Explore our library of content to learn more about identity security and SecureAuth solutions.
Product Blog
If an assistant uses a shared admin account and the log records only that account, you can't tell who asked. Calls to the Agent Authority management tools run with the roles of the person the assistant belongs to, and the audit log records each call with both the assistant and that person.
Product Blog
The FIDO Passkey Index 2026 puts passkeys at 36% of sign-ins at the best-resourced deployments in the world. The other 64% of sign-ins, the enrollment that creates a passkey and the session after the login still need a risk score.
Industry Insights
On Thursday, Axios reported that major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, and that some of those agents appear to be taking actions their users never asked for. I have a confession. I am part of that bot army.
Knowledge Hub
MCP authentication for remote MCP servers uses OAuth 2.1. The MCP server acts as an OAuth resource server: it points the client to an authorization server, the user signs in there, and the client sends an access token issued for that one server on every request. Local stdio servers take their credentials from the environment instead.
Knowledge Hub
The leading enterprise MCP gateways in 2026 fall into four groups: identity-first gateways (SecureAuth Agent Authority, Okta Agent Gateway, Aembit, Pomerium, Runlayer, Cloudflare MCP server portals), API and AI gateways that added MCP (Kong AI Gateway, Azure API Management, agentgateway), open source gateways you host yourself (Docker MCP Gateway, IBM ContextForge, Microsoft MCP Gateway, Obot) and managed MCP platforms (TrueFoundry, Portkey, MintMCP). Most handle routing, sign-in and logging. Before you choose, check whether the gateway gives each agent run its own identity tied to the user and checks every tool call, down to its arguments.
Industry Insights
For many organizations running LLM-powered applications and agents, the first evidence of a breach won't show up in a SIEM. It will show up on a credit card statement, when the monthly bill from an AI provider is 10x what anyone budgeted.
Industry Insights
On Thursday, Axios reported that major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, and that some of those agents appear to be taking actions their users never asked for. I have a confession. I am part of that bot army.
Industry Insights
For many organizations running LLM-powered applications and agents, the first evidence of a breach won't show up in a SIEM. It will show up on a credit card statement, when the monthly bill from an AI provider is 10x what anyone budgeted.
Industry Insights
Cost attribution for AI agents lives where authorization does: the delegation chain. Walk it back to the human who initiated the intent, and "is this allowed?" and "who pays for this?" become the same question.
Industry Insights
Anyone who lived through the move to cloud knows how this goes: first it's magic, then the bills arrive. Agentic AI is running the same play — only faster. Here's why, this time, we can see the bill coming.
Industry Insights
It took nine seconds for an AI coding agent to wipe a production database. The headlines blamed the model. They were wrong: this was an authority problem, not a safety one — and we already know how to fix it.
Industry Insights
No password was cracked. No zero-day was burned. The attacker simply inherited an AI agent's existing OAuth authority — and walked in. Why the Vercel breach is the defining pattern of the agent era.
Product Blog
If an assistant uses a shared admin account and the log records only that account, you can't tell who asked. Calls to the Agent Authority management tools run with the roles of the person the assistant belongs to, and the audit log records each call with both the assistant and that person.
Product Blog
The FIDO Passkey Index 2026 puts passkeys at 36% of sign-ins at the best-resourced deployments in the world. The other 64% of sign-ins, the enrollment that creates a passkey and the session after the login still need a risk score.
Product Blog
Teams add MCP servers, and servers add tools. AI agent access control written as lists of tool names falls behind. Agent Authority denies tools by default and allows them by tag, so a new tool is covered by its tags.
Product Blog
Some AI agent actions should never happen. Others are acceptable one at a time and risky in volume. Agent Authority handles the first with deny rules and the second with usage limits on tool calls.
Product Blog
Power grids, pipelines, water treatment and defense systems still need strong MFA when their networks can't reach the cloud. Here's how SecureAuth secures privileged access to critical systems, entirely inside the perimeter.
Product Blog
Access rules decide on a call before the business system answers. An account number in a case note can still come back, and Agent Authority's data redaction and masking can hide it before the agent sees it, when it matches a pattern you configure.
Knowledge Hub
MCP authentication for remote MCP servers uses OAuth 2.1. The MCP server acts as an OAuth resource server: it points the client to an authorization server, the user signs in there, and the client sends an access token issued for that one server on every request. Local stdio servers take their credentials from the environment instead.
