Andrew-Riley

As a Product Manager for Identity Security, I’ve spent over a decade, including the last four years at Auth0, navigating the complex landscape of authentication and identity security. I specialize in building products that defend the 'front door' of the digital world, balancing robust protection with a seamless user experience. I believe that security should be an invisible enabler, not a hurdle, evolving constantly to meet new threats while keeping the human journey frictionless. When I’m not fighting bots and securing authentication flows, I spend my free time gaming.

Product Manager

Andrew Riley

Pooja-Bhojwani

Pooja is a Machine Learning Manager at Auth0 with 10 years of experience building and scaling intelligent systems. My background combines a strong foundation in software engineering with eight years of expertise in Data Science, allowing me to bridge the gap between complex research and production-grade machine learning systems. Throughout my career in fintech, e-commerce, and gaming, I have specialized in developing high-impact personalization strategies, robust risk mitigation frameworks, and scalable machine learning solutions. I am passionate about translating advanced machine learning into real-world applications that deliver measurable results while helping keep digital platforms safe and trustworthy.

Manager, Machine Learning

Pooja Bhojwani

Learn how Auth0 is using JA4 fingerprinting to defeat sophisticated bots, bypass TLS spoofing, and improve TLS security for your applications without code changes.

Strengthening Bot Detection with JA4 Signals

E017NDYFGQL-U4W9C40NL-51be4d627a6f-512

Ari is a seasoned Product-Led Growth (PLG) leader with a passion for architecting flawless customer journeys. As the VP of Developer-Led Growth at Auth0, he leads the Developer Marketing, Developer Relations, Activation, and Conversion teams, among others. His career journey includes a key role on the Microsoft Developer Evangelism team and a foundational period as a Software Engineer at Southworks and other firms, where he delivered mission-critical projects for Fortune 100 clients.

Vice President, DLG

Ari Schapiro

Enhanced developer security with PII masking in logs and improved bot detection, new global cloud regions, early access programs for Multiple Custom Domains, Passkey support, and more developer-focused features.

Welcome to our July product update! 🎉 This month, we've been busy rolling out exciting new features, enhancing existing capabilities, and expanding our global footprint to provide you with an even more robust and flexible identity platform. Our focus remains on empowering developers and organizations to build secure, seamless, and scalable authentication experiences. You can also check the [July release highlights on Youtube](https://www.youtube.com/watch?v=iBQDgUmHbWI):

<AmpContent>
<amp-youtube
    data-videoid="iBQDgUmHbWI"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  className='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/iBQDgUmHbWI'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## What's new this month

### Enhancing Security & Compliance 🛡️

* **PII Obfuscation/Masking in Log Streaming:** We're excited to introduce a new feature that allows you to mask sensitive Personally Identifiable Information (PII) directly within your log streams. This significantly enhances your security posture and helps meet compliance requirements by ensuring sensitive data isn't exposed in your logs. [Learn more](https://auth0.com/docs/customize/log-streams) 📖.  
* **Cascade Token and Session Revocation for Native to Web SSO:** Improving token lifecycle management and session integrity, this update automatically revokes dependent web sessions and refresh tokens when the original refresh token is revoked. This is a crucial step for maintaining robust security across your applications. [Learn more](https://auth0.com/docs/authenticate/single-sign-on/native-to-web/native-to-web-sso-and-sessions) 📖.  
* **Updates to Bot Detection:** We’ve upgraded our bot detection model to improve accuracy and reduce friction for legitimate users, particularly on mobile devices and evolving browser platforms. [Learn more](https://auth0.com/docs/secure/attack-protection/bot-detection) 📖.

![Screenshot of the Auth0 dashboard for configuring Bot Detection, showing options like Auth Challenge, Simple CAPTCHA, and Google reCAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/4glCjfQm2TLSk9WpbETqJg/bfe92a68bf1cbd5272d1235b918ccb84/bot-detection.png)

* **IETF JWT Profile for Access Tokens:** JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens \- [RFC9068](https://datatracker.ietf.org/doc/rfc9068/) is now Generally Available for all customers. You are now able to opt-in to use the new profile for your Access Tokens on a per-API basis. [Learn more](https://auth0.com/docs/secure/tokens/access-tokens/access-token-profiles) 📖.

