# MFA A security authentication method requiring more than one distinct factor to verify an identity. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Authentication is a long-running Workflow DevFeed: [Authentication is a long-running Workflow]() Original publisher: [Read original article]() Author: Mason Williams Published: 2026-09-15T00:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [Authentication](), [MFA](), [browser](), [Go Language](), [TypeScript](), [Deployment](), [push-notification](), [sessions](), [API]() Tags: [api](), [authentication](), [browser](), [community](), [deployment](), [go](), [mfa](), [push-notification](), [sessions](), [typescript]() ### AI overview This article explains how KERNEL models Managed Auth as a long-running Temporal workflow. A parent workflow maintains connection state, health checks, reauthentication, and cancellation, while child workflows handle individual login attempts with separate browsers, timeouts, and cleanup. Durable state stays in Go, and model-driven work runs in a dedicated TypeScript Worker. ### Source excerpt In this article# - A login is not a request - Model the connection, not the attempt - The human is part of the Workflow - Staying logged in is part of the product - Go owns durability; TypeScript runs the agent - What we learned 1. A login is not a request# An agent can enter a password, stop at an MFA prompt, wait for a person to approve a push notification, and then resume in the same browser. A deployment or Worker restart can happen anywhere in between. ## AuthKit vs Better Auth for B2B SaaS DevFeed: [AuthKit vs Better Auth for B2B SaaS]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Software as a service](), [Single sign-on (SSO)](), [Security](), [log management](), [threat detection](), [Frameworks](), [MFA](), [Passkeys]() Tags: [auth](), [comparison](), [enterprise](), [logs](), [mfa](), [saas](), [security](), [threat-detection](), [vercel]() ### AI overview This comparison examines AuthKit and Better Auth as platforms for B2B SaaS products selling to enterprise IT buyers. It argues that both now provide core capabilities such as SSO, SCIM, and audit logs, so the meaningful differences are provider coverage, where user lifecycle management begins, and contractual responsibility. The article also describes Better Auth's hosted infrastructure, dashboard, SIEM drain, self-service provisioning, and threat detection features, while noting its convergence with AuthKit on enterprise requirements. ### Source excerpt Both ship SSO, SCIM and audit logs now. The comparison that decides enterprise deals has moved to the long tail: provider coverage, where user lifecycle actually starts, and who is contractually on the hook. ## Passkey-themed social engineering leads to identity and cloud compromise DevFeed: [Passkey-themed social engineering leads to identity and cloud compromise]() Original publisher: [Read original article]() Author: Microsoft Security Research, Krithika Ramakrishnan, Bharat Vaghela, Vaibhav Deshmukh, Subhajit Ghosh, Anusha Chakraborty, Akash Chaudhuri, Victor Chingtham and Ivan Macalintal Published: 2026-09-09T17:41:18Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [MFA](), [data-processing]() Tags: [adversary-in-the-middle-aitm](), [apis](), [attacks](), [authentication](), [cloud](), [data](), [identity](), [mfa](), [phishing](), [security](), [social-engineering]() ### AI overview Microsoft Security Research describes a passkey-themed social-engineering campaign that compromises cloud identities through AiTM phishing or device-code flows, establishes authentication persistence, and collects cloud data. It outlines investigation signals and recommends revoking sessions and removing unauthorized authentication methods after confirmed compromise. ### Source excerpt Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance. The post Passkey-themed social engineering leads to identity and cloud compromise appeared first on Microsoft Security Blog. ## Accounts & Self-Service UX Research Update and Expansion: 3 Key Takeaways DevFeed: [Accounts & Self-Service UX Research Update and Expansion: 3 Key Takeaways]() Original publisher: [Read original article]() Author: Sally Collins Published: 2026-09-09T08:05:00Z Content type: article Language: en Sources: [Baymard Institute]() Topics: [User interface design](), [Authentication](), [passwords](), [MFA](), [web applications](), [password reset]() Tags: [article](), [authentication](), [insights](), [mobile](), [passwords](), [research](), [security](), [usability](), [web]() ### AI overview Baymard's updated Accounts & Self-Service UX research examines how ecommerce account experiences have