A monthly, practitioner-level take on identity security: privileged access, identity governance and the questions around them, plus honest reviews of the tools.https://mikerauch.com/https://mikerauch.com/blog/okta-vs-ping-identity/https://mikerauch.com/blog/okta-vs-ping-identity/Okta vs. Ping: Okta suits cloud-first orgs that want pure SaaS. Ping suits complex, hybrid or regulated enterprises that need deployment control.Tue, 06 Oct 2026 00:00:00 GMTidentity-securityhttps://mikerauch.com/blog/user-access-reviews/https://mikerauch.com/blog/user-access-reviews/A user access review confirms each person's access is still appropriate. Why most become rubber stamps, and how to make reviewers' decisions count.Tue, 01 Sep 2026 00:00:00 GMTigagrchttps://mikerauch.com/reviews/beyondtrust-privileged-remote-access/https://mikerauch.com/reviews/beyondtrust-privileged-remote-access/A practitioner review of BeyondTrust Privileged Remote Access for OT: replacing VPNs and shared accounts for vendor and engineer remote access.Tue, 04 Aug 2026 00:00:00 GMTot-securitypamhttps://mikerauch.com/blog/what-is-ciem/https://mikerauch.com/blog/what-is-ciem/CIEM finds every cloud identity, works out what it can actually do, and trims unused permissions. How it works and how it fits with CNAPP, IGA and PAM.Tue, 07 Jul 2026 00:00:00 GMTcloud-securityidentity-securitypamhttps://mikerauch.com/reviews/cyberark-privileged-access-manager/https://mikerauch.com/reviews/cyberark-privileged-access-manager/A hands-on CyberArk PAM review: vaulting, session recording, JIT access, what it takes to run, and who should (and shouldn't) buy it.Tue, 02 Jun 2026 00:00:00 GMTpamidentity-securityhttps://mikerauch.com/blog/zero-standing-privileges/https://mikerauch.com/blog/zero-standing-privileges/Zero standing privileges means no account holds privilege until it's needed. What's realistic, where it breaks, and how to measure progress toward it.Tue, 05 May 2026 00:00:00 GMTpamidentity-securityhttps://mikerauch.com/blog/just-in-time-access/https://mikerauch.com/blog/just-in-time-access/Just-in-time access grants privileges only when needed and removes them after. Here's how it works, where it fits, and when you're ready for it.Tue, 07 Apr 2026 00:00:00 GMTpamidentity-securityhttps://mikerauch.com/blog/certificate-lifecycle-management/https://mikerauch.com/blog/certificate-lifecycle-management/Certificate lifecycle management covers discovery, issuance, deployment, monitoring, renewal and revocation. Here's how to get ready for 47-day TLS certs.Tue, 03 Mar 2026 00:00:00 GMTpkiidentity-securityhttps://mikerauch.com/blog/cbom-post-quantum-readiness/https://mikerauch.com/blog/cbom-post-quantum-readiness/A CBOM (cryptographic bill of materials) inventories where you use cryptography. It's the first step of PQC readiness. Here's how to build one.Tue, 03 Feb 2026 00:00:00 GMTpqcpkihttps://mikerauch.com/blog/iec-62443-for-identity/https://mikerauch.com/blog/iec-62443-for-identity/IEC 62443 secures industrial control systems. For identity teams, FR1 and FR2 set the bar: unique IDs, MFA by security level, and role-based use control.Tue, 06 Jan 2026 00:00:00 GMTot-securitygrcidentity-securityhttps://mikerauch.com/blog/it-ot-convergence/https://mikerauch.com/blog/it-ot-convergence/IT/OT convergence connects plant systems to business networks and the cloud. Here's what it changes for identity and access, and how to converge safely.Tue, 02 Dec 2025 00:00:00 GMTot-securityidentity-securitynetwork-securityhttps://mikerauch.com/blog/non-human-identities/https://mikerauch.com/blog/non-human-identities/Non-human identities are the service accounts, API keys, tokens, certificates and AI agents that act without a person. How to get them under control.Tue, 04 Nov 2025 00:00:00 GMTidentity-securityai-securitypamhttps://mikerauch.com/blog/ad-cs-attack-paths-esc1/https://mikerauch.com/blog/ad-cs-attack-paths-esc1/ESC1 is an AD CS template misconfiguration that lets any domain user get a certificate as anyone, including a domain admin. Here's how to fix it.Tue, 07 Oct 2025 00:00:00 GMTpkiidentity-securityhttps://mikerauch.com/blog/what-is-pki/https://mikerauch.com/blog/what-is-pki/PKI (public key infrastructure) is the CAs, certificates, keys and policies that let machines and