Corsha Builds Out Leadership Team to Secure the Industrial AI and Data Revolution
Welcomes Melissa Keohane as COO and Kevin Bocek as CPO, Eric Kumar takes on expanded role as CCO
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
386 matching stories — in Non-Human Identity & Secrets — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
What Is OAuth? A Guide to Tokens, Scopes, and AI Agent Access
8 min readOAuth is an open standard for authorization that lets applications access protected resources without directly handling a user’s password.  When you see an “Allow app access” form like this one, there’s a good chance OAuth is under the hood: Before teams can understand OAuth 2.1, MCP authorization, or token exchange for AI agents, they need […] The post What Is OAuth? A Guide to Tokens, Scopes, and AI Agent Access appeared first on Aembit.
Delinea Launches New Partner Program
Delinea Partner Advantage Program brings codified rules of engagement and AI-powered enablement to channel
The Illicit Consent Grant Part 2: Device-Code Phishing and the AI PhaaS Wave
Part 1 showed the illicit consent grant done by hand. Part 2 shows its close cousin — device-code phishing — now sold as a ready-made kit, with AI writing the lures and reading the stolen mailbox. We analyze two Phishing-as-a-Service platforms, EvilTokens and the FBI-flagged Kali365, walk the device-code attack through the same three phases from Part 1, and share what a sandboxed reconstruction taught us — then map detection and mitigation to the SlashID identity layer.
The Illicit Consent Grant Part 2: Device-Code Phishing and the AI PhaaS Wave
Part 1 showed the illicit consent grant done by hand. Part 2 shows its close cousin — device-code phishing — now sold as a ready-made kit, with AI writing the lures and reading the stolen mailbox. We analyze two Phishing-as-a-Service platforms, EvilTokens and the FBI-flagged Kali365, walk the device-code attack through the same three phases from Part 1, and share what a sandboxed reconstruction taught us — then map detection and mitigation to the SlashID identity layer.
IBM Quantum System One London: Why Every Organisation Should Be Preparing for Post-Quantum Cryptography (PQC)
2026 CRN Tech Innovators Awards: Silverfort named a finalist for Identity Security innovation
CRN just named the Silverfort Identity Security Platform a finalist in the 2026 Tech Innovators Awards. Finalists were selected for introducing truly innovative products that bring tangible value to customers. At the core of this recognition is what Silverfort has always been built upon: enforcing Identity Security inline, at runtime—the moment access is requested, not […]The post 2026 CRN Tech Innovators Awards: Silverfort named a finalist for Identity Security innovation appeared first o
AI Agents Have an Identity Crisis And It's a Familiar One
IAM for Agentic AI: 6 Platforms Compared | Pomerium
AI agents are now calling production APIs, querying databases, and invoking tools through the Model Context Protocol (MCP) — often with more standing access than any human employee would ever be granted. Identity and access management (IAM) built for humans logging into dashboards was never designed for this. A new category of platforms has emerged to close the gap, and they take meaningfully different approaches. Some enforce policy in the request path at runtime. Others discover and govern the
Secrets management best practices: From .env files to centralized control
Five proven practices to secure secrets, reduce operational risk, and scale beyond .env files
Introducing the Risk Score Engine: identity risk you can quantify
TL;DR Permiso is launching the Risk Score Engine: a continuous, evidence-backed score from 0 to 100 for every identity in your environment. Every score breaks down across three dimensions, Behavior, Likelihood, and Impact, so two identities with the same score can still need different responses. Scores are built on the Universal Identity Graph and cover every identity type, human, non-human, and AI, not just the slice one tool happens to see. Score velocity tracks how fast a score is moving, bec
You Can't Manage What You Can't Score: Why Identity Security Needs Real Risk Measurement
TL;DR Security teams can quantify almost every risk they manage except identity risk, which is still assessed through static tiers and alert volume. Static risk labels and alert-driven triage both fail for the same reason: they ignore what identities are actually doing right now. A meaningful identity risk score must be continuous, multi-dimensional, and evidence-backed, combining posture with runtime behavior. Permiso's Risk Score Engine scores every identity, human, non-human, and AI, on a 0 t
Delinea Achieves FedRAMP High Authorization for Secret Server
Delinea’s Privileged Access Management solution is now available to U.S. Federal agencies via the FedRAMP Marketplace under UberEther
Agentic AI Just Got an Enterprise Access Layer
Anthropic recently shipped the Enterprise-Managed Authorization (EMA) extension for Claude’s MCP connectors, which lets IT admins configure tools such as Asana, Figma, and Linear once through their existing identity provider. Authorized employee end users can then inherit access at login without needing any additional individual OAuth approvals. Under the hood, Anthropic’s EMA relies on a […] The post Agentic AI Just Got an Enterprise Access Layer appeared first on Hush Security.