changed since 2018. Based on more than 4,000 hours of research, 1,400 usability issues, and a survey of over 1,000 US adults, the article highlights account security and sign-in changes, including passkeys, one-time passcodes, and two-factor authentication. ### Source excerpt (Note: Unfortunately, e-mail and RSS don't support advanced layouts and features. If the graphics in this article look strange, you may want to read the article in your web browser.) Key Takeaways Baymard has new research on Accounts & Self-Service UX The research uncovered UX issues and identified UX solutions specific to the Accounts area of ecommerce sites Much has changed in account security and sign in, order management and tracking, and order returns since our last large-scale research in 2018 Key Stats 4,000+ new hours of Accounts & Self-Service research 1,400+ usability issues observed in testing 1,000+ US adults surveyed as part of our complementary quantitative research Today at Baymard, we're announcing the launch of our new updated and expanded Accounts & Self-Service UX research. We first investigated UX issues in Accounts & Self-Service in 2018. In this update, we've retested all the UX issues observed in 2018, verified all our UX solutions, wrote new guidelines based on newly observed Accounts & Self-Service UX issues, and rewritten the bulk of our verified guidelines for improved usefulness and clarity. This work has resulted in 57 new and updated Accounts & Self-Service guidelines based on 1,400+ usability issues observed during testing. The 57 guidelines are a key foundation for ensuring a high-performing Accounts and Self-Service UX. Additionally, we've included mobile test observations for the first time. As a result, this study represents our most comprehensive findings on Accounts & Self Service ecommerce UX. In this article, we'll highlight 3 high-level insights from our new Accounts & Self-Service UX research findings. New Insights for Accounts & Self-Service UX Compared to 2018, the landscape of Accounts & Self-Service has changed dramatically, particularly in 3 areas. 1) Account Security and Sign In At J.Crew, participants updating their passwords were provided no guidance regarding the site's password requirements, and they were unable to ## Introducing universal sign-in: a seamless solution for every way you login DevFeed: [Introducing universal sign-in: a seamless solution for every way you login]() Original publisher: [Read original article]() Author: info@1password.com (Travis Hogan and Brandon Lucier) Published: 2026-09-03T00:00:00Z Content type: release Language: en Sources: [Blog on 1Password Blog]() Topics: [passwords](), [MFA]() Tags: [1password-in-the-browser](), [authentication](), [browser](), [extension](), [launch](), [passwords](), [security]() ### AI overview 1Password releases universal sign-in in its browser extension, presenting passwords, passkeys, one-time codes, social logins, and managed-app methods in one prompt. ### Source excerpt Today we're releasing universal sign-in, a new experience from 1Password that provides a seamless and secure way to sign into any site with your preferred method. It's currently available to all customers in the latest version of the 1Password browser extension. A single prompt for every sign-in Signing in doesn't happen one way anymore. A single site might support passwords, passkeys, or third-party providers like Google. Over the last several years, 1Password has evolved to support all major authentication methods used today (passwords, passkeys, 2FA, social logins, OIDC and SAML). But the authentication experience varied because of differences with the underlying technologies. Not having a consistent way to use every authentication type 1Password offered meant needing to remember which third-party provider account you used, manually submitting pages, or needing to find and click sign-in fields. No password manager on the market had a single, consistent way to let you sign in, until now. Universal sign-in means that when you land on a login page, 1Password displays a single prompt to sign in using the authentication method you've chosen for that website. No need to remember how you've logged into the website in the past; passwords, passkeys, one-time codes, social logins, and company-managed apps will all appear in the same, intuitive prompt. Simply pick which account you'd like to sign in with, and 1Password handles the rest. How it works Visit a login page, or launch a saved login in 1Password with an available sign-in URL. The universal sign-in prompt appears at the top of the login page using our new advanced field analysis. It'll appear when you need it, and disappear when