Token says browser agent Rehearsal broke its own identity rules
The vendor says apps cannot see an agent inside a user session and lists controls to use before standards land.
Stories per day · 30 days
14 RSS
Relatedai-agents9microsoft-3654okta4active-directory3ai-governance3ciso3extortion3mfa3ransomware3semperis3agent-security2conference2data-leak2dhs2huntress2incident-response2one-identity2pam2
106 stories, newest first · one card per story
Stories tagged #identity
Stale job access lingers because nobody owns removal
The author says role transfers should trigger a deletion review, with named owners and expiry dates on extra rights.
Y Meadows CISO explains cutting waste from a flat security budget
Leeser says inventory every tool's cost, map coverage to MITRE ATT&CK, and overlap replacements for 30 to 60 days.
One Identity unveils Safeguard 9.0 for simpler PAM
Passwords 9.0 moves to Windows 11 LTSC, sessions 9.0 to Ubuntu 24.04 LTS, and updates install with less disruption.
CISO Forum Virtual Summit 2026 runs November 10-11
The two-day virtual event for senior security leaders covers AI governance, identity, agents and supply chain.
Cloudflare says sites need identity tools for users behind AI agents
Remotely hosted agents hide the user, so sites lose the identity, reputation, and accountability signals they use for fraud and access.
2
Service desk account recovery can bypass stronger login controls
A Specops explainer cites Scattered Spider, deepfakes and voice phishing as reasons to drop knowledge-based checks.
1
Opal Security Hosts Agent.ID Event on AI Agent Governance
Virtual event on November 5 for security leaders covering trust, identity and standards for governing non-human AI agents.
Passkeys stop credential theft but do not remove identity risk
A successful passkey login does not prove the account, device, or later session should still be trusted.
Leak exposes personal details of over 41,000 DHS employees
Distributed Denial of Secrets published records it attributes to “Department of Peace”; Reuters matched some entries but not the collection method.
DDoSecrets publishes records of 41,000 DHS personnel, including undercover links
The Icepick archive, last updated August 19, lists emails, phones, supervisors, and more than 55,000 permission groups across seven DHS components.
Microsoft urges CISOs to govern AI agents as adoption surges
Microsoft says active agents in Microsoft 365 grew 15-fold year over year, and 18-fold in large enterprises.
Ubuntu authd flaw may expose another user’s local account
USN-8957-1 says identity-provider account matching can be abused for unauthorized access to files.
Rapid7 Command Platform adds SCIM user provisioning
SCIM is off by default and lets an existing identity provider create, update, and deactivate Command Platform accounts.
Analyst: AI security point tools will fold into larger platforms
Care says runtime agent decisioning should remain a product while scanning and posture tools become features.
1
NIST, CISA and NSA publish AI agent incident-response practices
A BeyondTrust architect says responders should start from the agent identity record, not from classifying intent.
1
Shared resources can cut the real cost of Sybil identities
Published phone-verification prices overstate per-account cost 1.6 to 4.3 times; a Tor relay-limit change cut modeled attack cost 8 to 72%.
Okta Access Gateway before 2026.10.2 allows admin command execution
CVE-2026-115547 is scored 9.1 but needs Admin Console privileges, and the advisory reports no known exploitation.
1
OAuth token theft bypasses MFA and outlives password resets, Unit 42 says
Stolen access and refresh tokens can persist for days or months and move across services tied to the same identity.
2
Microsoft security chief says sovereignty is a speed and risk choice
Halbheer says boards buy a location and assurance, while identity abuse and detection speed decide real control.
1
Survey finds AI agent authority outpaces audit controls
Among 1,100 IT and security leaders, 62% deployed AI tools before safeguards and only 49% can audit every agent action.
Scattered Spider uses help-desk calls to bypass MFA
Flare says a help-desk call alone does not prove the group, and CISA urges phishing-resistant MFA.
1
Attackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
1
Roundtable urges closing SDLC identity gaps before expanding AI
Participants say AI-written and non-developer code is outpacing how security is built into development.
1