Blog
Latest: Amazon says 175 million customers now sign in with passkeys · McKesson breach started with vishing against Okta SSO, then reached Salesforce and Snowflake · Two PaperCut flaws chain into unauthenticated code execution, and the patch has bypasses
Agent identity just got a protocol, which is the easy half
Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.
- Analysis · Aug 29, 2026Every EU member state owes citizens a wallet by December 2026
Regulation (EU) 2024/1183 anchors national EUDI Wallet availability to 24 December 2026. Most coverage treats this as a public sector milestone. The obligations that will surprise people fall on relying parties.
- Analysis · Aug 29, 2026Passkeys had a hard month, and none of it was the cryptography
Three research teams broke passkey guarantees in August 2026 without touching WebAuthn. The weak points were event logs, sync key custody, and in-session key reuse. Here is what actually changed for your rollout.
- Editorial · Aug 13, 2026A CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wrapping, Kerberos escalation, cloud-token bugs, and KEV items that let someone log in as you.
- Analysis · Aug 6, 2026Black Hat USA 2026 recap: passkeys get broken (twice), and AI agents get an identity perimeter
Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open source tool for dormant non-human identity trust paths, and insider risk getting AI-native and funded.
- Analysis · Jun 25, 2026The world is shipping digital identity: what 51 countries reveal
We catalogued 86 national digital ID schemes across 51 countries. The patterns that emerge, mobile-first, bank-led, biometric, and wallet-bound, tell you where identity is going and what to build for.
- Analysis · Jun 24, 2026Biometric authentication just became a regulatory frontier
Biometrics are now in nearly every national ID and a growing share of logins, and the law has caught up. BIPA, the EU AI Act, and a wave of US state rules treat biometric identifiers as a special category. Here is what changed and what to do.
- Analysis · Jun 23, 2026How to vet a national digital ID before you build KYC on it
Not every national ID is equally trustworthy or equally easy to verify. A practical seven-point checklist for evaluating a country's digital ID before you wire it into onboarding, with the references to do it fast.
- Analysis · Jun 12, 2026Identiverse 2026 recap: agentic identity grows up, and passkeys get real
Our takeaways from Identiverse 2026 in Las Vegas: AI agent identity moved from theory to roadmap, passkeys turned operational, deepfakes pressured identity verification, and session security took center stage.
- Editorial · Jun 5, 2026Why We're Building a Daily Identity Blog (And What You'll Get From It)
The identity industry moves faster than any single team can track. This blog is our attempt to keep practitioners current with quality, vendor-neutral writing, published daily.
- Analysis · Jun 4, 2026Agentic AI Identity Is the Next Frontier (And Your IAM Stack Isn't Ready)
AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.