you don't. Every account and available authentication method is listed and selectable within the universal sign-in prompt. Choose the login you'd like to use. Over time, 1Password also learns which accounts and methods you prefer using for that site. 1Password then automatically fills your ## Continuous identity intelligence for post-login security evaluation DevFeed: [Continuous identity intelligence for post-login security evaluation]() Original publisher: [Read original article]() Author: Catie Kolander Published: 2026-09-01T00:00:00Z Content type: article Language: en Sources: [Twilio Blog]() Topics: [Digital Security](), [Authentication](), [MFA](), [API](), [passwords](), [Passkeys]() Tags: [ai](), [authentication](), [industry-insights](), [mfa](), [passwords](), [security]() ### AI overview The article argues that passwords, MFA, and passkeys secure only the initial login, while later session activity may become risky. It advocates continuous post-login identity and context evaluation, delegated authority, communication guardrails, and auditability for sensitive actions. ### Source excerpt Secure your platform in the AI era with continuous identity intelligence. Learn how. ## Break-glass access for Amazon EKS when federated identity fails DevFeed: [Break-glass access for Amazon EKS when federated identity fails]() Original publisher: [Read original article]() Author: Sam Mukherjee Published: 2026-08-26T16:20:28Z Content type: article Language: en Sources: [Containers]() Topics: [Amazon EKS](), [AWS Identity and Access Management (IAM)](), [Infrastructure as code](), [MFA](), [Authorization](), [iac-security](), [migration]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [aws-iam](), [best-practices](), [identity-and-access-management](), [infrastructure-as-code](), [mfa](), [migration](), [technical-how-to]() ### AI overview This post presents a break-glass access pattern for Amazon EKS clusters when a federated identity provider fails. It describes a dedicated cross-account IAM role with enforced, recency-aware MFA, infrastructure-as-code templates, validation tests, and post-incident recovery procedures. ### Source excerpt Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure. ## Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) DevFeed: [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-18T19:05:33Z Content type: article Language: en Sources: [Unit 42]() Topics: [Credential theft](), [password spraying](), [MFA](), [Microsoft](), [Incident response]() Tags: [credential-based-attacks](), [credential-theft](), [general](), [high-profile-threats](), [identity](), [incident](), [incident-response](), [mfa](), [microsoft](), [password-spraying](), [thehatman]() ### AI overview This threat brief examines large-scale credential attacks, including password spraying campaigns and claimed credential theft from Microsoft Entra tenants. It provides guidance for identifying suspicious login activity, auditing remote access logs, and hardening internet-exposed edge devices. ### Source excerpt In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42. ## Custom MFA factor: send a second factor through any channel DevFeed: [Custom MFA factor: send a second factor through any channel]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-08-14T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [MFA](), [Authentication](), [API](), [Node.js](), [Rust]() Tags: [announcements](), [api](), [authentication](), [backend](), [console](), [mfa](), [node](), [rust](), [security](), [voice](), [whatsapp]() ### AI overview Appwrite introduces a custom MFA factor that generates and verifies authentication codes while allowing applications to deliver them through channels such as WhatsApp, voice calls, or internal providers. The article explains how to retrieve the code through a server-side function and deliver it securely. ### Source excerpt Appwrite now supports a custom MFA factor. Appwrite generates and verifies the code, and your function delivers it through WhatsApp, a voice call, or any provider you choose. ## How to add step-up authentication to your Next.js app with WorkOS AuthKit DevFeed: [How to add step-up authentication to your Next.js app with WorkOS AuthKit]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-10T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Next.js](), [Authentication](), [Tutorial](), [OpenID connect (OIDC)](), [MFA](), [ui]() Tags: [auth](), [authentication](), [build](), [how-to](), [mfa](), [next-js](), [oidc](), [sign-in](), [ui]() ### AI overview This tutorial shows how to add step-up authentication to a Next.js application using WorkOS AuthKit. It gates a destructive action, revoking