RISC (Risk Incident Sharing and Coordination)
RISC (Risk Incident Sharing and Coordination) is an OpenID Foundation specification, the OpenID RISC Profile Specification 1.0, that defines account-level security event types, such as credential compromise, account disabled, identifier recycled, and sessions revoked, delivered as Security Event Tokens over the Shared Signals Framework. It was approved as an OpenID Final Specification together with SSF and CAEP in September 2025.
Where CAEP is about sessions changing state, RISC is about accounts at risk. The classic use case is cross-provider: when the email provider that holds a user's recovery address detects a takeover, it can tell every relying party that uses that address to log the user in, so they stop trusting password resets sent there. The "identifier recycled" event addresses a quieter problem, an email address or phone number reassigned to a new person who then inherits the old owner's accounts. Google sends RISC events to apps that use Sign in with Google through its Cross-Account Protection program; the receiving side is where adoption lags, and an event nobody acts on changes nothing.
See also: Shared Signals Framework, CAEP, Security Event Token, account takeover, account recovery, ITDR
Related on Start with Identity
- GlossaryConsent Phishing (Illicit Consent Grant)
Consent phishing, which Microsoft calls an [illicit consent grant](https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-gr
- GlossaryCredential Stuffing
An attack that replays username and password pairs leaked from other breaches against a target, exploiting password reuse. Defended with MFA, passkeys, and bot
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- BlogCrowdStrike's Falcon Fund backs Above Security, folding AI-native insider risk into Falcon
Above Security, a Tel Aviv-based insider-threat platform, announced a strategic investment from the CrowdStrike Falcon Fund at Black Hat USA 2026, alongside an
- ArticleIAM Incident Response Playbook: Handling Identity Breaches, Compromised Credentials, and Privilege Escalation
A complete playbook for responding to identity-related security incidents, including credential compromise, privilege escalation, and identity infrastructure at
- ArticleIdentity for Media and Streaming: Sharing, Profiles, and TV Sign-In
Streaming identity ties login directly to revenue: it enforces households and paid sharing, limits concurrent streams, separates profiles, signs users in on TVs