### Expanding Global Reach 🌍

* **New Private Cloud Regions:** To better serve our global customers and address data residency needs, we've expanded our Private Cloud offerings with new regions in **Mexico 🇲🇽, Hong Kong 🇭🇰, and Calgary, Canada 🇨🇦.**  
* **Public Cloud Environment in Canada:** We've also launched a new Public Cloud environment in **Canada 🇨🇦**, providing more options for organizations seeking local data hosting.


### Early Access Programs 🚀

We're also excited about several features currently in Early Access, offering a glimpse into future enhancements:

* **Multiple Custom Domains on a Single Auth0 Tenant:** simpler, more flexible branding and white-labeling. Allowing you to:  
  * Deliver tailored, branded experiences for your users, including customized login URLs and emails.  
  * Enhance security through the consistent use of custom domains across end-user interactions.  
  * Scale B2B SaaS usage rapidly through Multiple Custom Domains (MCD) on a single tenant.

  [Learn more](https://auth0.com/docs/customize/custom-domains/multiple-custom-domains) and please send a request through the [Auth0 Support Center](https://support.auth0.com/?_gl=1*dea6jn*_gcl_aw*R0NMLjE3NTQwNjUzMDEuQ2p3S0NBand5N0hFQmhCSkVpd0E1aFFOb2hCN3pYUTJxRjVwakYxcC1vNkxhSHl6M1MyM2diZG1oM0Y5M3hwZ2RjdHYtMll0dl9kREhob0NNMjRRQXZEX0J3RQ..*_gcl_au*MTUzNDIzOTk3My4xNzUwMTg5ODMy*_ga*ODYzMzAwMjA5LjE3MzQ0ODQwMTg.*_ga_QKMSDV5369*czE3NTQ2MDI0MzEkbzI2NCRnMCR0MTc1NDYwMjQzNiRqNTUkbDAkaDA.) if you are interested in participating\!


![Diagram illustrating the Multiple Custom Domains feature, with a central 'MarketZero Tenant' connected to four different custom domains](https://images.ctfassets.net/23aumh6u8s0i/4TgAfhWwYWkd0PpCH3Za3M/06a5e44f1e9838a797140ce640b8fc92/multiple-custom-domains.png)

* **Passkey Support for Custom Database Connections (with import mode off):** you can now leverage passkey support directly with your custom database connections, without needing import mode. Request access by contacting your Technical Account Manager.  
* **My Account API Explorer:** Empower your users with self-service capabilities. The new My Account API Explorer provides a user-friendly interface for managing their own account settings and preferences.[Try it out](https://auth0.com/docs/api/myaccount).  
* **Advanced Customizations for Universal Login:** Gain even finer control over the look and feel of your Universal Login pages, allowing for a truly branded experience. Check out our [online documentation](https://auth0.com/docs/customize/login-pages/advanced-customizations) to learn more about ACUL\!

![Advanced Customizations for Universal Login](https://images.ctfassets.net/23aumh6u8s0i/h6C4eHfv46EVD5OlLI2x2/a2e4f69e413a053fe7cd8594ab5fe148/universal-login-banner.png)

* **Right-to-Left Language Support for Universal Login:** Expanding our global accessibility, Universal Login now supports right-to-left languages, catering to a wider audience. Contact your Auth0 account manager or [Auth0 Support](https://support.auth0.com/) to enable Early Access on your tenant.  
* **Multi-Resource Refresh Tokens (MRRT):** This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes providing a more granular control and flexibility.  [Learn more](https://auth0.com/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token) 📖.

We're continuously working to bring you the best in authentication and authorization. These updates reflect our commitment to providing a secure 🔒, flexible 💪, and developer-friendly platform 🧑‍💻.

