Glossary
The identity security glossary.
Plain-language definitions for the terms behind IAM, PAM, and identity governance — written by the team that builds them.
Identity & Access
Identity and Access Management (IAM)IAM is the framework of policies and technology that verifies who users are and controls what they can access across an organization.Read moreSingle Sign-On (SSO)SSO lets users authenticate once and access many applications without signing in again, using a trusted central identity provider.Read moreMulti-Factor Authentication (MFA)MFA requires two or more independent proofs of identity, such as a password plus a passkey or one-time code, before granting access.Read morePasswordless AuthenticationPasswordless authentication verifies users without any password, using passkeys, biometrics, security keys, or device-bound credentials instead.Read morePasskeys (FIDO2 / WebAuthn)Passkeys are phishing-resistant sign-in credentials based on FIDO2/WebAuthn public-key cryptography, unlocked with a fingerprint, face, or PIN.Read moreSAML (Security Assertion Markup Language)SAML is an XML-based standard that lets an identity provider pass signed authentication assertions to applications, enabling enterprise SSO.Read moreOpenID Connect (OIDC)OIDC is a modern identity layer on top of OAuth 2.0 that lets applications verify who a user is via signed JSON tokens from an identity provider.Read moreSCIM (System for Cross-domain Identity Management)SCIM is an open standard for automatically creating, updating, and deactivating user accounts across applications from a central identity source.Read moreAdaptive AuthenticationAdaptive authentication adjusts login requirements in real time based on risk signals like device, location, and behavior, stepping up only when needed.Read moreIdentity Provider (IdP)An identity provider is the central service that authenticates users and issues trusted tokens that applications rely on for sign-in.Read moreIdentity FederationIdentity federation lets separate organizations or systems trust one identity provider, so users sign in once and access resources across domain boundaries.Read moreOAuth 2.0OAuth 2.0 is the open standard for delegated authorization: it lets applications access resources on a user's behalf using tokens instead of shared passwords.Read moreAuthentication vs AuthorizationAuthentication verifies who a user is; authorization decides what that user may do. Every secure system needs both, in that order.Read moreDirectory ServiceA directory service is a centralized, hierarchical database of users, groups, and devices that applications query to authenticate people and look up attributes.Read moreActive Directory (AD)Active Directory is Microsoft's directory service for Windows domains, managing users, computers, and policies, and authenticating them with Kerberos and LDAP.Read moreLDAP (Lightweight Directory Access Protocol)LDAP is the standard protocol applications use to query directory services and verify credentials, powering authentication for countless enterprise systems.Read moreRADIUS (Remote Authentication Dial-In User Service)RADIUS is the network protocol that VPNs, Wi-Fi, firewalls, and switches use to authenticate users against a central server and authorize their network access.Read moreKerberosKerberos is a ticket-based network authentication protocol that lets users and services prove their identity without sending passwords over the network.Read moreJSON Web Token (JWT)A JWT is a compact, digitally signed token that carries identity claims as JSON, letting services verify who a request comes from without a database lookup.Read moreOne-Time Password (OTP / TOTP)A one-time password is a short code valid for a single login or transaction. TOTP, the most common form, generates time-based codes from a shared secret.Read moreIdentity OrchestrationIdentity orchestration coordinates multiple identity systems and login steps into unified, policy-driven journeys without rewriting applications.Read moreSocial LoginSocial login lets users sign in to an application with an existing account from providers like Google, Microsoft, or Apple instead of creating a new password.Read moreBiometric AuthenticationBiometric authentication verifies identity using physical traits such as fingerprints or facial features instead of passwords or codes.Read moreMagic Link AuthenticationMagic link authentication signs users in through a one-time link sent to their email, removing the need for a password entirely.Read moreSingle Logout (SLO)Single logout (SLO) ends a user's sessions across all connected applications at once when they sign out, closing the gap SSO leaves open.Read moreIdentity BrokerAn identity broker sits between applications and multiple identity providers, translating protocols so each side integrates only once.Read moreStep-Up AuthenticationStep-up authentication asks for a stronger verification factor only when a user attempts a sensitive action, instead