Incident Response Is Paying for Identity Data Now
Identity spend competes with other identity spend and loses. The answers that stall an investigation are identity answers, and IR is measured on them.
Blog
Posts from the Hydden team on AI agent, non-human identity and identity security.
Featured
The MTTR Clock Starts Too Late
In an identity-originated incident the causal event is an authorization change made months before any sensor fires. MTTR starts at detection, so it leaves out the only interval in which the incident was still preventable.
Why Access Reviews at Banks Fail an Audit
Banks have the most mature identity governance deployments of any industry, and their auditors still come back saying the list of accounts is incomplete.
All posts
Showing 1 to 9 of 68 posts
Whatever You Call an AI Agent, It Runs as an Identity
Every team defines AI agents differently, but every agent runs as an identity with access. That identity can be inventoried, given an owner and governed like any other account.
The MTTR Clock Starts Too Late
In an identity-originated incident the causal event is an authorization change made months before any sensor fires. MTTR starts at detection, so it leaves out the only interval in which the incident was still preventable.
The Missing Context Layer in Identity
Access changes between the systems that approve it and the systems that watch for misuse. An identity system of record that keeps the grant history of every human, non-human and AI agent account is the context layer that fills that middle.
Incident Response Is Paying for Identity Data Now
Identity spend competes with other identity spend and loses. The answers that stall an investigation are identity answers, and IR is measured on them.
Why One Identity Question Takes Two Days to Answer
Identity answers get assembled by hand while the clock runs. Audit preparation stalls on the same three questions, and DORA measures the deadline in hours.
Why Access Reviews at Banks Fail an Audit
Banks have the most mature identity governance deployments of any industry, and their auditors still come back saying the list of accounts is incomplete.
Your SOC Cannot Close an Identity Alert Without the IAM Team
An identity alert gives an analyst a name and almost nothing else. Every question that decides whether it matters lives in another team's system.
IGA, PAM and IdP Are Not the System of Record
IGA, PAM and the IdP are each the authority in their own category. None of them can hold every identity. Here is why the record has to live outside those tools.
The Identities Your HRIS, IdP, IGA and PAM Never See
Your HRIS says she left Tuesday. IGA disabled her Thursday and the review came back clean. She can still SSH to the jump host. Nothing keeps the whole story.
Also see use cases, news and product updates.
See Hydden on your own identities
Request a trial, or talk to the team about AI agent and non-human identity security.