Smallstep

Missed our webinar last week? The recording is live! 🎥 Zero Trust taught us to verify every user. Passwords, MFA, presence checks... we've gotten really good at proving who someone is. 🔐 But the device on the other end? Most of the time, it's still taken at face value. That's the missing half of Zero Trust. In Device Identity Is Still the Missing Half of Zero Trust, Ted Malone and Andy Mast kept the slides short and went straight to three live demos: 🎬 🔏 Hardware-signed Git commits: proof that a commit came from a trusted company device, not just someone with the right login. Change the commit and the signature breaks. 🖥️ SSH access to a cloud VM: the server is open to anyone, but only devices in your trusted inventory can actually get in. 📶 Certificate-based Wi-Fi: no shared password to leak. The credential lives in the device's TPM, Intune pushes the profile, and there's nothing for the user to set up. Plus answers to the questions we hear most from customers, like bringing your own RADIUS, VLAN tagging, and what happens when someone leaves. 🙋 👉 Watch the full recording here! https://hubs.ly/Q04CNzLD0

Forget haunted houses. The real IT horror story starts with: "Hey, I think I clicked something I shouldn't have..." At 4:59 PM. On a Friday. Right before Halloween. 😑 And suddenly, your entire security team has weekend plans they didn't ask for. 💀 Phishing attacks, stolen credentials, and compromised sessions are scary enough. The real nightmare is when those credentials are all an attacker needs to get in. Here's to fewer phishing nightmares and more phishing-resistant security. 🔐 Happy Halloween from Smallstep! 🎃🐈⬛ #Halloween #Cybersecurity #ITHumor #Phishing #DeviceIdentity

Quick gut check: if someone stole a developer's credentials tomorrow, could you tell whether their next commit came from their laptop or someone else's? 🤔 That's the kind of question we're answering at our next webinar, Device Identity Is Still the Missing Half of Zero Trust, happening Tuesday, October 27 at 12 PM ET. Ted Malone, VP of Strategy and GTM, and Andy Mast, Customer Success Manager, are skipping the slide marathon and doing two live demos: 🎬 🔐 Hardware-backed code signing: Ted will sign a commit with a key that lives in his developer machine's hardware and push it to GitHub, where it earns the "Verified" badge. Then he'll try the same thing from a machine that isn't trusted, so you can see the difference. 📶 Certificate-based Wi-Fi: Andy will move a Windows laptop from a regular network onto enterprise Wi-Fi that only lets in devices with a hardware-backed certificate, using an off-the-shelf router and Smallstep's hosted RADIUS. Plus live Q&A, so bring your questions! 🙋 👉 Register for this webinar here! https://hubs.ly/Q04BL47p0 Can't make it, but still want to watch? We will send the recording out to all registrants after the webinar!

Here's a fun question to ask your team: when an AI agent calls one of your internal APIs, whose credentials is it using? 🤖 One security team we talked to this year put it well: agents need their own scoped, time-limited credentials, not ones inherited from the employees who set them up. Most AI agents today authenticate with OAuth tokens and API keys, which are basically passwords for APIs. They aren't going away anytime soon, but they shouldn't be the only thing standing between an agent and your data. Smallstep gives AI agents, MCP clients, and MCP servers their own certificate-based identity, backed by the hardware they run on, so you can prove what is actually making a request and where it's running. When access also requires that certificate, a stolen token on its own isn't enough. We've been calling it MFA for AI! 🔐 👉 Learn more about MFA for AI here! https://hubs.ly/Q04Bzs610

Public TLS certificates used to last 398 days. As of this year, the max is 200, and it keeps dropping from here. ⏰ March 2027: 100 days March 2029: 47 days That’s the browser world’s rulebook for public websites, but the message applies to every certificate you run: shorter lifetimes are the new normal, and manual renewals don’t scale. Think about the private certificates inside your company. The ones on your laptops, Wi-Fi, VPN, internal apps, and servers. A lot of them were issued years ago, last for years, and get renewed (if at all) by someone opening a ticket and hoping they remembered. 😬 That’s where Smallstep comes in. We run your private CA and automate it with ACME, the same protocol behind Let’s Encrypt, so internal certificates can be short-lived and renew in the background without anyone having to think about it. Public certs are getting shorter because shorter is safer. Your internal ones can get there too. 👇🏼 Click below to learn how to automate your internal certificates! 👇🏼 https://hubs.ly/Q04zblJs0

