Standard
NIST catalogue of security and privacy controls for US federal information systems, covering access control, audit, and accountability requirements.
NIST and CISA have finalized IR 8587, guidance that spells out how signing keys, token verification and revocation are supposed to be handled in cloud identity systems.
Perspective Coverage
4 publishersReality
The FBI published version 6.1 on June 25, 2026, keeping v6.0's NIST-aligned structure while lifting SC-13 and SC-28 to a 256-bit minimum and tripling how often agencies must run vulnerability scans.
Reality
NIST and CISA have finalised implementation guidance for the identity tokens behind single sign-on, written for federal agencies and their cloud providers. The case the announcement rests on is one cited attack.
Reality
In HackerOne report #3022516 the trail was multi-region, the metric filter for unauthorised API calls existed and the alarm published to an SNS topic, while threat_detection.enabled read false. Turning it on costs one CLI call.
Reality
Pulumi's research preview builds a threat model before it looks for anything, then leans on two inputs its own post treats as conditional, the infrastructure code behind a resource and the runtime telemetry around it.
Reality
An essay on dev.to argues ISO 27001, SOC 2 and NIST SP 800-53 were built around authenticated human decisions with a paper trail. AI sessions leave none, and you cannot reconstruct them later.
Reality