Khush Kaushal 

Khush Kaushal is Senior Software engineer with a focus on building intelligent, secure identity systems. He works at the intersection of large-scale authentication infrastructure and applied ML, developing models and features that enhance fraud detection, risk-based authentication, and adaptive access control. With deep expertise in full-stack development, distributed systems, and production ML pipelines, he is passionate about creating AI-driven solutions that make digital identity both seamless for users and robust against evolving threats.

Senior Software Engineer

Khush Kaushal

Matthew-w

Director, Threat Intelligence

Mathew Woodyard

Learn how to mitigate the risks of Bulletproof Hosting providers using Auth0 Actions and threat intelligence signals to secure your identity infrastructure.

Bulletproof Hosting Defense: Mitigating the Proxy Threat with Threat Intelligence

Maria-v

Maria Vasilevskaya is a leading Identity Defense Security Engineer at Okta. With her extensive experience in identity security, she has held diverse roles including security executive advisory, professional consulting services, identity and security solutions architecture, and solutions engineering. Her primary objective at Okta is to empower customers in maintaining robust security postures by offering expert assistance during critical incidents and providing strategic advice on implementing security practices to prevent future crises.

Principal Security Engineer

Maria Vasilevskaya

Prevent configuration drift. Detect changes to critical security defenses like MFA and Attack Protection real-time, leveraging Auth0 Management API logs for enhanced Auth0 security posture.

Proactive Auth0 Security Posture via Real-Time Audit of Management API Logs

Jeremie Berthiaume jpg

Group Product Marketing Manager

Jeremie Berthiaume

SamanthaMurphy2025

Samantha Murphy is a Product Marketing Senior Manager for Auth0. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Senior Manager, Product Marketing, Auth0

Samantha Murphy

abhi

Abhishek Ambastha is a Group Product Manager with over 18 years of experience in security and identity solutions. At Okta CIC, he drives innovations to counter identity threats and enhance user security with seamless experiences.

Group Product Manager

Abhishek Ambastha

How AI is powering attacks – and how to fight back with Auth0 and AWS.

Bots can be harmless. However, many have malicious intentions. [Bots make up 42% of all internet traffic today, and 65% of these are ‘bad bots](https://www.akamai.com/site/en/documents/state-of-the-internet/2024/akamai-web-scraping-report-2024.pdf)’. These bots are not only wielding automated attacks to breach accounts — they are also draining your marketing budget. Bots are being used to sign up for accounts at scale and eat up your company’s sign-up bonuses, offers, and loyalty points. And the numbers don’t lie – bot attacks are taking a serious toll on businesses. A [2024 Fastly survey](https://www.fastly.com/blog/bot-wars-how-bad-bots-hurting-businesses) revealed just how widespread and damaging these attacks have become: 

![The Future of Bot Protection](https://images.ctfassets.net/23aumh6u8s0i/TcA3et7yA6eXXmaqkLewa/425f5fb556aa7118b11f927bb27ede92/The_Future_of_Bot_Protection_-_Smarter_Attacks_Demand_a_Layered_Approach.png)

### GenAI is reshaping cybercrime—and making bots more dangerous

It’s not just the quantity of bad bots that’s concerning; it's also the growing sophistication. Unless you’ve been *a tad* out of the loop, you’ve likely seen how GenAI is revolutionizing business. From AI-powered agents handling customer support to marketing teams generating personalized content at scale, the benefits are undeniable. But there’s a dark side. [AI adoption in cybercrime is expected to grow at a staggering 37% CAGR between 2023 and 2030](https://www.grandviewresearch.com/industry-analysis/artificial-intelligence-ai-market), making it easier than ever for attackers to run automated attacks and cause more damage.

These same AI advancements are being used by cybercriminals to supercharge their automated attacks, some without even writing a line of code themselves. Bots are now easier to create than ever and are vastly more adept at mimicking human behavior, allowing them to evade conventional security controls. As bots become more advanced, we have to get cleverer about how we fight them. Spoiler alert: this means layering modern defenses – there’s no silver bullet. Also, to fight AI, we need to use AI. We’ll get into this in a bit...

### CAPTCHAs — Not all bot detection is created equal 

When you think of bot detection, you probably cringe – because, chances are, the first thing that comes to mind is the traditional CAPTCHA. 
 