of front-loading friction at login.Read moreDevice TrustDevice trust verifies that the device requesting access is known, managed, and healthy before granting entry, adding a second identity beside the user's.Read moreSession ManagementSession management controls how authenticated sessions are created, maintained, timed out, and revoked, keeping a login trustworthy after the password screen.Read moreRefresh TokenA refresh token is a long-lived credential used to obtain new access tokens silently, keeping users signed in without storing passwords or re-prompting.Read morePhishing-Resistant MFAPhishing-resistant MFA uses cryptographic, origin-bound authentication such as FIDO2 passkeys, so credentials cannot be captured or replayed by fake sites.Read moreIdentity Visibility and Intelligence Platform (IVIP)An identity visibility and intelligence platform (IVIP) builds a unified graph of every identity — human, machine and AI agent — and its effective access, so organizations can see, query and fix identity risk.Read moreIdentity Security Posture Management (ISPM)Identity security posture management (ISPM) is the continuous practice of finding and fixing static identity risks — MFA gaps, dormant accounts, excess privilege — before attackers exploit them.Read moreAD BridgingAD bridging extends an existing Active Directory to govern non-Windows systems — chiefly Linux and Unix — so users sign in with AD identities and AD groups drive access instead of local accounts.Read more
Privileged Access
Privileged Access Management (PAM)Privileged access management secures, controls and monitors accounts with elevated permissions to critical systems, reducing the risk of breach and misuse.Read moreJust-in-Time (JIT) AccessJust-in-time access grants privileges only when needed and for a limited time, eliminating standing access that attackers can exploit.Read morePrivileged Session RecordingPrivileged session recording captures video and keystrokes of administrative sessions, creating a searchable audit trail of what was done on critical systems.Read moreCredential VaultingCredential vaulting stores privileged passwords and keys in an encrypted, access-controlled repository instead of spreadsheets, scripts or memory.Read morePassword RotationPassword rotation automatically changes privileged passwords on a schedule or after each use, so stolen or leaked credentials quickly stop working.Read moreZero Standing Privilege (ZSP)Zero standing privilege means no account holds permanent admin rights; all elevated access is granted just in time and expires automatically.Read morePrinciple of Least Privilege (PoLP)The principle of least privilege gives every user, application and system only the minimum access needed to do its job, and nothing more.Read morePrivileged Session Management (PSM)Privileged session management brokers, monitors and controls administrative sessions to critical systems, from credential injection to live termination.Read moreSecrets ManagementSecrets management secures the passwords, API keys, tokens and certificates that applications and machines use to authenticate to each other.Read moreBreak-Glass AccountA break-glass account is a sealed emergency account used to regain access to critical systems when normal authentication or approval paths fail.Read moreBastion Host (Jump Server)A bastion host is a hardened gateway that admins must pass through to reach internal systems, concentrating remote access into one controlled, auditable point.Read moreService AccountA service account is a non-human identity that applications, scripts and services use to authenticate to systems — powerful, numerous and often poorly governed.Read moreSSH Key ManagementSSH key management is the discovery, control and rotation of the SSH keys that grant server access — credentials that never expire unless someone makes them.Read moreShared Account ManagementShared account management brings individual accountability to accounts used by multiple people — root, admin, emergency and application logins — via vaulting and check-out controls.Read moreCredential InjectionCredential injection logs users into target systems by inserting vaulted credentials directly into the session, so the user connects without ever seeing the password.Read morePrivileged Identity Management (PIM)Privileged identity management governs which identities hold elevated roles and when — activating admin rights on demand instead of leaving them permanently assigned.Read moreEndpoint Privilege Management (EPM)Endpoint privilege management removes local admin rights from workstations and elevates individual applications instead, enforcing least privilege on every endpoint.Read moreVendor Privileged Access Management (VPAM)Vendor privileged access management secures the remote admin access of contractors and third parties — time-limited, recorded and without VPNs or shared passwords.Read moreDatabase Access ManagementDatabase access management controls