## Where we were in July

* [DWX 2025](https://www.developer-world.de/dwx) (June 30 – July 3, Mannheim, Germany) – [Ramona Schwering](https://auth0.com/blog/authors/ramona-schwering/) presented *"From the Crypt to the Code"*, diving into secure coding and modern auth strategies  
* [WeAreDevelopers World Congress](https://www.wearedevelopers.com/world-congress) (July 9–11, Berlin, Germany) – [Deepu K Sasidharan](https://auth0.com/blog/authors/deepu-sasidharan/) and [Ramona Schwering](https://auth0.com/blog/authors/ramona-schwering/) were at the booth answering developer questions. They also found themselves on stage:   
  * [Ramona](https://auth0.com/blog/authors/ramona-schwering/) presented *"The Cake Is a Lie... And So Is Your Login’s Accuracy"*, unpacking real-world login flaws and how to build trust in AI-era authentication  
  * [Deepu](https://auth0.com/blog/authors/deepu-sasidharan/) presented *"Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue"*

* [AWS Summit](https://aws.amazon.com/events/summits/new-york/) (July 16, New York, USA) – Fred Patton and Lily Wisecarver were at the booth connecting with cloud builders and answering developer questions.  
* [dev\_night](https://auth0-japan.connpass.com/event/359423/) (July 16, Tokyo, Japan) \- [Daizen Ikahara](https://auth0.com/blog/authors/daizen-ikehara/) hosted a dev\_night in Tokyo for the local developer community. Keep an eye out for our next dev\_night Tokyo in the fall covering our extensibility capabilities.  
* [TechRAMEN 2025](https://techramenconf.net/) (July 26 \- July 27, Asahikawa, Japan) \- [Daizen Ikahara](https://auth0.com/blog/authors/daizen-ikehara/) presented a talk about FGA for RAG during the after conference.

![Collection of images from past events in July](https://images.ctfassets.net/23aumh6u8s0i/5nxgPtun4i3j8Q6w8OSror/f8d940fa00290ad29c71c21814dc592e/auth0-dev-adv-at-events-july-2025.png)

Thank you to all that stopped by to chat with us – We loved connecting with our developer community around the world. 

## Where we are going in August

* [Agentic AI Summit](https://rdi.berkeley.edu/events/agentic-ai-summit) (August 2, Berkeley, USA) \- Fred Patton and Shreya Gupta at the booth networking with the local developer community.  
* [Google Cloud Next Tokyo 2025](https://www.googlecloudevents.com/next-tokyo/) (August 5, Tokyo, Japan) \- [Daizen Ikahara](https://auth0.com/blog/authors/daizen-ikehara/) at the booth connecting with cloud builders  
* [Build Secure AI Agents with Auth0 and Workers](https://workshop.cloudflare.dev/) (August 5, virtual) \- [Juan Cruz Martinez](https://auth0.com/blog/authors/juan-cruz-martinez/) hosting a workshop with CloudFlare developer advocate, Confidence Okoghenun, on how to build and securely deploy a Google Calendar-integrated personal assistant using Auth0 and Cloudflare.  
* [AI Dev Tool Demo Night @ AWS Gen AI Loft](https://lu.ma/toyijx9w) (\#2nd Edition) (August 8, San Francisco, USA) \- Fred Patton presenting an Auth0 demo.   
* [KCDC](https://www.kcdc.info/) (August 14 \- August 15, Kansas city, USA) \- [Ramona Schwering](https://auth0.com/blog/authors/ramona-schwering/”) will present 2 sessions: A workshop titled *“One Does Not Simply Build Authentication: UI Components to the Rescue!”* and a session titled *“The Cake Is a Lie... And So Is Your Login’s Accessibility”*  
* [Auth0 x AI Tinkerers Demo Night](https://urldefense.com/v3/__https://nyc.aitinkerers.org/p/ai-tinkerers-august-demo-day-ft-auth0__;!!PwKahg!4AUFzM5IwkAkFdHtB0dwCZjD1dRUEt_uO_xU1Fh4UCfW2e-XWPDhbksTwUshJmlKPe1osSJdoFSuRoB6KEMZ5LjJR4Dl$) (August 26, New York, USA) \- Fred Patton presenting an Auth0 demo.   
* [TechBBQ](https://techbbq.dk/) (August 27 \- August 28, Copenhagen, Denmark) \- Two days of networking, sessions, and startup energy.

