# Teleport Recent content in The Teleport Blog This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## FIPS 140-2 vs FIPS 140-3, Explained DevFeed: [FIPS 140-2 vs FIPS 140-3, Explained]() Original publisher: [Read original article]() Author: info@goteleport.com (Mayur Pipaliya) Published: 2026-09-09T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [fips 140-3](), [FIPS validation](), [Cryptography](), [Encryption](), [certificates](), [Security](), [Cloud]() Tags: [certificates](), [cloud](), [cmvp](), [cryptography](), [encryption](), [fedramp](), [fips](), [fips-140-3](), [fips-validation](), [security](), [sensitive-data]() ### AI overview This article explains the differences between FIPS 140-2 and FIPS 140-3, including the standards' origins, CMVP validation certificates, applicable requirements for protecting sensitive data, and the transition timeline through September 2026. ### Source excerpt Understand key changes from FIPS 140-2 to FIPS 140-3. ## ISO 42001 Evidence: What Auditors Ask For DevFeed: [ISO 42001 Evidence: What Auditors Ask For]() Original publisher: [Read original article]() Author: info@goteleport.com (Preet Dhatt) Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [audit](), [AI Development](), [Deployment](), [CI/CD](), [data-governance](), [Monitoring](), [Requirements]() Tags: [ai](), [ai-development](), [article](), [audit](), [ci-cd](), [data-governance](), [deployment](), [eu](), [iso](), [monitoring](), [requirements]() ### AI overview This article explains what auditors look for in ISO 42001 evidence and how organizations can connect access, approvals, infrastructure, CI/CD activity, releases, and production changes into an evidence trail. It also discusses monitoring, human oversight, third-party access, and data governance within an AI Management System. ### Source excerpt Prepare ISO 42001 audit evidence that proves your controls work in practice. ## Identity Everywhere: Bringing Infrastructure Identity to Agentic IT DevFeed: [Identity Everywhere: Bringing Infrastructure Identity to Agentic IT]() Original publisher: [Read original article]() Author: info@goteleport.com (Peter Bailey, Ev Kontsevoy) Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Cisco](), [Security](), [Artificial Intelligence]() Tags: [agentic](), [ai-agents](), [cisco](), [cryptographic](), [identity-management](), [infrastructure](), [partnership](), [security]() ### AI overview Cisco and Teleport announce a strategic partnership involving technology integration, licensing, and investment. The article presents Infrastructure Identity as a cryptographic model intended to connect secure identity with human and machine actions, including activity by workloads, automation, and AI agents. ### Source excerpt Cisco and Teleport are announcing a strategic partnership centered on deep technology integration, licensing, and investment. ## We Had 13 Engineers Spend Three Months Finding Vulnerabilities with LLMs DevFeed: [We Had 13 Engineers Spend Three Months Finding Vulnerabilities with LLMs]() Original publisher: [Read original article]() Author: info@goteleport.com (Rob Picard) Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Vulnerabilities](), [Large Language Model](), [AI-assisted coding]() Tags: [agents](), [ai](), [coding-agents](), [llms](), [security](), [software](), [vulnerabilities]() ### AI overview Teleport describes how 13 software engineers spent a quarter using frontier LLMs and coding agents to review an existing codebase, find vulnerabilities, triage findings, and fix bugs. The article reports that simple prompting of an LLM at one codebase component performed better than a complicated multi-stage agentic harness in their experiments. ### Source excerpt Our approach to "pressure washing" our codebase using frontier LLMs. ## How to Prevent RBAC Role Explosion with Nested Access Lists DevFeed: [How to Prevent RBAC Role Explosion with Nested Access Lists]() Original publisher: [Read original article]() Author: info@goteleport.com (Paul Curtis) Published: 2026-08-13T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Access Control](), [Authorization](), [Development]() Tags: [access-control](), [development](), [how-to](), [permissions](), [teams]() ### AI overview This tutorial explains RBAC role explosion, how repeated role changes create inflexible and duplicated roles, and how nested access lists can apply inherited permissions while keeping roles fixed. ### Source excerpt Learn how to use access lists to prevent RBAC role explosion. ## Navigating SAMA, ADGM & DFSA Requirements with Teleport DevFeed: [Navigating