6 principles for securing non-human identities (NHIs)
Non-human identities have quietly become the most prevalent identity type in enterprise environments. Yet the security infrastructure built to manage identity was designed for people, not machines.  The result is an attack surface that grows with every new integration, AI workflow, and automated pipeline—one that existing identity programs were never designed to govern. Secrets management, including token […]The post 6 principles for securing non-human identities (NHIs) appeared first
The Illicit Consent Grant Part 1: Understanding Modern OAuth Consent Phishing
An illicit consent grant abuses OAuth 2.0's delegated authorization model: instead of stealing who you are, the attacker steals what you can do. There is no software bug to patch, and the attack sails past MFA because it intercepts authorization, not authentication. This post breaks down why consent phishing works and evades detection, walks through the three-move attack chain from lure to token, and dissects the CoPhish case study that weaponizes Microsoft Copilot Studio — then shows how SlashI
Should you use identity or static credentials to build edge functions?
Why OIDC and workload identity federation are replacing API keys at the edge
Secure Agentic Access: Authentication and Authorization for AI Agent Workloads
8 min readMany organizations deploying AI agents have not fully answered how those agents authenticate to services, what credentials they carry, or what happens to those credentials when the task ends. In some organizations, the agents work, so the question gets deferred. The problem is that “it works” is doing a lot of heavy lifting. The agent […] The post Secure Agentic Access: Authentication and Authorization for AI Agent Workloads appeared first on Aembit.
The risk of AI autonomy without runtime enforcement
Nothing moves faster than AI nowadays. But while we were busy perfecting our prompts, the technology quietly transitioned from answering questions to executing them. For the last two years, the conversation has been dominated by AI chatbots—reactive tools used to summarize meetings and polish slide decks. We treated them like digital interns, and in that world, […]The post The risk of AI autonomy without runtime enforcement appeared first on Silverfort.
HashiCorp Vault Secrets is going away. What now?
A complete migration guide for HCP Vault Secrets users.
Anthropic just changed how AI agents get access. Worth understanding why it matters.
Claude Tag (their new Slack-native agent) introduces a different authorization model. Instead of the agent acting as the user who invoked it, the agent gets its own identity — scoped per channel, with its own credentials and permissions. What changes: Old model: “What can this user do?” → agent inherits the requester’s permissions. New model: […] The post Anthropic just changed how AI agents get access. Worth understanding why it matters. appeared first on Hush Security.
Your GitHub Actions Job Deserves a Real Identity
Identiverse 2026 Confirmed the AI Agent Identity Gap: Visibility Is Not Enforcement
5 min readWe came to the Identiverse 2026 conference in Las Vegas to announce Aembit’s integration with Microsoft Copilot Studio. We left with a clearer picture of where the market actually is on AI agent security – and where it isn’t. Everyone’s talking about AI agents, and it seemed like every vendor had “agentic” in their pitch […] The post Identiverse 2026 Confirmed the AI Agent Identity Gap: Visibility Is Not Enforcement appeared first on Aembit.
Legacy Medical Devices Aren’t Going Away: Why Healthcare Needs an Identity-First Security Strategy
The post Legacy Medical Devices Aren’t Going Away: Why Healthcare Needs an Identity-First Security Strategy appeared first on Device Authority.