Will you be attending? Reach out! We’d love to connect and hear what you’re working on! 


Auth0 Product Updates (July 2025): New Security Features, Global Regions, and Developer Previews

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Bot Detection’s AI-boost helps block the majority of malicious requests, saving time and resources

Auth0 Bot Detection Reduces Bot Attacks by 79%

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature blocks majority of malicious requests, saving enterprises critical time and resources



**BELLEVUE, Wash. &mdash; August 18, 2020 &mdash;** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Bot Detection](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks), a new security feature that reduces the effectiveness of a credential stuffing attack by as much as 85%, with minimal impact on user experience. Bot Detection is a powerful addition to the company’s expanding security portfolio, and works in tandem with Auth0 Breached Password Detection, Brute Force Protection, and Multi-factor Authentication, to provide extensive mitigation against a variety of sophisticated threats, including automated attacks, account takeovers, phishing attacks, and more.

Credential stuffing attacks often rely on stolen account credentials (username and password) from a previous data breach, and are used to gain unauthorized access to user accounts on another website. This is executed via large-scale bot-driven attacks against the login flow and is an increasingly pervasive problem for enterprises. Ongoing Auth0 customer analysis revealed the following: 

* Auth0 sees an average of 175,000 unique IP addresses that are deemed suspicious on a daily basis. 
* Threat actors can use as many as 65,000 IP addresses for a single attack.
* During an attack, credential stuffing can account for as much as 65% of the traffic to Auth0’s authentication service.
* During a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 90% of overall activity. 

Bot Detection correlates numerous data sources to identify and mitigate bot-driven attacks before login, and relies on a collection of risk signals and assessors that identify indicators of suspicious activity. This layered approach — also known as defense in depth — consists of multiple security capabilities, including Bot Detection, that effectively reduce the number of credential stuffing attempts and many other attacks. At a high level, Bot Detection monitors IP addresses for non-suspicious events, such as successful logins; suspicious events, such as numerous failed login attempts across multiple accounts; and IP reputation data, which is used to identify known threat actors. When suspicious traffic is detected, a CAPTCHA step is required to complete a login request — the system is designed to mitigate the majority of bot attacks targeting the login or registration flow. At launch, Auth0 will support customers using its [Universal Login](https://auth0.com/blog/introducing-the-new-auth0-universal-login-experience/) capabilities, with additional support for other experiences in the coming months. 

Automated attacks are growing more sophisticated each day, and these large-scale bots are designed to respond to any and all controls to evade detection. Auth0 found that threat actors can, and do, change their attack strategies in as little as five minutes to bypass a security control. More than [80% of companies](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) state it is difficult to detect, fix, or remediate [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/), which result in an average of more than $6 million a year in costs per company and can cause a significant impact on IT resources, account takeovers, and brand reputation. 

“We’ve seen an increase in the volume and sophistication of bot attacks over the last few years, and companies are investing more in their defenses,” said Matias Woloski, CTO and cofounder at Auth0. “Being at the front door of applications with a service that secures more than 4.5 billion login transactions per month, we have a unique vantage point for quickly identifying and blocking suspicious activity before any damage is done. This is what makes Bot Detection very effective at preventing account takeover and reducing the load on DevOps and SecOps teams.” 

More detailed information on credential stuffing can be found here: [Credential Stuffing Attacks: What Are They and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) (whitepaper), and [Reducing the Impact of Credential Stuffing](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks) (blog post). 

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk <br />
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Hannah Carroll<br />
Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


New Bot Detection Feature by Auth0 Reduces Effectiveness of Credential Stuffing Attacks by Up to 85%

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

How Breached Password Detection and MFA Can Help Ward Off the Millions of Attempts Botnets Make Each Month



**TL;DR:** Credential stuffing can threaten user accounts and service availability. Security expert Duncan Godfrey shows how Auth0 defends customers with breached password protection.

