Our insights
Research and perspectives on identity, access and the security decisions that matter most.
- Latest thinking
- Identity by the numbers
- Chart of the Week
- Explore by topic
- All insights
- Engineering notebook
Latest thinking
Identity is the new perimeter. The 2026 breach data proves it.
October 6, 2026 - Four of the year's most respected threat reports point the same way: attackers would rather sign in than break in. Here is what that means for every security budget.
Every bill you pay on your phone is an identity decision
September 29, 2026 - If you have ever logged in to a telecom app to pay a bill or check your account, you have used the kind of system we build. Here is why that sign-in screen has become one of the most attacked doors in consumer technology.
Passkeys passed the tipping point. Now comes the hard part.
September 22, 2026 - Billions of passkeys exist and most consumers know what they are. The remaining work sits inside enterprises still relying on phishable sign-in.
NIST SP 800-63-4 in five changes
The updated US digital identity guidelines rewrite long-held password rules and raise the bar on phishing resistance. A short guide for architects.
Agentic AI needs an identity strategy before it needs a model strategy
AI agents act on behalf of people and systems. Who they are, what they may touch and how they are audited are identity questions first.
Friction, fraud and the customer at the login screen
Every extra step at sign-in costs conversions. Every missing step invites fraud. The data on where to draw the line.
Twenty-nine minutes: how fast attackers move once they are in
Breakout time keeps shrinking. Identity telemetry is the fastest signal defenders have.
Identity by the numbers
of breaches involve the use of stolen credentials.
Verizon, 2026 Data Breach Investigations Reportof intrusion detections were malware-free, using valid credentials and trusted identity flows.
CrowdStrike, 2026 Global Threat Report findingsis the global average cost of a data breach, a record high.
IBM, Cost of a Data Breach Report 2026machine identities, including AI agents, for every human identity.
Palo Alto Networks, 2026 Identity Security Landscapepasskeys are estimated to be in use worldwide.
FIDO Alliance, World Passkey Day 2026of UK account takeover cases in 2024 involved mobile phone accounts.
Cifas, Huge surge sees SIM swaps hit telco and mobile
Put the research to work
Talk with our architects about your identity roadmap.
Talk to our teamAll insights
- October 6, 2026Identity is the new perimeter. The 2026 breach data proves it.Report
- September 29, 2026Every bill you pay on your phone is an identity decisionArticle
- September 22, 2026Passkeys passed the tipping point. Now comes the hard part.Article
- September 15, 2026NIST SP 800-63-4 in five changesExplainer
- September 8, 2026Machine identities outnumber people 109 to 1Chart of the Week
- August 25, 2026Agentic AI needs an identity strategy before it needs a model strategyArticle
- August 11, 2026Friction, fraud and the customer at the login screenBrief
- July 28, 2026Twenty-nine minutes: how fast attackers move once they are inBrief
- December 22, 2016Introduction to the ForgeRock Dockerized stackEngineering
- March 13, 2015Welcome to the Indigo blogEngineering
From the engineering notebook
Introduction to the ForgeRock Dockerized stack
December 22, 2016 - How we packaged OpenAM, OpenDJ, OpenIDM and OpenIG into an automated, immutable Docker stack for rapid proofs of concept.
Welcome to the Indigo blog
March 13, 2015 - Our first post, with a few reference links we still recommend: OpenDJ indexes, SAML specifications and Oracle Identity Manager development notes.