Rezonate, a leader in identity-centric security solutions, today announced a new identity security solution for mid-market companies. The offering proactively reduces the identity attack surface and improves compliance efforts in a fraction of the time of legacy IAM tools or manual methods. This innovative approach promises faster time-to-value and unmatched cost-effectiveness in a radically simple way.

Mid-market teams battle mounting identity challenges as user and machine accounts rapidly multiply. These organizations lack the necessary visibility into who has access to which apps, what shadow IAM exists, and what privileges and entitlements identities (human and machine) have to critical SaaS applications and cloud infrastructure. These resource-constrained organizations are struggling to meet compliance mandates, lagging behind cyberinsurance requirements, and are left vulnerable to identity-based attacks. Trying to solve the problem manually or stitch together multiple tools proves inadequate, as teams are unable to effectively “connect the dots” across siloed applications.

Rezonate’s all-in-one platform provides a unified view into all identity data, access pathways, and security configurations across complex, multi-cloud, multi-IdP (identity providers), and SaaS-heavy environments. This comprehensive view strengthens security and compliance posture. Rezonate delivers visibility and the ability to continuously monitor and remediate over-privileged users, improper entitlements, anomalous behaviors, misconfigurations, and lack of identity security controls. By adopting a risk-based and context-aware view, Rezonate empowers teams to prioritize their efforts on the highest-risk identities or most sensitive application access, remediating directly from the platform.

“Mid-market organizations are the backbone of innovation, expanding their tech stacks at an accelerated pace, yet they’re often underserved by traditional security solutions that are either too costly or too complex to implement,” said Roy Akerman, co-founder and CEO of Rezonate. “We’re redefining identity security, making advanced capabilities accessible to even the least experienced and budget-constrained teams. Our platform empowers smaller security and IAM teams to operate with incredible visibility and speed while leveraging the practices of a larger enterprise in a much simpler, streamlined way. Built for fast-growing, agile businesses, our mid-market offering provides the tailored identity security they need to thrive in the cloud without the burden of a heavy investment in resources or time. We’re giving them an always-on platform to maintain control, stay compliant, and protect their most critical assets.”

As organizations rapidly expand their human and machine identities across complex environments like Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, they need a security solution that can keep pace and provide depth into the complexities of each platform. Rezonate’s mid-market solution addresses this challenge with a powerful combination of proactive capabilities that empower organizations to secure their cloud identity fabric efficiently and effectively.

Rezonate’s solution is uniquely suited to integrate with leading identity providers such as Okta Workforce Identity Cloud, Google Workspace, and Microsoft Entra ID, as well as business-critical SaaS applications, including Salesforce, GitHub, Snowflake, Workday, and others. This ensures a comprehensive approach to identity security across the entire digital ecosystem.

Key Features of Rezonate’s Mid-Market Solution

• A Single Pane of Glass into the Identity Fabric: Rezonate’s Identity Storyline visually connects the dots across all identities, delivering in-depth insights into effective privileges, entitlements, activities, and risk profiles.
• Continuous Monitoring, Alerts, and Remediation: Uncover shadow IAM, high-risk identities, and misconfigurations that require immediate attention and remediation, ensuring no vulnerabilities are left unchecked across cloud platforms and SaaS applications.
• Real-Time Actionability and Streamlined Compliance: With unified visibility and observability, organizations can use the real-time threat detection and response (ITDR) module to stop breaches before they become problems. Additionally, the identity compliance module automates access reviews, facilitates micro-certifications, and automates risk-enabled remediations, equipping teams with the tools they need to scale their proactive identity security efforts.

A Partnership for Success: Fast Time-to-Value and Seamless Integration

Beyond the technology, Rezonate is committed to ensuring successful delivery and implementation for its customers through a strong partnership approach. Rezonate’s mid-market solution delivers fast time-to-value with an onboarding approach that allows organizations to immediately reduce their overall identity attack surface and scale their security efforts over time.

• Risk Assessment: Rezonate works closely with organizations to deploy the solution and identify critical risks to reveal shadow IAM, at-risk identities, and security and access misconfigurations.
• Customize Risk Profiles, Alerts, and Workflows for Automation: The focus shifts to setting up remediation workflows, enabling both guided and automated remediations for identified risks. During this phase, key resources and integrations are prioritized to ensure seamless operation within existing security frameworks.
• Risk-Aware Actionability: Over time, Rezonate helps organizations build out a comprehensive threat detection model and expand processes to involve other departments and stakeholders. This ensures that hygiene and compliance needs are clearly defined and consistently met.

Each customer is assigned a Customer Success Program Manager to ensure that key metrics are achieved and risk reduction is demonstrated. Rezonate’s simple and predictable licensing model, based on the number of identities per year, ensures that organizations can scale their security efforts cost-effectively.

