Pillar guide
Passkeys for Workforce Identity: Buyer's Guide
A practical guide to evaluating phishing-resistant workforce authentication, deployment models, recovery controls, and device-bound trust.
Read resourceGideon
Documentation
Checklist / template
Phishing-Resistant Access Readiness Checklist
A 20-point readiness checklist for replacing passwords and OTP-based MFA with phishing-resistant workforce authentication.
Read resourceSupporting explainers
Device-Bound Authentication vs Conventional MFA: What Each Proves
Understand what credential binding adds to conventional password-plus-OTP or push MFA—and which device and session risks still require separate controls.
Read resourceSupporting explainers
What Is Trusted Authenticator Lineage?
Authenticator lineage assembles the evidence available about how a credential was registered, how it is protected, and which material lifecycle changes the relying party can observe.
Read resourceSupporting explainers
How Secure Enclave and TPM Change Workforce Access
Hardware security components can protect private authentication keys from export and make credential theft materially harder, while leaving device posture and session security as separate controls.
Read resourceSupporting explainers
WebAuthn, FIDO2, OIDC, SAML, and SCIM: Where Each Protocol Fits
A field guide to what each identity standard does, where the layers connect, and how to evaluate authentication, federation, provisioning, and sessions separately.
Read resourceSupporting explainers
Continuous access evaluation for device posture changes
Learn how CAEP and SSF propagate device-compliance changes so applications can reassess access before token expiry, with implementation patterns and limits.
Read resourcePillar guide
Zero-touch endpoint management for security teams
A six-stage playbook for enrollment, baseline enforcement, software delivery, posture evaluation, remediation, and secure retirement across the endpoint lifecycle.
Read resourceChecklist / template
Endpoint Posture Policy Starter Pack
A starter set of posture decisions for encryption, operating-system health, endpoint protection, patching, and inventory.
Read resourceSupporting explainers
Apple Business Manager Rollout Plan for Security Teams
Coordinate Apple Business Manager, automated device enrollment, MDM assignment, and security baselines.
Read resourceSupporting explainers
Apple Business content token (VPP) troubleshooting guide
Diagnose expired or invalid Apple Business content tokens, license-sync failures, account changes, and management-service conflicts without disrupting managed app assignments.
Read resourceSupporting explainers
Windows Autopilot Security Baseline for Mid-Market Teams
Build an Autopilot deployment that establishes identity, encryption, endpoint protection, and update policy during setup.
Read resourceSupporting explainers
Windows Autopilot enrollment errors and profile drift remediation
Diagnose common Windows Autopilot enrollment failures, Enrollment Status Page stalls, and devices that drift from their intended configuration after setup.
Read resourceSupporting explainers
MDM plus native agent architecture
Combine platform management with a native agent to improve endpoint visibility, reduce manual remediation, and produce stronger evidence of device compliance.
Read resourceSupporting explainers
Zero-touch laptop offboarding with Microsoft Intune
Connect an authoritative departure event to identity containment, a risk-based Intune action, and verified evidence without assuming an offline laptop has already received the command.
Read resourceSupporting explainers
Configuration Drift in Endpoint Management
Configuration drift is the gap between declared endpoint policy and the state actually enforced on a device.
Read resourceSupporting explainers
Endpoint posture freshness: polling, events, and access decisions
Understand how MDM check-ins, endpoint events, evidence freshness, and enforcement latency shape device-compliance decisions—and what teams should test.
Read resourcePillar guide
GitOps for endpoint compliance
Apply version control, review, automated validation, and reconciliation to endpoint security policy.
Read resourceChecklist / template
Security Policy Pull Request Checklist
Review identity, access, and endpoint policy changes for scope, risk, validation, approval, recovery, and evidence before they reach production.
Read resourceSupporting explainers
Reviewing access policy changes like code
Apply version control, effective-permission analysis, automated checks, and traceable approval to access policy changes before they reach production.
Read resourceSupporting explainers
Policy-as-Code for Identity and Endpoint Controls
Express identity and endpoint requirements as testable configuration instead of manual console settings.
Read resourceSupporting explainers
Audit Evidence from Versioned Security Workflows
Turn policy history, approvals, deployments, and reconciliation events into defensible audit evidence.
Read resourcePillar guide
MCP Security for Enterprise IT and Security Teams
Design MCP deployments around server trust, tool permissions, identity propagation, approval, and auditability.
Read resourceChecklist / template
Safe AI Remediation Checklist
A control checklist for allowing AI agents to investigate and remediate security findings.
Read resourceSupporting explainers
AI-Agent Access Control: Human, Workload, And Tool Scope
Model agent access across the requesting human, executing workload, selected tool, and target resource.
Read resourceSupporting explainers
AI-Agent Identity vs AI-Agent Authorization
Identity establishes which agent or workload is acting; authorization determines what that actor may do now.
Read resourceSupporting explainers
Delegation Chains for Autonomous Security Operations
Trace authority from a human or service through an agent to each tool and downstream system.
Read resourceSupporting explainers
Human Approval and Just-in-Time Grants for AI Agents
Use explicit approval and temporary grants for agent actions with material operational impact.
Read resourcePillar guide
Open-source identity and SSO: the real cost of self-hosting
Build an honest operating-cost model for Keycloak, Authentik, LDAP, and other self-hosted identity systems before comparing them with a managed service.
Read resourceSupporting explainers
Self-hosted identity on Docker Compose and Kubernetes
Separate web SSO from directory and domain-controller requirements, then choose a deployment model that matches the workload and operating team.
Read resourceSupporting explainers
Keycloak vs. Authentik: GitOps, multi-tenancy, and production readiness
Compare declarative configuration, isolation models, Kubernetes paths, and operational maturity without treating unlike tenancy features as equivalent.
Read resourceSupporting explainers
Authentik reverse proxy setup and custom authentication flows
Configure forward authentication safely, understand single-application and domain-level tradeoffs, and customize flows without creating an unreviewed login bypass.
Read resourcePillar guide
14-Day Enterprise POC Framework
Structure a short security-platform evaluation around agreed scope, integrations, controls, evidence, and success criteria.
Read resourceChecklist / template
Security Questionnaire Response Pack
Organize architecture, data handling, access control, resilience, and compliance evidence for buyer review.
Read resourceSupporting explainers
Security Architecture And Data Flow
Document system boundaries, trust relationships, data categories, processing locations, and control points.
Read resourceSupporting explainers
SOC 2 Evidence Mapping for Endpoint and Identity Controls
Map identity and endpoint operations to control objectives and repeatable evidence sources.
Read resourceSupporting explainers
Cyber-Insurance Endpoint And Identity Controls
Translate common insurer questions into concrete identity, endpoint, recovery, and monitoring controls.
Read resourceSupporting explainers
Essential Security Metrics for Cyber Insurance Compliance in 2026
A field guide to the security metrics and controls underwriters require in 2026, with the evidence carriers expect to see before binding coverage.
Read resourceSupporting explainers
AWS And Azure Marketplace Private Offers
Understand how private offers can align security procurement with cloud commitments and negotiated commercial terms.
Read resourceEnterprise demo
See Gideon against your fleet model.
Bring team size, identity provider, endpoint stack, and procurement path. We will map package fit, rollout shape, and POC timing.
- 14-day POC framework
- Marketplace and private offer support
- Security questionnaire routing