Delinea Named a Growth & Innovation Leader in Frost Radar for PAM 2026
Company recognized as a leader for the third time among top Privileged Access Management vendors, reflecting strong market momentum and platform depth in AI era
How We Designed a Tamper-Evident SSH Recording System for Zero-Trust infrastructure
Introduction Pomerium is a self-hosted zero-trust access proxy that secures access to applications, services, and infrastructure. Zero trust is a security model built around the idea that no user, device, or system should be implicitly trusted. Every request must be authenticated, authorized, and evaluated before access is granted. We recently added SSH session recording to help organizations meet security and compliance requirements while applying zero-trust principles to one of their most sens
Mind the Gap: GCP serviceData in Logs Explorer vs. Exported Logs
Cloud audit logs are the backbone of detection engineering in cloud environments. They provide the raw telemetry that security teams depend on to identify suspicious behavior, build detection rules and reconstruct attacker activity after an incident. In cloud platforms like GCP, every meaningful administrative action leaves a trace in the form of an audit log entry and the quality of that trace directly affects the reliability of these investigative and detection efforts.
Inside Veza’s AI Agent Security for Amazon Bedrock Agents: A Technical Deep Dive
How Veza Models Every Bedrock Agent, Action Group, Knowledge Base, and IAM Role in a Single Access Graph When we launched AI Agent Security for Amazon Bedrock in December, we promised customers one thing: that every Bedrock Agent in their AWS account would show up in the Access Graph as a first-class non-human identity — […] The post Inside Veza’s AI Agent Security for Amazon Bedrock Agents: A Technical Deep Dive appeared first on Veza.
The Anthropic Zero Trust Guide Is Excellent. Here Is What You Need to Implement It.
Zero Trust for AI agents is the right framework for this moment. Anthropic published their guide on it this month, and the thing I keep coming back to is how many of its controls rest on a single assumption: that you already have cryptographic, runtime identity for your agents and non-human workloads. Most organizations do […] The post The Anthropic Zero Trust Guide Is Excellent. Here Is What You Need to Implement It. appeared first on Hush Security.
Understanding Anthropic's Zero Trust for AI Agents Guide
Most writing about AI agent security stops at the scary part: agents can be prompt-injected, they hold credentials, they act near production. True, and not very useful. However, the implementation half of Anthropic's Zero Trust for AI Agents guide is more interesting because it stops describing the problem and starts grading the solutions. It lays out exactly which controls count as table stakes, which are enterprise-grade, and which are reserved for the highest-stakes environments. Let's review
Veza Product Updates – May 2026
Veza product 2026.5 delivers enhanced time-to-value for access governance, bridging the gap between identifying security exposures and taking remediation action. New this month, teams can now trigger remediation within NHI and Access Intelligence products; a scoped Remediation Owner role enables customers, including security analysts, to act on findings while maintaining least privilege in Veza; and […] The post Veza Product Updates – May 2026 appeared first on Veza.
The Agentic Era Just Got the Authentication Model It Needs
Workload identity federation has come to AI agents. The agentic identity era starts here. Using API Keys to access AI platforms was never going to survive the agentic era. Anthropic’s support for Workload Identity Federation is a confirmation of that reality. By supporting Workload Identity Federation, AI agents can now authenticate with short-lived, cryptographically verifiable …
Anthropic Workload Identity Federation with Riptides
Device Authority and Xalient Partner to Strengthen IoT Security for Enterprise Customers
The post Device Authority and Xalient Partner to Strengthen IoT Security for Enterprise Customers appeared first on Device Authority.
Veza Expands AI Agent Security to Azure AI Foundry
Your Foundry Agents Are Live in Azure. Today, You Can See What They Run As — and What They Can Reach. Azure AI Foundry is where developers ship agents on top of Azure OpenAI, Azure AI Search, third-party model deployments, and the broader Azure platform. Each Foundry agent runs against a model deployment, calls tools, […] The post Veza Expands AI Agent Security to Azure AI Foundry appeared first on Veza.
Post-Quantum Security: What Organizations Need to Know Now
Quantum computing is changing the way organizations need to think about long-term security. Most digital... La entrada Post-Quantum Security: What Organizations Need to Know Now se publicó primero en Secrets Vault.
Corsha Awarded $50 Million Sole-Source IDIQ by the Defense Logistics Agency (DLA) to Deliver Zero Trust Connectivity Across Critical Operational Systems
Award Validates Corsha's Machine Identity Provider Platform as the Foundation for Zero Trust OT Security Across the U.S. Military's Combat Logistics Enterprise
Mandatory Cyber Incident Reporting Arrives in 2026: What It Means for Businesses and How to Prepare
The post Mandatory Cyber Incident Reporting Arrives in 2026: What It Means for Businesses and How to Prepare appeared first on Device Authority.