“Rezonate has helped COTA tackle the critical identity risk landscape. The easy-to-follow visual mappings and per-identity risk ratings enable us to clearly see each identity’s reach and allow us to focus our identity posture and compliance efforts,” said Michael Myint, Vice President of Information Security at COTA Healthcare. “Since deployment this year, we have been able to streamline efforts to effectively review and update access privileges and entitlements across our cloud infrastructure and SaaS apps. Rezonate makes it easier for us to be proactive regarding security and compliance, staying one step ahead of attackers and meeting auditor expectations.”

Rezonate’s mid-market solution is now available, redefining how organizations manage and secure identities across their cloud and SaaS ecosystems. It supports major platforms, including AWS, GCP, Azure, Okta Workforce Identity Cloud, Google Workspace, Microsoft Entra ID, Salesforce, GitHub, Snowflake, Workday, ZenDesk, and many more.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Rezonate unveils new identity security solution for mid-market companies first appeared on AI-Tech Park.

Strivacity, a leading provider of customer identity and access management (CIAM) solutions, earned two new certifications, while renewing two existing certifications, as part of its continued effort to ensure data security for clients and consumers.

Strivacity earned PCI DSS, or Payment Card Industry Data Security Standard, and FIDO2 certifications and recertified SOC2, or Service Organization Control Type 2, and Web Content Accessibility Guidelines (WCAG) certifications. These credentials provide third-party recognition of the company’s commitment to safeguarding the data of business clients and their customers.

“Data and identity safety and security are of utmost concern to any online operation,” said Keith Graham, Strivacity co-founder and CEO. “Strivacity is committed to protecting data and adhering to standards while simplifying customer sign-up and sign-in processes.”

The four certifications cover key industry standards, including payment, authentication, and internal controls.

• PCI DSS helps ensure the security of credit card transactions and minimize fraud.
• The FIDO Alliance promotes authentication standards including the use of passkeys to simplify login while reducing phishing and enhancing scalability. FIDO2 provides enhanced security for users accessing their accounts via mobile or desktop.
• SOC2, launched by the American Institute of Certified Public Accountants, helps to ensure organizations have sufficient internal controls in place to manage security and trust.
• WCAG, a Voluntary Product Accessibility Template standard, addresses online accessibility, ensuring that Strivacity solutions are readily usable for all individuals.

“We will continue to push for secure and efficient customer identity and access management solutions, including aligning with evolving safety and security standards,” said Graham. “I’m proud of our team and their efforts to make e-commerce and all other online activity safe and secure for clients and their customers.”

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Strivacity Achieves PCI DSS Compliance and FIDO2 Certification first appeared on AI-Tech Park.

By acquiring Vantyr, Ark is strategically entering the SaaS security domain, focusing on the most critical business applications, such as Salesforce – expanding our cybersecurity offerings to include specialized protection for one of the most widely used CRM platforms in the world. Vantyr’s expertise in securing app-to-app connections across cloud and SaaS applications enhances our ability to provide tailored solutions to address the unique challenges of managing integrations and data flows across critical business applications. This acquisition positions Ark to deliver even greater value to clients who rely on SaaS applications for their business operations, ensuring their environments are secure, compliant, and optimized for performance.

Vantyr was founded in 2022 by serial entrepreneurs Mark Balovnev, Marek Termanowski, and Mile Oreskovic, and is based in San Francisco, California. The platform boasts a unique and proprietary solution in the field of SaaS security, with a focus on safeguarding the app-to-app ecosystem. The platform provides instant visibility into SaaS environments, enabling businesses to discover, audit, and protect their SaaS applications from potential security threats. Vantyr’s proprietary technology supports key SaaS platforms like Salesforce, GitHub, and Slack, providing critical features such as user and integration inventory, risk scoring, data flow mapping, and automated threat remediation.

Raj Natarajan, President & CEO of Ark, stated, “The acquisition of Vantyr enhances our cybersecurity portfolio, integrating Vantyr’s advanced SaaS security with our existing slauth.io platform. This combination strengthens our offerings, providing a comprehensive solution to address security challenges across cloud and SaaS environments, equipping our clients to better protect their digital assets.”

“Securing SaaS applications is the fastest growing pain point for businesses of every size,” Mark Balovnev, CEO of Vantyr, said. “Shadow IT, shadow AI, and app-to-app connections represent an exponential sprawl of hidden corners, data flows, and security risks. The cutting-edge platform we’ve built at Vantyr is an ideal complement to Ark’s cloud and SaaS security platform and we’re excited to further our shared mission to provide comprehensive and simple SaaS security for organizations anywhere.”