all API keys, behind recent interactive re-authentication using auth_time and max_age, while preserving the user's session and location in the interface. ### Source excerpt Build a Next.js app with AuthKit sign-in, then gate a destructive action behind a fresh re-authentication using auth_time and max_age. ## Inside the Modern SOC: The Identity Front Door DevFeed: [Inside the Modern SOC: The Identity Front Door]() Original publisher: [Read original article]() Author: Sharon Maydar Published: 2026-08-07T23:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [Incident response](), [MFA](), [Vulnerabilities]() Tags: [ai](), [attacks](), [authentication](), [credential-theft](), [identity](), [incident-response](), [inside-the-modern-soc](), [insights](), [mfa](), [phishing](), [soc](), [social-engineering](), [unit-42-incident-response-report](), [vulnerabilities]() ### AI overview The article examines identity-based initial access, including credential theft, MFA manipulation, session hijacking, phishing, and social engineering. It describes how attackers expand access through persistence, privilege escalation, and lateral movement, challenging SOC teams to correlate signals across environments. ### Source excerpt Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond. The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42. ## Bring your security stack into Edge for Business -- with support for more partners DevFeed: [Bring your security stack into Edge for Business -- with support for more partners]() Original publisher: [Read original article]() Author: Microsoft Edge Team Published: 2026-08-04T16:00:24Z Content type: article Language: en Sources: [Microsoft Edge Blog]() Topics: [Edge for Business](), [browser](), [Cisco Secure Access](), [Security](), [Endpoint Security & XDR](), [MFA](), [telemetry](), [Microsoft]() Tags: [browser](), [cisco-secure-access](), [edge-for-business](), [endpoint-security](), [integrations](), [mfa](), [microsoft](), [security](), [telemetry](), [uncategorized]() ### AI overview This Microsoft Edge Blog article announces expanded Edge for Business security connector integrations. It highlights Cisco Secure Access, Tanium, and Clever integrations for browser-based security, telemetry, endpoint visibility, compliance validation, data protection, AI guardrails, and streamlined MFA in education environments. ### Source excerpt At a glance Edge for Business security connectors extend your security tools into the browser, so you gain visibility and enforcement where work happens. This update adds new partner integrations, including Cisco Secure Access, The post Bring your security stack into Edge for Business -- with support for more partners appeared first on Microsoft Edge Blog. ## How to add two-factor SMS verification to Webflow with Twilio DevFeed: [How to add two-factor SMS verification to Webflow with Twilio]() Original publisher: [Read original article]() Author: Ismail Ajagbe Published: 2026-07-25T00:00:00Z Content type: tutorial Language: en Sources: [Webflow Blog]() Topics: [webflow](), [MFA](), [Workers](), [Nextra](), [Authentication](), [passwords](), [REST API](), [API](), [Node.js](), [Auth0]() Tags: [api](), [authentication](), [cli](), [cloud](), [code](), [guides](), [how-to](), [next-js](), [node-js](), [rest-api](), [webflow](), [workers]() ### AI overview A practical guide to adding two-factor SMS verification to a Webflow Cloud Next.js app using Twilio Verify. It covers server-side code delivery and validation through a Cloudflare Worker and Route Handlers, session signing, rate limiting, and the two-step user interface. ### Source excerpt Learn how to add two-factor SMS verification to Webflow with Twilio Verify, sending and checking one-time codes from a Webflow Cloud Route Handler. ## Strong Customer Authentication (SCA): A Practical Guide for SaaS DevFeed: [Strong Customer Authentication (SCA): A Practical Guide for SaaS]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-07-22T00:00:00Z Content type: tutorial Language: en Sources: [Dodo Payments Blog]() Topics: [Authentication](), [MFA](), [Software as a service](), [passwords]() Tags: [authentication](), [compliance](), [conversion](), [europe](), [fraud](), [guide](), [how-to](), [passwords](), [payments](), [saas](), [security](), [united-kingdom]() ### AI overview A practical guide to Strong Customer Authentication (SCA), explaining PSD2 requirements, two-factor verification, common authentication factors, 3D Secure, exemptions, and the effect of implementation on checkout conversion and fraud liability. ### Source excerpt Strong Customer Authentication (SCA) is the PSD2 rule requiring two-factor verification on many