#analysis

SWI's Identity Compliance Calendar lists 82 dated regulatory obligations with an identity angle from January 2026 to December 2028, each tied to an official source. 44 were still ahead as of November 5, 2026. The busiest stretches are the turn of 2026 into 2027, with eight events in each quarter, and the last quarter of 2027, when the AI Act's biometric rules, the Cyber Resilience Act and mandatory EU wallet acceptance all land.

SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let admins require them, and 60% of apps with a documented SSO plan charge more for SSO. Here is what the matrix is and how to use it.

SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of them on VPNs, gateways and remote-access tools rather than identity products, and the median exploited CVE reached KEV 5 days after disclosure.

SWI's Identity Funding Report 2026 records 101 identity-security funding rounds from January 2025 to October 2026. 49 of 99 equity rounds targeted AI agents or non-human identities, yet agent-focused seeds and Series A rounds are the same size as everyone else's. What the dataset is and how to use it.

October 2026 in identity came down to three things: exploited VPN and remote-access appliances on CISA KEV, stolen tokens and secrets in developer and AI tooling, and attackers who talked or replayed their way past MFA. Here is the month from SWI's coverage, plus our new research and what to watch in November.

SWI's Agent Identity Standards Map 2026 dates the status of 70 specifications for AI agent authentication, delegation and authorization. Most of the problem is buildable on published OAuth and workload standards. The parts that make agents different, from delegation chains to an owner registry, are still drafts or nothing at all.

SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and in 2025-2026, 20 of 43 breaches abused a path with no login for MFA to protect at all.

SWI's Identity Consolidation Report 2026 reads 63 identity acquisitions against the ownership of 297 tracked vendors. Identity companies make most of the deals; security, IT and data platforms pay almost all of the money. Five AI-agent identity vendors were bought in 87 days, and 67% of the market is still independent.

SWI's Identity Pricing Transparency Index 2026 classified the pricing of 295 identity vendors on sale on October 30, 2026. 79 publish a price for any paid tier, 158 are quote-only, and the market scores 38 out of 100. Who the vendor sells to predicts transparency better than what it sells.

ASOS and Dexcom both traced October breaches to people being talked into access, and India will show a network-asserted caller name on calls from November 1. None of it changes the core problem: an MFA reset issues a new credential, so the help desk decides who gets one. How to verify callers with proof instead of knowledge, and why the passkey migration will test it.

Public TLS certificates are already capped at 200 days. On March 15, 2027 the cap falls to 100 days, and Chrome's root program stops accepting new public certificates that also carry client authentication, which quietly breaks mTLS setups built on public CAs. Why that date, not 2029, is the one to plan around, and the order to automate in.

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, writes authentication and secure defaults into law for products sold in the EU, and lists identity management, PAM and password managers as important products. Its reporting duty started on 11 September 2026. What it asks of teams that buy identity products and teams that build them, and what to do before December 2027.

Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest way to become useful there is to learn the lifecycle end to end, from HR record to the last application, and then the protocols that carry it. A plan for help desk, sysadmin and developer crossovers.

Most AI agents in production today run on a borrowed identity: the developer's session or a shared cloud role. October's Copilot CLI and AgentCore research shows what that costs. The fix is an identity per agent, scoped to its task, with the human carried in the token through RFC 8693 delegation.

October is Cybersecurity Awareness Month. Instead of another poster, here are seven identity habits for every team, each traced to something that actually happened this month: a phone call to a medical device maker, a fake AI ad portal, a national register allegedly opened with 123456, and a VPN password reused once too often.

SCIM 2.0 is a decade old and the create path works almost everywhere. The failures that leave access behind sit in deactivation, group membership and PATCH, where RFC 7643 and 7644 leave room for two correct implementations to disagree. What breaks, why, and a test plan for the leaver path.

Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A patch closes the door, but the passwords, keys and certificates that walked out stay valid until you rotate them.

FIDO's Passkey Index 2026 says 36% of successful sign-ins at 15 consumer services now use a passkey, and that passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA. The finding that should change your rollout plan is smaller: enrolled users still get routed to the password.

A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, and two coding agents talked into handing over credentials. In October 2026 the credentials that mattered were publishing tokens, CI secrets and agent roles, not user passwords.

Just over half of the identity podcasts we track are made by vendors, and most of the rest have a commercial tie somewhere. That does not make them bad. It does mean you should know who is paying before you take the advice. Five questions to ask of any show, and how we label them.

A spraying campaign that only worked on functional accounts, a service principal secret in a GitHub issue, an email address that commits code, a public database key with no authorization behind it, and a leaver's token kept alive on purpose. None needed a new exploit. All of them were credentials no person was accountable for.

Cisco FMC, Cisco ISE, N-able N-central and an unnamed security product at Bitget were all exploited in September 2026. Each one held credentials or authority that other systems trust. Patching them is necessary; treating the compromise as an identity incident is what actually ends it.

Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and the new federal front door runs on Login.gov. Here is how to plan the move off SMS without creating a new weak point in recovery.

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

Regulation (EU) 2024/1183 anchors national EUDI Wallet availability to 24 December 2026. Most coverage treats this as a public sector milestone. The obligations that will surprise people fall on relying parties.

Three research teams broke passkey guarantees in August 2026 without touching WebAuthn. The weak points were event logs, sync key custody, and in-session key reuse. Here is what actually changed for your rollout.