Socrates Geetha, CTO of Ark, noted the synergy between Vantyr and slauth.io, stating, “Vantyr’s focus on non-human identities and app-to-app security complements slauth.io’s IAM capabilities, enabling us to offer a comprehensive security solution that manages access and protects data flows within SaaS environments.”

Marek Termanowski, CPO of Vantyr, added, “Our mission at Vantyr has always been to provide deep visibility, lifecycle management, and security into complex SaaS environments. By integrating with Ark’s powerful cloud and IAM solutions, we are set to deliver even more impactful security capabilities, ensuring our customers stay ahead of potential threats.”

Ark’s acquisition of Vantyr is expected to solidify Ark’s position as a leader in the cybersecurity industry, offering unparalleled protection for cloud and SaaS applications globally. The combined strength of Ark’s slauth.io and Vantyr’s advanced technology will empower organizations to protect their most valuable digital assets while driving business success.

Great Elm Solutions, Inc. served as the financial advisor and deal broker for both Ark and Vantyr. Details of the transaction remain confidential, not subject to regulatory constraints.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Ark announced the acquisition of Vantyr first appeared on AI-Tech Park.

 MongoDB, Inc. (NASDAQ: MDB), today announced that MongoDB Atlas for Government now supports Google Cloud’s Assured Workloads in US regions for government agencies, public sector organizations, and independent software vendors (ISVs) who develop software for the public sector. The introduction of support for Google Cloud adds onto MongoDB’s existing availability with other cloud solutions, making MongoDB Atlas for Government the first multi-cloud data platform authorized at FedRAMP Moderate.

“Google Cloud’s Assured Workloads gives public sector organizations access to the latest cloud capabilities without having to worry about compromising on compliance,” said Sunil Potti, Vice President, Cloud Security at Google Cloud. “We’re excited to provide these organizations with even further flexibility by adding MongoDB Atlas for Government as another database option for them to choose.”

The public sector and the ISVs that serve these organizations must balance maintaining the highest levels of security and remaining compliant with regulatory requirements—while continuing to adopt advanced technology to meet the ever-growing needs of citizens.

With MongoDB Atlas for Government, organizations can take advantage of a flexible and scalable developer data platform that supports a wide range of use cases, including mission-critical transactional workloads, generative AI-powered applications, real-time analytics, content management, and more. MongoDB Atlas for Government features built-in security capabilities like advanced encryption for data at rest, in transit, and in use; network management and isolation; and identity access and management controls to maintain the highest level of security for organizations’ most sensitive workloads. Adding support for Google Cloud’s Assured Workloads will enable public sector organizations and ISVs to host their workloads on Google Cloud’s most secure and compliant cloud service offering. Google Cloud customers will be able to select MongoDB Atlas for Government on Google Cloud Marketplace beginning in the fall.

“Due to strict security and compliance requirements, public sector organizations are often left with limited options for cloud adoption and modernization which present unique challenges that we at MongoDB help solve,” said Sahir Azam, Chief Product Officer at MongoDB. “Adding MongoDB Atlas for Government to Google Cloud provides greater choice to those organizations looking to modernize their operations and to innovate faster to meet the needs of citizens. And for those organizations already in the cloud, the support for Google Cloud allows customers to deploy multi-cloud solutions, enabling robust disaster recovery capabilities and improving overall resilience.”

To get started with MongoDB Atlas for Government on Google Cloud Assured Workloads, visit the Google Cloud Marketplace or read the Atlas for Government documentation.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post MongoDB Announces New Capabilities with Google Cloud first appeared on AI-Tech Park.

Beyond Identity, the leading provider of secure identity and access management (IAM) platform, today announced the release of RealityCheck, an identity assurance plugin for Zoom Video Communications, Inc. Beyond Identity’s new solution protects organizations from AI deception, such as impersonation attacks and deepfakes, by certifying the authenticity of call participants using the highest level of authentication assurance: Authenticator Assurance Level 3 (AAL3) combined with device security verification.

“With the rise of AI and deepfake-based attacks, organizations need their identity platforms to protect against such attacks. Beyond Identity’s RealityCheck is the first tool developed to purposely address this new type of attacks,” said Jasson Casey, CEO of Beyond Identity. “Our application focuses on the prevention of AI impersonation attacks and deepfakes in video conferencing applications, as they recently led to some devastating results to the reputation and financial stakes of the attacked organizations. Many organizations do not have in place cybersecurity strategies to combat AI deception attacks. They are further challenged by the fact that most deepfake detection tools and end-user training are probabilistic and cannot offer solid guarantees. With RealityCheck, we are providing organizations with a game-changing solution that shifts the focus to authentication assurances to make deterministic claims and ensures the authenticity and security of digital interactions. We will be further building more integrations for RealityCheck, to be able to attest the credibility of other communications such as email and chat.”