payments. Learn how SCA works, its exemptions, and how to stay compliant without killing conversion. ## Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond DevFeed: [Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond]() Original publisher: [Read original article]() Author: Datadog Published: 2026-06-24T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Adversary-in-the-middle (AiTM)](), [Amazon Web Services](), [Security](), [MFA](), [Cloudflare](), [JavaScript](), [VirusTotal](), [Batch file](), [cURL](), [Amazon Route 53]() Tags: [adversary-in-the-middle-aitm](), [aws](), [batch](), [cloudflare](), [dns](), [javascript](), [mfa](), [security](), [virustotal]() ### AI overview Datadog Security Research analyzes a June 2026 campaign using cloned AWS console login pages and adversary-in-the-middle techniques to harvest credentials and MFA codes. The article details the phishing infrastructure, delivery methods, VirusTotal artifact, and JavaScript-based credential-harvesting flow. ### Source excerpt Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes. ## Mapping out your unknown: A threat hunter's guide to Salesforce DevFeed: [Mapping out your unknown: A threat hunter's guide to Salesforce]() Original publisher: [Read original article]() Author: Julie Agnes Sparks Published: 2026-06-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Security](), [Reconnaissance](), [Software as a service](), [OAuth](), [Single sign-on (SSO)](), [MFA](), [API](), [log management](), [Monitoring]() Tags: [api](), [data](), [guide](), [logging](), [monitoring](), [oauth](), [post](), [saas](), [salesforce](), [security](), [tokens]() ### AI overview A threat-hunting guide to Salesforce that describes common attack paths, including compromised OAuth applications, stolen SSO and MFA credentials, resource discovery, data extraction, and ransomware. It provides detection queries and explains how Salesforce audit logging tiers support investigation, with queries mapped to MITRE ATT&CK tactics. ### Source excerpt In this post, we walk through different threats to Salesforce and how to detect them. ## EvilTokens: A phishing attack that doesn't steal your password DevFeed: [EvilTokens: A phishing attack that doesn't steal your password]() Original publisher: [Read original article]() Author: Christian Ali Bravo Published: 2026-06-15T08:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [OAuth 2.0](), [account takeover](), [microsoft 365](), [Microsoft](), [MFA](), [Reconnaissance](), [Authorization]() Tags: [account-takeover](), [attacks](), [authentication](), [cybercrime](), [microsoft](), [microsoft-365](), [oauth](), [phishing](), [process](), [time](), [tokens]() ### AI overview EvilTokens is a phishing-as-a-service kit that abuses Microsoft 365's OAuth 2.0 device authorization flow to compromise accounts without directly stealing passwords. Victims authenticate on Microsoft's genuine login page, unknowingly approving an attacker-controlled device; the resulting access and refresh tokens can enable account takeover and business email compromise. ### Source excerpt A phishing kit subverting Microsoft's legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages ## Introducing Moat: A Security Review for Your GitHub Account DevFeed: [Introducing Moat: A Security Review for Your GitHub Account]() Original publisher: [Read original article]() Author: Nuno Maduro Published: 2026-05-25T11:30:00Z Content type: article Language: en Sources: [Laravel Blog]() Topics: [GitHub](), [Security](), [Secret Scanning](), [Authentication](), [MFA](), [ci](), [Maintainers](), [supply-chain-security]() Tags: [authentication](), [ci](), [github](), [maintainers](), [pull-request](), [review](), [secret-scanning](), [secrets](), [security](), [supply-chain](), [supply-chain-security](), [vulnerability](), [workflow]() ### AI overview The article introduces Moat, a read-only package that reviews the security posture of GitHub users, organizations, and repositories. It checks settings such as two-factor authentication, branch protection, signed commits, secret scanning, Dependabot alerts, workflow permissions, pinned actions, webhooks, and collaborator access, then reports configuration gaps and suggestions. The article emphasizes that Moat does not change settings, certify security, remediate compromises, or scan dependencies. ### Source excerpt Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more. ## Credential management for AI agents DevFeed: [Credential management for AI agents]() Original publisher: [Read original article]() Author: info@1password.com (Rachel Sudbeck) Published: 2026-05-07T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [AI