Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
371 matching stories — announcement, in Non-Human Identity & Secrets — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Anthropic recently shipped the Enterprise-Managed Authorization (EMA) extension for Claude’s MCP connectors, which lets IT admins configure tools such as Asana, Figma, and Linear once through their existing identity provider. Authorized employee end users can then inherit access at login without needing any additional individual OAuth approvals. Under the hood, Anthropic’s EMA relies on a […] The post Agentic AI Just Got an Enterprise Access Layer appeared first on Hush Security.
Non-human identities have quietly become the most prevalent identity type in enterprise environments. Yet the security infrastructure built to manage identity was designed for people, not machines.  The result is an attack surface that grows with every new integration, AI workflow, and automated pipeline—one that existing identity programs were never designed to govern. Secrets management, including token […]The post 6 principles for securing non-human identities (NHIs) appeared first
An illicit consent grant abuses OAuth 2.0's delegated authorization model: instead of stealing who you are, the attacker steals what you can do. There is no software bug to patch, and the attack sails past MFA because it intercepts authorization, not authentication. This post breaks down why consent phishing works and evades detection, walks through the three-move attack chain from lure to token, and dissects the CoPhish case study that weaponizes Microsoft Copilot Studio — then shows how SlashI
An illicit consent grant abuses OAuth 2.0's delegated authorization model: instead of stealing who you are, the attacker steals what you can do. There is no software bug to patch, and the attack sails past MFA because it intercepts authorization, not authentication. This post breaks down why consent phishing works and evades detection, walks through the three-move attack chain from lure to token, and dissects the CoPhish case study that weaponizes Microsoft Copilot Studio — then shows how SlashI
8 min readMany organizations deploying AI agents have not fully answered how those agents authenticate to services, what credentials they carry, or what happens to those credentials when the task ends. In some organizations, the agents work, so the question gets deferred. The problem is that “it works” is doing a lot of heavy lifting. The agent […] The post Secure Agentic Access: Authentication and Authorization for AI Agent Workloads appeared first on Aembit.
Nothing moves faster than AI nowadays. But while we were busy perfecting our prompts, the technology quietly transitioned from answering questions to executing them. For the last two years, the conversation has been dominated by AI chatbots—reactive tools used to summarize meetings and polish slide decks. We treated them like digital interns, and in that world, […]The post The risk of AI autonomy without runtime enforcement appeared first on Silverfort.
Claude Tag (their new Slack-native agent) introduces a different authorization model. Instead of the agent acting as the user who invoked it, the agent gets its own identity — scoped per channel, with its own credentials and permissions. What changes: Old model: “What can this user do?” → agent inherits the requester’s permissions. New model: […] The post Anthropic just changed how AI agents get access. Worth understanding why it matters. appeared first on Hush Security.
5 min readWe came to the Identiverse 2026 conference in Las Vegas to announce Aembit’s integration with Microsoft Copilot Studio. We left with a clearer picture of where the market actually is on AI agent security – and where it isn’t. Everyone’s talking about AI agents, and it seemed like every vendor had “agentic” in their pitch […] The post Identiverse 2026 Confirmed the AI Agent Identity Gap: Visibility Is Not Enforcement appeared first on Aembit.
Silverfort integrates with Google Security Operations to help SecOps teams use identity telemetry to accelerate detection and response times.The post Silverfort identity response actions in Google Security Operations appeared first on Silverfort.
Company recognized as a leader for the third time among top Privileged Access Management vendors, reflecting strong market momentum and platform depth in AI era
Introduction Pomerium is a self-hosted zero-trust access proxy that secures access to applications, services, and infrastructure. Zero trust is a security model built around the idea that no user, device, or system should be implicitly trusted. Every request must be authenticated, authorized, and evaluated before access is granted. We recently added SSH session recording to help organizations meet security and compliance requirements while applying zero-trust principles to one of their most sens
Cloud audit logs are the backbone of detection engineering in cloud environments. They provide the raw telemetry that security teams depend on to identify suspicious behavior, build detection rules and reconstruct attacker activity after an incident. In cloud platforms like GCP, every meaningful administrative action leaves a trace in the form of an audit log entry and the quality of that trace directly affects the reliability of these investigative and detection efforts.