Knowledge Hub
The leading enterprise MCP gateways in 2026 fall into four groups: identity-first gateways (SecureAuth Agent Authority, Okta Agent Gateway, Aembit, Pomerium, Runlayer, Cloudflare MCP server portals), API and AI gateways that added MCP (Kong AI Gateway, Azure API Management, agentgateway), open source gateways you host yourself (Docker MCP Gateway, IBM ContextForge, Microsoft MCP Gateway, Obot) and managed MCP platforms (TrueFoundry, Portkey, MintMCP). Most handle routing, sign-in and logging. Before you choose, check whether the gateway gives each agent run its own identity tied to the user and checks every tool call, down to its arguments.
Knowledge Hub
B2B CIAM is customer identity for the companies you sell to and partner with. What it is, why workforce IAM falls short, the core capabilities, partner sign-in, architecture patterns and build or buy.
Knowledge Hub
Six CIAM providers side by side on what matters for business customers: organizations, delegated administration, partner sign-in and authorization, plus a 30-day proof of concept plan.
Knowledge Hub
The best CIAM solution is the one that fits how your customers and partners sign in and are managed. Define your user model, weight your criteria and match CIAM software to your use case.
Knowledge Hub
An RFP is only as good as its requirements. CIAM capability groups, requirements you can paste straight into an RFP, maturity levels and the capabilities buyers often forget.
Customer Story
Deda Sphere is a core and digital banking platform purpose-built for credit unions. Across its digital banking platforms, it serves more than 70 credit union clients in the U.S. and handles 1M+ authentications for members accessing financial services through its platform.
Customer Story
One of the world's largest banks transformed workforce authentication for 300,000+ employees, achieving 75% faster logins and eliminating password fatigue with SecureAuth Workforce Authority.
Customer Story
Transcom is a global customer experience company serving more than 300 clients from over 80 locations. Many of its clients are in financial services, retail, and healthcare, so its workforce often operates under strict compliance rules on how employees work and what data they can access.
Customer Story
Bass Pro Shops partnered with SecureAuth to protect millions of customer accounts across their retail ecosystem, implementing adaptive authentication that stops fraud without impacting the shopping experience.
Customer Story
Hobart and William Smith Colleges deployed SecureAuth to secure workforce and student access, providing passwordless authentication that improves security while meeting the expectations of digital-native students.
Customer Story
Credit Interlink trusts SecureAuth to protect access to sensitive consumer credit data, implementing continuous authentication that meets strict regulatory requirements while enabling efficient business operations.
Analyst Report
Get complimentary access to The Agentic AI Governance Framework, a Gartner® report on runtime controls for AI agents.
Ebook
Where an IdP and an MCP gateway stop, and the controls that govern an agent’s access on the device, the tool call and the model.
Ebook
Each of the ten OWASP agentic risks mapped to Agent Authority controls, with a control catalog and an indicative NIST SP 800-53 mapping.
White paper
How OAuth 2.1 and OpenID Connect give an agent a machine identity, and why the agent’s token flows cannot look like a human login.
White paper
A gateway can check a token, but only your IdP should issue one: wire MCP as an OAuth resource server, not its own mini-IdP.
White paper
Keeping internal tool access least-privilege with token exchange, rich and pushed authorization requests, and CIBA for human approval.
White paper
Connecting AI agents and MCP servers across the SaaS boundary, in both directions, with Dynamic Client Registration, signed software statements and a trust registry.
Two ebooks for security and IAM leaders, and a five-part white paper series for architects who secure AI agents with OAuth, OIDC, and trust frameworks.
Ebook
Where an IdP and an MCP gateway stop, and the controls that govern an agent’s access on the device, the tool call and the model.
Ebook
Each of the ten OWASP agentic risks mapped to Agent Authority controls, with a control catalog and an indicative NIST SP 800-53 mapping.
White paper
How OAuth 2.1 and OpenID Connect give an agent a machine identity, and why the agent’s token flows cannot look like a human login.
White paper
A gateway can check a token, but only your IdP should issue one: wire MCP as an OAuth resource server, not its own mini-IdP.
White paper
Keeping internal tool access least-privilege with token exchange, rich and pushed authorization requests, and CIBA for human approval.
White paper
Connecting AI agents and MCP servers across the SaaS boundary, in both directions, with Dynamic Client Registration, signed software statements and a trust registry.
White paper
OpenID Federation trust chains and CDR-style accreditation let identity domains trust each other without pre-registering every client.
