Topic
The practice of protecting digital identities, credentials, and access rights—human and machine—across systems to prevent takeover and misuse.
Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.
Reality
Cybersecurity startups raised $6.8 billion in Q3 2026, up about 50% on the prior quarter, according to Crunchbase data. At least 18 AI-linked companies raised $100 million or more while round counts fell at every stage.
Reality
Semperis's survey of 1,200 IT and security professionals reports AI in the ransomware attacks on 84% of surveyed victims. The survey counts victims, and the people quoted on its meaning are tied to Semperis. The 87% who saw identity systems targeted give budget owners firmer ground this quarter.
Reality
Unit 42 says compromised credentials were enough to enter a European bank through a third-party-managed gateway not set to enforce strict authentication. It judged the actor opportunistic, though the months of activity looked like espionage.
Reality
Storm-3068 hijacked one account via self-service password reset and ran an Azure DevOps pipeline authorized for 50-plus resources, Microsoft says. No exploit was involved, so the fix sits in the reset flow and in what one account's pipelines can reach.
Reality
Rig Security launched with $12 million to separate the actions of AI agents from those of the employees whose accounts they run under. Its early customers use it to learn whether a person or an agent took an action logged under an employee's name.
Reality
The actor compromised a cloud environment first and built the framework inside it. The scanning and address rotation ran with little human involvement. The credentials collected belonged to other companies.
Reality
ANY.RUN says the kit lures staff with Teams, DocuSign and Dropbox pages, walks them through a genuine device code sign-in, and then takes the access and refresh tokens to register a device of its own.
Reality
OpenAI classified Astra as the first of its models to meet the company's critical cybersecurity threshold and limited the top capabilities to Daybreak Blue users. Arctic Wolf's Laura Ellis expects that limit to be temporary.
Reality
Dario Amodei's call for the industry to pace itself sent software past chips by 10.67 percentage points, the widest one-day gap Dow Jones Market Data has recorded, and the analysts making the bull case date the money to 2027.
Perspective Coverage
3 publishersReality
A passing MFA event proves someone controls an authenticator. SecurityWeek argues the processes that bind authenticators to people are where attackers work, and where assurance is never measured.
Reality
The deal completed on February 11, with identity security named a core pillar of platformization. CyberArk stays standalone for now, which is what every acquired platform is told first.
Reality
The January 8 deal puts continuously granted and revoked access at the center of the Falcon roadmap. Anyone signing a PAM or IGA renewal this year now has a harder question to answer.
Reality
TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.
Reality
A public proof-of-concept for CVE-2026-54121 shows an Enterprise CA vouching for a forged Domain Controller identity. Microsoft's July 14 fix adds a missing check, not judgement.
Reality