<div class="alert alert-info alert-icon">
 
 CAPTCHA: 
 Completely Automated Public Turing test to tell Computers and Humans Apart – a challenge-response test that is meant to be easy for humans to pass, but difficult for computers (or bots) to solve. 
</div>

You’ve seen them before – checking a box, deciphering distorted text, or selecting every image with a stoplight. While these simple CAPTCHAs can be effective against **basic** bot attacks, they also slow down real users, creating frustration (who hasn’t struggled through endless grids of bicycles?)

 

And here’s the real kicker – modern bots are outsmarting them. Advanced automation and AI-powered bots can now solve image-based CAPTCHAs faster and more accurately than humans. That means traditional CAPTCHA isn’t just frustrating – it’s also failing. We need better, layered defenses that distinguish humans and good bots from malicious ones with minimal friction to the user and harness the power of AI to fight the threat of AI.

 

Let’s look at how Auth0 and AWS together help you do that.

### How Auth0 fights back against malicious bots

#### Auth0 bot detection – a first line of defense for automated attacks 

As AI-powered attacks evolve, we’ve re-engineered our fourth-generation Auth0 Bot Detection engine to strengthen protection against malicious traffic without compromising the user experience. Auth0 Bot Detection continuously monitors Identity threats across hundreds of millions of users, enabling us to detect bad bots and respond in real time. It features advanced machine learning models, making it even more effective at spotting and stopping bots.

- Detect automated attacks like fake signups and credential stuffing, and respond with user-friendly challenges like Auth Challenge or out-of-the-box third-party bot challenge integrations like Google reCAPTCHA, hCaptcha Enterprise, or Friendly Captcha.

- Leverage machine-learning models, including a model designed for signup attacks. Tailored models greatly improve detection and prevention of bots across the user journey, while reducing bot challenges presented to real customers.

- Auth0 Bot Detection, on average, is shown to block less than 1% of legitimate users (based on overall Auth0 customer traffic). 

#### Layer in these additional Auth0 defenses to defend against automated attacks: 

- Passkeys offer a passwordless login option that lets users log in to apps, platforms, and devices quickly and helps prevent phishing. In theory, passkeys mean bot detection, and CAPTCHA could be skipped, but bot detection remains the most viable first level of defense for the login box as not all users or organizations add MFA (multi-factor authentication) in every app. 

- Adaptive MFA reduces MFA fatigue by only prompting extra verification with risks like untrusted IPs, new devices detected, or ‘Impossible Travel' (detects suspicious login attempts by analyzing the distance and time between consecutive sign-ins). If an automated attack succeeds in guessing a user’s username and password, MFA is the second line of defense in preventing an incident.

- [Breached Password Protection](https://auth0.com/features/breached-passwords) blocks known breached credentials at sign-up, login, or password reset. It detects the use of compromised credentials, and then blocks and notifies the user in real-time. 

- [Credential Guard](https://auth0.com/features/breached-passwords) allows up to 10x faster detection of compromised credentials with a dedicated security team and support for 35+ languages and 200+ regions. Cut detection time from months to hours. Our dedicated security team infiltrates criminal undergrounds and the dark web to find compromised credentials.

- Brute Force Protection and Suspicious IP Throttling block high-velocity attacks on accounts inflicted by bots. 

- Security Center enables faster detection and response to attacks with a dashboard of near real-time observability tools. Get intelligent insights into identity events, anomalies and efficacy. Set custom threshold alerts. Easily Integrates with SIEM tools.

- Log Streaming allows streaming relevant Auth0 activity to 3rd party SIEM and SOAR tooling to enable faster detection and response. Automate response to security threats, outages, new sign-ups, and more with custom business logic.

### Combine Auth0 with AWS for defense in depth 

Auth0’s bot protection and Identity security capabilities, together with AI-powered threat detection from AWS, bolster your organization’s defenses even further. 

AWS provides a suite of services to detect anomalous behavior throughout your GenAI stack, whether you’re building business apps that use generative AI or protecting your systems against generative AI threats. Here are some of the solutions available from AWS: 

#### Auto Scaling Groups
Auto Scaling Groups in AWS automatically adjust the number of AWS instances based on traffic demand – but it also helps mitigate bot attacks by scaling resources to handle unexpected surges caused by malicious bot traffic.

#### AWS WAF (Web Application Firewall)
AWS WAF provides bot detection by analyzing incoming traffic. It helps protect web applications by filtering out harmful bot traffic before it reaches critical resources, reducing the risk of credential stuffing, scraping, and other automated attacks.

#### AWS Shield
AWS Shield defends against distributed denial-of-service (DDoS) attacks, including bot-driven attacks. AWS Shield Advanced offers enhanced protection by integrating with AWS WAF to detect and block sophisticated bot traffic targeting your applications.

