Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Many engineering teams treat zero trust as a simple MFA checkbox. They invest in advanced identity providers but still leave environments exposed, with permanent admin roles and manual ticket queues that frustrate developers. Most teams have adopted the language of zero trust without changing how access actually works. They verify identity at login, then leave broad permissions in place long after the task is done.

There’s never a good time to disclose a breach, but days before your IPO has to rank near the bottom of the list. That was the backdrop to the Vercel breach. On Sunday the 19th, the company confirmed that attackers had walked into parts of its internal environment and walked back out with customer API keys. Early reporting focused on the flashy parts: an attacker claiming ties to ShinyHunters, a $2 million BreachForums demand, crypto teams rotating credentials with the IPO roadshow in full swing.

Hims & Hers, one of the biggest telehealth platforms in the U.S., just disclosed that millions of customer records were exposed. Not because of some sophisticated exploit, but because a single compromised login had standing access to a connected platform. One identity was all it took. This breach is worth paying attention to not because it’s unusual, but because it’s so ordinary.

Today, we’re introducing Approval Escalation, a new capability in Apono that automatically moves access requests forward when the original approver doesn’t respond in time. Because no one should be stuck waiting seven hours just to do their job.

Most organizations are still managing Active Directory (AD) in environments designed decades ago – often by people who are no longer with the company. What started as a logical organizational unit (OU) structure has slowly become brittle and feels too risky to change. Even when everyone agrees it’s not ideal, rebuilding your OU’s from the ground up just doesn’t feel realistic. It’s disruptive, time-consuming and carries a high risk of breaking something critical.

Today, we’re introducing Justification Coach, a new AI-powered capability that helps users write better access request justifications in real time, so admins get the context they need for audits and investigations without having to chase people down after the fact.

It’s no surprise that AI is being integrated into identity governance and administration (IGA) platforms. Automation promises productivity boosts, risk detection can be in real-time and cloud environments allow greater scalability. What’s more, the pace of AI means IGA is quickly moving beyond slower, more rigid, rule-based approaches.

Despite constant sweeping changes across IT, Active Directory (AD) continues to be the center of identity and access management (IAM) processes for most enterprises. Even as organizations adopt cloud identity platforms, on-premises AD carries the lion’s share of user authentication, authorizing access to critical systems and anchoring hybrid identity strategies. Because of this central role, AD security is nearly inseparable from directory security, cyber-resilience and breach prevention.

SAP environments, especially in the age of cloud work and hybrid infrastructures, are ripe with security complications. But SAP support and security is nothing to scoff at. Access controls alone in SAP environments require compliance capabilities for ultimate security, regardless of the security solution or deployment scenario.

An intern gets admin access to production for a temporary task, but nobody remembers to revoke it. Imagine that intern works at machine speed, never sleeps, and can chain dozens of actions before you’ve read the Slack ping—and has no instinct for when they’re about to do something irreversible.