SAMA, ADGM & DFSA Requirements with Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Mukund Cadambi) Published: 2026-08-12T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Requirements](), [Cybersecurity](), [Cloud](), [audit trail](), [data-governance](), [Architecture & Design]() Tags: [audit-trail](), [cloud](), [compliance](), [cybersecurity](), [data-governance](), [requirements](), [security]() ### AI overview This article explains how SAMA, ADGM, and DFSA requirements affect cloud service providers operating in Saudi Arabia and the UAE. It describes challenges involving data sovereignty, cybersecurity, identity and access controls, privileged and third-party access, and audit evidence, and presents a unified identity layer as an approach to operationalizing compliance. ### Source excerpt Learn how Teleport helps CSPs meet SAMA, ADGM, and DFSA compliance. ## How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library DevFeed: [How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library]() Original publisher: [Read original article]() Author: info@goteleport.com (Rob Picard) Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cryptographic audit](), [Go Language](), [ssh](), [Security](), [vulnerability]() Tags: [analysis](), [audit](), [bugs](), [cryptographic-audit](), [cryptography](), [go](), [security](), [security-engineering](), [ssh](), [vulnerability]() ### AI overview Teleport describes a critical vulnerability caused by two interacting bugs in its SSH certificate validation logic and reports that NCC Group conducted a cryptographic audit of Go's SSH package. The audit resulted in nine CVEs and identified subtle issues requiring expert review. ### Source excerpt Learn about NCC Group's cryptographic audit of Go's SSH package. ## How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secrets DevFeed: [How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secrets]() Original publisher: [Read original article]() Author: info@goteleport.com (Noah Stride) Published: 2026-08-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [GitHub Actions](), [Kubernetes](), [Security](), [sensitive data](), [Vulnerabilities]() Tags: [ci-cd](), [github](), [github-actions](), [how-to](), [kubernetes](), [secrets](), [security](), [sensitive-data]() ### AI overview This tutorial explains how to use Teleport and GitHub Actions to deploy applications to Kubernetes without shared, long-lived credentials. It covers short-lived identities, Kubernetes RBAC, Teleport roles, and join tokens, and discusses extending the approach to database connections and internal APIs. ### Source excerpt Learn how use GitHub Actions to deploy to Kubernetes using short-lived, verifiable identities. ## Guide: Certificate-Based Authentication for Payment & Banking Infrastructure DevFeed: [Guide: Certificate-Based Authentication for Payment & Banking Infrastructure]() Original publisher: [Read original article]() Author: info@goteleport.com (Chris De La Garza) Published: 2026-07-31T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Authentication](), [Security](), [cloud-infrastructure](), [Kubernetes](), [Databases]() Tags: [authentication](), [ci-cd](), [databases](), [financial-services](), [guide](), [kubernetes](), [security]() ### AI overview This guide explains the challenges of static credentials in payment and banking infrastructure and presents certificate-based authentication as an approach for managing machine and workload identity. It covers on-premises, cloud, and Kubernetes environments, including hardware attestation. ### Source excerpt A guide to certificate-based authentication in payment infrastructure. ## VPN Alternative for Internal Web Apps | Teleport DevFeed: [VPN Alternative for Internal Web Apps | Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Sami Ali) Published: 2026-07-24T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [web applications](), [Virtual Private Network](), [Authorization](), [audit trail](), [Security]() Tags: [audit-trail](), [authorization](), [identity-aware-proxy](), [security](), [vpn](), [web](), [web-apps]() ### AI overview This guide explains why VPN-based access to internal web applications becomes difficult to manage as organizations grow. It presents an identity-aware proxy as an alternative that authenticates users to individual applications, enforces per-application authorization, and provides an audit trail tied to named identities. ### Source excerpt Replace VPN access to internal web apps with an identity-aware proxy: one login, one audit trail, and per-app access for every user. ## Identity Security