FusionAuth

The only Customer Identity and Access Management (CIAM) with hybrid, single-tenant deployment you can dev and test anywhere*

[FusionAuth @FusionAuth]

If unmoderated user input can trigger execution before moderation happens, your security boundary does not exist.

Treating "preview" like "approved" is how a calendar plugin pops a root shell on your server. It's the software equivalent of opening an uninspected package inside the server room to read the packing slip.

If that package contains an exploit payload, reading it inside the secure perimeter already compromised the environment.

In an analysis for Cybersecurity Insiders, Dan Moore breaks down where teams go wrong and how to fix the pattern:

- Validate in the execution path, not in a parallel routine next to it.
- Use strict structural allowlists instead of attempting to sanitize bad input.
- Keep preview pipelines completely isolated from privileged backend actions.

Read Dan's full architectural breakdown on Cybersecurity Insiders: https://t.co/oi4WSeuXnP

[FusionAuth @FusionAuth]

Token Exchange https://t.co/GfriiMq1lp

[FusionAuth @FusionAuth]

Consumer retail is unique. It's one of the few industries where infrastructure success is directly penalized by your identity vendor's pricing model.

You run a massive holiday campaign, get a huge spike in active users, and can immediately blow your CIAM budget if it's based on MAUs or SSO thresholds.

It is a success tax.

Beyond the billing model, retail authentication can also become an architectural nightmare.

Today's product requirements involve connecting legacy mainframes, modern frontends, and most likely, an external loyalty database (that has not been updated since 2018).

Trying to bolt a generic multi-tenant SaaS identity provider onto that mess usually results in brittle integrations, weird user loops, and lost checkouts.

If your CIAM platform dictates your schema or forces you into their cloud, you don't really own your customer identity layer.

You're renting it.

We documented the exact architectural requirements retail engineering teams need to handle peak load, maintain deployment control, and bypass the MAU tax entirely.

Get the technical blueprint here: https://t.co/i7shqvdCNf

[FusionAuth @FusionAuth]

Ever tried explaining an account takeover to a five-year-old?

Well, we’ve got the perfect solution. Introducing our new coloring book for product & marketing teams, because nothing says “secure your identity architecture” like crayons and creativity.

Picture this: A user logs in from London, decides to reset their password just three minutes later from Seattle. No need for an AI wizard to flag this one; you just need a smart identity provider.

With FusionAuth’s intelligent MFA, we evaluate signals like impossible travel and unrecognized devices in the background. It's like having a digital watchdog that never sleeps!

Ready to get coloring? Download the PDF: https://t.co/W1zt14uFxi

#CyberSecurity #IdentityManagement #ColoringBookFun #MFA #DigitalSafety

[FusionAuth @FusionAuth]

Excited to have our talented engineers at #AGNTCon + #MCPCon in San Jose this week.

If you’re attending, let’s connect and talk about machine identity architecture.

Drop a comment or DM us!

https://t.co/Km1RRAb1wD

#MachineIdentity #Innovation #Networking

[FusionAuth @FusionAuth]

An AI agent didn't go rogue. It was asked to verify a frontend change, couldn't find a sanctioned way to share an image, and dumped internal screenshots into a public GitHub repo to get the job done.

Over 13,000 times.

Glow's recent "PixelLeak" research documented over 13,000 internal screenshots sitting in public repositories across 300+ organizations. We are talking internal hostnames, treasury consoles, customer billing screens, and auth tokens sitting in URL bars.

The agents were trained to persist until the job was done. When GitHub blocked private image hosting via text, the agent found a workaround. In 93% of cases, that workaround meant publishing to the developer's personal account, completely bypassing enterprise audit logs.

Traditional secrets scanners missed every byte because scanners look for regex and text strings, not pixels.

Years ago, security through obscurity might have saved you because no attacker would manually inspect 13,000 unindexed PNGs. As Dave Hayes, our VP of Product, pointed out in the report, that economic defense is dead:

"Not long ago, most of those 13,000 images would have been treated as junk because nobody would go through them manually. But it's much easier to scan and find anything useful with AI."

Multimodal models turn raw visual noise into structured reconnaissance in seconds. An attacker does not need to crack your perimeter when an autonomous agent is armed with personal developer credentials and an LLM to index the output.

If your agents run on ungoverned personal identities without scoped tool boundaries, you haven't automated your engineering workflow. You have automated credential leakage.

Where do your coding agents draw the line between developer credentials and organizational identity?

[FusionAuth @FusionAuth]

Where your identity data runs is a product decision.

Editorialge’s guide to authentication platforms for SaaS apps names FusionAuth the best option for self-hosted authentication.

It notes you can run FusionAuth on private infrastructure, in your own cloud account, or on FusionAuth’s managed hosting, and that the migration tools help teams moving off an existing identity database.

https://t.co/wlBQ91SVO8

[FusionAuth @FusionAuth]

Tomorrow, Dan Moore shows what happens when you put an authorization server between Claude Desktop and your MCP server.