### Wrapping up

While AI is exacerbating the threat of bot attacks, it can also be leveraged in the fight against them.

That’s where Auth0 and AWS come in. Together, we provide a multi-layered security approach utilizing AI to protect every aspect of your user journey, ensuring only legitimate users gain access to your systems while blocking malicious automated activity. All in a way that minimizes user friction and reduces the load on DevOps and SecOps teams.

Learn more about how Auth0 and AWS [here](https://auth0.com/partners/aws).

The Future of Bot Protection: Smarter Attacks Demand a Layered Approach

apollo (1)

Charlotte is an experienced security professional with a long history of successfully and securely leading global brands, including PwC, Hewlett-Packard, and Daimler Trucks North America. She is a Certified Secure Software Life Cycle Professional (CSSLP), Certified Information Systems Security Professional (CISSP), and Certified Ethical Hacker (C|EH), passionate about proactive and defensive security through early lifecycle improvements.

Former Director of Security Engineering

Charlotte Townsley

Focusing security efforts early in the SDLC provides proactive, impactful protection against evolving threats and attacks

## Shifting Left for Improving Security Outcomes

**TL;DR:** Shifting security to the left, or early in the Software Development Life Cycle (SDLC), creates more effective, less costly security controls, promotes developer ownership of security principles and features, and helps reduce risk to our organization.

## What does Shift-Left Mean?

Shift-left refers to a focus on security efforts early in the Software Development Life Cycle (SDLC). These early phases include early developer and technologist awareness efforts, as well as secure design, development, and deployment of software.

![SDLC](https://images.ctfassets.net/23aumh6u8s0i/7irltF8FB74O9aFLUP84Xa/9e0f7fe1f8ee1c5a16a6d03f343b8bda/image1)

Shift-left is a well-known term in the [software development and testing industry](https://dzone.com/articles/software-testing-trends-to-watch-for-in-2019). It refers to both security and non-security specific testing and evaluation of an application early in the development lifecycle. A shift-left mindset helped develop some notable non-security specific techniques such as [Test Driven Development (TDD)](https://www.guru99.com/test-driven-development.html) and [Agile methodologies](https://smartbear.com/learn/automated-testing/shifting-left-in-testing/). 

## What are the Benefits of Shift-Left?

The clear benefit to shift-left is that a focus on the early design and development phases translates to [fewer defects in the later stages](https://www.cigniti.com/blog/successfully-implementing-tdd-bdd-to-enable-shift-left-testing-approach/). Shift-left is well-recognized as an approach that [lowers the cost of defect remediation](https://www.bmc.com/blogs/what-is-shift-left-shift-left-testing-explained/). In fact, the cost of fixing code flaws [increases exponentially with each phase to the right in the SDLC that they are found and remediated](https://deepsource.io/blog/exponential-cost-of-fixing-bugs/). The 2019 Poneman study estimated that vulnerabilities detected in the early [development process cost around ~$80 to remediate. However, the same vulnerabilities can cost ~$7600 to remediate](https://resources.whitesourcesoftware.com/blog-whitesource/shift-left-testing) if detected after deployment to production. This is a _9400% increase in cost_!

It is worth noting that the term shift-left can be a misnomer, as it denotes a linear phased approach, rather than a continuous approach. In actuality, software is developed in an infinite cycle of continuous design, development, remediation, integration, delivery, and monitoring.

![Continuous Development Life Cycle](https://images.ctfassets.net/23aumh6u8s0i/3R7h35zCpEV3jm0snCemXc/b774324a5e660ff997faecf2e241f82f/image2)
Continuous Development Life Cycle

Because each phase in the infinite cycle is discrete and identifiable, the term shift-left is still helpful in understanding the efforts in moving security earlier in the life cycle. As a mindset, shift-left is both a way to train developers, and a way to design, develop, and deploy code more securely and with less cost. So while we refer to shift-left to identify our efforts, we are not promoting the abandonment of a continuous development and deployment cycle.

## What is Auth0 Doing to Shift-Left in Security?

The focus on defensive and preventive controls early in the SDLC encompasses several key initiatives at Auth0. These initiatives include the improvement of **Static Analysis Security Testing (SAST)**, the creation and publication of the **Secure Software Benchmarks (SSB)**, and the development of **Security Champions**.

