November 2025 Summaries

For years, platforms have used identity-level impersonation for handling support requests, allowing admins to "log in as the user," but this practice poses significant security and compliance risks, as evidenced by incidents like the 2020 Twitter breach. Impersonation breaks the link between identity and accountability, complicating audit trails and violating frameworks such as SOC2, GDPR, HIPAA, and PCI DSS. Although operational convenience and legacy systems perpetuate this practice, a safer alternative is permission-level impersonation, where support agents retain their identity while receiving temporary, user-equivalent permissions. This approach, facilitated by tools like Ory Kratos, Ory Hydra, and Ory Keto, aligns with Zero Trust principles and ensures compliance by maintaining detailed, verifiable audit logs, thereby enhancing security without sacrificing efficiency in support workflows.

Spencer Kimball, CEO of Cockroach Labs, and Jeff Kukowski, CEO of Ory Corp, discuss the challenges and opportunities of rebuilding digital trust in an era dominated by autonomous AI agents. Unlike the traditional web scale era, where infrastructure was designed around predictable human interactions, today's AI-driven environment requires systems to handle massive and unpredictable machine-generated interactions. This shift necessitates a redefinition of trust and identity management, demanding infrastructure that can support a vast number of autonomous agents acting simultaneously and securely. Cockroach Labs and Ory Corp propose a model where Ory manages identity and access with precision, while CockroachDB provides a robust, globally-distributed data layer, ensuring resilience and compliance even under extreme conditions. As AI agents become the primary drivers of scale, businesses must pivot to architectures that can maintain security, resilience, and compliance, making identity and data locality core design dimensions. This approach not only addresses current demands but also positions companies to define the future of enterprise technology, emphasizing that resilience and trust are essential for scaling in the age of intelligent systems.

Developers often consider building custom authentication systems but may underestimate the complexity that arises as their products scale. Ory offers a compelling alternative with its open-source, security-first architecture that handles identity management, compliance, and evolving security threats, allowing developers to focus on core product development. Ory's modular components, such as Kratos for identity and Hydra for OAuth2, support scalability and extensibility without reinventing the wheel. By integrating seamlessly with modern DevOps tools and offering standards-compliant protocols, Ory ensures compliance and boosts developer velocity. The investment in Ory is not just cost-effective but also enhances security, scalability, and developer productivity, making it a preferred choice over custom solutions.

Ory has released version 25.4.0 of its open-source Identity and Access Management tools, including Ory Hydra, Kratos, Keto, and Oathkeeper, marking a significant advancement in open identity infrastructure. These updates introduce new capabilities such as agentic authentication for AI and IoT devices, passwordless authentication enhancements, encrypted pagination tokens for secure data handling, and improved observability across the ecosystem. The new calendar-based versioning scheme (YY.Q.B) aims to simplify compatibility tracking and make upgrades more predictable. Additionally, Ory Elements, the frontend components, now support 83 languages, enhancing global accessibility. While Ory's open-source solutions power over 1.2 billion identities, the Ory Enterprise License offers continuous security patches and enterprise features for production environments needing robust compliance and security. The release reaffirms Ory's commitment to building open, transparent, and community-driven identity solutions, supported by a global developer community.

The latest releases of Ory Keto v25.4.0 and Ory Oathkeeper v25.4.0 focus on enhancing security, maintainability, and cohesion within the Ory ecosystem, featuring improvements such as encrypted pagination tokens, better observability, and upgraded runtime environments. The updates to Ory Keto strengthen privacy by encrypting pagination tokens, ensuring secure data handling, and introducing a critical runtime fix by running on Go 1.24.4. Oathkeeper's modernization involves adopting vendored libraries to reduce dependency issues and enhance build consistency, along with improved tracing for better system monitoring. These releases align with Ory's mission of providing developers with powerful and privacy-conscious tools and are complemented by the Ory Enterprise License (OEL), which offers continuous security updates and advanced features for production environments.

