Topic
IAM is the field of technology and practice for verifying identities and controlling access, encompassing authentication and authorization.
Spring Security 7.1 no longer applies DPoP verification on resource servers automatically, so upgraded apps stop enforcing it until they add .dPoP(). InfoQ's walk-through calls the failure silent and the rest of the upgrade a version bump.
Reality
Microsoft's mandatory MFA enforcement blocks an Entra break-glass account with no MFA method from admin portals, a dev.to guide says. A vaulted password therefore fails when the lockout it was kept for arrives.
Reality
JumpCloud surveyed 250 IT leaders and found 59% of organisations using AI agents have not fully integrated them into identity and access management. For incident responders the harder number is the 36% that investigated an AI-related concern and could not establish what the AI had accessed.
Reality
A fast SOC cut off the intrusion in minutes. The red team still reached the domain controller and the control network, because every control that failed afterwards was a permission somebody granted and nobody had reviewed.
Perspective Coverage
3 publishersReality
Oasis Security says attackers' servers held about 960,000 Yoido Full Gospel Church member records with resident registration numbers. The church is still verifying, but the cache shows how much identity and donation data sits behind one administrator account at a large congregation.
Perspective Coverage
3 publishersReality
Technical University of Denmark says a login with compromised credentials to its IAM system may have exposed data on up to 200,000 people. The records reach back to 2003, and active users' entries include CPR national ID numbers that DTU warns can be used for identity fraud.
Reality
MacPaw, the CleanMyMac maker, is launching Leebry, an AI platform for IT teams whose prototype resolved 30% of MacPaw's own level 1 tickets. Admins weighing it are working from MacPaw's own survey and MacPaw's own help desk, so a pilot on their own ticket queue is the evidence that counts.
Reality
Okta's forward earnings multiple went from about 18x to about 50x in five months while its full-year EPS guide rose about 2%. That ties the price as much to investors' view of AI security stocks as to Okta's own forward bookings.
Reality
Anthropic and OpenAI took a joint problem statement covering six agent authorization problems to the OAuth Working Group on September 28, 2026. A dev.to analysis of the session argues integration teams can fix the data model they own before any standard arrives.
Reality
Delinea's 2026 survey found 99.7% of IT and security leaders have a formal AI data policy, but only about 51% check AI access against it in real time. For responders, the shortfall comes after an agent starts acting: how fast out-of-scope access is seen, and how fast it is taken away.
Reality
PwC's survey of about 4,000 business and tech leaders found no agreed owner for AI risk, with the CIO or CTO the top answer at just 29%. Until that settles, the usable control is per agent: its own credential and one named owner.
Reality
Ping Identity has launched three agents that let Gemini Enterprise administrators reset passwords, end sessions and change access by typing a request. IT teams now have to decide whether a confirmation inside a chat window meets their change-control and audit rules.
Reality
GroundedDocs, a FastAPI RAG service, verifies Keycloak-signed tokens that expire in about 15 minutes and holds no key that can sign one. Keycloak now keeps the passwords and the signing key, so the identity provider becomes the system worth attacking.
Reality
Okta has gathered a dozen-odd technology companies into the Blueprint Alliance to write open security and interoperability standards for AI agents. The standards are still unwritten, and the six principles published so far are identity-management rules, the category Okta sells.
Reality
Microsoft will allow only scripts from its own CDN domains during Entra ID browser sign-ins under a Content Security Policy enforced from mid-October 2026. Browser extensions and tools that inject code into the sign-in page will stop working as the rollout completes in late October.
Reality
Okta and 11 vendors including AWS, Google Cloud and CrowdStrike signed six shared principles for securing AI agents under a new Blueprint Alliance. Buyers can put the list to vendors in procurement now, while Okta's release describes a reference architecture with no stated way to test compliance.
Reality
A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.
Perspective Coverage
5 publishersReality
CVE-2026-18963 lets an unauthenticated request skip the emailed reset token entirely. Upstream 26.7.2 and four Red Hat errata are out, and the stopgap has to be set realm by realm.
Perspective Coverage
4 publishersReality
According to SecurityWeek, every technique in the chain was ordinary and the detection stack correlated it correctly. The time was lost in escalation, the part of the playbook most teams still size for an intruder working at human speed.
Reality
The flag rate on US-based remote IT roles climbed from 11% in the third quarter of 2024 to an estimated 47%, which prices candidate verification into every application even as venture money for identity startups fell to $0.3bn in a quarter.
Reality
Security · September 22, 2026 · Confirmed2 publishers
Security · September 21, 2026 · One report1 publisher
Security · September 11, 2026 · One report1 publisher
Security · September 10, 2026 · Confirmed2 publishers