The security team is improving **Static Analysis Security Tests (SAST)** for all new and existing code bases at Auth0. SAST tools automate security-specific code reviews and help identify and remediate security-relevant coding flaws that directly translate to exploitable flaws in production. Finding these flaws early adds great value to the organization in terms of risk reduction. 

SAST improvements include better traceability of flaws to [OWASP Top 10](https://owasp.org/www-project-top-ten/) and [CWE Top 25](https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html), and improvements in the ease of integration with existing development IDEs, source repositories, and build tools.

These SAST tools support both manual deployment pipelines, and automated pipelines where controls can be integrated into a model known as [DevSecOps](https://www.sumologic.com/insight/devsecops-rugged-devops/). DevSecOps helps incorporate security into all stages of the software development workflow and thus helps to avoid security bottlenecks since [security checks are run continuously along with the phases of the SDLC](https://insight.claranet.co.uk/driven/the-devsecops-mindset) rather than only at the end of the life cycle.

![DevSecOps](https://images.ctfassets.net/23aumh6u8s0i/7l22UtdExJhSxYf40OhyBJ/47553bad506159065c5482c4ac9c453d/image3)
DevSecOps

The **Secure Software Benchmarks (SSB)** comprehensively document the expectations and implementation details for creating secure applications at Auth0. The SSBs can be used as a baseline for teams to assess the security of applications. However, their greatest value will be as an early lifecycle guide to plan, develop, and deploy their applications according to security best practices. 

The SSBs are rich in both breadth and depth and are based on industry best practices, including the [OWASP Top 10 Proactive Controls](https://owasp.org/www-project-proactive-controls/). They include details such as secure coding techniques, SAST tools integration guidance, expectations around protecting data at rest, in-transit, and in-memory, how to securely create production builds, and how to hook into monitoring controls. The SSBs are meant to be an ongoing tool for assessment and creation of secure applications.

The security training and awareness team runs a mentorship program for Auth0 developers with interest in security. The purpose of the program is to help amplify and socialize the security messages within development teams and scale security operations. Security-minded developers serve as **Security Champions** and receive training and guidance in how to implement and interpret **SAST** results. 

Security Champions will also participate in briefings with the security team to help them understand and socialize the **SSBs**. Security champions have a defined path for advancement, including apprentice, intermediate, and advanced champion criteria that define the milestones and maturation of the champions at Auth0.

The security awareness team will combine **SAST**, **SSBs**, and the **Security Champions** program in an internal certification program for Node.js developers. This **Auth0 Node.js Secure Developer Certification** expands upon the current hands-on secure code training. The certification includes general security concept training, Node.js secure coding guidelines defined in the SSBs, threat modeling, best practices for implementing and interpreting SAST, risk assessments, offensive security, secure architecture, hands-on labs, and skills formal assessment. The security team will begin the roll-out of the certification with our Security Champions, receive feedback from these champions, then open the certification to our development community within Auth0.

We are also applying shift-left to expand our machine image scanning capabilities within our infrastructure and cloud security program. Rather than scanning images after deployment, scanning will take place at the time of image creation. Scanning at the time of image creation provides early feedback for service owners as they make decisions about installed packages and versions. The scanning services are accessible via API, and thus can be automated as part of the development life cycle and seamlessly integrated with vulnerability management tools and processes. 

## What about Late Life Cycle Efforts at Auth0?

There are several successful late life cycle efforts at Auth0 that we plan to continue and grow with a particular focus on automation. These offensive and detection efforts are crucial in finding security vulnerabilities, detecting and handling incidents, and helping teams assess the security of their applications as the threat landscape continuously changes. We will continue to offer our private bug bounty program, conduct offensive security tests, encourage contributions through our Responsible Disclosure program, and offer threat modeling for secure design. We encourage submission to our [Responsible Disclosure](https://auth0.com/responsible-disclosure-policy/) program and use this disclosure program as an entry point to our private bug bounty program.

The defensive and offensive programs do not exist in vacuums. Instead, offensive programs help to inform our defensive efforts in what the security industry terms a purple and orange team functions, where [_purple_ describes how defenders (such as our Detection and Response team) learn from attackers, and orange describes how builders (our developers) learn from attackers](https://danielmiessler.com/study/red-blue-purple-teams/).

Auth0 Security strives to continuously improve our security posture. By embracing shift-left, we create more effective, less costly security controls, promote developer ownership of security principles and features, and help reduce risk to our organization. This approach results in a more secure solution for our customers at a lower cost.

<include src="asides/AboutAuth0" />

"#attack protection"