Bots](), [passwords](), [MFA]() Tags: [ai](), [ai-agents](), [api-keys](), [developer](), [identity](), [management](), [mfa](), [saas](), [secrets](), [security](), [unified-access]() ### AI overview The article examines how AI agents intensify credential sprawl by creating, using, and replicating non-human credentials at machine scale. It highlights risks from overprivileged, long-lived, and poorly audited API keys and service accounts, alongside gaps in traditional identity controls. ### Source excerpt This blog has been adapted from an excerpted section of 1Password's ebook: Credential sprawl: How AI increases the risks. To read the complete ebook and learn more about the evolving challenges of credential sprawl, click here. The proliferation of credentials outside centralized visibility and control is known as "credential sprawl," and attackers are eager to take advantage of it. Unfortunately, credential management is a broad problem that only grows in complexity as organizations add new tools, employees, and partners. Today's companies have to manage an ever-growing number of credentials that go well beyond traditional passwords, such as developer secrets, passkeys, shared logins, API keys, SSH keys, service accounts, and SSO access tokens. Each of these, if exposed in an attack or breach, can have severe consequences, and developer secrets pose particular, systemic risk. Addressing credential sprawl has become especially urgent due to the rise of AI-based tools and agents. AI agents are a primary driver of credential sprawl because they create, use, and replicate credentials at machine scale. They have unique access needs and can behave both autonomously and unpredictably. Companies that want to integrate AI-based tools must carefully consider how to mitigate these risks to avoid an exponential rise in unmanaged and vulnerable credentials. How do AI agents increase credential risk? AI agents increase credential security risks through their reliance on non-human identities like API keys and service accounts, which are frequently overprivileged, long-lived, and poorly audited. Agents create and use these credentials at machine scale, beyond centralized oversight, leading to rapidly expanding credential sprawl with limited oversight for security teams. And while AI tools and agents pose new and distinct risks, they're also expanding on credential problems that have existed for years, stemming from SaaS sprawl, shadow IT, and unsafe developer practices. Traditiona ## CMMC Phase 2, explained: Requirements, deadlines, and who's affected DevFeed: [CMMC Phase 2, explained: Requirements, deadlines, and who's affected]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Security & Privacy](), [Cryptography](), [vulnerability management](), [vulnerability scanning](), [Encryption](), [MFA]() Tags: [certificates](), [cmmc](), [cmmc-container-images](), [cmmc-phase-2](), [cmvp](), [compliance](), [cve](), [cybersecurity-maturity-model-certification](), [fips](), [nist](), [sboms](), [stig](), [stigs](), [supply-chain](), [u-s-dod](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains the requirements, deadlines, and scope of CMMC Phase 2. It describes the CMMC Level 2 certification requirements for organizations handling Controlled Unclassified Information or supporting Department of Defense and certain civilian agency contracts, including MFA, encryption, vulnerability scanning, supported systems, independent assessments, and compliance documentation. ### Source excerpt CMMC Phase 2 and NIST 800-171 are here. Learn how Chainguard helps teams meet compliance with FIPS, STIGs, and zero-CVE containers. ## From Plaintext, to BLESS, to Identity: The Evolution of Secure Remote Access DevFeed: [From Plaintext, to BLESS, to Identity: The Evolution of Secure Remote Access]() Original publisher: [Read original article]() Author: info@goteleport.com (Leon Fong) Published: 2026-04-09T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [remote access](), [Security](), [ssh](), [Unix](), [MFA]() Tags: [mfa](), [remote-access](), [security](), [ssh]() ### AI overview A historical developer article traces secure UNIX remote access from plaintext telnet and rsh to SSH encryption and key-based login, then discusses the operational risks of long-lived SSH keys. It also describes Netflix's use of MFA and signed SSH certificates as a more secure remote-access approach. ### Source excerpt A senior Adobe security engineer traces the evolution of secure remote access from telnet to SSH keys, Netflix's BLESS, and modern certificate-based identity. ## As breakout time accelerates, prevention-first cybersecurity takes center stage DevFeed: [As breakout time