Identity & Access — Page 7
Cyera Buys Oasis Security for $1 Billion to Lock Down AI Agents
Data security firm Cyera is acquiring Oasis Security in a deal worth $1 billion, combining two platforms that track what AI agents and software bots are permitted to see and do inside company systems.
SSO Is the New Skeleton Key. Criminals Have Noticed.
One stolen single sign-on password can hand attackers the run of a company. Here's how the break-ins work and what actually stops them.
Changing Your Password No Longer Kicks Hackers Out
A growing wave of attacks steals not passwords but the digital passes that keep you logged in, meaning a password reset leaves the intruder sitting comfortably inside your account.
The AI helpers your staff installed without telling IT
Autonomous AI agents are quietly attaching themselves to company accounts, often with wide permissions and no oversight. Here is what that means and how to get a grip on it.
Microsoft's New Passkey System Has Flaws That Let Old Hacking Tricks Work Again
A security researcher found three near-exploitable bugs in Windows 11 and Microsoft's cloud login service, just as the company prepares to make passkeys the default sign-in method for hundreds of millions of users.
Google rolls out selfie video sign-in for locked-out account holders
The new recovery option sits alongside email and phone number checks, and is aimed at people who cannot get back into their Google account any other way.
Synthetic Identity Fraud Is Quietly Building People Who Don't Exist
Criminals stitch real data points together with fake ones to invent 'people' banks and payroll systems will lend to, hire, and eventually be defrauded by.
What is a VPN and when do you actually need one?
VPNs encrypt your internet traffic and hide your real IP address, but they are not a privacy cure-all. Here is when one genuinely helps and when it does not.
What is multi-factor authentication and why does it matter?
MFA blocks the vast majority of automated account takeovers, even when your password is already stolen.
A Stolen Phone Number Nearly Took Over Someone's Entire Digital Life
A real-world SIM swap attack shows how quickly identity checks break down once a criminal gets hold of your phone number.
Police shut down Kratos, the phishing kit built to hijack Microsoft 365 logins
German and US investigators dismantled the kit's servers, and Indonesian police arrested its alleged creator, ending a service that helped criminals slip past two-factor login checks.
Why Stolen Logins Keep Opening the Door to Power Grids and Water Plants
Attackers rarely need fancy exploits when a valid password and an unchecked laptop will do. A look at why device trust is the missing half of Zero Trust in critical infrastructure.
Fake X Login Alerts Are Being Used to Steal Your Password
Criminals are sending convincing 'new device login' emails to X users, hoping to harvest account credentials for follow-on fraud including crypto scams and phishing attacks.
Microsoft sees spike in ACR Stealer attacks lifting passwords and session tokens from browsers
The info-stealer is arriving through fake 'fix this error' prompts and hidden inside JPEG images, and it walks off with the browser cookies that keep users signed in.
On-Device Age Checks: The Quiet Fix to a Loud Privacy Problem
New age verification laws are forcing websites to check how old you are. A newer approach keeps your face on your phone instead of shipping it to a server.