Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Identity Fundamentals: Understanding Digital Identity and IAM

Every login, every API call, and every file someone opens starts with the same two questions: who is this, and what are they allowed to do? Those questions matter more than they used to. Networks no longer have a clean perimeter, applications run across cloud and on-premises environments, and users connect from anywhere. Identity is now what decides whether a request is allowed through.

SSO for Healthcare: HIPAA-Compliant Single Sign-On for Healthcare Organizations

Healthcare workers move between EHRs, clinical applications, imaging systems, telehealth platforms, and administrative tools throughout the day. When every system requires separate authentication, access becomes a recurring interruption and identity management becomes fragmented. SSO for healthcare brings authentication into a centralized identity layer, allowing authorized users to access multiple applications through one authentication experience.

Identity Security Debt: What MSPs Inherit From Clients

MSPs rarely inherit a clean slate. Whether onboarding a new client or expanding services within an existing account, providers often step into environments shaped by years of identity and access decisions made long before they became involved. Former employees may still have active accounts. Temporary administrator privileges may have quietly become permanent. Shared credentials can persist because replacing them would disrupt established workflows.

What's New With Keeper | September 2026

Launched in June, Keeper Privileged Cloud has delivered just-in-time, zero-standing privilege access across cloud platforms, identity providers and federated applications – including AWS IAM, Microsoft Entra ID, GCP, Okta and Active Directory. Rather than relying on shared privileged credentials, it grants temporary elevated access by modifying a user’s identity-layer membership or role assignment for an approved, time-bound window.

Building a certificate authority for the whole Internet

Twelve years ago, during Birthday Week 2014, we turned on Universal SSL and nearly doubled the number of encrypted sites on the web overnight, giving free TLS to every site behind Cloudflare, including the ones that never paid us a cent. Encryption stopped being an expensive, time-intensive undertaking and instead became the default. For Birthday Week this year, we are taking the next step on that path.

The Cyber Outage That Ends Before the Recovery Does

An interruption model measures the time from failure to restoration. Systems down, systems back, multiply by revenue per hour. ‍ In an airline the outage ends well before the recovery does, and the ratio between the two is large enough to make a model keyed to restoration wrong rather than imprecise. One carrier restored connectivity in under an hour and the resulting displacement ran into the following morning. ‍

AI Agents Were Never Outside the Definition

The word agent appears nowhere in the AI Act. Some read that absence as a scope question still to be settled, and treat agentic deployments as sitting outside a regime written before they existed. ‍ On its own FAQ the Commission has answered it directly. Agents are not a separate category and the existing definitions already reach them, so nothing needs amending for the rules to apply.

Know What's Actually Happening to Your Suppliers, Not Just When Their Names Show Up in Threat Data

A vendor can pass every questionnaire you send it and still be the reason you end up in a breach report. That's the gap most third-party risk programs live in today. According to the 2026 Verizon Data Breach Investigations Report, 48% of breaches now involve a third party, up from 30% the year before and 15% the year before that. But most organizations still manage that risk with periodic assessments and separate threat feeds. Those methods can tell you whether a supplier passed a review last quarter.

Beyond Alerts: What the 2026 Gartner Market Guide Says About the Future of MDR

Managed Detection and Response has long helped organizations extend their security operations capabilities, but buyer expectations are changing. Detecting suspicious activity and notifying internal teams is no longer enough. Organizations increasingly expect MDR providers to help investigate incidents, contain threats, identify exposures, and deliver measurable improvements to their security posture.