Identity Security focuses on protecting digital identities and securing identity-related processes and data. It includes technologies such as identity-based encryption, biometric authentication, and identity-based threat detection.
Adopt
We can clearly recommend this technology. It has been used for longer period of time at many customers and it has proven to be stable and useful.
Identity Threat Detection and Response (ITDR) is the practice and tooling of detecting attacks that use or target identities (credential theft, session hijacking, privilege escalation in directories, and misuse of legitimately held access) and of responding to them by revoking sessions, disabling accounts, or forcing re-authentication. It closes a gap between preventive IAM controls, which cannot tell an attacker's valid sign-in from the owner's, and general security monitoring, which rarely understands identity systems in depth. ITDR reads authentication events, directory activity and identity provider telemetry directly, and hands its findings to the same response processes as the rest of security operations.
Security Information and Event Management (SIEM) collects, normalizes and correlates log events from across an organization's systems, and keeps them as the record that investigations and audits are answered from. For an IAM team it is where identity telemetry has to arrive in usable form: sign-ins, token issuance, directory and entitlement changes, privileged sessions, and changes to the identity systems' own configuration. What the SIEM can detect and prove about identities is decided less by the SIEM than by choices the IAM team makes: which events each identity system emits, which identifier ties an event to a person or a workload, and how long the events are kept.
Zero Trust, also known as Zero Trust Architecture (ZTA), Zero Trust Strategy or Zero Trust Security Model, is a security model that grants no trust based on network location, replacing the perimeter model in which everything inside the corporate network was trusted. Zero Trust follows an Identity First approach and is based on the principle of "never trust, always verify", which means that every access request must be verified explicitly, regardless of where it originates from or what it is trying to access. Zero Trust also applies the principle of least privilege, which means that users and devices are only granted the minimum level of access they need to perform their tasks.
Zero Trust Network Access (ZTNA) applies the Zero Trust principles to remote and private application access.
Where a virtual private network (VPN) places a device on the corporate network, a ZTNA broker checks the user's identity and device posture for each request and connects them to one named application, and to nothing else, regardless of their location.
Zero Trust is the security model for the whole organization; ZTNA is the part of it that replaces or narrows network-level access.
It is commonly delivered as a software-defined perimeter or as part of a secure access service edge (SASE) service, and it relies on the identity provider for who the user is.
Trial
We have used it with success and recommend to have a closer look at the technology in this ring. The goal of items here is to look at them more closely, with the goal to bring them to the adopt level.
Identity Security Posture Management (ISPM) continuously inventories an organization's identity systems and accounts and evaluates their configuration and entitlements against a security baseline, so that weaknesses are found and fixed before an attacker uses them. It covers the settings of identity providers, directories and federation trusts, the state of human, service and agent accounts, and the paths by which ordinary access can lead to administrative control. Where Identity Threat Detection and Response (ITDR) notices someone walking through an unlocked door, ISPM is the practice of finding the doors left unlocked, and of making sure each one has an owner who locks it.
The OWASP Cheat Sheet Series is a free, openly licensed collection of short security guidance documents created and maintained by the Open Worldwide Application Security Project (OWASP) community. These concise, concrete references provide developers, architects, and security professionals with practical guidance for implementing security controls and best practices across application development and deployment lifecycles.
Security Orchestration, Automation, and Response (SOAR) turns a security alert into executed actions: it opens a case, gathers context, and runs a playbook that acts on other systems through connectors, pausing for an analyst where a step needs a human. For identity incidents, the playbook is the IAM team's containment procedure written down in executable form: which sessions and tokens to revoke, which credentials to rotate, which changes an attacker made to undo, and which of those steps wait for approval. A playbook can only contain an identity incident as far as the identity systems let it act, and the automation account that can disable any user is itself one of the most privileged identities in the estate.
Verifiable Credentials (VCs) are digitally signed statements about a person, organization, or thing, such as a diploma, an employment record, or a proof of age, which the holder keeps in a digital wallet and presents to whoever needs to check them.
They address a problem most identity processes still have: an attribute can only be confirmed by asking the organization that issued it, or by trusting a copy of a document.
With a VC, the verifier checks the issuer's signature cryptographically without contacting the issuer, and the holder can disclose only the claims a transaction needs.
Three formats are in use, the W3C Verifiable Credentials Data Model 2.0, SD-JWT VC and ISO mdoc, and OpenID for Verifiable Credentials (OID4VC) carries issuance and presentation of all of them over familiar OAuth 2.0 and OpenID Connect flows.
Together with decentralized identifiers (DIDs), VCs are the credential layer of Self-Sovereign Identity (SSI) and of government wallet programmes such as the EU Digital Identity Wallet.
Assess
We have tried it out and we find it promising. We recommend having a look at these items when you face a specific need for the technology in your project.
Decentralized Identifiers (DIDs) are globally unique identifiers for verifiable, self-sovereign digital identities. Unlike traditional identities managed by governments, banks, or platforms, DIDs are designed to give individuals control over their digital identity through independent verification of digital signatures or encrypted communications without a central authority. However, the actual level of decentralization and control depends heavily on the chosen DID method: some (like did:key) are truly self-sovereign, while others (like did:web) rely on existing centralized infrastructure like DNS.
The W3C Digital Credentials API is a browser API for requesting credentials from a digital identity wallet, extending the same navigator.credentials interface that FIDO2 (WebAuthn) uses for authentication. It exists because presenting a Verifiable Credential on the web previously meant handing the user off through a custom URL scheme or a QR code that the browser could neither inspect nor protect: any site could try to invoke a wallet, and the wallet had no reliable way of telling who was asking. The API replaces that handoff with a mediated exchange — the site declares which credentials it needs and in which protocol, the browser shows a chooser the site cannot see into, and the wallet receives the request annotated with the origin the browser itself asserts. What matters most here is less the API call than how the wallet establishes who is asking, because that is what decides whether any attribute is released at all.
Post-Quantum Cryptography (PQC), also known as quantum-safe or quantum-resistant cryptography (in the IAM context, sometimes referred to as Quantum-Safe Authentication), is the family of public-key algorithms designed to withstand attacks from quantum computers. Traditional public-key cryptography underlying today's digital security (including RSA, ECDSA, and Diffie-Hellman key exchange) relies on mathematical problems like integer factorization and discrete logarithms. While these are computationally infeasible for classical computers, quantum algorithms such as Shor's algorithm can solve them efficiently, rendering current cryptographic protections obsolete once sufficiently powerful quantum computers become available.
Self-sovereign identity (SSI) is a concept that puts individuals in control of their own digital identities without relying on a central authority.
In traditional identity systems, such as government-issued IDs or online accounts, your identity is often stored and verified by third parties.
SSI instead lets individuals hold signed credentials in a wallet of their own and share only the attributes a service needs, which the service can verify without contacting the issuer.
Real-world implementations such as mobile Driver Licenses (mDL) and the European Digital Identity Wallet (EUDI Wallet) under the eIDAS 2.0 regulation (electronic identification, authentication and trust services) demonstrate the practical viability of SSI principles in government and regulatory contexts.