RealityCheck layers a badge of authentication and risk assurance over Zoom calls and displays a side panel with additional data about device and user risk. Once installed in Zoom, RealityCheck uses trusted, deterministic signals to validate Zoom participants through phish-resistant authentication by the claimed user, ensures devices meet organizational security standards, and continuously verifies users and devices to maintain ongoing trust. As a result, meeting hosts and other call participants have the data they need to make informed decisions about whether or not the person on the other side of the screen is a legitimate actor, providing critical information for protecting their meetings, data, and privacy.

RealityCheck comes at a critical time with the rise of AI deception targeting private and public organizations. In addition to the deepfake frauds where adversaries trick victims into sending money by impersonating company personnel, RealityCheck can supplement new hire onboarding processes by delivering verification that the employee is actually on an authorized device and strongly authenticated with phishing-resistant MFA when verifying identity documents over Zoom. 

As a component of our Secure Access platform, RealityCheck extends Beyond Identity’s foundational strong authentication and device security to provide visible verification to help end-users make informed decisions. Aligned with our holistic secure-by-design approach to identity, Secure Access platform with RealityCheck embedded makes it simple for organizations to defend against current attacks and stay secure while conducting day to day business.

Key features include:

• A dynamic badge displayed in the user’s camera layer
• Surface user and device claims on the badge and participants’ panel
• Participant verification status in Zoom side panel for meeting hosts
• Simple admin deployment via Zoom marketplace and end-user enrollment

Zoom is only the first application of RealityCheck as Beyond Identity seeks to deliver additional value to security-oriented customers for use cases requiring attestations of authenticity assurance. The technology will further apply to other communication applications including email and chat.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Beyond Identity Launches RealityCheck first appeared on AI-Tech Park.

SecureAuth, a market leader in identity and access management, today unveiled its vision for advancing workforce and customer identity security, creating experiences that are as welcoming as they are secure – alongside a rebranded company and product UX.

As organizations continue to transform to meet the growing demands of digital business, they must balance stringent security demands, while ensuring seamless experiences for their users. This market context is driving the demand for workforce and customer identity solutions, which surpassed USD $12B in 2022 and is growing at a projected CAGR of 13% through 2032, according to Global Market Insights 2023 data.

Designed to meet the growing identity needs of enterprises serving their employees and customers, SecureAuth has aligned its market-leading capabilities under two flagship offerings: SecureAuth Workforce and SecureAuth CIAM (Customer Identity & Access Management).

“We envision a world where your employees are always safe, productive, and engaged; where your customers delight in seamless online experiences and never worry about comprised data. Where your company and brand are as protected as they are valued. Our latest innovations are designed to advance that vision and deliver the outcomes that matter most to our customers,” said Joseph Dhanapal, CEO of SecureAuth.

Three core solution principles are driving the company’s latest innovation across both its Workforce and CIAM solutions, including just a few of the latest capabilities released below:

Always Serve Users

• Enhanced branding, improved UX and modern layouts across both Workforce and Customer solutions give users more streamlined experiences and ensures easier profile management.
• Customizable Portal in SecureAuth Workforce, enabling tailored look and feel to perfectly match organizations’ branding, while users get real-time password strength feedback and seamless single logout across all connected applications.
• A new tailored consent experience in SecureAuth CIAM enables administrators to manage the end-user privacy experience through dynamic policies that determine when users can and should assert control over the handling and distribution of their personal data.

Always Be Flexible

• Fine-Grained Authorization (FGA). Use dynamic policies to control access, based not only on roles and attributes, but also on object relationships modeled in SecureAuth’s relationship graph as well as from any API-accessible external third-party source.
• Enhanced management delegation across B2B2C ecosystems, delivering SecureAuth cloud CIAM customers enhanced flexibility to give third parties and partners secure, efficient access to systems, without adding additional internal resources to manage – scaling for growth without scaling headcount.
• Flexible, streamlined workflows and a powerful new dashboard give SecureAuth Workforce administrators improved drill-down functionality, for near real-time visibility into user activity logs making monitoring easier than ever.

Never Compromise Security

• AI/ML driven risk and level-of-assurance calculations, allow administrations of both SecureAuth Workforce & CIAM deployments to dynamically alter the amount of friction users experience depending on a wide variety of factors such as their behavior, location and device characteristics.
• External Authentication Methods for Microsoft Entra. Support for external authentication methods enables Microsoft Entra ID customers to leverage SecureAuth’s Workforce identity solution as an external authentication provider, providing enhanced security and a better MFA experience to users within their existing Microsoft ecosystem.
• FIPS Capable Containers: Public Sector Organizations required to adhere to FedRamp compliance requirements can now leverage the FIPS-capable container set to deploy SecureAuth’s CIAM offering.

