Token Security

No entries match these filters. Clear filters

1. announced Oct 26, 2026 · issue 123

   Token Security launches Rehearsal, an AI-driven walkthrough that navigates the platform and applies filters on your behalf.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Discover which AI agents have no owner without manually navigating filters — type a plain-language goal into Token AI and let Rehearsal walk the route for you.
   📍Open Token AI › type: 'Which AI agents have no owner?' › Rehearsal opens the relevant page, sets filters, and highlights matching agents.
   Bootstrap a new playbook without knowing the exact UI path — ask Rehearsal to create it and it will navigate to the Playbooks page and scaffold the workflow.
   📍Open Token AI › type: 'Create a playbook that sends a Slack message when an AI agent gets a critical finding' › Rehearsal navigates to Playbooks, drafts the configuration, and prompts before saving.
   • Adds Rehearsal, an AI-driven walkthrough mode accessible via Token AI that accepts plain-language goals, plans a route through the platform, opens pages, sets filters, highlights results, and writes the answer — all in the user's own tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Rehearsal supports read-only automation (no secret fields filled, no blocked calls sent) and can be paused at any time by clicking to resume control, then picked up from where it left off.

   2 details in Everything

2. announced Oct 22, 2026 · issue 120

   Token Security integrates with Grok Build via a marketplace plugin and the Grok Build Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. to surface and remediate risky agent credential access inside the editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Ask Token Security which secrets are expiring soon and who owns them, directly from inside Grok Build, so the right developer can rotate credentials before they become a risk.
   📍Which secrets expire in the next 30 days, and who owns them?
   • Adds a Token Security plugin in the Grok Build Marketplace, letting developers query Token findings — secrets, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server permissions, and credential ownership — without leaving the editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Integrates with the Grok Build Admin API to enumerate which users are enabled in a workspace and which MCP servers and tools each team has configured.
   • Pairs EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integrations (e.g. CrowdStrike) with Grok Build workspace data to surface MCP config files and hardcoded credentials found on developer endpoints, including agents running outside the sanctioned workspace.
   • Enables the Grok Build agent itself to call Token Security plugin tools during remediation workflows, querying metadata about secrets and credential ownership directly from the editor.
   • Delivers per-finding attribution — each risky Grok Build config item (hardcoded PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., over-permissioned MCP servers, unreviewed remote endpoints) is routed to the developer or identity owner responsible for it.

   5 details in Everything

3. announced Oct 13, 2026 · issue 109

   Token Security adds Attack Path Analysis to visualize multi-hop privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. chains across AWS, Azure, Okta, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Investigate which single identity fix eliminates the most critical breach paths across your AWS and GitHub environments.
   📍In the Token Security platform, navigate to Attack Paths. Filter the prioritized table by severity Critical. Review the stats bar to identify which source identity appears most frequently as a dangerous starting point. Select a path to open the graph view and use the sidebar to inspect the findings — such as unrotated credentials or missing MFA — that make each hop exploitable, then remediate at that node to collapse the maximum number of paths at once.
   • Surfaces a prioritized, filterable table of discovered attack chains showing source identity, destination resource, severity, number of hops, and environments involved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides an interactive graph view for each path where identity nodes are labeled by type and environment, edges show attacker actions (such as federated SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and cross-account role chaining), and a sidebar exposes the findings — unrotated credentials, excessive permissions, missing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. — that make each hop exploitable.
   • Assigns each attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. a severity score based on destination criticality, source identity risk level, administrative access involvement, and exploitability from existing findings.
   • Includes a stats bar summarizing total paths by severity and the identities that most frequently appear as dangerous starting points or critical targets.
   • Models IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, service principals, human users, AI agents, and GitHub apps as nodes in a directed graph, with federated SSO and cross-account role assumption as edges.

   +1 more show less

   • Traces IAM assume-role and federation chains and flags dangerous permission combinations to cut through billions of theoretical paths and surface only exploitable ones.

   6 details in Everything

4. announced Oct 13, 2026 · issue 016

   Token Security adds Attack Path Analysis to visualize multi-hop privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. chains across AWS, Azure, Okta, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Investigate which single identity fix eliminates the most critical breach paths across your AWS and GitHub environments.
   📍In the Token Security platform, navigate to Attack Paths. Filter the prioritized table by severity Critical. Review the stats bar to identify which source identity appears most frequently as a dangerous starting point. Select a path to open the graph view and use the sidebar to inspect the findings — such as unrotated credentials or missing MFA — that make each hop exploitable, then remediate at that node to collapse the maximum number of paths at once.
   • Surfaces a prioritized, filterable table of discovered attack chains showing source identity, destination resource, severity, number of hops, and environments involved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides an interactive graph view for each path where identity nodes are labeled by type and environment, edges show attacker actions (such as federated SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and cross-account role chaining), and a sidebar exposes the findings — unrotated credentials, excessive permissions, missing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. — that make each hop exploitable.
   • Assigns each attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. a severity score based on destination criticality, source identity risk level, administrative access involvement, and exploitability from existing findings.
   • Includes a stats bar summarizing total paths by severity and the identities that most frequently appear as dangerous starting points or critical targets.
   • Models IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, service principals, human users, AI agents, and GitHub apps as nodes in a directed graph, with federated SSO and cross-account role assumption as edges.