New integration connects privileged identity access to sensitive data exposure intelligence in one unified view, prioritizing the highest-risk threats
We are proud to share that Permiso has been named the winner of Best Identity Threat Detection and Response (ITDR) Platform at the 2026 Cybersecurity Stars Awards, presented by The Hacker News.
How Veza Models Every Bedrock Agent, Action Group, Knowledge Base, and IAM Role in a Single Access Graph When we launched AI Agent Security for Amazon Bedrock in December, we promised customers one thing: that every Bedrock Agent in their AWS account would show up in the Access Graph as a first-class non-human identity — […] The post Inside Veza’s AI Agent Security for Amazon Bedrock Agents: A Technical Deep Dive appeared first on Veza.
Zero Trust for AI agents is the right framework for this moment. Anthropic published their guide on it this month, and the thing I keep coming back to is how many of its controls rest on a single assumption: that you already have cryptographic, runtime identity for your agents and non-human workloads. Most organizations do […] The post The Anthropic Zero Trust Guide Is Excellent. Here Is What You Need to Implement It. appeared first on Hush Security.
Most writing about AI agent security stops at the scary part: agents can be prompt-injected, they hold credentials, they act near production. True, and not very useful. However, the implementation half of Anthropic's Zero Trust for AI Agents guide is more interesting because it stops describing the problem and starts grading the solutions. It lays out exactly which controls count as table stakes, which are enterprise-grade, and which are reserved for the highest-stakes environments. Let's review
The Register reported today that CVE-2026-0257, an authentication bypass in Palo Alto's GlobalProtect, has moved from a quiet medium-severity advisory to confirmed exploitation in the wild. Rapid7 traced successful attacks back to at least May 17 and reproduced the technique themselves. The flaw now sits in CISA's Known Exploited Vulnerabilities catalog with a same-day patch deadline for federal agencies. The mechanics are worth reading closely. PAN-OS trusts authentication override cookies, and
On March 11, 2026, attackers turned Stryker Corporation's own Microsoft Intune device-management plane into a non-encrypting wiper, factory-resetting roughly 200,000 endpoints across 79 offices worldwide without dropping a single piece of custom malware. This analysis reconstructs the Living-off-the-Land attack chain — from infostealer logs and AiTM session theft through privilege escalation to the Intune control-plane pivot — and shows how SlashID's MITM/AiTM detection, phishing-resistant authe
Veza product 2026.5 delivers enhanced time-to-value for access governance, bridging the gap between identifying security exposures and taking remediation action. New this month, teams can now trigger remediation within NHI and Access Intelligence products; a scoped Remediation Owner role enables customers, including security analysts, to act on findings while maintaining least privilege in Veza; and […] The post Veza Product Updates – May 2026 appeared first on Veza.
Workload identity federation has come to AI agents. The agentic identity era starts here. Using API Keys to access AI platforms was never going to survive the agentic era. Anthropic’s support for Workload Identity Federation is a confirmation of that reality. By supporting Workload Identity Federation, AI agents can now authenticate with short-lived, cryptographically verifiable …
Discover how Veza Actions transforms identity governance by operationalizing access control through automation, smart workflows, and continuous remediation—turning identity security into a proactive advantage. The post From Insight to Action: Automating Identity Remediation with Veza and ServiceNow appeared first on Veza.
Quantum computing is changing the way organizations need to think about long-term security. Most digital... La entrada Post-Quantum Security: What Organizations Need to Know Now se publicó primero en Secrets Vault.
Award Validates Corsha's Machine Identity Provider Platform as the Foundation for Zero Trust OT Security Across the U.S. Military's Combat Logistics Enterprise
