Shared Signals Framework
An OpenID Foundation specification defining how security events are shared between cooperating parties: how a transmitter and receiver establish a stream, how events are delivered by push or poll, and how delivery is acknowledged. CAEP and RISC are profiles that define the event types carried over it.
The framework matters because signalling only works if both sides implement the same mechanics. Delivery is specified in RFC 8935 (push) and RFC 8936 (poll), using Security Event Tokens, a JWT profile for representing an event. Adoption is the hard part: a signal is only useful if the receiving application acts on it, which means revoking a session rather than logging the event.
See also: CAEP, ITDR, JWT, Annabelle Backman, RISC, Security Event Token, Shared Signals Framework standard
Related on Start with Identity
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- GlossaryEntity Analytics
Entity analytics is the behavioural analysis of every identity in an environment, human and non-human, to learn what normal activity looks like for each one and
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- PodcastSemperis
Semperis' biweekly show for defenders of hybrid Active Directory and Entra ID environments, hosted by 15-time Microsoft MVP Sean Deuby.