Anyone operating a web application which authenticates users will know credential stuffing attacks all too well. It’s a constant hum of bots knocking on your infrastructure trying to take over user accounts. [_OWASP_](https://www.owasp.org/index.php/Credential_stuffing) defines it as _"the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts."_

Credential stuffing is an efficient type of brute force attack which uses the vast amount of available breached user credentials to exploit the still all too often story of users reusing their passwords across different services.

The most recent [_Akamai State of the Internet Report_](https://www.akamai.com/us/en/about/our-thinking/state-of-the-internet-report/global-state-of-the-internet-security-ddos-attack-reports.jsp) focuses on credential stuffing and gives some insight into the scale of the problem — between May to June 2018 they recorded 8.35 million credential stuffing attempts. It brings into focus the dire state of using passwords as a single authentication factor in 2018. As Auth0 handles authentication for our customers, we find ourselves at the epicenter of these kinds of attacks.

<include src="TweetQuote" quoteText="@akamai_soti reported 8.35M credential stuffing reports in a single month. Security expert @duncangodfrey shares how to protect your customers with the help of @auth0."/>

On particularly busy days at Auth0, we will detect up to 600K logins being made with known breached passwords. The attacks are not always random and are often targeted against companies whose customers resources can be drained or where access to the account itself can be sold (i.e. it gives access to premium content).

## Defending Credential Stuffing with Breached Password Detection

In response to the growth of credential stuffing attacks, we developed the [_breached password detection_](https://auth0.com/breached-passwords) service to help our customers defend their users. Once enabled, the service will monitor for logins using known compromised credentials and can be set to lock out that user until they have reset their password.

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4"> breached password detection</a> instead.
</video>

</NonAmpContent>

The botnets that carry out these attacks not only threaten our customers’ accounts but they are a threat to the availability of our service. An attacker can slowly try the credentials aiming to avoid detection or they can burst attempts using all their capacity to test credentials as quickly as possible. When that happens it is effectively a DDoS attack — so we have to proactively manage our capacity, scaling, and rate limiting to protect our customers and our infrastructure.

![Auth0 Anomaly Detection](https://images.ctfassets.net/23aumh6u8s0i/BScpkuG04n0rMk2kj9s1s/5d8901f8d17cddabd600fcfb50e247d7/Auth0-Anomaly-Detection)

> Auth0 maintains a continuously-updated collection of breached credentials, with hundreds of millions of entries. All password-based login attempts are checked against this database, and any matches are blocked in real-time. [Auth0 offers a **free tier**](https://auth0.com/pricing) to get started with modern authentication. Check it out, or <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>!

## FTC: "Innocent Corporate Victim" No Defense

Credential stuffing is also a developing legal threat to companies who hold sensitive data for their customers. The Federal Trade Commission (FTC) [_recently took action against online tax preparer TaxSlayer_](https://www.ftc.gov/news-events/press-releases/2017/08/operator-online-tax-preparation-service-agrees-settle-ftc-charges) because they were leaving customer data open to credential stuffing, going so far as to state that being an “innocent corporate victim” was no defense in an enforcement case. Rather, in the FTC’s view companies holding sensitive customer information should be taking proactive action to reduce the risk of credential stuffing.

There are things which can be done now to reduce the risk of automated attacks. Firstly, they are not effective against logins protected with [_MFA_](https://auth0.com/docs/multifactor-authentication). Authenticating with two factors should be considered a minimum good practice for protecting your users. The TaxSlayer attack was halted when the company implemented MFA.

Educating your users against reusing their passwords and helping them to improve their password hygiene can help protect your users and your business. Password management apps like [_1Password_](https://1password.com/) or [_lastpass_](https://www.lastpass.com/business-password-manager) make maintaining a unique password for all your accounts more manageable.

<include src="TweetQuote" quoteText="Automated cyber attacks can be overwhelming. Protect your customers with tips from @auth0 security expert @duncangodfrey."/>

The reality is that right now it’s just too simple for attackers. This is an Internet-scale security problem and one which we are working actively with our customers to solve. Auth0 was created to help make managing authentication simple for everyone, and, underpinning that is the desire to make it secure for everyone too.

<include src="asides/AboutAuth0" />


"bot detection"