Ory Kratos v25.4.0 introduces several enhancements to its open-source identity and user management system, including passwordless authentication via SMS, expanded passkey support, and improved WebAuthn capabilities. This release also strengthens OIDC and SAML integrations, offering better control and interoperability, while refining user flows to enhance the verification and registration processes. With a focus on improving visibility, Kratos adds new events for better monitoring and debugging, alongside performance optimizations that streamline operations and reduce overhead. Additionally, the update features enhanced migration tools and support for HTML emails, making it easier to manage identities and integrate with other systems. The release aims to inspire developers to build secure and seamless identity experiences, with a specific nod to enterprise environments requiring robust security and compliance features through the Ory Enterprise License.

Ory Hydra v25.4.0, the latest release from the Ory OSS ecosystem, introduces significant advancements in agentic authentication, addressing the need for secure, standards-based access management for autonomous agents, IoT devices, and headless clients. This version includes support for the Device Authorization Grant (RFC 8628), token chain revocation, and the OAuth 2.1 discovery endpoint, positioning Hydra as a production-ready OAuth 2.1 and OpenID Connect server. The update enhances security by allowing operators to revoke entire token chains and improves performance with lower latency for session revocations and faster JWT queries. Additionally, Hydra v25.4.0 ensures security across environments with updated cryptographic dependencies and database migration fixes, making it a reliable choice for scalable applications. The release is part of a broader shift to a new versioning scheme aimed at simplifying upgrades and preparing for future agentic use cases, while also emphasizing the importance of Ory Enterprise License for mission-critical production environments requiring continuous security and compliance updates.

Ory has evolved from a set of open-source projects into a comprehensive identity infrastructure platform, managing over 1.2 billion identities globally. To address the need for simpler release tracking across its product stack, Ory has introduced a unified calendar-based versioning system to streamline upgrades and compatibility management across its offerings, including Hydra, Kratos, Keto, and Oathkeeper. This new versioning format—using a YY.Q.B[-TAG] structure—provides operational clarity, distinguishes between open-source and enterprise releases, and ensures backward compatibility, giving teams predictable release information. While open-source releases offer robust identity infrastructure, the Ory Enterprise License (OEL) provides continuous updates with the latest security patches and advanced features necessary for mission-critical environments, ensuring security, compliance, and performance at scale. New open-source releases are anticipated soon, with a live walkthrough planned to discuss the updates and answer questions.

A reported jewelry heist at the Louvre Museum in Paris revealed a critical digital security flaw: the password for the museum’s video surveillance system was simply "LOUVRE." This incident highlights a significant failure in Identity and Access Management (IAM), showcasing the risks of relying on basic, static passwords and outdated systems like Windows 2000. Despite previous security audits flagging these weaknesses, the museum's reliance on obsolete infrastructure and inadequate password security illustrates the existential threat posed by complacency in digital security. The situation underscores the importance of modern IAM practices, such as Multi-Factor Authentication, the Principle of Least Privilege, and Continuous Access Governance, to protect valuable assets. In a zero-trust security environment, every entity is a potential threat until verified, and modern IAM strategies are essential for safeguarding digital identities and assets against unauthorized access.

The blog post discusses the increasing importance of identity as the primary security perimeter in the face of cyber threats, as highlighted by a recent incident involving a small town's water supply targeted through stolen credentials. It emphasizes the need for robust identity resilience across various systems, from enterprise software to municipal infrastructure, and outlines ten practical steps organizations should adopt to enhance security. These steps include treating identity as critical infrastructure, enforcing adaptive authentication, applying least privilege principles, securing machine and service identities, continuous monitoring, adopting zero-trust principles, protecting administrative interfaces, ensuring regional and regulatory compliance, maintaining strong identity hygiene, and fostering a culture of awareness. The post underscores that identity security is crucial not only for preventing hacks but also for maintaining continuity and trust, and it presents Ory's solutions as integral to building secure identity infrastructures that prioritize safety and sovereignty.