#Identity Security
All CosmicBytez Labs articles tagged #Identity Security, across news, security advisories, how-to guides, and projects.
- News
No Identity, No Recovery: Why Cyber Resilience Starts With IAM
A Dark Reading analysis argues identity resilience, not just data backups, determines whether enterprises can actually recover from an attack.
- News
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
Amazon blocked Meta's Muse for not disclosing it was a bot, as personal AI agents like Instinct and OpenClaw gain unmanaged access to corporate SaaS logins.
- News
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
A 2026 report finds roughly 1,280 third-party products now embed AI, but only 282 sit behind SSO, leaving about 1,000 agents invisible.
- News
How to Keep AI Agents Within Their Permissions
AI agents can reuse valid credentials to exceed their assigned scope. Token Security maps seven enforcement points that stop overreach without killing autonomy.
- News
Microsoft Says Threat Actors Are Ahead in the Early AI Race
Microsoft's 2026 Digital Defense Report warns attackers are weaponizing AI faster than defenders, cutting exploit timelines to under 24 hours.
- News
The EDR Blind Spot: 3 Ways Browser Attacks Evade Endpoint Telemetry
AiTM phishing, malicious extensions, and clipboard-hijack attacks finish inside the browser, leaving little for endpoint detection tools to catch.
- News
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
A 2026 industry roundup maps 10 cybersecurity segments—from identity and cloud to AI-native SecOps—reshaping how defenders manage risk.
- News
AI's Third Wave: Coworkers Break the Security Model That Worked for Agents
Token Security warns persistent AI 'coworkers' with standing access break identity controls built for chat tools and task-scoped agents.
- News
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
Microsoft ties Storm-3168 to JADEPUFFER after two hijacked Azure service principals wiped 100+ storage accounts in a 7-minute burst.
- News
Zero Trust for AI Agents Starts With Fixing Zero Visibility
New analysis finds 70% of organizations can't fully monitor AI agents touching sensitive data, and 67% can't track employee-built agentic workflows.
- News
With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance
AI agents can act through human credentials, and most SOC 2 controls cannot tell the difference. Token Security explains what needs to change.
- News
Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm
Outerlimit emerges from stealth with $16M pre-seed to build a decentralized authorization layer that discovers, observes, and blocks rogue AI agent actions.
- News
Rogue External MFA Providers Can Steal Passwords During Logins
TrustSink lets a privileged Entra admin register a rogue external MFA provider that quietly captures users' passwords in plain text.
- News
Identity Visibility in 2026: The Foundation of Identity Security
Why identity visibility — seeing every identity and how its access is actually used — is now foundational to identity security.
- HOWTO
Deploying Vaultwarden: A Self-Hosted Password Manager
Stand up a lightweight, Bitwarden-compatible password vault on your own infrastructure — with Docker, TLS via reverse proxy, and an automated backup routine.
- News
Password Spraying Attacks Surge 155x as Hackers Exploit MFA Gaps
Huntress reports a 155x surge in password spraying in H1 2026, with one campaign logging 81 million login attempts in two weeks via MFA and legacy auth gaps.
- News
When Credentials Are No Longer Enough: Device Trust in the AI Era
AI is making phishing, credential theft, and MFA bypass faster and cheaper than ever. As traditional trust signals — passwords, MFA codes, IP geolocation...
- News
Cyera Acquiring Oasis Security in $1 Billion Deal
Data security platform Cyera is acquiring Oasis Security, an agentic access management specialist, in a deal valued at approximately $1 billion. The...
- News
Seeing AI Agents Is Not Enough — Security Teams Must Enforce What They Can Do
Visibility into AI agents is a starting point, not a security control. Security teams need to move from agent discovery to enforcement — defining...
- News
How Enterprise GenAI Can Amplify Ransomware Risk — and How to Contain It
Enterprise AI assistants and agents that inherit excessive permissions or compromised identities create new ransomware attack paths. Identity controls,...
- News
Identity Attacks Overtake Exploits as Top Ransomware Cause
Sophos 2026: 79% of ransomware attacks start with stolen identities. MFA was present in 97% of credential-based cases yet failed to stop every one of them.
- Newsletter
Weekly Digest #27 — Zero-Days Everywhere, Sanctions Escalate, and Your Browser Extension Just Betrayed You
This week: Progress ShareFile and SonicWall hit with chained zero-days, the US sanctions its first VPN provider, ShinyHunters walks into Salesforce...
- News
Breach at the Beach: Play the Ultimate Entra ID CTF
Varonis has launched Breach at the Beach, a free hands-on Capture the Flag competition designed to teach defenders how attackers abuse Microsoft Entra ID...
- News
Cisco Adds NHI to Security Stack With Astrix, WideField Acquisitions
Cisco has acquired Astrix Security and WideField to build out non-human identity (NHI) protection capabilities, betting that securing AI agents, service...
- News
SailPoint to Acquire Entro in Reported $200 Million Deal
SailPoint's acquisition of Israeli startup Entro adds non-human identity and secrets management to its IGA platform, addressing a critical gap as machine...
- News
Can You Enforce Strong Active Directory Password Rules Without Frustrating Users?
Strong AD passwords don't have to mean frustrated users — passphrases, breached-password checks, and self-service resets balance security and usability.
- News
Why Changing Passwords Doesn't End an Active Directory
Resetting compromised passwords is a natural first response to a breach, but it's not enough. Cached credentials, Kerberos ticket grants, and persistent...
- News
ConsentFix v3 Automates Azure OAuth Abuse With Mass
A new iteration of the ConsentFix attack toolkit has surfaced on cybercriminal forums, adding automation and scaling capabilities to OAuth consent...
- News
Learning from the Vercel Breach: Shadow AI and OAuth Sprawl
The Vercel breach, traced to a compromised third-party AI tool with OAuth access, illustrates how Shadow AI adoption and unchecked OAuth integrations are...
- News
No Exploit Needed: How Attackers Walk Through the Front
Stolen credentials remain the dominant initial access vector in 2026 — no zero-days, no malware, just valid logins that blend in with normal activity...
- News
Your Next Breach Will Look Like Business as Usual
Credential-based attacks now dominate the threat landscape, and traditional detection models are failing. Here are the fundamental shifts cybersecurity...
- News
Why Simple Breach Monitoring Is No Longer Enough
Infostealers are harvesting credentials and session cookies at scale, quietly bypassing MFA and traditional defenses. Here's why organizations need...
- News
Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks
A new report reveals how industrialized credential theft has become the common thread connecting ransomware campaigns, SaaS platform breaches, and...
- News
CISA Mandates Full Zero Trust Architecture for Federal
New CISA directive requires all federal civilian agencies to implement comprehensive zero trust security architecture by September 2027, setting a...