Most enterprises collect more authoritative identity data and risk signals than they act on. They also lack clearly defined relationships between specific risk signals and specific identity fraud types. A device fingerprint that is effective against credential stuffing may be irrelevant for synthetic identity fraud. A phone number check that…
The identity and access management (IAM) ecosystem now spans at least six functional categories, and the relationships between those categories matter more than any single product decision. Security teams evaluating their IAM architecture need to understand where coverage gaps emerge between categories and what questions to ask before consolidating or…
For years, Short Message Service (SMS) one-time passwords (OTP) worked well enough. If you could receive a code at a phone number, you likely controlled the account. When porting required showing up at a carrier store with ID, that assumption generally held. It no longer does. The Cybersecurity and Infrastructure…
Many organizations do not miss account takeover attacks because they lack controls. They miss them because they interpret the wrong risk signals or reduce useful signals to a simple pass-or-fail outcome. The issue is not only whether a credential, device, phone number, or recovery factor can be validated. It is…
Addressing cybersecurity vendor sprawl is challenging because it is typically the result of reasonable decisions made under real constraints. In identity security, that drift is even easier than in other domains. A new tool can “work” while only touching a siloed component of the identity lifecycle—whether enrollment, login, privileged access,…
Most enterprise teams already understand the critiques of Short Message Service (SMS). Codes can be intercepted, phished, or redirected. Yet phone numbers remain embedded in too many critical flows. They are still a standard recovery channel and second-factor authenticator. The problem is that a phone number is not a stable…