates identities, entitlements, and related data from a primary Region to additional Regions, allowing users to retain access during primary Region disruptions. Multi-Region support works with external identity providers or the IAM Identity Center directory and requires a multi-Region customer managed KMS key (CMK); new instances can enable the feature with one click, while existing instances must create and configure a CMK. Standard AWS KMS charges apply; IAM Identity Center itself has no extra fee.

🔒 AWS IAM Identity Center's Identity Store APIs now accept ARNs for users, groups, group memberships, and identity stores wherever resource IDs were previously required. This additive change means existing integrations keep working while allowing callers to supply either resource IDs or full ARNs directly. Responses still return resource IDs and malformed or wrong-type ARNs result in a ValidationException. The feature is available in all Regions where IAM Identity Center is offered at no extra cost.

🔒 AWS IAM outbound identity federation now supports VPC endpoints for OIDC discovery, allowing workloads to access OIDC metadata and JWKS verification keys over AWS PrivateLink without traversing the public internet. This enables short-lived JWTs from AWS STS to be verified by external services while keeping traffic inside the AWS network. The feature addresses network security requirements for VPCs with restricted internet access and is available in all commercial, GovCloud (US), and China Regions with standard PrivateLink pricing.

🔐 Okta is positioning identity as the primary control plane for securing AI agents, unveiling Okta for AI Agents and enhancements like Agent SSO, agent-to-agent rules, and runtime policy and logging. The company argues identity can help manage agentic risk, but experts caution that authentication is only the first step and agents introduce scale and delegation challenges. Market competition is intense as hyperscalers, IAM vendors, and security firms vie to be the control plane.

🔒 AI agents change how we evaluate access by turning permissions into exploration paths that can discover credentials and combine identities across systems. Autonomous agents persistently test many actions, often using hard-coded credentials and exploiting trust boundaries, as seen in notable incidents like Hugging Face in July 2026. Security teams must map full access chains, assign ownership, and enforce continuous identity governance to constrain an agent's effective blast radius.

🔍 This article defines identity visibility in IAM as the continuous ability to discover every identity, map its entitlements, and observe runtime access usage. It explains why cloud and multicloud environments, machine identities, and application-local accounts create an expanding identity attack surface. The piece surveys identity visibility tool capabilities and vendor approaches, and outlines how visibility complements IAM, IGA, PAM, and zero trust efforts.

🔐 AWS HealthOmics now supports IAM session policies, allowing you to restrict permissions for individual runs without creating and managing multiple IAM roles. An IAM session policy is an inline policy that limits the maximum permissions of a run by intersecting with the underlying identity-based policy. This enables per-run scoping—such as restricting access to a tenant's S3 buckets or specific S3 objects—without provisioning separate roles. Support is available in all Regions where HealthOmics is offered.

🔒 AWS Security Token Service (STS) now enforces a single assembled session token size limit of 4,096 bytes, replacing the previous packed policy and token size limits. STS returns session token size and utilization in API responses, CloudWatch metrics, and CloudTrail events, and preserves PackedPolicySize for backward compatibility. A new MinimumSessionTokenSize parameter lets you generate larger tokens to test infrastructure limits; error handling remains unchanged with PackedPolicyTooLargeException used for over-limit tokens.

🔒 This post explains why Database Migration Service (DMS) does not migrate SQL Server instance-level logins and how to migrate them safely. It outlines the security, compliance, and identity-modernization reasons behind that design decision and shows a practical three-step approach using Microsoft's sp_help_revlogin script. The guide covers generating hashed-password CREATE LOGIN statements, applying them to Cloud SQL, and resolving orphaned users, while recommending migration to Customer-Managed Active Directory where possible.

🔍 A new SpyCloud report finds compromised non-human identities (NHIs) — including AI agents, service accounts, API keys and tokens — accounted for 31% of intrusions versus 17% for social engineering. Based on a survey of 750 cybersecurity leaders across North America and Europe, the study highlights a gap between perceived and actual NHI visibility and monitoring. The report also notes weak AI governance, inconsistent third‑party identity checks, and elevated supply chain identity risk.

🔍 The FBI is investigating a reported breach tied to a service called Nexus that allegedly exposed over 153 million driver’s licenses and other identity documents across the US and Canada. The trove was first reported by journalist Brian Krebs, who traced activity to identity verification provider IDScan.net, which is investigating. Security experts warn the breach could have long-lasting consequences because government IDs are immutable and widely used for verification.

🔒 Amazon Redshift now supports AWS IAM Identity Center authentication for provisioned clusters and serverless workgroups configured with enhanced VPC routing (EVR). This enables single sign-on using corporate credentials while keeping traffic inside your Amazon VPC and on the AWS network, meeting data residency and network-isolation requirements. Redshift validates and exchanges IAM Identity Center tokens over AWS PrivateLink interface VPC endpoints inside the VPC and supports multi-Region Identity Center replication.

🔍 This post explains how to plan and automate governance for AWS IAM Identity Center across an AWS Organization. It outlines integration with external IdPs, recommended delegation and IAM permissions, and naming conventions to improve discoverability. The article describes a sample solution that uses AWS CDK to deploy reporting and remediation stacks to discover Identity Center applications, generate CSV reports, and optionally enforce assignment policies. It emphasizes cross-team planning, detective controls, and testing before remediation.

🔒 AWS Elastic Beanstalk now automatically joins Windows Server instances to an Active Directory domain managed with AWS Directory Service. Previously requiring custom join scripts, the new feature uses configuration options so every instance, including those launched by auto scaling, joins the domain at boot before application deployment. Domain-joined instances can use Windows-integrated authentication, group policy, and access domain resources, and the join process is resilient so failures don't block deployments.

🔍 An Identity Fabric unifies fragmented identity systems to provide runtime visibility across applications, APIs, and infrastructure. It bridges design-time policies with runtime behavior to reveal identity drift, orphaned credentials, and unobserved attack paths. The approach is essential for hybrid and multi-cloud environments, especially to govern non-human and AI identities and enable continuous least-privilege enforcement.