for AI DevFeed: [Identity Security for AI]() Original publisher: [Read original article]() Author: info@goteleport.com (Ben Arent) Published: 2026-07-21T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security for AI](), [Security](), [Artificial Intelligence](), [Authorization]() Tags: [agents](), [ai](), [ai-agents](), [github](), [identity](), [least-privilege](), [llms](), [permissions](), [secrets](), [security](), [security-for-ai]() ### AI overview The article examines identity-security challenges created by AI agents that can act continuously with delegated access. It connects traditional risks such as broad permissions, credential sprawl, insider threats, and long-lived secrets with emerging risks from agents, sub-agents, and LLM capabilities, and advocates delegated, ephemeral, least-privilege access. ### Source excerpt AI agents run 24/7 with the same infrastructure access as your engineers. See how Teleport secures AI with cryptographic identity, audit, and trusted runtimes. ## Securing kubectl on Remote Kubernetes Clusters Without Static Credentials or VPNs DevFeed: [Securing kubectl on Remote Kubernetes Clusters Without Static Credentials or VPNs]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2026-07-17T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Kubernetes clusters](), [k3s](), [Network](), [Networks]() Tags: [best-practices](), [clusters](), [credentials](), [firewalls](), [how-to](), [infrastructure](), [k3s](), [kubectl](), [kubernetes](), [kubernetes-clusters](), [network](), [networks](), [remote]() ### AI overview A guide to securing kubectl access to remote Kubernetes clusters running on distributed edge devices. It explains how NAT, firewalls, kubeconfig sprawl, and static credentials create access and security risks, and discusses avoiding publicly exposed API servers and VPN-related operational challenges. ### Source excerpt Learn how to secure Kubernetes access across remote fleets without creating risk. ## How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate DevFeed: [How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate]() Original publisher: [Read original article]() Author: info@goteleport.com (Maximilian Heck, Waldemar Kindler) Published: 2026-07-16T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cyber resilience act](), [Security](), [Architecture & Design](), [Authentication](), [Encryption](), [audit trail](), [Monitoring & Alerting]() Tags: [audit-trail](), [authentication](), [cra-requirements](), [cryptographic](), [cyber-resilience-act](), [eu](), [monitoring-alerting](), [secure-by-design](), [security]() ### AI overview The article explains how Teleport maps its infrastructure identity, access, policy, logging, monitoring, and audit controls to ENISA's Secure by Design and Default Playbook and the EU Cyber Resilience Act. It highlights cryptographic identity, least privilege, secure communication, supply-chain controls, and default protection of device identities and secrets. ### Source excerpt See how Teleport features map to ENISA's Secure-by-Design specification for CRA. ## Keeping AI Workshop Content Current as Tools Change DevFeed: [Keeping AI Workshop Content Current as Tools Change]() Original publisher: [Read original article]() Author: info@goteleport.com (Kathleen Sikora) Published: 2026-07-15T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [Artificial Intelligence](), [Claude](), [Automation]() Tags: [ai](), [automation](), [claude](), [training](), [workshop]() ### AI overview An internal AI workshop had to be revised repeatedly after Claude's skills feature cleared approval between two sessions. The experience led the author to treat workshop content as iterative and to rely on participants' shared knowledge of prompts, workarounds, and workflows. ### Source excerpt I taught the same AI workshop twice in one week, and half my material was already wrong by round two. Here's what that taught me about training on a moving target. ## When AI Agents Call AWS, Who Does AWS Think They Are? DevFeed: [When AI Agents Call AWS, Who Does AWS Think They Are?]