The company’s vision, reinvigorated brand, and latest innovations are part of a unified and holistic approach to identity and access management that delivers maximum security with exceptional digital experiences.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post SecureAuth unveiled new workforce and customer identity security vision first appeared on AI-Tech Park.

Opal Security, building the next generation of identity and access management, announced updates to its industry-first least privilege posture management platform. Originally launched in April, it consists of capabilities that enable security teams to better manage identity security in a standard security workflow by proactively, detecting, prioritizing and calibrating over-provisioned access across organizations.

Opal has added several new features to its identity security platform, including group optimization, which helps customers identify and remediate identity risk inherent in broad group-based access; irregular access, a new risk factor used in detecting and prioritizing risky access; and native least privilege support for Snowflake.

Group Optimization

Companies leverage groups — Okta, Microsoft Entra or Google groups — as a simple way to provide role-based access to resources. However, managing access via groups comes with complications. Groups can become obsolete, the policies can be too broad, and the sheer number of groups can become unwieldy over time. Group optimization helps customers identify risks inherent in group-based access, and take immediate steps to reduce the blast radius of over-provisioned, unused and accidental membership access.

Opal’s group optimization helps teams manage group access by detecting:

• Users in groups who are not using the group to leverage resources over a duration of time, and who should be removed from the group.
• Resources available to groups that no one in the group has accessed over a duration of time, and that should be removed from the group.
• Groups that have not been leveraged by any users over a duration of time, and that may be deleted.
• Groups that are not following the company’s group naming convention, and that should be re-named to align.
• Group hierarchy issues, such as deeply nested or circularly referenced groups that should be moved out of a hierarchy to avoid unintended access management issues.

For each group risk identified, Opal enables immediate action. In just a couple of clicks, IAM or security teams can remove users from groups they are not leveraging, remove resources from groups that are not being used or convert access to just-in-time (JIT) with an expiration date for access.

Irregular Access
Opal Security’s least privilege posture management detects and prioritizes different types of risky access based on several factors, including permanent access, sensitivity, unused access and access provisioned outside of Opal.

In addition, the platform will now leverage machine learning to identify irregular access. Access patterns that do not conform to the usual patterns will be detected by combining several variables, such as job function and team, nature of access, resource attributes and access graph topology.

For example, it may detect that someone on the sales team has access or privileges to an AWS database that is usually only given to developers, an indication of over-privileged access that might be accidental or nefarious.

As with all of the other risk factors, irregular access is factored and prioritized by assigning an overall risk score, and remediation action is recommended and achievable within two clicks.

Native Support for Critical Data Systems

Opal Security’s first-party Snowflake integration empowers security, infrastructure and IT teams to easily manage and remediate access to Snowflake Roles and resources such as databases, schemas and tables.

Snowflake’s powerful and flexible Access Controls Framework allows administrators to set granular permission scopes with a high degree of customizability. However, this also means administrators must be equipped to manage complex access patterns that come with elaborate organizational policies. This complexity can lead to challenges when managing Snowflake instances at scale as a part of a company’s overall security strategy. Several recent breaches, all stemming from situations where valuable data was accessible on Snowflake instances that did not require multifactor authentication (MFA) have highlighted not only the challenge but also the magnitude of the impact if critical data is leaked.

With Opal’s first-party integration, customers can key access questions and implement and maintain least privilege in their Snowflake environments. Opal provides the ability to see and modify which users have access to Snowflake Roles and Securable Objects so that teams can manage access and privileges to a granular level. Teams can enable just-in-time access to reduce risk by shrinking the time access is enabled and therefore potentially exploited, and enable and enforce policies such as requiring multifactor access.

“Our mission is to bring the best of infrastructure and security to all of identity. With this new set of features, we empower teams to properly mitigate more types of identity risk, move away from point-in-time audits managed by arbitrary teams, and get to an ongoing flow within a comprehensive security strategy,” said Umaimah Khan, founder and CEO of Opal Security. “We believe this is the very beginning of an overall shift toward identity being a primary lens and focus for security teams as data and applications spread across SaaS, cloud and self-hosted infrastructure.”

One customer who recently evaluated and selected Opal said, “We chose Opal Security over other vendors for several reasons. Their mature API and Terraform support enable us to manage resource access through a codified, reviewable, and easily revertible system. Opal’s flexible and comprehensive platform allows us to tailor approval flows based on the risk level of a resource or the role of the requestor, ensuring a robust and secure user experience. Additionally, the Threat Center feature allows us to easily monitor and reduce unused or permanent access while still providing our users with a seamless request experience through their Slack integration.”