Our 2026 Device Identity Webinar Series is wrapping up, and we saved some of the best conversations for last! 🎙️ Next up on Tuesday, October 27 at 9am PT / 12 PM ET: Device Identity Is Still the Missing Half of Zero Trust 🔐 Zero Trust changed how we think about user identity. We added MFA, SSO, and conditional access, but the device on the other end of the request is still often taken at face value. MFA can verify who is asking for access. MDM can tell you a device is managed. But neither one gives you cryptographic proof of the device actually making the request. That's the missing half. 👀 Ted Malone, VP of Strategy and GTM and Andy Mast, Customer Success Manager will walk through: ✅ Why user identity and device posture aren't the same as device identity ✅ How stolen credentials get more dangerous when they can be used from an unverified device ✅ How hardware attestation and hardware-bound credentials prove a device is who it says it is ✅ How to carry device trust into access decisions across Wi-Fi, SSH, internal apps, and more Can't make it? The series wraps on November 17 with "PKI is not Legacy, but the Way You're Running It Might Be," and our AI agents session is available on-demand now. 👉 Register for our October 27th webinar here! https://hubs.ly/Q04zbT1W0 👉 Check out the rest of the Device Identity Webinar series here! https://hubs.ly/Q04zbT3x0

Your MFA might be airtight, but the session cookie it hands out afterward usually isn't. 🍪 Here's something that doesn't get talked about enough: once a user finishes signing in, the browser gets a session cookie that isn't tied to the device that earned it. Infostealer malware doesn't bother trying to beat your MFA. It just copies that cookie and replays it from somewhere else. One team we work with tried to solve this by shortening SSO sessions to a single day. It worked, but it meant everyone at the company (CEO included!) had to log in again every morning. 😩 What they landed on instead was tying the session to a hardware-bound certificate that never leaves the laptop. Steal the cookie and you still don't have the device. They went from daily logins to weekly ones and ended up more secure than before. Better security and fewer logins. That's a trade everyone can get behind! 👉 Learn how device identity works with Okta and Entra here! https://hubs.ly/Q04yLhpR0

Two weeks ago in Kansas City, our CTO Josh Drake took the Spotlight Theater stage for "More Lessons from the Titans of Tech: A proprietor's guide to Device and Agentic Identity." 🎤 Last year at JNUC, we looked at how some of the world's leading tech companies approach device identity. This year, Josh took those lessons into the age of AI, where a trusted device is only the beginning. 🤖 The big idea: trust has to follow the whole chain, from the human who authorizes an action, to the device they're on, to the workload and AI agent that actually carries it out. Josh walked through practical best practices and showed how Jamf and Smallstep establish hardware-backed trust for the devices and the AI systems running on them. 🔐 Thank you to everyone who stopped by the Spotlight Theater, and to our friends at Jamf for having us back for another great year! 💙 Missed it? Check out the recording here!👇🏼 https://hubs.ly/Q04zch8q0

Quick question: how many MDMs is your company running right now? 🤔 If the answer is one, you're in the minority. Most teams we talk to have Jamf managing their Macs, Intune on Windows, and something else covering Linux and mobile. Consolidating all of that is a big project. One security team told us recently it's at least two years away for them, since it would mean replacing both Jamf and Intune. That's completely fine, but your device identity strategy shouldn't have to wait two years too. Smallstep syncs device inventory from every MDM you use into one trusted list, and only the devices on that list get hardware-bound certificates. Wi-Fi, VPN, SSO and SSH all follow the same policy no matter which MDM enrolled the device. And if you switch MDMs down the road, nothing else has to change! 🙌 👇🏼 Click below to see how Smallstep works across every MDM! 👇🏼 https://hubs.ly/Q04yLgRP0