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeffrey Ellin) Published: 2026-07-08T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon Bedrock AgentCore](), [Amazon Web Services](), [MCP](), [AI Agent](), [Model Context Protocol](), [JSON Web Tokens](), [AWS IAM](), [Amazon S3]() Tags: [agents](), [ai](), [ai-agents](), [amazon-bedrock-agentcore](), [aws](), [gateway](), [how-to](), [iam](), [jwt](), [mcp](), [s3]() ### AI overview This tutorial explains how to propagate a verified caller identity through an AI agent, Amazon Bedrock AgentCore, Lambda, and AWS API calls. It uses short-lived Teleport JWTs so downstream tools can associate requests with the authenticated user and improve accountability in CloudTrail. ### Source excerpt Learn how to use Teleport JWTs to give MCP tools a verified identity in Amazon Bedrock AgentCore. ## Kubernetes for Agentic AI: Best Practices for Identity and Access DevFeed: [Kubernetes for Agentic AI: Best Practices for Identity and Access]() Original publisher: [Read original article]() Author: info@goteleport.com (Boris Kurktchiev, Megan Moore) Published: 2026-07-07T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Artificial Intelligence](), [Kubernetes](), [Authentication](), [audit](), [SPIFFE](), [OpenID connect (OIDC)](), [Cloud Native Ecosystem]() Tags: [agent-identity](), [agentic-ai](), [audit](), [cloud-native](), [identity](), [kubernetes](), [least-privilege](), [oidc](), [spiffe](), [technical]() ### AI overview This article explains when autonomous or long-running agents in Kubernetes need distinct workload identities instead of inheriting a user's identity. It recommends least-privilege access, short-lived credentials, re-authentication for sensitive actions, network enforcement, and auditability. ### Source excerpt When agents act autonomously beyond a user's session, they need their own identity, least-privilege access, and full audit trails. ## How to Meet EU Cyber Resilience Act (CRA) Requirements DevFeed: [How to Meet EU Cyber Resilience Act (CRA) Requirements]() Original publisher: [Read original article]() Author: info@goteleport.com (Maximilian Heck, Waldemar Kindler) Published: 2026-07-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [cyber resilience act](), [Requirements](), [Security](), [audit trail](), [Encryption]() Tags: [audit-trail](), [ci-cd](), [compliance](), [cyber-resilience-act](), [cybersecurity](), [encryption](), [eu](), [how-to](), [requirements]() ### AI overview This tutorial explains how identity, access, encryption, and audit controls relate to EU Cyber Resilience Act requirements. It also discusses fragmented security toolchains, a compromised Trivy release, and infrastructure patterns such as short-lived cryptographic identities, hardware-rooted device trust, and unified audit trails. ### Source excerpt Learn how to implement identity, access, and audit controls that meet EU Cyber Resilience Act compliance requirements. ## PostgreSQL: How to Control and Audit Agent Access with Identity DevFeed: [PostgreSQL: How to Control and Audit Agent Access with Identity]() Original publisher: [Read original article]() Author: info@goteleport.com (Megan Moore) Published: 2026-06-26T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [PostgreSQL](), [AI Agent](), [Access Control](), [audit]() Tags: [access-control](), [ai-agent](), [audit](), [how-to](), [postgresql]() ### AI overview This article explains that PostgreSQL cannot identify AI agents as distinct actors because they authenticate as database roles. It describes the resulting access-control and audit risks, including broad permissions, non-deterministic query behavior, and long-lived service-account credentials, and introduces short-lived, task-scoped access as an alternative. ### Source excerpt PostgreSQL cannot distinguish an AI agent as a distinct actor. Here's how that impacts access control, and what DBAs can do about it. ## Your AI Agent Needs to Know Who You Are DevFeed: [Your AI Agent Needs to Know Who You Are]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeffrey Ellin) Published: 2026-06-24T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [JSON Web Tokens](), [Model Context Protocol (MCP)](), [Authorization](), [AI Agent](), [audit]() Tags: [access-control](), [ai-agent](), [audit](), [authorization](), [identity](), [jwt](), [mcp]() ### AI overview The article explains that MCP tools typically see only the calling AI agent, not the human who initiated a request. It describes using short-lived, cryptographically signed Teleport JWTs to carry verified user identity through agent requests, enabling more precise authorization and more useful audit trails. ### Source excerpt Learn how Teleport JWTs propagate human identity through MCP tool calls for audit, authorization, and access control. ## Automating Identity and Access for FedRAMP 20x KSIs with Teleport DevFeed: [Automating Identity and Access for FedRAMP 20x KSIs with Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Nicolas Morris) Published: 2026-06-17T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [audit trail](), [identity