people prove identity. Here's how it works in practice.Tue, 02 Sep 2025 00:00:00 GMTpkiot-securityidentity-securityhttps://mikerauch.com/blog/purdue-model-identity/https://mikerauch.com/blog/purdue-model-identity/The Purdue model splits OT networks into levels 0–5 plus an IDMZ. Here's what identity and access look like at each level, and why IT patterns break.Tue, 05 Aug 2025 00:00:00 GMTot-securitynetwork-securityidentity-securityhttps://mikerauch.com/blog/what-is-identity-governance-and-administration/https://mikerauch.com/blog/what-is-identity-governance-and-administration/IGA is how you decide who should have access, grant it, review it and prove it. What it does, how it differs from IAM and PAM, and how programs go wrong.Tue, 01 Jul 2025 00:00:00 GMTigaidentity-securitygrchttps://mikerauch.com/blog/what-is-itdr/https://mikerauch.com/blog/what-is-itdr/ITDR (identity threat detection and response) finds and stops attacks that abuse identities and the systems behind them, like AD and your IdP.Tue, 03 Jun 2025 00:00:00 GMTidentity-securitypamhttps://mikerauch.com/blog/what-is-ot-security/https://mikerauch.com/blog/what-is-ot-security/OT security protects the systems that run physical processes. What makes it different from IT security, and why identity is the place to start.Tue, 06 May 2025 00:00:00 GMTot-securityidentity-securityhttps://mikerauch.com/blog/cyberark-vs-beyondtrust-vs-delinea/https://mikerauch.com/blog/cyberark-vs-beyondtrust-vs-delinea/I've run all three PAM platforms in production. Here's where each one shines, where each one hurts, and how I'd choose between them.Tue, 01 Apr 2025 00:00:00 GMTpamhttps://mikerauch.com/blog/zero-trust-identity-pillar/https://mikerauch.com/blog/zero-trust-identity-pillar/Zero Trust identity in practice: the four technology pieces (PAM, access enforcement, IGA, ITDR), how they connect, where to start and how to measure it.Tue, 04 Mar 2025 00:00:00 GMTidentity-securitypamigahttps://mikerauch.com/blog/what-is-the-dark-web/https://mikerauch.com/blog/what-is-the-dark-web/A plain-English breakdown of the dark web, why your data is almost certainly on it, and the five things that actually make it useless to criminals.Tue, 04 Feb 2025 00:00:00 GMTidentity-securitycyber-resiliencehttps://mikerauch.com/blog/what-is-zero-trust/https://mikerauch.com/blog/what-is-zero-trust/Zero Trust in plain English: why "trust but verify" stopped working, the three principles that replaced it, and where to actually start.Tue, 07 Jan 2025 00:00:00 GMTnetwork-securityidentity-securityhttps://mikerauch.com/blog/insider-threats/https://mikerauch.com/blog/insider-threats/What is an insider threat? The three types, the warning signs to watch for, and the identity controls that limit what any insider can do.Tue, 03 Dec 2024 00:00:00 GMTidentity-securitypamhttps://mikerauch.com/blog/beyondtrust-password-safe/https://mikerauch.com/blog/beyondtrust-password-safe/What BeyondTrust Password Safe is and how it works: discovery, vaulting, rotation, credential injection, session management, Smart Rules and who it suits.Tue, 05 Nov 2024 00:00:00 GMTpamhttps://mikerauch.com/blog/what-is-cyberark/https://mikerauch.com/blog/what-is-cyberark/What CyberArk is, what it does, its product lineup from PAM to machine identity, who uses it, and the trade-offs to know before you buy.Tue, 01 Oct 2024 00:00:00 GMTpamhttps://mikerauch.com/blog/common-cyber-threats/https://mikerauch.com/blog/common-cyber-threats/The types of cyber threats most people actually face, from phishing and ransomware to SIM swapping, and the simple habits that stop most of them.Tue, 03 Sep 2024 00:00:00 GMTcyber-resilienceidentity-securityhttps://mikerauch.com/blog/what-is-privileged-access-management/https://mikerauch.com/blog/what-is-privileged-access-management/Privileged accounts are the keys attackers want most. What PAM is, how it works, and the core capabilities every PAM program needs.Tue, 06 Aug 2024 00:00:00 GMTpamhttps://mikerauch.com/blog/what-is-identity-and-access-management/https://mikerauch.com/blog/what-is-identity-and-access-management/What is IAM? The building blocks of identity and access management, from authentication to provisioning and governance, and why they matter.Tue, 02 Jul 2024 00:00:00 GMTidentity-securityiga