Most MCP tutorials stop after connecting an LLM to a local database. That works for a solo dev on localhost, but breaks completely the second multiple users or sensitive actions are involved.

Dan will walk through enforcing user login and scope-based consent before an AI agent executes actions against your APIs using the Ruby SDK.

Grab a spot (virtual or in-person) before tomorrow: https://t.co/pZg4KfZv2H

#DeveloperTools #Identity

[FusionAuth @FusionAuth]

FusionAuth Establishes UK Team as European Demand for Data Sovereignty Drives 72% Regional Growth https://t.co/NcfEOAyV5X

[FusionAuth @FusionAuth]

Monktoberfest: A Conference I Love https://t.co/8dNZGQhhL5

[FusionAuth @FusionAuth]

When AI goes into customer-facing products, buyers start asking where their customers' identity data sits and who controls it.

The AI Journal covers how that question is driving our growth in Europe, where we just opened our first UK sales team, and how football clubs use FusionAuth to keep the fan relationship with the club.

Brian Bell, CEO of FusionAuth, shares his perspective in The AI Journal: https://t.co/TiLAh0TVSC

[FusionAuth @FusionAuth]

Hooking Claude Desktop to your database via MCP is neat until you realize the LLM now has unauthenticated access to your data.

AI agents need context, but giving a model an open pipe to internal APIs without user-level auth isn't an architecture.

It's a future post-mortem.

Next week, Dan Moore walks through how to properly secure an MCP server at Boulder Ruby October 2026.

He will cover setting up a Ruby MCP server, connecting it to Claude Desktop, and putting a real authorization server in front of it so specific agent actions require explicit user login and consent.

Registration link in-person & virtual at https://t.co/pZg4KfZv2H

[FusionAuth @FusionAuth]

The Hidden Conversion Cost of Retail Authentication https://t.co/ZxT2OHz5DX

[FusionAuth @FusionAuth]

European buyers chose FusionAuth even before we had a team in the region, surging ARR by 72%.

With our first UK sales team in place, we're ready to meet the demand for greater control over identity and data.

CEO Brian Bell via IT Security Guru, “European enterprises want control over how customer data is isolated and who manages the infrastructure."

Full read at: https://t.co/8DOaEbjRv7

[FusionAuth @FusionAuth]

In case you missed it, here are a few highlights from our Smart Guide to Implementing Risk-Based MFA (That Customers Won’t Hate).

Learn how to boost security without annoying your customers.

Perfect for teams in security, identity, and product.

Get the full eBook at https://t.co/7IPTfffQYE

[FusionAuth @FusionAuth]

Intelligent MFA: Stop Challenging Logins That Don't Deserve It https://t.co/3FljbLXeyV

[FusionAuth @FusionAuth]

Most identity rankings score how fast you can drop a login widget into a prototype.

They do not score what happens in year three when your MAU bill eclipses your entire database budget.

Cybersecurity News named FusionAuth "Best Self-Host Control" in their 2026 AaaS report.

Renting multi-tenant auth works fine until you need single-tenant isolation, audit log ownership, or predictable scaling costs.

Security is table stakes. Architecture is the advantage.

Read more at https://t.co/NVVIlzNB6m

[FusionAuth @FusionAuth]

If a supporter buys tickets for two decades, orders merch online, and streams every match, why does the underlying infrastructure still treat them as three total strangers?

For 20 years, sports tech stacks were built around isolated systems.

E-commerce owned the cart, ticketing owned the gate, and streaming owned the app.

The fan bore all the friction, re-authenticating at every boundary while the organization lost unified context.

Without a unified identity architecture, that delegation breaks.

Next week at Leaders Week London, Brian Bell is taking the stage at the Fan Identity Forum to break down why fan identity and agent delegation are becoming the main commercial battleground of the next decade.

[FusionAuth @FusionAuth]

Caching handles product page spikes. It does nothing for authentication.

Every user login requires CPU-heavy password hashing and session table writes. At 10x peak traffic, an untested identity provider becomes a bottleneck that takes down your entire checkout flow.

If you have not load-tested your auth layer for Cyber Week, you are only load-testing your CDN.

How to benchmark your identity stack before traffic hits: https://t.co/pwdEzKpy2O

[FusionAuth @FusionAuth]

A federated login you forgot you set up can hand your account to an attacker.

That's what happened to about 5,000 Dropbox users: a legacy Lenovo ID integration let someone register a Lenovo ID with a victim's email and sign right in, no Dropbox password needed.

Dan Moore, Senior Director of CIAM Strategy and Identity Standards at FusionAuth, breaks down the pattern in Hackread: adding a new login method to an account should require the user to prove they own it. https://t.co/7evBGpCUXE

#Cybersecurity #Identity #CIAM #AccountTakeover