and access management](), [Logging](), [Monitoring](), [Security](), [CI/CD](), [Cloud]() Tags: [audit-trail](), [ci-cd](), [credentials](), [fedramp](), [fedramp-20x](), [hardcoded-credentials](), [identity-and-access-management](), [logging](), [monitoring](), [security]() ### AI overview This article explains how FedRAMP 20x changes identity and access compliance toward persistent validation using machine-readable evidence. It describes how unified identity management and audit trails can help address gaps in machine-to-machine authentication and continuous KSI validation. ### Source excerpt Learn how to automate identity and access for FedRAMP 20x KSIs with a unified audit trail for identities, access, and persistent evidence. ## SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8 DevFeed: [SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8]() Original publisher: [Read original article]() Author: info@goteleport.com (Kayne McGladrey) Published: 2026-06-09T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [soc 2](), [audit](), [Authorization](), [sigstore]() Tags: [audit](), [authorization](), [certificates](), [credentials](), [soc-2]() ### AI overview This article explains how Teleport maps workload attestation, short-lived certificates, access rules, and audit logs for non-human identities to SOC 2 controls CC6, CC7, and CC8. It describes evidence auditors can use, including access rules, denied credential issuance logs, and Sigstore policy configurations where enabled. ### Source excerpt Discover how to meet SOC 2 CC6, CC7, and CC8 controls for non-human identities. ## How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More DevFeed: [How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More]() Original publisher: [Read original article]() Author: info@goteleport.com (Dan Johns) Published: 2026-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Databases](), [MySQL](), [PostgreSQL](), [certificates](), [passwords](), [Single sign-on (SSO)](), [audit](), [Authorization]() Tags: [apply](), [audit](), [certificates](), [credentials](), [cryptographic](), [database](), [how-to](), [mysql](), [passwords](), [permissions](), [policy](), [postgresql](), [sso]() ### AI overview A guide to replacing shared database passwords and standing privileges with short-lived certificates and identity-based access. It explains how Teleport supports MySQL, PostgreSQL, and other databases, including role-based permissions, hardware-key approval for writes, and query-level attribution in audit logs. ### Source excerpt Learn how to access MySQL, PostgreSQL, and other databases using short-lived certificates instead of shared passwords. ## How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP DevFeed: [How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP]() Original publisher: [Read original article]() Author: info@goteleport.com (Gus Luxton) Published: 2026-06-04T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [audit](), [Kubernetes](), [ssh](), [Databases](), [Security]() Tags: [audit](), [audit-trail](), [compliance](), [databases](), [kubernetes](), [rdp](), [security](), [ssh]() ### AI overview This article explains how SSH, Kubernetes, databases, and RDP create audit challenges for high-frequency and quantitative trading firms. It describes the need for identity-attributed evidence and unified audit trails across protocols to support regulatory assessments. ### Source excerpt Learn how SSH, Kubernetes, database, and RDP create audit challenges for high-frequency and quant trading firms and how to unify audit trails across protocols. ## What SPIFFE Answers for Workload Identity and What It Doesn't DevFeed: [What SPIFFE Answers for Workload Identity and What It Doesn't]() Original publisher: [Read original article]() Author: info@goteleport.com (Rob Cobbins) Published: 2026-05-29T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [SPIFFE](), [Authorization](), [active directory](), [AWS IAM](), [passwd](), [OpenID connect (OIDC)](), [saml]() Tags: [active-directory](), [authorization](), [aws](), [identity](), [ldap](), [oidc](), [passwd](), [permissions](), [saml](), [spiffe]() ### AI overview This article examines what SPIFFE provides for workload identity and where it falls short. It argues that SPIFFE offers a sound way for machines to prove their identities without shared secrets, but does not define authorization and leaves workload registration largely to implementations. ### Source excerpt Learn about the workload identity questions SPIFFE can't answer and considerations for filling gaps in the spec. [Next page]()