   +1 more show less

   • Traces IAM assume-role and federation chains and flags dangerous permission combinations to cut through billions of theoretical paths and surface only exploitable ones.

   6 details in Everything

5. announced Aug 27, 2026 · issue 058

   Token Security launches the first NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., enabling natural-language querying, remediation, and posture insights for Non-Human Identities.

   • New Token MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server exposes Token's NHI inventory, findings, risk data, and remediation guidance to any MCP-compatible AI client (Claude, ChatGPT, Gemini, Cursor) via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. standard.
   • Supports natural-language queries across NHI inventory, permission structures, authentication methods, environment criticality, ownership, and usage patterns — returning prioritized, actionable risk views.
   • Delivers customer-specific remediation output including ready-to-use de-provisioning scripts and CLI commands tailored to the customer's environment, generated on demand through conversational queries.
   • Enables cross-cloud identity analysis (e.g. GCP service accounts consumed by AWS resources) through plain-language queries, surfacing relationships that would otherwise require manual cross-environment investigation.
   • Connects into agentic workflows — AI agents can autonomously retrieve findings, generate JIRA tickets with pre-filled scripts, and send Slack notifications without human input.

   +1 more show less

   • Accessible from both the Token Portal and external AI chat/agent applications, with no specialized query language required.

   6 details in Everything

6. announced Aug 26, 2026 · issue 058

   Token Security launches Enzo, a natural-language AI application builder for creating live identity security workflows, dashboards, and automations.

   • Introduces Enzo, a new AI-native application builder inside the Token Security platform that generates live, runnable identity security applications from natural-language prompts — no code required.
   • Generated applications connect to live identity data across human identities, non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls., AI agents, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., cloud infrastructure, secrets, and credentials already ingested by the Token Security platform.
   • Supports building interactive operational applications — not static reports — including dashboards, approval flows, remediation tools, governance apps, and recurring identity workflows.
   • Integrates automation actions including Slack notifications, email workflows, ticketing, approvals, lifecycle management, and remediation triggers from within generated apps.
   • Applications run in sandboxed, tenant-isolated environments with per-session credential scoping, secure execution boundaries, and full audit logging.

   +1 more show less

   • Generated apps can persist, be refined through additional natural-language prompts, and be shared across teams.

   6 details in Everything

7. Token Security Brings Claude Compliance API Into Its Identity Control Plane | Token Security (2026-08-06) Aug 6, 2026 · issue 054

   Token Security integrates with Claude's Compliance API to discover, map, and govern Anthropic API keys and AI agent identities.

   ▶ ⤢
   • Integrates with Claude's Compliance API to pull Anthropic identity and activity signals — API keys, workspaces, projects, users, service accounts, model activity, tool usage, administrative events, and key lifecycle events — into Token's identity control plane.
   • Enables discovery and ownership mapping of Anthropic API keys across the full access chain: from creation in Claude through storage in repository secrets, invocation by CI/CD pipelines, and execution inside cloud workloads.
   • Surfaces Claude-specific identity posture risks including stale Anthropic keys, keys without clear owners, abandoned workspaces, over-privileged access, and unrotated credentials.
   • Correlates Claude activity signals with identity and access context from cloud, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., source control, CI/CD, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers into a unified identity graph, enabling blast-radius analysis for compromised Anthropic identities.
   • Brings Claude-related identities into Token's posture scoring and remediation workflows alongside other non-human and AI agent identities.

   5 details in Everything

8. Token Security’s MCP Server Discovery Capability Uncovers Hidden AI Servers and Secrets | Token Security (2026-08-06) Aug 6, 2026 · issue 054

   Token Security adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Discovery to automatically find, inventory, and analyze hidden AI/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and embedded secrets across enterprise endpoints.

   • Automatically retrieves MCP configuration files (e.g., claude_desktop_config.json, .mcp.json configs) from endpoints via CrowdStrike Real Time Response (RTR) without user disruption.
   • New MCP Server Discovery capability continuously scans and inventories MCP servers and AI agent processes across enterprise environments, integrating with CrowdStrike and other endpoint ecosystems without requiring additional agents.
   • Analyzes CrowdStrike logs for IDE and Claude Code instances to pinpoint which MCP servers they are communicating with, surfacing discoveries in near real time.
   • Scans collected MCP configuration files to identify hardcoded secrets (API keys, plaintext tokens, credentials), correlates them to identities, and safely redacts sensitive values in the platform UI.
   • Produces a Risk Graph showing each MCP server's connections, access scope, and authentication classification for actionable governance.

   5 details in Everything