accelerates, prevention-first cybersecurity takes center stage]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-04-07T09:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Cybersecurity](), [Threat Research](), [Artificial Intelligence](), [Automation](), [MFA](), [passwords](), [Reconnaissance](), [Social engineering](), [spoofing](), [ransomware]() Tags: [ai](), [ai-automation](), [attacks](), [authentication](), [automation](), [business-security](), [cybersecurity](), [exploits](), [malware](), [mfa](), [passwords](), [phishing](), [ransomware](), [social-engineering](), [tools]() ### AI overview Threat actors are using AI, automation, credential theft, phishing, zero-day exploits, reconnaissance, and AI-powered scripts to accelerate attacks. The article argues that shrinking breakout times require defenders to adopt a prevention-first cybersecurity strategy. ### Source excerpt Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy. ## Go beyond device health with External Checks in 1Password Device Trust DevFeed: [Go beyond device health with External Checks in 1Password Device Trust]() Original publisher: [Read original article]() Author: info@1password.com (1Password) Published: 2026-04-02T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [Device Trust](), [Zero Trust](), [API](), [Security](), [MFA]() Tags: [api](), [compliance](), [device-trust](), [external](), [mfa](), [security](), [zero-trust]() ### AI overview 1Password Device Trust now supports custom External Checks that use signals from third-party systems, such as compliance status, policy acknowledgments, MFA enrollment, and employment status, in access decisions for protected applications. ### Source excerpt Most organizations already have the policies they need in place. The problem is enforcement. Employees must complete security awareness training, contractors must acknowledge updated agreements, and teams must meet compliance requirements. But the systems that track these requirements rarely connect to the systems that control user and device access. As a result, access is granted even when required conditions haven't been met. That's why we're excited to announce that 1Password Device Trust can now take signals from other systems into account before allowing users to reach sensitive company apps and data. External Checks in Device Trust Until now, 1Password Device Trust focused primarily on device telemetry. That meant administrators could block employees from accessing company resources if their device failed to meet certain requirements, but they couldn't enforce compliance based on signals that live outside of the device. With the ability to create custom External Checks, that changes. Access to protected apps can now depend on: User compliance status Policy acknowledgments MFA enrollment status Active employment status Many other external verification signals Access decisions are no longer limited to what's happening on the device. They reflect whether the user of the device has met required conditions across systems. How External Checks work Administrators configure an External Check by connecting Device Trust to a third-party system via API. That external system becomes a source of truth for a specific requirement, such as whether a user has completed training or acknowledged a required policy. When a user attempts to access a protected application: Device Trust evaluates device posture as it does today. Device Trust sends a request to the configured external system. The external system returns a simple result: pass or fail. Device Trust incorporates that result into the overall access decision. If the check passes, access proceeds normally. If the check fail ## How Multi-Factor Authentication Helps Keep Your Discord Account Safe DevFeed: [How Multi-Factor Authentication Helps Keep Your Discord Account Safe]() Original publisher: [Read original article]() Author: Locke Published: 2026-03-27T00:00:00Z Content type: tutorial Language: en Sources: [Discord Blog]() Topics: [MFA](), [Discord](), [Authentication](), [Passkeys](), [Security](), [QR Code]() Tags: [authentication](), [blog](), [discord](), [how-to](), [security]() ### AI overview This Discord blog post explains how multi-factor authentication, passkeys, authenticator apps, SMS backup authentication, and QR code login can help protect Discord accounts from account takeover. ### Source excerpt A Discord account is more than just your username and avatar. That's why it's important to help keep your account safe and secure by using Multi-Factor Authentication, SMS Backup Authentication & QR Code Login. Learn how to keep your account more secure in the following blog post! [Next page]()