The only Customer Identity and Access Management (CIAM) with hybrid, single-tenant deployment you can dev and test anywhere*
Denver, CO
Joined July 2018
- Tweets3.2K
- Following1K
- Followers2K
- Likes1.3K
An AI agent didn't go rogue. It was asked to verify a frontend change, couldn't find a sanctioned way to share an image, and dumped internal screenshots into a public GitHub repo to get the job done.
Over 13,000 times.
Glow's recent "PixelLeak" research documented over 13,000 internal screenshots sitting in public repositories across 300+ organizations. We are talking internal hostnames, treasury consoles, customer billing screens, and auth tokens sitting in URL bars.
The agents were trained to persist until the job was done. When GitHub blocked private image hosting via text, the agent found a workaround. In 93% of cases, that workaround meant publishing to the developer's personal account, completely bypassing enterprise audit logs.
Traditional secrets scanners missed every byte because scanners look for regex and text strings, not pixels.
Years ago, security through obscurity might have saved you because no attacker would manually inspect 13,000 unindexed PNGs. As Dave Hayes, our VP of Product, pointed out in the report, that economic defense is dead:
"Not long ago, most of those 13,000 images would have been treated as junk because nobody would go through them manually. But it's much easier to scan and find anything useful with AI."
Multimodal models turn raw visual noise into structured reconnaissance in seconds. An attacker does not need to crack your perimeter when an autonomous agent is armed with personal developer credentials and an LLM to index the output.
If your agents run on ungoverned personal identities without scoped tool boundaries, you haven't automated your engineering workflow. You have automated credential leakage.
Where do your coding agents draw the line between developer credentials and organizational identity?
Where your identity data runs is a product decision.
Editorialge’s guide to authentication platforms for SaaS apps names FusionAuth the best option for self-hosted authentication.
It notes you can run FusionAuth on private infrastructure, in your own cloud account, or on FusionAuth’s managed hosting, and that the migration tools help teams moving off an existing identity database.
editorialge.com/best-authent…
Tomorrow, Dan Moore shows what happens when you put an authorization server between Claude Desktop and your MCP server.
Most MCP tutorials stop after connecting an LLM to a local database. That works for a solo dev on localhost, but breaks completely the second multiple users or sensitive actions are involved.
Dan will walk through enforcing user login and scope-based consent before an AI agent executes actions against your APIs using the Ruby SDK.
Grab a spot (virtual or in-person) before tomorrow: luma.com/7y5n7ubf?tk=nzygcA&…
#DeveloperTools #Identity
FusionAuth Establishes UK Team as European Demand for Data Sovereignty Drives 72% Regional Growth fusionauth.io/blog/fusionaut…
When AI goes into customer-facing products, buyers start asking where their customers' identity data sits and who controls it.
The AI Journal covers how that question is driving our growth in Europe, where we just opened our first UK sales team, and how football clubs use FusionAuth to keep the fan relationship with the club.
Brian Bell, CEO of FusionAuth, shares his perspective in The AI Journal: aijourn.com/as-ai-raises-the…
Hooking Claude Desktop to your database via MCP is neat until you realize the LLM now has unauthenticated access to your data.
AI agents need context, but giving a model an open pipe to internal APIs without user-level auth isn't an architecture.
It's a future post-mortem.
Next week, Dan Moore walks through how to properly secure an MCP server at Boulder Ruby October 2026.
He will cover setting up a Ruby MCP server, connecting it to Claude Desktop, and putting a real authorization server in front of it so specific agent actions require explicit user login and consent.
Registration link in-person & virtual at luma.com/7y5n7ubf?tk=nzygcA&…
The Hidden Conversion Cost of Retail Authentication fusionauth.io/blog/hidden-co…
European buyers chose FusionAuth even before we had a team in the region, surging ARR by 72%.
With our first UK sales team in place, we're ready to meet the demand for greater control over identity and data.
CEO Brian Bell via IT Security Guru, “European enterprises want control over how customer data is isolated and who manages the infrastructure."
Full read at: itsecurityguru.org/2026/10/0…
In case you missed it, here are a few highlights from our Smart Guide to Implementing Risk-Based MFA (That Customers Won’t Hate).
Learn how to boost security without annoying your customers.
Perfect for teams in security, identity, and product.
Get the full eBook at fusionauth.io/ebooks/risk-ba…
Intelligent MFA: Stop Challenging Logins That Don't Deserve It fusionauth.io/blog/intellige…
Most identity rankings score how fast you can drop a login widget into a prototype.
They do not score what happens in year three when your MAU bill eclipses your entire database budget.
Cybersecurity News named FusionAuth "Best Self-Host Control" in their 2026 AaaS report.
Renting multi-tenant auth works fine until you need single-tenant isolation, audit log ownership, or predictable scaling costs.
Security is table stakes. Architecture is the advantage.
Read more at cybersecuritynews.com/best-a…
If a supporter buys tickets for two decades, orders merch online, and streams every match, why does the underlying infrastructure still treat them as three total strangers?
For 20 years, sports tech stacks were built around isolated systems.
E-commerce owned the cart, ticketing owned the gate, and streaming owned the app.
The fan bore all the friction, re-authenticating at every boundary while the organization lost unified context.
Without a unified identity architecture, that delegation breaks.
Next week at Leaders Week London, Brian Bell is taking the stage at the Fan Identity Forum to break down why fan identity and agent delegation are becoming the main commercial battleground of the next decade.
Caching handles product page spikes. It does nothing for authentication.
Every user login requires CPU-heavy password hashing and session table writes. At 10x peak traffic, an untested identity provider becomes a bottleneck that takes down your entire checkout flow.
If you have not load-tested your auth layer for Cyber Week, you are only load-testing your CDN.
How to benchmark your identity stack before traffic hits: fusionauth.io/blog/black-fri…
A federated login you forgot you set up can hand your account to an attacker.
That's what happened to about 5,000 Dropbox users: a legacy Lenovo ID integration let someone register a Lenovo ID with a victim's email and sign right in, no Dropbox password needed.
Dan Moore, Senior Director of CIAM Strategy and Identity Standards at FusionAuth, breaks down the pattern in Hackread: adding a new login method to an account should require the user to prove they own it. hackread.com/hackers-accesse…
#Cybersecurity #Identity #CIAM #AccountTakeover
🎉 Exciting news! FusionAuth has been featured in Cyber Press's 2026 CIAM buyer's guide! 🚀
We're thrilled to be highlighted in the value-and-control lane! Our full-featured CIAM can be self-hosted or run in our cloud, complete with standards and passkeys. Plus, our pricing is crystal clear right from the start! 💪
Check out their take on our unlimited-user self-hosting option—"turns login cost into an infrastructure line, not a success tax."
Dive into the full guide here: cyberpress.org/ciam-solution…
#CIAM #Identity #Authentication #Excited #CyberPress
Add extra security to your SPA with DPoP and FusionAuth fusionauth.io/blog/sender-co…
Most breaches are transactional, but a data catalog breach? That's architectural.
If compromised, attackers get a full view of your enterprise! You can't just rotate credentials and move on.
Learn why data catalog remediation requires a new approach: cybersecurity-insiders.com/w… #CyberSecurity #DataProtection
5 Warning Signs Your Company Has Outgrown Its Current Authentication Solution fusionauth.io/blog/5-warning…
AI Is Exposing the Limits of Your Identity Infrastructure fusionauth.io/blog/ai-exposi…