Least privilege posture management is available to Opal Security customers in cloud and self-hosted deployments at no additional cost. To learn more about least privilege posture management, you can schedule a meeting with the Opal team at Blackhat, August 6-8 in Las Vegas, or visit the Opal Security website.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Opal Security Expands Least Privilege Posture Management Capabilities first appeared on AI-Tech Park.

• Zoe provides AI-augmented identity security to help IAM and security teams get ahead and stay ahead of attackers by boosting speed and efficiency on routine posture/compliance activities and reducing MTTR/MTTD in case of identity breaches.
• Security, IAM, GRC, and DevOps teams can collaborate to resolve identity security concerns using generative AI to share insights and create instructions each team can easily follow based on their role.
• The early access launch of Zoe is the first step in Rezonate’s phased approach to delivering generative AI-enabled identity security capabilities while protecting customers via adherence to strict privacy controls customized to their unique AI readiness factor.

Rezonate, an innovator in identity-first security, today introduced its AI-powered assistant, Zoe. This innovative solution is designed to augment cybersecurity and identity and access management (IAM) teams. Zoe helps to proactively detect and mitigate identity risks across the dynamic, ever-expanding population of human and non-human identities operating in cloud infrastructures and SaaS applications. Zoe is now in early access and will be generally available in fall 2024.

Addressing and mitigating modern security issues requires a cross-disciplinary approach for IAM, DevOps, governance, risk and compliance (GRC), and security departments. However, these teams don’t always speak the same language and lack a common framework for complete situational awareness when under attack. Zoe guides everyone through to the best decision via a conversational approach, empowering both small teams within mid-size organizations to overcome the skills and staffing gaps and larger enterprises to coordinate across departments to quickly resolve access privilege misconfigurations, policy violations, and other critical vulnerabilities before they become an attacker’s next attack vector.

AI-Powered Identity Security for Modern Enterprise Environments

Powered by generative AI, Zoe automates identity security tasks through natural language interactions, making any task a breeze by significantly enhancing the efficiency and effectiveness of IAM and security teams and existing IAM technologies. The dynamic cybersecurity environment and increasing sophistication of attackers leveraging AI themselves require advanced solutions like Rezonate to keep up and stay ahead.

To help security analysts and identity security teams locate critical risks and conduct triage and remediation most efficiently, Zoe offers query abilities that lead to suggested actions, task lists, and reports. This streamlines and accelerates the execution of core identity security and compliance activities for resource-constrained teams.

Additional benefits of Zoe include:

• Faster Time to Identity Intelligence and Action: Translate inquiries from natural conversation into a unified query language. Leveraging end-to-end visibility via Rezonate’s Identity Storyline^TM, Zoe provides contextual and granular risk understanding. The AI assistant offers actionable insights for any access or identity security question.
• Continuous Monitoring and Proactive Alerts: Set up real-time alerts or messages on integrated platforms such as Slack or Teams to enable security and IAM personnel to stay updated on any changes or activities that might create risks or vulnerabilities.
• Accelerated Access Reviews and Compliance: Simplify and improve access reviews and compliance efforts by pulling reports using natural language prompts from the user and suggesting areas to focus on to ensure all policy violations are addressed.
• Knowledge Assistance for Security-IAM Teams: Break down any knowledge barriers between security and IAM teams. The advanced version will provide full details and necessary context on any alert relating to suspicious activities to enable remediation.

“Identity security is broken by siloed, disparate systems and manual efforts, leading to increased risk and breaches,” said Roy Akerman, CEO and co-founder at Rezonate. “First, we delivered the game-changing Identity Storyline^TM to close the visibility gap; next, we automated core identity security tasks. Today, we’re launching Zoe, the identity security AI assistant, to improve multidisciplinary collaboration, ease remediation anxiety, and speed up actionability. CISOs and their teams will love interacting with Zoe, always there to streamline complex identity security projects.”

Resolve the Critical Identity Crisis Facing Security and IAM Teams

Zoe is the latest front in Rezonate’s mission to protect identities everywhere. This starts with supporting organizations’ most common security needs, such as communication and visibility gaps, changing compliance needs, ongoing staffing and skills shortages, and the sheer number of security alerts and identities to manage.

Security and IAM teams often have different missions. Rezonate bridges this gap by enhancing operational efficiencies and meeting protective and defensive security demands with a better, faster way to collaborate and communicate across technical boundaries and siloed environments. The platform offers a holistic view of identity across complex, cloud-forward environments, providing the necessary context to understand the true risk associated with each identity and transaction. The same principle applies to compliance, allowing organizations to track how they stay in line with ever-increasing government regulations and certification requirements.

