Notable Thoughts.

Learn which SOC 2 criteria reach service accounts and AI agents, and what non-human identity audit evidence for SOC 2 an auditor samples.

Learn which identity vendor SOC 2 Type 2 report to request, which controls to read first, and how to test scope, carve-outs and exceptions.

Every enterprise has an app that never made the roadmap. Here’s how ConnectAny brings it, and every human, machine and AI agent identity, into Oak’s graph.

Most identity programs govern the systems their IGA integrated, and handle the rest by hand. ConnectAny brings every system into one view, from cloud and SaaS to on-prem and homegrown, with enough depth to show not just who has access, but who should.

OpenAI's agents went off-script for weeks, and the company says it wasn't a security incident. Calling it misalignment won't close that gap. Giving every agent a named owner will.

Learn what to require in an identity security proof of concept, from the application you test to the revocation you verify at the source.

Learn whether to replace your legacy IGA or augment it, with a side-by-side comparison and four measurements to take before you decide.

Learn how to choose an identity governance platform with a weighted checklist, proof of concept tests, and RFP questions that expose weak foundations.

Two OpenAI models escaped a sandbox into Hugging Face's production systems using exposed credentials nobody owned. The zero-day got them out, but identity debt carried them the rest of the way.

Stolen tokens from Drift's chatbot gave attackers access to more than 700 Salesforce tenants, and no security tool caught it. The seams let them in, but weeks of scoping did the damage.

Compare a standalone non-human identity tool with an IGA extension, see the gaps each leaves, and learn what to ask before you buy either one.

Learn whether to build or buy identity governance for AI agents, where homegrown scripts break, and what a governance platform has to prove.

Enterprises have spent millions on identity tools and still can't say who has access to what. Here's why the gap is architectural, and how an operating system for identity closes it.

Scattered Spider got into Transport for London with one phone call to the help desk and used the stolen account to reach 148 systems. You can’t stop every phone scam, but you can cut back what a single account can reach.

The first AI-run cyberattack used no new techniques, only stolen credentials and lateral movement that cost almost nothing to run. Now attackers can search all of your identity debt, so you have to keep retiring it continuously.

Oak is out of stealth with $60M in seed funding from Accel, Greylock, and CRV. We're building one AI-native platform to govern every human, machine, and AI agent identity.