and audits privileged connections to databases, protecting the systems where sensitive data actually lives.Read morePAM vs Password ManagerPassword managers store individual logins for convenience; PAM governs shared and privileged credentials with brokered sessions, approvals and full audit trails.Read moreEmergency Access ManagementEmergency access management provides controlled, audited ways to obtain elevated access during incidents when normal approval channels are too slow or unavailable.Read moreSecure Remote AccessSecure remote access lets users and administrators reach internal systems from outside the network with strong authentication, least privilege, and full auditability.Read moreCertificate Lifecycle Management (CLM)Certificate lifecycle management (CLM) is the practice of discovering, inventorying, issuing, renewing, deploying and monitoring TLS and other X.509 certificates across an organization.Read moreDynamic Data Masking (DDM)Dynamic data masking (DDM) transforms sensitive values in query results on the fly, per user and policy, so people can work with databases without seeing regulated data — and without altering what is stored.Read moreDynamic SecretsDynamic secrets are credentials minted on demand for a specific client and purpose, valid only for a short lease, and automatically revoked when the lease expires.Read more
Governance
Identity Governance and Administration (IGA)IGA is the discipline of managing digital identities and access rights across systems, combining lifecycle automation with governance controls like access reviews.Read moreAccess Review (Access Certification)An access review is a periodic check where managers or system owners verify that each user still needs the access they hold, and revoke what they do not.Read moreSegregation of Duties (SoD)Segregation of duties splits critical tasks between people so no single person can both perform and conceal a sensitive action, reducing fraud and error risk.Read moreJoiner-Mover-Leaver (JML) ProcessJML is the process of granting, adjusting, and revoking access as employees join, change roles, and leave — the core of identity lifecycle management.Read moreIdentity Lifecycle ManagementIdentity lifecycle management governs a digital identity from creation to deletion, keeping accounts and access aligned with a person's current status and role.Read moreUser ProvisioningUser provisioning is the automated creation and configuration of user accounts and access rights across applications, driven by an authoritative source such as HR.Read moreDeprovisioningDeprovisioning is the timely removal of accounts, access rights, and sessions when a person leaves the organization or no longer needs them.Read moreAccess Request ManagementAccess request management is the governed workflow through which users request access to applications and entitlements, with approvals, policy checks, and fulfillment.Read moreEntitlement ManagementEntitlement management is the discipline of discovering, cataloging, and governing the fine-grained access rights users hold across applications and infrastructure.Read moreOrphaned AccountAn orphaned account is an active account in a system that no longer has a valid owner — typically left behind when an employee departs or a project ends.Read morePrivilege Creep (Access Creep)Privilege creep is the gradual accumulation of access rights as users change roles and keep old permissions, leaving them with far more access than they need.Read moreBirthright AccessBirthright access is the baseline set of accounts and permissions every user automatically receives on day one, based on attributes like department and role.Read moreRole MiningRole mining analyzes existing user permissions to discover natural groupings and propose roles, turning messy per-user access into a manageable role model.Read moreIdentity ReconciliationIdentity reconciliation compares accounts in target systems against authoritative identity data to find orphaned, rogue, and mismatched accounts and fix them.Read moreAudit Log (Audit Trail)An audit log is a tamper-evident, chronological record of who did what, when, and where in a system — the primary evidence for investigations and compliance.Read moreIdentity AnalyticsIdentity analytics applies data analysis to identity and access information to surface risky entitlements, anomalies, and cleanup opportunities across systems.Read more
Concepts