Homan Farahmand, VP Analyst of Gartner, recommends that organizations “evaluate relevant identity and access intelligence (IAI) use cases to incorporate GenAI capabilities as part of the enterprise identity fabric functions such as the addition of an IAM copilot and in-product features. Large and complex organizations should evaluate key components such as GenAI large language models and orchestration technologies for implementing custom IAI solutions. Small and midsize organizations can start with adopting vendors’ in-product capabilities.”¹

“With Rezonate, we can finally see and understand the end-to-end view of our cloud identities and their respective risk across our identity provider to our multi-account AWS infrastructure in real time,” said Olivier Martinet, Group CISO, TX Group. “Our DevOps and Security teams can work together eliminating blind spots and accelerating remediations.”

For more information about Zoe and how Rezonate is revolutionizing identity security, please visit www.rezonate.io/zoe. Zoe will be generally available fall 2024, with a free trial.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Rezonate Unveils Zoe: The AI Assistant for Identity Security first appeared on AI-Tech Park.

Yet use of AI/Automation cut breach costs by $1.88 million

IBM (NYSE: IBM) today released its annual Cost of a Data Breach Report revealing the global average cost of a data breach reached $4.88 million in 2024, as breaches grow more disruptive and further expand demands on cyber teams. Breach costs increased 10% from the prior year, the largest yearly jump since the pandemic, as 70% of breached organizations reported that the breach caused significant or very significant disruption.

Lost business and post-breach customer and third-party response costs drove the year-over-year cost spike, as the collateral damage from data breaches has only intensified. The disruptive effects data breaches are having on businesses are not only driving up costs, but are also extending the after-effect of a breach, with recovery taking more than 100 days for most of the small number (12%) of breached organizations that were able to fully recover.

The 2024 Cost of a Data Breach Report is based on an in-depth analysis of real-world data breaches experienced by 604 organizations globally between March 2023 and February 2024. The research, conducted by Ponemon Institute, and sponsored and analyzed by IBM, has been published for 19 consecutive years and has studied the breaches of more than 6,000 organizations, becoming an industry benchmark.  

Some key findings in the 2024 IBM report include:

• Understaffed Security Teams – More organizations faced severe staffing shortages compared to the prior year (26% increase) and observed an average of $1.76 million in higher breach costs than those with low level or no security staffing issues.
• AI-Powered Prevention Pays Off – Two out of three organizations studied are deploying security AI and automation across their security operation center (SOC). When these technologies were used extensively across prevention workflows organizations incurred an average $2.2 million less in breach costs, compared to those with no use in these workflows – the largest cost savings revealed in the 2024 report.
• Data Visibility Gaps – Forty percent of breaches involved data stored across multiple environments including public cloud, private cloud, and on-prem. These breaches cost more than $5 million on average and took the longest to identify and contain (283 days).

“Businesses are caught in a continuous cycle of breaches, containment and fallout response. This cycle now often includes investments in strengthening security defenses and passing breach expenses on to consumers – making security the new cost of doing business,” said Kevin Skapinetz, Vice President, Strategy and Product Design, IBM Security. “As generative AI rapidly permeates businesses, expanding the attack surface, these expenses will soon become unsustainable, compelling business to reassess security measures and response strategies. To get ahead, businesses should invest in new AI-driven defenses and develop the skills needed to address the emerging risks and opportunities presented by generative AI.”

Security staffing shortages drove up breach costs
More than half of the organizations studied had severe or high-level staffing shortages last year and experienced significantly higher breach costs as a result ($5.74 million for high levels vs. $3.98 million for low levels or none). This comes at a time when organizations are racing to adopt generative AI (gen AI) technologies, which are expected to introduce new risks for security teams. In fact, according to a study from the IBM Institute for Business Value, 51% of business leaders surveyed were concerned with unpredictable risks and new security vulnerabilities arising, and 47% were concerned with new attacks targeting AI.

Mounting staffing challenges may soon see relief, as more organizations stated that they are planning to increase security budgets compared to last year (63% vs. 51%), and employee training emerged as a top planned investment area. Organizations also plan to invest in incident response planning and testing, threat detection and response technologies (e.g., SIEM, SOAR and EDR), identity and access management and data security protection tools.  

Hacking the clock with AI
The report found that 67% of organizations deployed security AI and automation – a near 10% jump from the prior year – and 20% stated they used some form of gen AI security tools. Organizations that employed security AI and automation extensively detected and contained an incident, on average, 98 days faster than organizations not using these technologies. At the same time, the global average data breach lifecycle hit a 7-year low of 258 days – down from 277 days the prior year and revealing that these technologies may be helping put time back on defenders’ side by improving threat mitigation and remediation activities.

Shorter breach lifecycles can also be attributed to the increase in internal detection: 42% of breaches were detected by an organization’s own security team or tools compared to 33% the prior year. Internal detection shortened the data breach lifecycle by 61 days and saved organizations nearly $1 million in breach costs compared to those disclosed by an attacker.

Data insecurities fuel intellectual property theft
According to the 2024 report, 40% of breaches involved data stored across multiple environments and more than one-third of breaches involved shadow data (data stored in unmanaged data sources), highlighting the growing challenge with tracking and safeguarding data.

These data visibility gaps contributed to the sharp rise (27%) in intellectual property (IP) theft. Costs associated with these stolen records also jumped nearly 11% from the prior year to $173 per record. IP may grow even more accessible as gen AI initiatives push this data and other highly proprietary data closer to the surface. With critical data becoming more dynamic and active across environments, businesses will need to reassess the security and access controls surrounding it.

Other key findings in the 2024 Cost of a Data Breach Report include:

• Stolen credentials topped initial attack vectors – At 16%, stolen/compromised credentials was the most common initial attack vector. These breaches also took the longest to identity and contain at nearly 10 months.
• Fewer ransoms paid when law enforcement is engaged – By bringing in law enforcement, ransomware victims saved on average nearly $1 million in breach costs compared to those who didn’t – that savings excludes the ransom payment for those that paid. Most ransomware victims (63%) who involved law enforcement were also able to avoid paying a ransom.
• Critical infrastructure organizations see highest breach costs – Healthcare, financial services, industrial, technology and energy organizations incurred the highest breach costs across industries. For the 14^th year in a row, healthcare participants saw the costliest breaches across industries with average breach costs reaching $9.77 million.
• Breach costs passed to consumers – Sixty-three percent of organizations stated they would increase the cost of goods or services because of the breach this year – a slight increase from last year (57%) – this marks the third consecutive year that the majority of studied organizations stated they would take this action.

Additional Sources

• Download a copy of the 2024 Cost of a Data Breach Report.
• Sign up for the 2024 IBM Security Cost of a Data Breach webinar on Tuesday, August 13, 2024, at 11:00 a.m. ET.
• Read more about the report’s top findings in this IBM Security Intelligence blog.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post IBM Report: Escalating Data Breach Disruption Pushes Costs to New Highs first appeared on AI-Tech Park.

Saviynt, a leading provider of cloud-native identity and governance platform solutions, today announced a collaboration with Ernst & Young LLP (EY) to manage robust third-party identities, as well as simplify the administration of external staff throughout the entire identity lifecycle.

“The ability for an organization to interface with a third-party entity is important for many of our clients. They rely on external workers to provide supplies, services, and other functions critical to our client’s business,” said Sam Tang, EY’s Digital Identity Leader. “We believe the combination of Saviynt’s Identity Cloud technical solution and EY’s experience will help clients meet their identity and access management (IAM) needs. It will also potentially reduce cost, simplify and streamline operations, and turn IAM into a true business enabler.”

EY’s extensive IAM consulting experience provides a deep understanding of its clients’ needs and strategies with innovative IAM solution design. Saviynt’s technology is posed to solve those current challenges, while also keeping the future in mind, and developing solutions that can flex to accommodate future requirements and industry innovations with relative ease.

This collaboration between Saviynt and EY will enable clients to simplify the on-boarding and administration of external workforce, suppliers and other external user relationships, while also improving the user experience and risk management of the organizations that implement this solution. It will also provide:

• A delegated on-boarding workflow: Enabling external organizations to manage users directly, reducing operational costs and administrative labor.
• An integration with online identity proofing vendors: Saviynt’s external user management function helps to improve the trust clients have in who external users are and what risks they may bring to their organization.
• Control over external users and their access: The Identity Cloud platform by Saviynt will directly manage the on-boarding and full access lifecycle of external identities seamlessly for enterprise users.
• Incorporation of identity and organizational risk into access decisions: This fills a significant gap in current commercial tools and enables a risk-based approach to external user access management.
• Better insight into off-boarding of external users

“The industry has historically lacked effective tools to manage external users and their access, and many suboptimal homegrown solutions have been created in the process,” said Paul Zolfaghari, President at Saviynt. “Saviynt’s answer for managing these external identities will greatly improve the administration of this critical user community throughout its entire lifecycle.”

Watch Saviynt and EY’s Part 1 webinar that aired on June 13th to learn how the joint identity-level approach can transform operations, protect the business, and power an organization’s supply chain. Part 2 of the webinar series will take place on July 18th at 11 a.m. ET / 8 a.m. PT to learn how to empower threat resistance and reaction through an identity-based architecture.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!

The post Saviynt Expands Capabilities with EY Alliance first appeared on AI-Tech Park.