Zero Trust SecurityZero trust is a security model that trusts no user or device by default, verifying every access request based on identity, context, and risk.Read moreConditional AccessConditional access is a policy engine that decides whether to allow, block, or step up a sign-in based on context like user, device, location, and risk.Read moreMachine IdentityA machine identity is the credential set — certificates, keys, secrets, or accounts — that lets a device, workload, or application authenticate to other systems.Read moreNon-Human Identity (NHI)A non-human identity is any digital identity not tied to a person — service accounts, API keys, bots, workloads, and AI agents that authenticate and hold access.Read moreIdentity Threat Detection and Response (ITDR)ITDR is the practice of detecting and responding to attacks on identities — credential theft, account takeover, and privilege abuse — across identity systems.Read moreRole-Based Access Control (RBAC)RBAC grants access based on roles rather than individuals: permissions are attached to roles, and users receive access by being assigned to those roles.Read moreAttribute-Based Access Control (ABAC)ABAC makes access decisions by evaluating attributes of the user, the resource, the action, and the context against policies at the moment of the request.Read moreIdentity FabricAn identity fabric is an architecture that weaves an organization's identity tools into one consistent, composable layer serving every user, application, and environment.Read moreAI Agent IdentityAI agent identity is the practice of giving autonomous AI agents their own governed identities, credentials, and permissions instead of letting them act as anonymous code or borrowed users.Read moreWorkload IdentityWorkload identity gives applications, containers, and services verifiable identities of their own, so they authenticate with short-lived credentials instead of stored secrets.Read moreContinuous Access Evaluation (CAE)Continuous access evaluation re-checks access decisions during active sessions, so events like account disablement or a risk change take effect in near real time.Read moreZero Trust Network Access (ZTNA)ZTNA grants users access to specific applications — never the whole network — after verifying identity, device, and context on every connection.Read moreKerberoastingKerberoasting is an Active Directory attack that abuses Kerberos service tickets to crack service account passwords offline and gain elevated access.Read moreCredential StuffingCredential stuffing is an attack that replays username-password pairs leaked from one breach against many other sites, exploiting password reuse at scale.Read morePassword SprayingPassword spraying tries a few common passwords against many accounts, staying under lockout thresholds while hunting for the weakest users in an organization.Read moreBrute-Force AttackA brute-force attack tries password combinations systematically until one works, exploiting weak credentials and unprotected login endpoints.Read moreAccount Takeover (ATO)Account takeover is when an attacker gains control of a legitimate user account and operates it for fraud, data theft or further attacks.Read moreLateral MovementLateral movement is how attackers expand from one compromised system to others, reusing credentials and trust relationships to reach valuable targets.Read morePrivilege EscalationPrivilege escalation is gaining higher access rights than granted, turning a low-level foothold into administrative control of systems or the domain.Read morePass-the-Hash AttackPass-the-hash lets attackers authenticate with a stolen password hash instead of the password itself, enabling lateral movement across Windows networks.Read moreCredential TheftCredential theft is the stealing of passwords, keys, tokens and hashes that attackers then use to log in as legitimate users instead of breaking in.Read moreACME ProtocolACME (RFC 8555) is a protocol that automates domain validation, issuance and renewal of X.509 certificates, popularized by Let’s Encrypt and now an enterprise standard.Read moreCrypto-AgilityCrypto-agility is an organization’s ability to inventory, replace and upgrade cryptographic algorithms, keys and certificates quickly when an algorithm weakens or standards change.Read moreModel Context Protocol (MCP)The Model Context Protocol (MCP) is an open standard that lets AI applications and agents connect to external tools and data sources — and a new identity challenge for enterprises adopting it.Read moreAgentic AI SecurityAgentic AI security governs AI systems that plan and act autonomously — giving each agent an identity, an owner, least-privilege access, and audited, approvable tool calls.Read moreShadow AIShadow AI is the use of AI tools, assistants and agents by employees without IT or security approval — the AI-era version of shadow IT, and a growing source of ungoverned identities and data exposure.Read moreHuman-in-the-Loop (HITL)Human-in-the-loop (HITL) places a human decision gate before selected automated or AI actions — destructive agent calls pause until an accountable person approves, and unanswered requests fail closed.Read morePrompt InjectionPrompt injection hides adversarial instructions in content an AI processes — a page, e-mail or tool result — to override its operator’s intent; with tool-wielding agents, the stakes become real actions.Read more
Ready to start managing
identities the right way?
Spin up a fully-loaded trial tenant in under five minutes. No credit card. No sales gate.